cristian cadar, peter boonstoppel, dawson engler rwset: attacking path explosion in constraint-based...
TRANSCRIPT
![Page 1: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/1.jpg)
Cristian Cadar, Peter Boonstoppel, Dawson Engler
RWset: Attacking Path Explosion in Constraint-Based Test Generation
TACAS 2008, Budapest, Hungary ETAPS 2008
![Page 2: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/2.jpg)
Goal: generate inputs that explore (ideally) all paths of a program
Run program on symbolic input, whose initial value is anything
At conditionals that use symbolic inputs, fork execution and follow both paths:
On true branch, add constraint that condition is true On false, that it is not
When a path terminates, generate a test case by solving the constraints on that path
Constraint-Based Test Generation
![Page 3: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/3.jpg)
• EGT / EXE / KLEE• DART [Godefroid/Klarlund/Sen]• CUTE [Sen et al.]• SAGE, Pex [Godefroid et al.]• Vigilante [Castro et al ]• BitScope [Song et al.]
• RWset applicable to any of these
Constraint-Based Test Generation
![Page 4: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/4.jpg)
Effective bug-finding tool File system code
ext2, ext3, JFS
Networking applications bpf, udhcpd
Library code PCRE, Pintos
Device drivers Minix
EXE Results
![Page 5: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/5.jpg)
Scalability challenge
• Exponential space!– Relatively small number of interesting paths: e.g., those that achieve
maximum branch coverage
• Mixed symbolic/concrete execution (EXE/DART)• Search heuristics
– Best First Search (EXE)– Generational Search (SAGE)
• Symbolic execution + random testing (Hybrid CUTE)• Caching function summaries (SMART)• Demand-Driven Compositional Symbolic Execution (Pex)
![Page 6: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/6.jpg)
RWset (read-write set) analysis
• Determine whether continuing to execute the current program path will explore new states
• Only a value observed by the program can determine the execution of new program states
![Page 7: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/7.jpg)
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
![Page 8: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/8.jpg)
flag = 0
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
![Page 9: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/9.jpg)
arg1 > 100
flag = 0
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
true: arg1 > 100 false: arg1 100
. . . . . .
![Page 10: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/10.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100 false: arg2 100
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
true: arg1 > 100 false: arg1 100
![Page 11: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/11.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg2 100
process(data, 1)
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
true: arg1 > 100 false: arg1 100
![Page 12: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/12.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg2 100
process(data, 1) process(data, 1)
{data, arg1, arg2} = unconstrained
flag = 0;
if (arg1 > 100) flag = 1;
if (arg2 > 100) flag = 1;
process(data, flag);
true: arg1 > 100 false: arg1 100
![Page 13: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/13.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg2 100
process(data, 1) process(data, 1)
If arg1, arg2 not read
true: arg1 > 100 false: arg1 100
![Page 14: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/14.jpg)
Write-set analysis• Look at values written in the past• State abstraction in model checking• Memory state = write set up to current progr. pt.
– Concrete writes: concr loc = concr val– Symbolic writes: constraint(sym loc)
• Program point P, two paths w/ same write-set – prune the second one
![Page 15: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/15.jpg)
Write-sets
• Precision: reason at the byte-level• Minimize write-set size
1. Overwrites
2. Dead locations
3. Alpha renaming
• Complicated in the symbolic domain
a[i] = 17; a[j] = 20;
• Cannot discard all constraints
on dead locations
![Page 16: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/16.jpg)
Read-set analysis
• Key idea: can ignore from write-set writes to locations that are never read again– Definition of read driven by goal to achieve
high branch coverage– Location read if can hit a new branch by
changing its value
![Page 17: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/17.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
RWset
arg1 =
True-True path
arg2 =
data =
![Page 18: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/18.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
arg1 =
True-True path
arg2 = flag = 0
data =
RWset
![Page 19: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/19.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
arg1 > 100
True-True path
arg2 = flag = 0
data =
RWset
![Page 20: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/20.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
arg1 > 100
True-True path
arg2 = flag = 1
data =
RWset
![Page 21: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/21.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
arg1 > 100
True-True path
arg2 > 100
flag = 1
data =
RWset
![Page 22: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/22.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
arg1 > 100
True-True path
arg2 > 100
flag = 1
data =
RWset
![Page 23: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/23.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
arg1 > 100
True-True path
arg2 > 100
flag = 1
data =
RWset
![Page 24: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/24.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
True-True path
flag = 1
data =
arg1, arg2 not read
arg1 > 100
arg2 > 100
RWset
![Page 25: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/25.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
True-False path
arg1 > 100
True-True path
arg2 > 100
flag = 1
data = arg1 > 100
arg2 100
flag = 1
data =
arg1, arg2 not read
RWset RWset
![Page 26: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/26.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
True-False path
arg1 > 100
True-True path
arg2 > 100
flag = 1
data = arg1 > 100
arg2 100
flag = 1
data =
arg1, arg2 not read
RWset RWset
![Page 27: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/27.jpg)
arg1 > 100
. . .
arg2 > 100
flag = 1
flag = 0
true: arg2 > 100
flag = 1
false: arg1 100
process(data, 1)
true: arg1 > 100 false: arg1 100
process(data, 1)
True-False path
arg1 > 100
True-True path
arg2 > 100
flag = 1
data = arg1 > 100
arg2 100
flag = 1
data =
arg1, arg2 not read
RWset RWset
![Page 28: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/28.jpg)
Implementation
Execution path Global cache
P
W1
W2
Wp
(W1, R1) (W2, R2)
…(Wn, Rn)
RW-Set(P)
WP
![Page 29: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/29.jpg)
Implementation
P
W1
W2
Wp
(W1, R1) (W2, R2)
…(Wn, Rn)Write-set Hit!
