Symbolic execution with abstract subsumption checking

  • Authors:

  • Saswat Anand;Corina S. Păsăreanu;Willem Visser

  • Affiliations:

  • College of Computing, Georgia Institute of Technology;NASA Ames Research Center, QSS and RIACS, CA;NASA Ames Research Center, QSS and RIACS, CA

  • Venue:
  • SPIN'06 Proceedings of the 13th international conference on Model Checking Software
  • Year:
  • 2006

Quantified Score

Hi-index 0.00

Visualization

Abstract

We address the problem of error detection for programs that take recursive data structures and arrays as input. Previously we proposed a combination of symbolic execution and model checking for the analysis of such programs: we put a bound on the size of the program inputs and/or the search depth of the model checker to limit the search state space. Here we look beyond bounded model checking and consider state matching techniques to limit the state space. We describe a method for examining whether a symbolic state that arises during symbolic execution is subsumed by another symbolic state. Since subsumption is in general not enough to ensure termination, as the number of symbolic states may be infinite, we also consider abstraction techniques for computing and storing abstract states during symbolic execution. Subsumption checking determines whether an abstract state is being revisited, in which case the model checker backtracks – this enables analysis of an under-approximation of the program behaviors. We illustrate the technique with abstractions for lists and arrays. The abstractions encode both the shape of the program heap and the constraints on numeric data. We have implemented the techniques in the Java PathFinder tool and we show their effectiveness on Java programs.