Compact Symbolic Execution
نویسندگان
چکیده
We present a generalisation of King’s symbolic execution technique called compact symbolic execution. It proceeds in two steps. First, we analyse cyclic paths in the control flow graph of a given program, independently from the rest of the program. Our goal is to compute a so called template for each such a cyclic path. A template is a declarative parametric description of all possible program states, which may leave the analysed cyclic path after any number of iterations along it. In the second step, we execute the program symbolically with the templates in hand. The result is a compact symbolic execution tree. A compact tree always carry the same information in all its leaves as the corresponding classic symbolic execution tree. Nevertheless, a compact tree is typically substantially smaller than the corresponding classic tree. There are even programs for which compact symbolic execution trees are finite while classic symbolic execution trees are infinite.
منابع مشابه
Compact Symbolic Execution (technical report)
We present a generalisation of King’s symbolic execution technique called compact symbolic execution. It is based on a concept of templates: a template is a declarative parametric description of such a program part, generating paths in symbolic execution tree with regularities in program states along them. Typical sources of these paths are program loops and recursive calls. Using the templates...
متن کاملSymInfer: Inferring Program Invariants using Symbolic States
We introduce a new technique for inferring program invariants that uses symbolic states generated by symbolic execution. Symbolic states, which consist of path conditions and constraints on local variables, are a compact description of sets of concrete program states and they can be used for both invariant inference and invariant verification. Our technique uses a counterexample-based algorithm...
متن کاملSymbolic Simulation on Complicated Loops for Timing Analysis
We address the problem of estimating the Worst-Case Execution Time (WCET) for bounded programs, formalized as discovering a tight upper bound of a resource variable. One main obstacle is the role of complicated loops, where each iteration exhibits different behavior. Here traditional methods such as abstract interpretation often are too inaccurate. Our basic approach addresses complicated loops...
متن کاملThe Auspicious Couple: Symbolic Execution and WCET Analysis
We have recently shown that symbolic execution together with the implicit path enumeration technique can successfully be applied in the Worst-Case Execution Time (WCET) analysis of programs. Symbolic execution offers a precise framework for program analysis and tracks complex program properties by analyzing single program paths in isolation. This path-wise program exploration of symbolic execut...
متن کاملSymbolic execution systems-a review - Software Engineering Journal
Symbolic execution is a technique that is useful in the validation of software. It may be used to aid in the generation of test data and in program proving. As software engineering becomes more concerned with the development of tools, symbolic execution will become an important item in the toolkit. This paper gives a review of symbolic execution and its applications. A minimum set of features f...
متن کامل