SymbolicExecutionforModelCheckingandTesting.pptVIP

Paper Khurshid, S., Pasareanu, C.S., and Vissser, W., “Generalized Symbolic Execution for Model Checking and Testing”, in Proc. of the 9th International Conference on Tools and Algorithms for the Construction and Analysis of Systems (TACAS 2003). April 2003, Warsaw, Poland. Our symbolic execution framework Extends model checking to programs that have complex inputs with unbounded (very large) data Automates test input generation Provides: A novel symbolic execution algorithm Handles dynamic data (e.g., lists and trees), concurrency Uses lazy initialization: Initializes the components of the program’s inputs on an ``as-needed basis No a priori bound on input sizes Uses preconditions to initialize inputs only with valid values A source to source translation to instrument a program Enables standard model checkers to perform symbolic execution of the program Uses “off-the-shelf” decision procedures Symbolic Execution Algorithm: Lazy Initialization To symbolically execute method m of class C: create a new object, o, of class C set all its fields to uninitialized values invoke o.m() when m accesses field f if (f is uninitialized) { if (f is reference field of type T) { non-deterministically initialize f to null a new object of class T (with un-initialized field values) a previously initialized object of class T } if (f is numeric (string) field) initialize f to a new symbolic value } Implementation for Java Uses Korat (MIT) for program instrumentation Uses Java PathFinder model checker toolset Uses Omega library as a decision procedure for integer linear constraints Framework: Can be used as a symbolic execution tool with backtracking Handles multithreaded programs No state matching Un-decidable in general Good for finding counter-examples to safety properties Programs with loops can have infinite execution trees Uses breadth first search or depth first search with limited depth Used to check for null pointer exceptions, rich properties in multithreaded programs