What are the common metrics used to evaluate the cost of symbolic execution based techniques?

With respect to threats to construct validity, the metrics the authors selected to evaluate the cost of their algorithms are commonly used to measure the cost of symbolic execution based techniques.

What is the common execution driver for each artifact?

For each artifact, the authors create a symbolic execution driver, which is commonacross all versions: “T o = new T (); o.add(x1); ...; o.add(x5);” for symbolic variables x1, . . . , x5 and data structure type T .

What is the idea of optimizing symbolic execution in the context of code that undergoes change?

The idea of optimizing symbolic execution in the context of code that undergoes change was introduced by DiSE [45], which first uses a static analysis as the authors describe and utilize in this paper.

How do the authors add partial correctness properties to the Java example?

The authors manually add partial correctness properties, specifically post-conditions, to this example in the form of assertions just before the method exit.

How many versions of the WBS and Apollo artifacts are created?

The authors create four and five versions of the WBS and Apollo artifacts respectively, using the relevant and valid invariants generated by Daikon.

How does iProperty solve the problem of calculating property differences?

Their technique addresses this problem in two ways: 1) by defining a mechanism to compute property differences between p and p′ that leverages the results from checking p to automatically re-write the properties in p′, retaining only the necessary parts of the properties, and 2) by checking p′ incrementally with respect to the impact of the code changes along with the property differences.

What are the possible paths through the program defined by the path constraints?

There are four possible paths through the program defined by these path constraints (a) x > 0 ∧ y == 0, (b) x > 0 ∧ y 6= 0, (c) x ≤ 0 ∧ y == 0, and (d) x ≤ 0 ∧ y 6=

Open AccessProceedings Article10.1145/2568225.2568319

Property differencing for incremental checking

Guowei Yang, +3 more

- 31 May 2014

- pp 1059-1070

TL;DR: Experimental results in the context of symbolic execution of Java programs annotated with properties written as assertions show the effectiveness of iProperty in utilizing change information to enable more efficient checking.

Abstract: This paper introduces iProperty, a novel approach that facilitates incremental checking of programs based on a property differencing technique. Specifically, iProperty aims to reduce the cost of checking properties as they are initially developed and as they co-evolve with the program. The key novelty of iProperty is to compute the differences between the new and old versions of expected properties to reduce the number and size of the properties that need to be checked during the initial development of the properties. Furthermore, property differencing is used in synergy with program behavior differencing techniques to optimize common regression scenarios, such as detecting regression errors or checking feature additions for conformance to new expected properties. Experimental results in the context of symbolic execution of Java programs annotated with properties written as assertions show the effectiveness of iProperty in utilizing change information to enable more efficient checking.

AI Agents for this Paper

Find similar papers on Google Scholar, PubMed and Arxiv
Write a critical review of this paper
Analyze citations of this paper to find unaddressed research gaps

Most frequently asked questions

1. What have the authors contributed in "Property differencing for incremental checking" ?

This paper introduces iProperty, a novel approach that facilitates incremental checking of programs based on a property differencing technique.. Furthermore, property differencing is used in synergy with program behavior differencing techniques to optimize common regression scenarios, such as detecting regression errors or checking feature additions for conformance to new expected properties.

2. What are the primary threats to external validity in their study?

The primary threats to external validity in their study are the use of SPF and DiSE, the selection of artifacts and properties, and the changes made to create versions of the code and properties.

3. What is the key novelty of iProperty?

The key novelty of iProperty is to compute logical differences between old and new versions of properties that undergo change and facilitate two development scenarios that form their focus: (1) writing properties correctly for an existing program, and (2) checking changes to code and properties as they coevolve.

4. What is the purpose of Check II?

Check II serves as a regression metric where the analysis ensures that changes to the code do not violate the preserved properties.

Table 2: Results for checking the tritype assertions.

Figure 1: Method to compute the middle value of three input numbers [31] and expected properties (Lines 16–19).

Table 4: Results for checking data structure assertions.

Table 3: Subjects with mechanically synthesized assertions using Daikon.

Table 5: Results for checking WBS, TCAS, and Apollo.

Citations

Proceedings Article•10.1145/2970276.2970332

Conc-iSE: incremental symbolic execution of concurrent software

Shengjian Guo, +2 more

- 25 Aug 2016

TL;DR: This paper develops an inter-thread and inter-procedural change-impact analysis to check if a statement is affected by the changes and then leverage the information to choose executions that need to be re-explored.

...read moreread less

•Journal Article•10.1109/TSE.2016.2584063

Dependence Guided Symbolic Execution

Haijun Wang, +5 more

- 01 Mar 2017

- IEEE Transactions on Software Engineerin...

