Effective Search-Space Pruning for Solvers of String Equations, Regular Expressions and Length Constraints

  • Yunhui Zheng
  • Vijay Ganesh
  • Sanu Subramanian
  • Omer Tripp
  • Julian Dolby
  • Xiangyu Zhang
Conference paper

DOI: 10.1007/978-3-319-21690-4_14

Part of the Lecture Notes in Computer Science book series (LNCS, volume 9206)
Cite this paper as:
Zheng Y., Ganesh V., Subramanian S., Tripp O., Dolby J., Zhang X. (2015) Effective Search-Space Pruning for Solvers of String Equations, Regular Expressions and Length Constraints. In: Kroening D., Păsăreanu C. (eds) Computer Aided Verification. CAV 2015. Lecture Notes in Computer Science, vol 9206. Springer, Cham

Abstract

In recent years, string solvers have become an essential component in many formal-verification, security-analysis and bug-finding tools. Such solvers typically support a theory of string equations, the length function as well as the regular-expression membership predicate. These enable considerable expressive power, which comes at the cost of slow solving time, and in some cases even nontermination. We present two techniques, designed for word-based SMT string solvers, to mitigate these problems: (i) sound and complete detection of overlapping variables, which is essential to avoiding common cases of nontermination; and (ii) pruning of the search space via bi-directional integration between the string and integer theories, enabling new cross-domain heuristics. We have implemented both techniques atop the Z3-str solver, resulting in a significantly more robust and efficient solver, dubbed Z3str2, for the quantifier-free theory of string equations, the regular-expression membership predicate and linear arithmetic over the length function. We report on a series of experiments over four sets of challenging real-world benchmarks, where we compared Z3str2 with five different string solvers: S3, CVC4, Kaluza, PISA and Stranger. Each of these tools utilizes a different solving strategy and/or string representation (based e.g. on words, bit vectors or automata). The results point to the efficacy of our proposed techniques, which yield dramatic performance improvement. We argue that the techniques presented here are of broad applicability, and can be integrated into other SMT-backed string solvers to improve their performance.

Copyright information

© Springer International Publishing Switzerland 2015

Authors and Affiliations

  • Yunhui Zheng
    • 1
  • Vijay Ganesh
    • 2
  • Sanu Subramanian
    • 2
  • Omer Tripp
    • 1
  • Julian Dolby
    • 1
  • Xiangyu Zhang
    • 3
  1. 1.IBM T.J. Watson Research CenterYorktown HeightsUSA
  2. 2.University of WaterlooWaterlooCanada
  3. 3.Purdue UniversityWest LafayetteUSA

Personalised recommendations