3 research outputs found
Model counting for complex data structures
We extend recent approaches for calculating the probability of program behaviors, to allow model counting for complex data structures with numeric fields. We use symbolic execution with lazy initialization to compute the input structures leading to the occurrence of a target event, while keeping a symbolic representation of the constraints on the numeric data. Off-the-shelf model counting tools are used to count the solutions for numerical constraints and field bounds encoding data structure invariants are used to reduce the search space. The technique is implemented in the Symbolic PathFinder tool and evaluated on several complex data structures. Results show that the technique is much faster than an enumeration-based method that uses the Korat tool and also highlight the benefits of using the field bounds to speed up the analysis
Recommended from our members
Korat-API : an API for building constraint solving problems for Korat
This thesis introduces the foundation of an API for building constraint solving problems for the Korat solver for imperative predicates. Our goal is two-fold: (1) to facilitate the use of Korat as a backend solver for applications that desire using it as a constraint solving engine; and (2) to facilitate optimized analyses using Korat, which follow the spirit of modern constraint solving and software testing techniques. We describe the API and how it uses the core Korat engine, and demonstrate the benefits in two application contexts: (1) using Korat as a backend engine for model counting; and (2) using Korat as test generator. We believe our work introduces a promising approach for making the ability of Korat to efficiently solve imperative predicates more widely applicable, possibly even in new application contexts where Korat has net been used before.Electrical and Computer Engineerin
Towards optimal concolic testing
ACM Distinguished Paper Award</p