Automated Software Engineering

, Volume 19, Issue 3, pp 233–301

Efficient and formal generalized symbolic execution

Article

DOI: 10.1007/s10515-011-0089-9

Cite this article as:
Deng, X., Lee, J. & Robby Autom Softw Eng (2012) 19: 233. doi:10.1007/s10515-011-0089-9

Abstract

Programs that manipulate dynamic heap objects are difficult to analyze due to issues like aliasing. Lazy initialization algorithm enables the classical symbolic execution to handle such programs. Despite its successes, there are two unresolved issues: (1) inefficiency; (2) lack of formal study. For the inefficiency issue, we have proposed two improved algorithms that give significant analysis time reduction over the original lazy initialization algorithm. In this article, we formalize the lazy initialization algorithm and the improved algorithms as operational semantics of a core subset of the Java Virtual Machine (JVM) instructions, and prove that all algorithms are relatively sound and complete with respect to the JVM concrete semantics. Finally, we conduct a set of extensive experiments that compare the three algorithms and demonstrate the efficiency of the improved algorithms.

Keywords

Symbolic executionOperational semanticsJVMSoundnessCompleteness

Copyright information

© Springer Science+Business Media, LLC 2011

Authors and Affiliations

  1. 1.Pennsylvania State University at HarrisburgMiddletownUSA
  2. 2.Google Inc.Mountain ViewUSA
  3. 3.Korea UniversitySeoulKorea
  4. 4.Kansas State UniversityManhattanUSA