Generalized symbolic execution for model checking and testing

  • Authors:

  • Sarfraz Khurshid;Corina S. Păsăreanu;Willem Visser

  • Affiliations:

  • MIT Laboratory for Computer Science, Cambridge, MA;Kestrel Technology LLC;RIACS/USRA, NASA Ames Research Center, Moffett Field, CA

  • Venue:
  • TACAS'03 Proceedings of the 9th international conference on Tools and algorithms for the construction and analysis of systems
  • Year:
  • 2003

Quantified Score

Hi-index 0.02

Visualization

Abstract

Modern software systems, which often are concurrent and manipulate complex data structures must be extremely reliable. We present a novel framework based on symbolic execution, for automated checking of such systems. We provide a two-fold generalization of traditional symbolic execution based approaches. First, we define a source to source translation to instrument a program, which enables standard model checkers to perform symbolic execution of the program. Second, we give a novel symbolic execution algorithm that handles dynamically allocated structures (e.g., lists and trees), method preconditions (e.g., acyclicity), data (e.g., integers and strings) and concurrency. The program instrumentation enables a model checker to automatically explore different program heap configurations and manipulate logical formulae on program data (using a decision procedure). We illustrate two applications of our framework: checking correctness of multi-threaded programs that take inputs from unbounded domains with complex structure and generation of non-isomorphic test inputs that satisfy a testing criterion. Our implementation for Java uses the Java PathFinder model checker.