[Paper Review] Enhancing Symbolic Execution of Heap-based Programs with Separation Logic for Test Input Generation

Long Hoang Pham, Quang Loc Le+3 more|arXiv (Cornell University)|Dec 16, 2017

Software Testing and Debugging Techniques37 references3 citations

TL;DR

This paper proposes a symbolic execution framework for heap-based programs using separation logic to generate fully initialized, valid test inputs. By integrating context-sensitive lazy initialization with separation logic preconditions, the approach eliminates invalid inputs and reduces path explosion, achieving 98.98% average branch coverage in evaluation.

ABSTRACT

Symbolic execution is a well established method for test input generation. Despite of having achieved tremendous success over numerical domains, existing symbolic execution techniques for heap-based programs are limited due to the lack of a succinct and precise description for symbolic values over unbounded heaps. In this work, we present a new symbolic execution method for heap-based programs based on separation logic. The essence of our proposal is context-sensitive lazy initialization, a novel approach for efficient test input generation. Our approach differs from existing approaches in two ways. Firstly, our approach is based on separation logic, which allows us to precisely capture preconditions of heap-based programs so that we avoid generating invalid test inputs. Secondly, we generate only fully initialized test inputs, which are more useful in practice compared to those partially initialized test inputs generated by the state-of-the-art tools. We have implemented our approach as a tool, called Java StarFinder, and evaluated it on a set of programs with complex heap inputs. The results show that our approach significantly reduces the number of invalid test inputs and improves the test coverage.

Motivation & Objective

• To address the limitations of existing symbolic execution tools in generating valid test inputs for heap-based programs.
• To reduce path explosion caused by explicit enumeration of heap object choices in lazy initialization.
• To eliminate partially initialized or invalid test inputs by leveraging precise heap specifications via separation logic.
• To improve test coverage and efficiency in generating meaningful test inputs for complex data structures.
• To provide a practical, scalable symbolic execution framework for real-world Java programs with mutable heap structures.

Proposed method

• The approach uses a logic combining separation logic, existentially quantified variables, inductive predicates, and arithmetic to precisely describe heap preconditions.
• It introduces context-sensitive lazy initialization, where symbolic execution only explores states that satisfy separation logic preconditions.
• A least fixed point analysis is used to compute valid heap configurations without enumerating invalid ones.
• The method generates only fully initialized test inputs, avoiding the need for post-concretization.
• The framework is implemented as Java StarFinder, built on Symbolic PathFinder, to analyze Java bytecode.
• Separation logic formulas are used to guide symbolic execution and prune invalid paths at the source.

Experimental results

Research questions

• RQ1 How can separation logic be used to precisely specify heap input structures and reduce invalid test input generation?
• RQ2 Can context-sensitive lazy initialization based on separation logic preconditions eliminate path explosion and invalid inputs?
• RQ3 To what extent does the use of separation logic improve test coverage compared to traditional symbolic execution?
• RQ4 How effective is the approach in generating fully initialized test inputs for complex, mutable heap-based data structures?
• RQ5 Can the integration of separation logic with symbolic execution scale to real-world programs with unbounded heap structures?

Key findings

• The proposed approach reduced the number of invalid test inputs significantly compared to state-of-the-art tools.
• Java StarFinder achieved 98.98% average branch coverage on a set of complex heap-based Java programs.
• All generated test inputs were fully initialized, eliminating the need for post-concretization.
• The use of separation logic preconditions enabled precise, local reasoning over heaplets, avoiding global reasoning complexity.
• The method outperformed existing approaches by avoiding explicit enumeration of all possible heap object bindings.
• The integration of separation logic with symbolic execution demonstrated scalability and practicality for real-world programs.