Emit test case i.(WP = Wi)
RW-Set(P)
WP
Execution path Global cache
![Page 30: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/30.jpg)
Implementation
P
W1
W2
Wp
WP
Read-set Hit!i.(WP Ri = Wi Ri)
Add (WP,Ri) to RW-Set(P)
(W1, R1) (W2, R2)
…(Wn, Rn)(WP, Ri)Emit test case
RW-Set(P)
Execution path Global cache
![Page 31: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/31.jpg)
Implementation
P
W1
W2
Wp
(W1, R1) (W2, R2)
…(Wn, Rn)(WP, _)
Miss!
Add (WP,_) to RW-Set(P)
. . .
RW-Set(P)
WP
Execution path Global cache
![Page 32: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/32.jpg)
Evaluation
• Medium-sized open source benchmarks– bpf, udhcpd, expat, tcpdump, pcre
• Minix 3 device drivers– lance, pci, sb16
![Page 33: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/33.jpg)
Medium-sized apps
• bpf: Berkeley Packet Filter• expat: XML parsing library• pcre: Perl compatible reg exp library• tcpdump: tool for printing packet headers• udhcpd: a DHCPD server
![Page 34: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/34.jpg)
Medium-sized apps
• Ran base EXE on each app for 30 minutes– Except 30,000 test cases for PCRE
• Recorded number of branches hit• Reran in RWset mode until we reached
the same branch coverage
![Page 35: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/35.jpg)
Medium-sized apps
Percentage tests needed by RWset EXE
100 100 100 100 100
16.2
31.1
72.2
11.4
49.7
0
20
40
60
80
100
120
bpf expat pcre tcpdump udhcpd
Base EXE RW-set EXE
![Page 36: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/36.jpg)
Non-redundant states
pcre
tcpdump
expat
udhcpd
bpf
Test cases
Non
-red
unda
nt s
tate
s
Test cases Test cases
Test cases Test cases
Non
-red
unda
nt s
tate
s
Non
-red
unda
nt s
tate
s
![Page 37: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/37.jpg)
+ 5%
Base EXE RWset EXE
Performance
• Dry run for the medium-sized apps: compute write-sets and read-sets but do no pruning
![Page 38: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/38.jpg)
Device drivers
• Hard to check w/o the physical device or outside of the kernel
• Focused on three MINIX 3 drivers:– lance: AMD lance ethernet card driver– pci: PCI bus driver– sb16: Sound Blaster 16 driver
![Page 39: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/39.jpg)
Minix 3 device drivers
• Structured around a main dispatch loop
while (1) { /* receive message from other processes, the kernel, or the hardware */ message = read_message(); process(message); }
![Page 40: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/40.jpg)
Minix 3 device drivers
• Structured around a main dispatch loop
while (1) { /* receive message from other processes, the kernel, or the hardware */ message = read_symbolic_data(); process(message); }
![Page 41: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/41.jpg)
Minix 3 device drivers
• Structured around a main dispatch loop
for (k=0; k < n; k++) { /* receive message from other processes, the kernel, or the hardware */ message = read_symbolic_data(); process(message); }
![Page 42: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/42.jpg)
Minix drivers - evaluation
• Three versions of EXE:– Base – Write-set– RWset
• Fixed the # of iterations in each version– mainly to have the base version terminate
• Ran each version for an hour– recorded branch coverage + non-redundant states
![Page 43: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/43.jpg)
Branch coverage (pci)
RWsetWrite-set
Base
![Page 44: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/44.jpg)
Branch coverage (lance)
RWsetWrite-set
Base
![Page 45: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/45.jpg)
RWsetWrite-set
Base
Branch coverage (sb16)
![Page 46: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/46.jpg)
Non-redundant states
RWset DFS
RWset DFS
RWset DFS
RWsetBase
RWsetBase
RWsetBase
![Page 47: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/47.jpg)
4
13
Base EXE RWset EXE
Bugs in device drivers
![Page 48: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/48.jpg)
Summary
• RWset analysis – efficient way to prune large numbers of
redundant paths– only values observed by the program trigger the
execution of new paths
• Evaluated on Minix drivers and medium size applications– big reduction in the number of paths explored
![Page 49: Cristian Cadar, Peter Boonstoppel, Dawson Engler RWset: Attacking Path Explosion in Constraint-Based Test Generation TACAS 2008, Budapest, Hungary ETAPS](https://reader038.vdocuments.site/reader038/viewer/2022110116/551784dd5503460e6e8b55b0/html5/thumbnails/49.jpg)
Questions?