Consider the c code of figure 1 and assume that our goal is to determine. King marie nesfield 31st jan 2017 testing sy mb o l i c ex ecu ti o n p ro vi n g exercises a single program tracedynamic tries to exhaust all program tracesdynamic need not be dynamic ensures property holds on single trace ensures property holds on as much as maybe executed. Symbolic execution and program testing semantic scholar. In software testing, symbolic execution is used to generate a test input for each feasible execution path of a program. In computer science, symbolic execution is a means of analyzing a program to determine what. Symbolic execution instead of values, use symbols representing arbitrary numbers as input all variables can hold symbols all operations work on symbols closely related to normal execution reiter symbolic execution and program testing 1. An execution path is a sequence of true and false, where a value of true respectively false at the ith position in the sequence denotes that the ith conditional statement encountered along the. The execution proceeds as in a normal execution except that values may be symbolic formulas over the input symbols. Programs interact with their environment by performing system calls, receiving signals, etc. The difficult, yet interesting issues arise during the symbolic execution of conditional branch type statements. Symbolic execution is used to reason about a program pathbypath which is an advantage over reasoning about a program inputbyinput as other testing paradigms use e.
King,symbolic execution and program testing, communications of the acm, volume 19, number 7, 1976, 385. Symbolic execution and program testing communications of the acm. Symbolic execution is a popular program analysis technique introduced in the. Symbolic execution umd department of computer science. Symbolic execution for software testing in practice patrice godefroid. Instead of supplying the normal inputs to a program e. Generalizing symbolic execution to library classes the university. However, if few inputs take the same path through the program, there is little savings over testing each of the inputs separately.
Selecta formal system for testing and debugging programs by symbolic execution. This paper describes the symbolic execution of programs. A particular system called effigy which provides symbolic execution for program testing and debugging is also described. Draws an execution tree corresponding to the symbolic execution of a subset of the language described in the paper symbolic execution and program testing by james c. A feasible execution path is a sequence of true and false, where a value of true respectively false at the i th position in the sequence denotes that the i th conditional statement encountered along the execution path took. Fundamental approaches, pioneered by king in a seminal paper 68, are the following.
960 41 95 1080 846 204 1291 1301 567 1500 281 806 756 414 829 733 96 985 1596 1066 1029 405 622 1422 21 16 931 842 1597 712 1307 794 287 728 638 1475 1236 1257