Directed Incremental Symbolic Execution

Question

1. What contributions have the authors mentioned in the paper "Directed incremental symbolic execution" ?

2. What have the authors stated for future works in "Directed incremental symbolic execution" ?

3. What are the primary threats to external validity for their study?

4. What can be used as input to a subsequent analysis?

Accepted Answer

One approach that is widely studied in the context of regression analysis is to analyze the differences between two related program versions.. In this paper, the authors present Directed Incremental Symbolic Execution ( DiSE ), a novel technique for detecting and characterizing the effects of program changes.. A case-study of their implementation of DiSE illustrates its effectiveness at detecting and characterizing the effects of program changes.. Furthermore, DiSE does not require analysis results to be carried forward as the software evolves—only the source code for two related program versions is required.

Accepted Answer

The authors plan to extend DiSE to use an inter-procedural analysis to generate affected path conditions over the entire system as part of their future work.. In future work, the authors plan to conduct a more comprehensive evaluation of their DiSE technique.

Accepted Answer

The primary threats to external validity for their study are (1) the use of SPF within which the authors implemented their technique, (2) the use of Choco as the underlying constraint solver, (3) the selection of artifacts used to evaluate DiSE, and (4) the changes applied to create the mutants.

Accepted Answer

The path conditions in the symbolic summary can be used as input to a subsequent analysis, e.g., the solved path conditions can be used as regression test case inputs.

Accepted Answer

DiSE enables other program analysis techniques to efficiently perform software evolution tasks such as program documentation, regression testing, fault localization and program summarization.

Accepted Answer

The AffectedLocIsReachable returns true if the CFG node, ni, corresponding to the input symbolic state, si, can reach a node in the set of unexplored affected nodes to indicate that exploration should continue along the path that contains si; else, it returns false indicating that the path containing si is not influenced by the modifications to the program and should be pruned.

Accepted Answer

The authors also conjecture that program structure, particularly with regard to the number and complexity of the constraints generated during symbolic execution contributes to the differences in execution time for each technique.

Accepted Answer

During symbolic execution, satisfiability checks are performed each time a constraint is added to the path condition to determine the feasibility of the path; if a path condition becomes unsatisfiable, it represents an infeasible path and symbolic execution does not consider any other paths that contain the known infeasible path as its prefix.

Accepted Answer

The procedure UpdateExploredSet checks whether the input node n is contained in one of the unexplored sets (UnExWrite or UnExCond ) in order to track the affected nodes explored during symbolic execution (lines 30–35).

Accepted Answer

Using full symbolic execution to validate this change results in 21 path conditions, each of which represents a program execution path of the modified version of update.

Accepted Answer

The mutant versions the authors used to perform their study were created manually, and may or may not reflect actual program changes; however, the mutations were developed in a systematic way that considered program location, change type, and number of changes.

Accepted Answer

Note that the number of test cases generated by symbolic execution and by DiSE differs from the number of path conditions generated by each technique; this is due to the fact that the current implementation of the test generation tool computes input values only for the method arguments, i.e., a partial state.

Accepted Answer

For all of the examples, when the changes to the program do not affect all path conditions (program paths), DiSE takes at most 20% of the time taken by full symbolic execution.

Accepted Answer

During symbolic execution, the path condition is used to collect constraints on the program expressions, and describes the current path through the symbolic execution tree.

Accepted Answer

The authors observed from their study that the number of changes is only one factor affecting which (and how many) path conditions are changed; program structure and the nature of the change also appear to have a considerable effect.

Directed Incremental Symbolic Execution

Chat with Paper

AI Agents for this Paper

Most frequently asked questions

1. What contributions have the authors mentioned in the paper "Directed incremental symbolic execution" ?

2. What have the authors stated for future works in "Directed incremental symbolic execution" ?

3. What are the primary threats to external validity for their study?

4. What can be used as input to a subsequent analysis?

5. What other tasks can be performed by DiSE?

6. What is the function that returns true if the input node can reach a node?

7. What do the authors conjecture about the differences in execution time for each technique?

8. What is the meaning of satisfiability checks?

9. What is the procedure that checks whether the input node is in a unexplored set?

10. How many path conditions are used to validate the change?

11. What did the authors do to evaluate the mutant versions?

12. Why does the number of test cases generated by symbolic execution differ from the number of path conditions generated?

13. How much time does DiSE take to execute a program?

14. What is the path condition used to collect constraints on the program expressions?

15. What are the main factors that affect the number of changes?

Figures

Citations

A Survey of Symbolic Execution Techniques

ACM Transactions on Software Engineering and Methodology : Volume 22, Nomor 4, 2013

BEACON: Directed Grey-Box Fuzzing with Provable Path Pruning

Regression Greybox Fuzzing

Dependence Guided Symbolic Execution

References

Z3: an efficient SMT solver

A theory of timed automata

KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs

Symbolic execution and program testing

CUTE: a concolic unit testing engine for C

Related Papers (5)

Symbolic execution and program testing

KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs

Scaling symbolic execution using staged analysis

Staged symbolic execution

Scaling symbolic execution using ranged analysis