Symbolic Execution with Interval Solving and Meta-heuristic Search

Borges, Mateus; d’Amorim, Marcelo; Anand, Sandeep; Bushnell, David; Păsăreanu, Corina S.

doi:10.1109/icst.2012.91

Cited by 32 publications

(26 citation statements)

References 15 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…However, they cannot solve the constraints of path conditions, since: 1) they cannot determine unsatisfiability when the path is infeasible, and 2) they can fail to find a test input while the set of constraints is satisfiable. 8 Recently, Borges et al [6] combined a search-based test data generation engine with the RealPaver interval constraint solver, which is well-known in the Constraint Programming community. Even though FPSE and RealPaver are based on similar principles, their treatment of intervals is completely different.…”

Section: Discussionmentioning

confidence: 99%

“…[7] contains small examples showing that an interval constraint solver over the reals can miss floating-point solutions to constraints over floating-point variables. However, as RealPaver can treat transcendental functions with high precision, the approach followed in [6] allows the generation of floating-point inputs for programs that use such functions in a nontrivial way, something that is outside the scope of this paper.…”

Section: Discussionmentioning

confidence: 99%

“…5 This decomposition requires that intermediate results of an operation conform to the type of storage of its operands. 6 Constraint solving is implemented by using interval consistency combined with search heuristics. Several heuristics with static and dynamic choice of variable have been considered.…”

Section: Implementation In Fpsementioning

confidence: 99%

See 2 more Smart Citations

Symbolic Path-Oriented Test Data Generation for Floating-Point Programs

Bagnara

Carlier

Gori

et al. 2013

2013 IEEE Sixth International Conference on Software Testing, Verification and Validation

View full text Add to dashboard Cite

Abstract-Verifying critical numerical software involves the generation of test data for floating-point intensive programs. As the symbolic execution of floating-point computations presents significant difficulties, existing approaches usually resort to random or search-based test data generation. However, without symbolic reasoning, it is almost impossible to generate test inputs that execute many paths with floating-point computations. Moreover, constraint solvers over the reals or the rationals do not handle the rounding errors. In this paper, we present a new version of FPSE, a symbolic evaluator for C program paths, that specifically addresses this problem. The tool solves path conditions containing floating-point computations by using correct and precise projection functions. This version of the tool exploits an essential filtering property based on the representation of floating-point numbers that makes it suitable to generate path-oriented test inputs for complex paths characterized by floating-point intensive computations. The paper reviews the key implementation choices in FPSE and the labeling search heuristics we selected to maximize the benefits of enhanced filtering. Our experimental results show that FPSE can generate correct test inputs for selected paths containing several hundreds of iterations and thousands of executable floating-point statements on a standard machine: this is currently outside the scope of any other symbolicexecution test data generator tool.

show abstract

Section: Discussionmentioning

confidence: 99%

Section: Discussionmentioning

confidence: 99%

See 1 more Smart Citation

Symbolic Path-Oriented Test Data Generation for Floating-Point Programs

Bagnara

Carlier

Gori

et al. 2013

2013 IEEE Sixth International Conference on Software Testing, Verification and Validation

View full text Add to dashboard Cite

show abstract

“…Several works have investigated extending symbolic analysis to floating-point programs [6], [11], [12], [66], [67]. Ours is one of the few that integrates floating-point reasoning with a mature symbolic execution tool, KLEE, and our study is distinguished by our N-version programming approach.…”

Section: Related Workmentioning

confidence: 99%

Floating-point symbolic execution: A case study in N-version programming

Liew

Schemmel

Cadar

et al. 2017

2017 32nd IEEE/ACM International Conference on Automated Software Engineering (ASE)

View full text Add to dashboard Cite

Abstract-Symbolic execution is a well-known program analysis technique for testing software, which makes intensive use of constraint solvers. Recent support for floating-point constraint solving has made it feasible to support floating-point reasoning in symbolic execution tools. In this paper, we present the experience of two research teams that independently added floating-point support to KLEE, a popular symbolic execution engine. Since the two teams independently developed their extensions, this created the rare opportunity to conduct a rigorous comparison between the two implementations, essentially a modern case study on Nversion programming. As part of our comparison, we report on the different design and implementation decisions taken by each team, and show their impact on a rigorously assembled and tested set of benchmarks, itself a contribution of the paper.

show abstract

“…Lakhotia et al [15] extended the DSE tool PEX to use local search to solve floating point constraints, which constraint solvers struggle with. The CORAL tool [4], [23] applies global and local search to solve complex mathematical constraints in the context of Symbolic JPF.…”

Section: Hybrid Approachesmentioning

confidence: 99%

Improving search-based test suite generation with dynamic symbolic execution

Galeotti

Arcuri

2013

2013 IEEE 24th International Symposium on Software Reliability Engineering (ISSRE)

View full text Add to dashboard Cite

Abstract-Search-based testing can automatically generate unit test suites for object oriented code, but may struggle to generate specific values necessary to cover difficult parts of the code. Dynamic symbolic execution (DSE) efficiently generates such specific values, but may struggle with complex datatypes, in particular those that require sequences of calls for construction. The solution to these problems lies in a hybrid approach that integrates the best of both worlds, but such an integration needs to adapt to the problem at hand to avoid that higher coverage in a few corner cases comes at the price of lower coverage in the general case. We have extended the Genetic Algorithm (GA) in the EVOSUITE unit test generator to integrate DSE in an adaptive approach where feedback from the search determines when a problem is suitable for DSE. In experiments on a set of difficult classes our adaptive hybrid approach achieved an increase in code coverage of up to 63% (11% on average); experiments on the SF100 corpus of roughly 9,000 open source classes confirm that the improvement is of practical value, and a comparison with a DSE tool on the Roops set of benchmark classes shows that the hybrid approach improves over both its constituent techniques, GA and DSE.

show abstract

Symbolic Execution with Interval Solving and Meta-heuristic Search

Cited by 32 publications

References 15 publications

Symbolic Path-Oriented Test Data Generation for Floating-Point Programs

Symbolic Path-Oriented Test Data Generation for Floating-Point Programs

Floating-point symbolic execution: A case study in N-version programming

Improving search-based test suite generation with dynamic symbolic execution

Contact Info

Product

Resources

About