Log In Sign Up

Symbolic Partial-Order Execution for Testing Multi-Threaded Programs

by   Daniel Schemmel, et al.

We describe a technique for systematic testing of multi-threaded programs. We combine Quasi-Optimal Partial-Order Reduction, a state-of-the-art technique that tackles path explosion due to interleaving non-determinism, with symbolic execution to handle data non-determinism. Our technique iteratively and exhaustively finds all executions of the program. It represents program executions using partial orders and finds the next execution using an underlying unfolding semantics. We avoid the exploration of redundant program traces using cutoff events. We implemented our technique as an extension of KLEE and evaluated it on a set of large multi-threaded C programs. Our experiments found several previously undiscovered bugs and undefined behaviors in memcached and GNU sort, showing that the new method is capable of finding bugs in industrial-size benchmarks.


page 1

page 2

page 3

page 4


Benchmarking Symbolic Execution Using Constraint Problems – Initial Results

Symbolic execution is a powerful technique for bug finding and program t...

Quasi-Optimal Partial Order Reduction

A dynamic partial order reduction (DPOR) algorithm is optimal when it al...

Angora: Efficient Fuzzing by Principled Search

Fuzzing is a popular technique for finding software bugs. However, the p...

Tamarin: Concolic Disequivalence for MIPS

Given two MIPS programs, when are they equivalent? At first glance, this...

Differentially Testing Soundness and Precision of Program Analyzers

In the last decades, numerous program analyzers have been developed both...

Active Learning for Efficient Testing of Student Programs

In this work, we propose an automated method to identify semantic bugs i...

Representing Partial Programs with Blended Abstract Semantics

Synthesizing programs from examples requires searching over a vast, comb...