TL;DR: It is argued that for the purpose of fault detection it is not necessary to systematically explore the paths, and a new symbolic execution approach is proposed to mitigate the path explosion problem by predicting and eliminating the redundant paths based on symbolic value.

...read moreread less

•Journal Article•10.1145/2629536

Directed Incremental Symbolic Execution

Guowei Yang, +3 more

- 07 Oct 2014

- ACM Transactions on Software Engineering...

TL;DR: The novelty of DiSE is to combine the efficiencies of static analysis techniques to compute program difference information with the precision of symbolic execution to explore program execution paths and generate path conditions affected by the differences.

...read moreread less

Book Chapter•10.1007/978-3-662-48899-7_42

Automated Discovery of Simulation BetweenźPrograms

Grigory Fedyukovich, +2 more

- 24 Nov 2015

TL;DR: This paper presents SimAbs, the first fully automated SMT-based approach to synthesize an abstraction of one program called target that simulates another program called source, and presents a novel algorithm for dealing with such formulas using an incremental SMT solver.

...read moreread less

•Proceedings Article

Sys: A {Static/Symbolic} Tool for Finding Good Bugs in Good (Browser) Code

Fraser Brown, +2 more

- 01 Jan 2020

TL;DR: An extensible bug-finding tool designed to automatically find security bugs in huge codebases, even when easy-to-find bugs have been already picked clean by years of aggressive automatic checking, is described and evaluated.

...read moreread less

...

Expand

References

Journal Article•10.1109/32.588521

The model checker SPIN

Gerard J. Holzmann

- 01 May 1997

TL;DR: An overview of the design and structure of the verifier, its theoretical foundation, and an overview of significant practical applications are given.

...read moreread less

4.3K

•Proceedings Article•10.5555/1855741.1855756

KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs

Cristian Cadar, +2 more

- 08 Dec 2008

TL;DR: A new symbolic execution tool, KLEE, capable of automatically generating tests that achieve high coverage on a diverse set of complex and environmentally-intensive programs, and significantly beat the coverage of the developers' own hand-written test suite is presented.

...read moreread less

3.3K

Journal Article•10.1145/360248.360252

Symbolic execution and program testing

James C. King

- 01 Jul 1976

- Communications of The ACM

TL;DR: A particular system called EFFIGY which provides symbolic execution for program testing and debugging is described, which interpretively executes programs written in a simple PL/I style programming language.

...read moreread less

3.2K

•Book Chapter•10.1007/978-3-642-19237-1_4

DART: directed automated random testing

Koushik Sen

- 19 Oct 2009

TL;DR: Direct automated random testing is described, an efficient approach which combines random and symbolic testing, and several heuristic search strategies are presented, including a novel strategy guided by the control flow graph of the program under test.

...read moreread less

1.9K

Journal Article•10.1023/A:1022920129859

Model checking programs

Willem Visser, +3 more

- 11 Sep 2000

TL;DR: A verification and testing environment for Java, called Java PathFinder (JPF), which integrates model checking, program analysis and testing, and uses state compression to handle big states and partial order and symmetry reduction, slicing, abstraction, and runtime analysis techniques to reduce the state space.

...read moreread less

1.6K

...

Expand

Property differencing for incremental checking

Chat with Paper

AI Agents for this Paper

Most frequently asked questions

1. What have the authors contributed in "Property differencing for incremental checking" ?

2. What are the primary threats to external validity in their study?

3. What is the key novelty of iProperty?

4. What is the purpose of Check II?

5. What are the common metrics used to evaluate the cost of symbolic execution based techniques?

6. What is the common execution driver for each artifact?

7. What is the idea of optimizing symbolic execution in the context of code that undergoes change?

8. How do the authors add partial correctness properties to the Java example?

9. How many versions of the WBS and Apollo artifacts are created?

10. How does iProperty solve the problem of calculating property differences?

11. What are the possible paths through the program defined by the path constraints?

Figures

Citations

Conc-iSE: incremental symbolic execution of concurrent software

Dependence Guided Symbolic Execution

Directed Incremental Symbolic Execution

Automated Discovery of Simulation BetweenźPrograms

Sys: A {Static/Symbolic} Tool for Finding Good Bugs in Good (Browser) Code

References

The model checker SPIN

KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs

Symbolic execution and program testing

DART: directed automated random testing

Model checking programs

Related Papers (5)

KLEE: unassisted and automatic generation of high-coverage tests for complex systems programs

DART: directed automated random testing

Symbolic execution and program testing

Symbolic PathFinder: symbolic execution of Java bytecode

Scaling symbolic execution using ranged analysis