Z3str3: A String Solver with Theory-aware Heuristics

Abstract

We present a new string SMT solver, Z3str3, that is faster than its competitors Z3str2, Norn, CVC4, S3, and S3P over majority of three industrial-strength benchmarks, namely, Kaluza, PISA, and IBM AppScan. Z3str3 supports string equations, linear arithmetic over length function, and regular language membership predicate. The key algorithmic innovation behind the efficiency of Z3str3 is a technique we call theory-aware branching, wherein we modify Z3's branching heuristic to take into account the structure of theory literals to compute branching activities. In the traditional DPLL(T) architecture, the structure of theory literals is hidden from the DPLL(T) SAT solver because of the Boolean abstraction constructed over the input theory formula. By contrast, the theory-aware technique presented in this paper exposes the structure of theory literals to the DPLL(T) SAT solver's branching heuristic, thus enabling it to make much smarter decisions during its search than otherwise. As a consequence, Z3str3 has better performance than its competitors.

A Novel Approach to String Constraint Solving

“…As also noted in [5], DPLL(T)-based string solvers like Z3str2 [148], Z3str3 [26], CVC4 [89], S3 [135][136][137], Norn [4],…”

“…Their interface for string solving is maintained and well documented [131,132]. Note that Z3 provides two alternatives for string solving: the theory of strings (via Z3str3 solver [26]) and the theory of sequences (Z3seq). Z3str2 and Z3-str are no longer maintained.…”

On Solving Word Equations Using SAT

“…The next three constraints (2)-(4) ensure the validity of the paths we follow: from a location we can only proceed to exactly one other location, in order to find a satisfying assignment; therefore we disallow simultaneous steps in multiple directions. In (5), (6) we forbid using an λ-transition whenever there is another possibility of moving forward. In the same manner we proceed in the case of two matching λ in (7); this part is especially important for finding substitutions which are smaller than the given bounds.…”

StringFuzz: A Fuzzer for String Solvers

“…In recent years, many algorithms for solving string constraints have been developed and implemented in SMT solvers such as Norn [6], CVC4 [12], and Z3 (e.g., Z3str2 [13] and Z3str3 [7]). To validate and benchmark these solvers, their developers have relied on hand-crafted input suites [1,4,5] or real-world examples from a limited set of industrial applications [2,11].…”