Symbolic Partial-Order Execution for Testing Multi-Threaded Programs

1@inproceedings{schemmelSymbolicPartialOrderExecution2020,
2  author = {Schemmel, Daniel and Büning, Julian and Rodríguez, César and Laprell, David and Wehrle, Klaus},
3  title = {Symbolic {{Partial-Order}} {{Execution}} for {{Testing}} {{Multi-Threaded}} {{Programs}}},
4  booktitle = {{{Computer-Aided}} {{Verification}} {{(CAV}} 2020)},
5  location = {Los Angeles, CA, USA (Online)},
6  pages = {376--400},
7  year = {2020},
8  doi = {10.1007/978-3-030-53288-8_18},
9}

We describe a technique for systematic testing of multi-threaded programs. We combine Quasi-Optimal Partial-Order Reduction, a state-of-the-art technique that tackles path explosion due to interleaving non-determinism, with symbolic execution to handle data non-determinism. Our technique iteratively and exhaustively finds all executions of the program. It represents program executions using partial orders and finds the next execution using an underlying unfolding semantics. We avoid the exploration of redundant program traces using cutoff events. We implemented our technique as an extension of KLEE and evaluated it on a set of large multi-threaded C programs. Our experiments found several previously undiscovered bugs and undefined behaviors in memcached and GNU sort, showing that the new method is capable of finding bugs in industrial-size benchmarks.

Notes

Unless reading the exact version as published at CAV is important to you, we advise reading the extended version (arXiv ) instead, which contains a lot of additional content in the appendix and has not been edited to fit the Springer LNCS format.