Symbolic Execution Abstraction for Path Explosion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Traditional symbolic execution faces the state explosion problem, leading to time-consuming and resource-intensive test input generation due to the exponential increase in paths to explore, making it impractical for larger software programs.
Innovation Solution
The method of mixed symbolic and abstraction execution, where symbolic values are constrained by derived abstractions, reducing the number of paths explored by generating a declarative function based on the return value and exploring only paths that satisfy the abstraction, referred to as 'lazy symbolic execution'.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional symbolic execution is used to generate test inputs, then comprehensive path coverage can be achieved, but the state explosion problem causes exponential increase in processing time and resource consumption
Solution Approach 1:
The patent segments the symbolic execution process by dividing the program into functions and further into basic blocks. Each function is analyzed separately with its own abstraction, and basic blocks are processed incrementally. This segmentation prevents the exponential state explosion by handling one function at a time rather than the entire program simultaneously, thus reducing the computational burden while maintaining path coverage.
Solution Approach 2:
The patent performs preliminary abstraction derivation for each function before executing symbolic paths. By pre-computing abstractions that capture essential function behavior and constraints, the system prepares in advance to filter and guide subsequent path exploration. This preliminary action reduces the search space early, preventing exponential state growth during actual path execution.
2Reliability
If traditional symbolic execution explores all possible paths, then complete software verification can be achieved, but resource consumption becomes prohibitive for larger programs
Solution Approach 1:
The patent changes the parameter representation by introducing abstractions that summarize function behavior in terms of input-output relationships and invariant properties. Instead of tracking every possible concrete state, the system uses abstract parameters (predicates, constraints, and function signatures) that capture essential verification information. This parameter transformation reduces the state space from exponential to manageable levels while preserving verification completeness.
Solution Approach 2:
The patent extracts and separates the analysis of each function into independent units with dedicated abstractions. By taking out individual functions from the whole program and analyzing them separately with their own symbolic execution contexts, the system avoids the combinatorial explosion that would result from analyzing all functions simultaneously. Each function's abstraction is then reused across multiple call sites, reducing redundant processing.
3Measurement precision
If symbolic execution maintains detailed symbolic values for all variables, then precise path analysis can be performed, but the complexity of managing symbolic states increases significantly
Solution Approach 1:
The patent segments symbolic state management by scope, creating separate symbolic contexts for each function and basic block. Symbolic variables and their constraints are localized to specific function boundaries rather than being globally managed. This segmentation reduces the complexity of tracking symbolic states by limiting the scope of each symbolic context to only what is necessary for that particular function, while maintaining precise path analysis within each segment.
Data Source
AI summary
A method of testing software may include generating a symbolic value for a return value of a software function of a software program during mixed symbolic and abstraction execution (“mixed execution”) of the software program. Additionally, the mixed execution may maintain symbolic values, abstract values, and constraints of one or more variables of the software function. The method may also include deriving, during the mixed execution, an abstraction for the symbolic value. The abstraction may constrain the symbolic value and may be derived based on the return value of the paths that satisfy the abstraction. Further, the method may include exploring, during the mixed execution, the one or more paths of the software function that correspond to the return value based on the symbolic value, as constrained by the abstraction, such that a number of the one or more paths explored during the symbolic execution is constrained by the abstraction.