Adding Constraint Building Mechanisms to a Symbolic Execution Engine Developed for Detecting Runtime Errors

  • István Kádár
  • Péter Hegedűs
  • Rudolf Ferenc
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9159)


Most of the runtime failures of a software system can be revealed during test execution only, which has a very high cost. The symbolic execution engine developed at the Software Engineering Department of University of Szeged is able to detect runtime errors (such as null pointer dereference, bad array indexing, division by zero) in Java programs without running the program in real-life environment.

In this paper we present a constraint system building mechanism which improves the accuracy of the runtime errors found by the symbolic execution engine mentioned above. We extend the original principles of symbolic execution by tracking the dependencies of the symbolic variables and substituting them with concrete values if the built constraint system unambiguously determines their value.

The extended symbolic execution checker was tested on real-life open-source systems as well.


Software engineering Symbolic execution Java runtime errors Constraint system building 


Unable to display preview. Download preview PDF.

Unable to display preview. Download preview PDF.


  1. 1.
    King, J.C.: Symbolic Execution and Program Testing. Communications of the ACM 19(7), 385–394 (1976)zbMATHCrossRefGoogle Scholar
  2. 2.
    Gecode Tool-set.
  3. 3.
    Kádár, I., Hegedűs, P., Ferenc, R.: Runtime exception detection in java programs using symbolic execution. Acta Cybernetica 21(3), 331–352 (2014)zbMATHGoogle Scholar
  4. 4.
    Ferenc, R., Beszédes, Á., Tarkiainen, M., Gyimóthy, T.: Columbus – reverse engineering tool and schema for C++. In: Proceedings of the 18th International Conference on Software Maintenance (ICSM 2002), pp. 172–181. IEEE Computer Society, October 2002Google Scholar
  5. 5.
    Allen, F.E.: Control flow analysis. SIGPLAN Not. 5(7), 1–19 (1970)CrossRefGoogle Scholar
  6. 6.
    Păsăreanu, C.S., Rungta, N.: Symbolic pathfinder: symbolic execution of Java bytecode. In: Proceedings of the IEEE/ACM International Conference on Automated Software Engineering, ASE 2010, pp. 179–180. ACM, New York (2010)Google Scholar
  7. 7.
    Weimer, W., Necula, G.C.: Finding and preventing run-time error handling mistakes. In: Proceedings of the 19th Annual ACM SIGPLAN Conference on Object-oriented Programming, Systems, Languages, and Applications, OOPSLA 2004, pp. 419–431. ACM, New York (2004)Google Scholar
  8. 8.
    Csallner, C., Smaragdakis, Y.: JCrasher: an Automatic Robustness Tester for Java. Software Practice and Experience 34(11), 1025–1050 (2004)CrossRefGoogle Scholar
  9. 9.
    Godefroid, P., Klarlund, N., Sen, K.: DART: directed automated random testing. In: Proceedings of the 2005 ACM SIGPLAN Conference on Programming Language Design and Implementation, PLDI 2005, pp. 213–223. ACM, New York (2005)Google Scholar
  10. 10.
    Cadar, C., Ganesh, V., Pawlowski, P.M., Dill, D.L., Engler, D.R.: EXE: automatically generating inputs of death. In: Proceedings of the 13th ACM Conference on Computer and Communications Security, CCS 2006, pp. 322–335. ACM, New York (2006)Google Scholar
  11. 11.
    Coward, P.D.: Symbolic Execution Systems - a Review. Software Engineering Journal 3(6), 229–239 (1988)CrossRefGoogle Scholar
  12. 12.
    Cadar, C., Godefroid, P., Khurshid, S., Păsăreanu, C.S., Sen, K., Tillmann, N., Visser, W.: Symbolic execution for software testing in practice: preliminary assessment. In: Proceedings of the 33rd International Conference on Software Engineering, ICSE 2011, pp. 1066–1071. ACM, New York (2011)Google Scholar
  13. 13.
    Song, J., Ma, T., Cadar, C., Pietzuch, P.: Rule-based verification of network protocol implementations using symbolic execution. In: Proceedings of the 20th IEEE International Conference on Computer Communications and Networks (ICCCN 2011), pp. 1–8 (2011)Google Scholar
  14. 14.
    Java PathFinder Tool-set.
  15. 15.
    Bushnell, D., Giannakopoulou, D., Mehlitz, P., Paielli, R., Păsăreanu, C.S.: Verification and validation of air traffic systems: tactical separation assurance. In: 2009 IEEE Aerospace Conference, pp. 1–10 (2009)Google Scholar
  16. 16.
    Khoo, Y.P., Chang, B.Y.E., Foster, J.S.: Mixing type checking and symbolic execution. In: Zorn, B.G., Aiken, A. (eds.) PLDI, pp. 436–447. ACM (2010)Google Scholar
  17. 17.
    Shannon, D., Zhan, D., Hajra, S., Lee, A., Khurshid, S.: Abstracting symbolic execution with string analysis testing. In: Academic and Industrial Conference Practice and Research TechniquesMUTATION, 2007. Taicpart-Mutation (2007)Google Scholar
  18. 18.
    Păsăreanu, C.S., Rungta, N., Visser, W.: Symbolic execution with mixed concrete-symbolic solving. In: Proceedings of the 2011 International Symposium on Software Testing and Analysis, ISSTA 2011, pp. 34–44. ACM, New York (2011)Google Scholar

Copyright information

© Springer International Publishing Switzerland 2015

Authors and Affiliations

  • István Kádár
    • 1
  • Péter Hegedűs
    • 1
  • Rudolf Ferenc
    • 1
  1. 1.Department of Software EngineeringUniversity of SzegedSzegedHungary

Personalised recommendations