Steering symbolic execution to less traveled paths

  • Authors:

  • You Li;Zhendong Su;Linzhang Wang;Xuandong Li

  • Affiliations:

  • Nanjing University, Nanjing, China;University of California, Davis, Davis, CA, USA;Nanjing University, Nanjing, China;Nanjing University, Nanjing, China

  • Venue:
  • Proceedings of the 2013 ACM SIGPLAN international conference on Object oriented programming systems languages & applications
  • Year:
  • 2013

Quantified Score

Hi-index 0.00

Visualization

Abstract

Symbolic execution is a promising testing and analysis methodology. It systematically explores a program's execution space and can generate test cases with high coverage. One significant practical challenge for symbolic execution is how to effectively explore the enormous number of program paths in real-world programs. Various heuristics have been proposed for guiding symbolic execution, but they are generally inefficient and ad-hoc. In this paper, we introduce a novel, unified strategy to guide symbolic execution to less explored parts of a program. Our key idea is to exploit a specific type of path spectra, namely the length-n subpath program spectra, to systematically approximate full path information for guiding path exploration. In particular, we use frequency distributions of explored length-n subpaths to prioritize "less traveled" parts of the program to improve test coverage and error detection. We have implemented our general strategy in KLEE, a state-of-the-art symbolic execution engine. Evaluation results on the GNU Coreutils programs show that (1) varying the length n captures program-specific information and exhibits different degrees of effectiveness, and (2) our general approach outperforms traditional strategies in both coverage and error detection.