Proofs from Tests

Beckman, Nels E.; Nori, Aditya V.; Rajamani, Sriram K.; Simmons, Robert J.; Tetali, Sai Deep; Thakur, Aditya

doi:10.1109/tse.2010.49

Cited by 61 publications

(68 citation statements)

References 18 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This way, the rapid progress in SMT solvers can be directly utilized to improve performance in practice. In the presence of unknown functions, trace-based abstraction techniques as in [29], which uses concrete parameter/return values to model library functions, are employed to derive the predictive model, while ensuring that the analysis results remain precise.…”

Section: Related Workmentioning

confidence: 99%

Trace-Based Symbolic Analysis for Atomicity Violations

Wang¹,

Limaye

Ganai³

et al. 2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. We propose a symbolic algorithm to accurately predict atomicity violations by analyzing a concrete execution trace of a concurrent program. We use both the execution trace and the program source code to construct a symbolic predictive model, which captures a large set of alternative interleavings of the events of the given trace. We use precise symbolic reasoning with a satisfiability modulo theory (SMT) solver to check the feasible interleavings for atomicity violations. Our algorithm differs from the existing methods in that all reported atomicity violations can appear in the actual program execution; and at the same time the feasible interleavings analyzed by our model are significantly more than other predictive models that guarantee the absence of false alarms.

show abstract

Section: Related Workmentioning

confidence: 99%

Trace-Based Symbolic Analysis for Atomicity Violations

Wang¹,

Limaye

Ganai³

et al. 2010

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Dash [4] uses weakest-precondition (WP) over infeasible program paths to partition (i.e., refine) a program's state space. In contrast, Ufo refines multiple program paths at the same time.…”

Section: Related Workmentioning

confidence: 99%

“…In [15], the only instantiation of Smash that is experimented with is an under-approximationdriven algorithm based on Dash [4], where no abstract domain is used. In this paper, we have experimented with multiple instances of Ufo, ranging from UD to OD.…”

Section: Related Workmentioning

confidence: 99%

“…In our previous work [2], we used predicate abstraction to generalize symbolic program executions. Note that Synergy [17] and Dash [4] are considered underapproximation-driven according to our categorization, as they use weakestprecondition computations along infeasible symbolic paths to refine a partition of the state space with the goal of computing an invariant. Testing in these techniques only acts as a way of choosing which symbolic paths to examine.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

From Under-Approximations to Over-Approximations and Back

Albarghouthi

Gurfinkel

Chećhik

2012

Tools and Algorithms for the Construction and Analysis of Systems

View full text Add to dashboard Cite

Abstract. Current approaches to software model checking can be divided into over-approximation-driven (OD) and under-approximationdriven (UD). OD approaches maintain an abstraction of the transition relation of a program and use abstract reachability to build an inductive invariant (or find a counterexample). At the other extreme, UD approaches attempt to construct inductive invariants by generalizing from finite paths through the control-flow graph of the program.In this paper, we present Ufo, an algorithm that unifies OD and UD approaches in order to leverage both of their advantages. Ufo is parameterized by the degree to which over-and under-approximations drive the analysis. At one extreme, Ufo is a novel interpolation-based (UD) algorithm that generates interpolants to label (refine) multiple program paths using a single SMT solver query. At the other extreme, Ufo uses an abstract domain to drive the analysis, while using interpolants to strengthen the abstraction.We have implemented Ufo in LLVM and applied it to programs from the Competition on Software Verification. Our experimental results demonstrate the utility of our algorithm and the benefits of combining UD and OD approaches.

show abstract

“…Directed proof generation [4] combines over-and under-approximation in the form of predicate abstraction and directed test generation. Thakur et al [18] lift this approach to binaries in their McVeto tool.…”

Section: Related Workmentioning

confidence: 99%

Alternating Control Flow Reconstruction

Kinder

Kravchenko

2012

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Unresolved indirect branch instructions are a major obstacle for statically reconstructing a control flow graph (CFG) from machine code. If static analysis cannot compute a precise set of possible targets for a branch, the necessary conservative over-approximation introduces a large amount of spurious edges, leading to even more imprecision and a degenerate CFG. In this paper, we propose to leverage under-approximation to handle this problem. We provide an abstract interpretation framework for control flow reconstruction that alternates between over-and under-approximation. Effectively, the framework imposes additional preconditions on the program on demand, allowing to avoid conservative over-approximation of indirect branches. We give an example instantiation of our framework using dynamically observed execution traces and constant propagation. We report preliminary experimental results confirming that our alternating analysis yields CFGs closer to the concrete CFG than pure over-or under-approximation.

show abstract

Proofs from Tests

Cited by 61 publications

References 18 publications

Trace-Based Symbolic Analysis for Atomicity Violations

Trace-Based Symbolic Analysis for Atomicity Violations

From Under-Approximations to Over-Approximations and Back

Alternating Control Flow Reconstruction

Contact Info

Product

Resources

About