Symbolic execution and program testing
Communications of the ACM
LLVM: A Compilation Framework for Lifelong Program Analysis & Transformation
Proceedings of the international symposium on Code generation and optimization: feedback-directed and runtime optimization
CUTE: a concolic unit testing engine for C
Proceedings of the 10th European software engineering conference held jointly with 13th ACM SIGSOFT international symposium on Foundations of software engineering
EXE: automatically generating inputs of death
Proceedings of the 13th ACM conference on Computer and communications security
Boolector: An Efficient SMT Solver for Bit-Vectors and Arrays
TACAS '09 Proceedings of the 15th International Conference on Tools and Algorithms for the Construction and Analysis of Systems: Held as Part of the Joint European Conferences on Theory and Practice of Software, ETAPS 2009,
A Concurrent Portfolio Approach to SMT Solving
CAV '09 Proceedings of the 21st International Conference on Computer Aided Verification
SATzilla: portfolio-based algorithm selection for SAT
Journal of Artificial Intelligence Research
SMT-Based Bounded Model Checking for Embedded ANSI-C Software
ASE '09 Proceedings of the 2009 IEEE/ACM International Conference on Automated Software Engineering
A decision procedure for bit-vectors and arrays
CAV'07 Proceedings of the 19th international conference on Computer aided verification
Variant-based competitive parallel execution of sequential programs
Proceedings of the 7th ACM international conference on Computing frontiers
TACAS'08/ETAPS'08 Proceedings of the Theory and practice of software, 14th international conference on Tools and algorithms for the construction and analysis of systems
Opportunistic computing: a new paradigm for scalable realism on many-cores
HotPar'09 Proceedings of the First USENIX conference on Hot topics in parallelism
KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs
OSDI'08 Proceedings of the 8th USENIX conference on Operating systems design and implementation
Proceedings of the FSE/SDP workshop on Future of software engineering research
Symbolic execution for software testing in practice: preliminary assessment
Proceedings of the 33rd International Conference on Software Engineering
Satisfiability modulo theories: introduction and applications
Communications of the ACM
Proceedings of the 2012 International Symposium on Software Testing and Analysis
make test-zesti: a symbolic execution solution for improving regression testing
Proceedings of the 34th International Conference on Software Engineering
Green: reducing, reusing and recycling constraints in program analysis
Proceedings of the ACM SIGSOFT 20th International Symposium on the Foundations of Software Engineering
Symbolic execution for software testing: three decades later
Communications of the ACM
Hi-index | 0.00 |
One of the main challenges of dynamic symbolic execution--an automated program analysis technique which has been successfully employed to test a variety of software--is constraint solving. A key decision in the design of a symbolic execution tool is the choice of a constraint solver. While different solvers have different strengths, for most queries, it is not possible to tell in advance which solver will perform better. In this paper, we argue that symbolic execution tools can, and should, make use of multiple constraint solvers. These solvers can be run competitively in parallel, with the symbolic execution engine using the result from the best-performing solver. We present empirical data obtained by running the symbolic execution engine KLEE on a set of real programs, and use it to highlight several important characteristics of the constraint solving queries generated during symbolic execution. In particular, we show the importance of constraint caching and counterexample values on the (relative) performance of KLEE configured to use different SMT solvers. We have implemented multi-solver support in KLEE, using the metaSMT framework, and explored how different state-of-the-art solvers compare on a large set of constraint-solving queries. We also report on our ongoing experience building a parallel portfolio solver in KLEE.