Symbolic Partial-Order Execution for Testing Multi-Threaded Programs [Extended Version]

Abstract

We describe a technique for systematic testing of multi-threaded programs. We combine Quasi-Optimal Partial-Order Reduction, a state-of-the-art technique that tackles path explosion due to interleaving non-determinism, with symbolic execution to handle data non-determinism. Our technique iteratively and exhaustively finds all executions of the program. It represents program executions using partial orders and finds the next execution using an underlying unfolding semantics. We avoid the exploration of redundant program traces using cutoff events. We implemented our technique as an extension of KLEE and evaluated it on a set of large multi-threaded C programs. Our experiments found several previously undiscovered bugs and undefined behaviors in memcached and GNU sort, showing that the new method is capable of finding bugs in industrial-size benchmarks.

Publication
arXiv

This is the extended version of our upcoming CAV 2020 paper, which includes additional algorithms and proof sketches.

PhD Student

I am a researcher and head of Systems Analysis at the Chair of Communication and Distributed Systems at RWTH Aachen University, where I research the testability of distributed systems. My specific focus is on the applicability of Symbolic Execution to real world software.

Previous