KIL: An Abstract Intermediate Language for Symbolic Execution and Test Generation of C++ Programs

We present a declarative intermediate language KIL in a symbolic executor for C++ programs and show how to use KIL to control symbolic execution. KIL is an abstract language defined over LLVM bytecode; it provides a higher level model of C++ object operations and functions. KIL enables lazy function evaluation, object-level execution and reasoning, defining built-in efficient solvers, function summary based execution, and so on. Specifically, the symbolic executor first performs KIL level execution to build abstract path constraints, then uses these abstract constraints to guide bytecode level execution and produce concrete test cases. This method is able to avoid exploring many useless or duplicate paths. Experimental results show that KIL can help solve path constraints and produce test cases in much less time without losing source coverage.