C++ Symbolic Execution Optimization for Testing Coverage

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

Current software testing methods, such as regression testing, often fail to detect corner-case bugs and provide limited coverage, while existing symbolic execution tools for C++ are inefficient due to lack of good abstractions, fast solvers, and domain-specific handlers.

Innovation Solution

A symbolic execution and automatic test generation tool for C, C#, and C++ software that compiles programs into LLVM bytecode, uses customized low-level libraries, and implements efficient solvers for common data structures, along with domain-specific handlers to optimize processing and generate high-coverage test cases.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Reliability

If symbolic execution is used to achieve exhaustive validation of software, then testing coverage is improved, but processing time and computational resources increase significantly

Engineering Contradiction:

Improvetesting coverageVSAvoidprocessing time

Core Design Contradiction:

ReliabilityVSLoss of time

Solution Approach 1:

The patent segments the symbolic execution process by separating concrete execution (for performance-critical paths) from symbolic execution (for coverage-critical paths). This allows the system to achieve high testing coverage through symbolic execution while maintaining reasonable processing times by using concrete execution for routine operations.

Inventive Principle:

Principle #1Segmentation

Solution Approach 2:

The patent applies partial symbolic execution by selectively applying symbolic analysis only to specific code regions or paths that require exhaustive validation, rather than performing symbolic execution on the entire program. This reduces the overall computational burden while still achieving high coverage for critical areas.

Inventive Principle:

Principle #16Partial or excessive action

2Ease of manufacture

If existing symbolic execution tools are used for C++, then implementation is simplified, but efficiency and performance deteriorate due to lack of optimizations

Engineering Contradiction:

Improveimplementation simplicityVSAvoidexecution efficiency

Core Design Contradiction:

Ease of manufactureVSProductivity

Solution Approach 1:

The patent changes key parameters of the symbolic execution engine by implementing custom data structures optimized for C++ programs, adjusting the analysis depth and breadth parameters, and modifying the path exploration strategy to prioritize high-value paths, thereby significantly improving execution efficiency.

Inventive Principle:

Principle #35Parameter changes

Solution Approach 2:

The patent replaces the generic symbolic execution mechanism with a specialized C++-optimized version that uses custom data structures, memory management strategies, and analysis algorithms tailored to C++'s specific features such as pointers, references, and object-oriented constructs.

Inventive Principle:

Principle #28Mechanics substitution (Replace mechanical system)

3Adaptability or versatility

If generic testing tools are used, then tool availability is improved, but detection precision for corner-case bugs deteriorates

Engineering Contradiction:

Improvetool availabilityVSAvoidbug detection precision

Core Design Contradiction:

Adaptability or versatilityVSMeasurement precision

Solution Approach 1:

The patent introduces an intermediary layer between the testing tool and the C++ program that translates generic testing operations into C++-specific analysis operations. This intermediary handles C++ constructs like pointers, templates, and exception handling, enabling generic tools to achieve precision comparable to specialized tools.

Inventive Principle:

Principle #24Intermediary (Mediator)

Data Source

PatentUS8943487B2Optimizing libraries for validating C++ programs using symbolic execution

Publication Date: 2015.01.27 FUJITSU LTD

AI summary

Particular embodiments optimize a C++ function comprising one or more loops for symbolic execution, comprising for each loop, if there is a branching condition within the loop, then rewrite the loop to move the branching condition outside the loop. Particular embodiments may further optimize the C++ function through simplified symbolic expressions and adding constructs forcing delayed interpretation of symbolic expressions during the symbolic execution.