Lazy counterfactual symbolic execution

Abstract

We present counterfactual symbolic execution, a new approach that produces counterexamples that localize the causes of failure of static verification. First, we develop a notion of symbolic weak head normal form and use it to define lazy symbolic execution reduction rules for non-strict languages like Haskell. Second, we introduce counterfactual branching, a new method to identify places where verification fails due to imprecise specifications (as opposed to incorrect code). Third, we show how to use counterfactual symbolic execution to localize refinement type errors, by translating refinement types into assertions. We implement our approach in a new Haskell symbolic execution engine, G2, and evaluate it on a corpus of 7550 errors gathered from users of the LiquidHaskell refinement type system. We show that for 97.7% of these errors, G2 is able to quickly find counterexamples that show how the code or specifications must be fixed to enable verification. CCS Concepts • Theory of computation → Abstraction; • Computing methodologies → Symbolic and algebraic manipulation.

Generating Next Step Hints for Task Oriented Programs Using Symbolic Execution

“…Symbolic execution [4,12] is typically being applied to imperative programming languages, but in recent years it has been used for functional programming languages as well. Ongoing work by Hallahan et al [8,9] aims to implement a symbolic execution engine for Haskell. Giantsios et al [7] use symbolic execution for a mix of concrete and symbolic testing of Erlang programs.…”

System FR: formalized foundations for the stainless verifier

“…Other techniques, such as symbolic execution for verification (see e.g. [Hallahan et al 2019;Nguyen et al 2017]) or using term rewriting systems (see e.g. [Giesl et al 2011[Giesl et al , 2006[Giesl et al , 2004) can be used instead or in complement to our approach.…”

Assisting End Users in Workflow Systems

“…Symbolic execution for functional programming languages struggles with higher order features. This topic is under active study, and is not the focus of our work (Hallahan, Xue, Bland, Jhala, & Piskac, 2019;Hallahan, Xue, & Piskac., 2017). Therefore, we restrict symbols to only represent values of basic types.…”

“…In recent years it has been used for functional programming languages as well. To name some examples, there is ongoing work by Hallahan et al (2019) to implement a symbolic execution engine for Haskell. Giantsios, Papaspyrou, and Sagonas (2017) use symbolic execution for a mix of concrete and symbolic testing of programs written in a subset of Core Erlang.…”