Targeted program transformations for symbolic execution

Abstract

Semantics-preserving program transformations, such as refactorings and optimisations, can have a significant impact on the effectiveness of symbolic execution testing and analysis. Furthermore, semantics-preserving transformations that increase the performance of native execution can in fact decrease the scalability of symbolic execution.Similarly, semantics-altering transformations, such as type changes and object size modifications, can often lead to substantial improvements in the testing effectiveness achieved by symbolic execution in the original program.As a result, we argue that one should treat program transformations as first-class ingredients of scalable symbolic execution, alongside widely-accepted aspects such as search heuristics and constraint solving optimisations. First, we propose to understand the impact of existing program transformations on symbolic execution, to increase scalability and improve experimental design and reproducibility. Second, we argue for the design of testability transformations specifically targeted toward more scalable symbolic execution.

Automatic testing of symbolic execution engines via program generation and differential testing

“…The main problem is that different symbolic executors may explore different paths in a given time budget, and also that the same code may have different number of paths at different levels (e.g., source, binary and LLVM) [3]. Therefore, instead of performing differential testing between different symbolic execution engines, we crosschecked native and symbolic execution versions of the same program, with the symbolic execution versions carefully constructed in three different modes ( §II-B).…”

A Survey of Symbolic Execution Techniques

“…Compiler Optimizations. [19] argues that program optimization techniques should be a first-class ingredient of practical implementations of symbolic execution, alongside widely accepted solutions such as search heuristics, state merging, and constraint solving optimizations. In fact, program transformations can affect both the complexity of the constraints generated during path exploration and the exploration itself.…”

Non-Semantics-Preserving Transformations for Higher-Coverage Test Generation Using Symbolic Execution

“…KLEE's developers theorized about the possibility of using such transformations to improve symbolic execution [29], but this paper is the first to our knowledge to design and implement nonsemantics-preserving testability transformations explicitly for this purpose. As our design goals in the symbolic execution setting are similar to those of compiler optimizations in the concrete execution setting, we have decided that it is appropriate to refer to our transformations as testability optimizations (shortened to optimizations for ease of discussion).…”

“…The study observed that, somewhat counter-intuitively, some compiler optimizations can actually slow down symbolic execution. Cadar's more recent new ideas paper [29] hypothesizes about the use of non-semantics-preserving transformations for symbolic execution. The central idea of using unsound program transforms to preprocess programs for more efficient test data generation was initially formalized by Harman et al [24].…”