[Paper Review] Towards Bounded Infeasible Code Detection

Jürgen Christ, Jochen Hoenicke+1 more|arXiv (Cornell University)|May 30, 2012

Software Testing and Debugging Techniques23 references3 citations

TL;DR

This paper presents a bounded approach to detecting infeasible code by encoding feasible program executions as logical formulas using reachability verification conditions. It introduces two complete algorithms—path and statement cover—that generate test cases for all feasible paths/statements within a bounded number of loop unwindings, ensuring any uncovered code is provably infeasible under the bounds.

ABSTRACT

A first step towards more reliable software is to execute each statement and each control-flow path in a method once. In this paper, we present a formal method to automatically compute test cases for this purpose based on the idea of a bounded infeasible code detection. The method first unwinds all loops in a program finitely often and then encodes all feasible executions of the loop-free programs in a logical formula. Helper variables are introduced such that a theorem prover can reconstruct the control-flow path of a feasible execution from a satisfying valuation of this formula. Based on this formula, we present one algorithm that computes a feasible path cover and one algorithm that computes a feasible statement cover. We show that the algorithms are complete for loop-free programs and that they can be implemented efficiently. We further provide a sound algorithm to compute procedure summaries which makes the method scalable to larger programs.

Motivation & Objective

• To address the challenge of detecting infeasible code in programs, especially when traditional static analysis fails to distinguish between unreachable and infeasible code.
• To improve test case generation by ensuring that all generated test cases correspond to actual, terminating program executions within bounded loop unwinding.
• To provide a sound and complete method for verifying the absence of infeasible code up to a given bound, enabling reliable code coverage analysis.
• To scale the approach to larger programs through the use of procedure summaries computed from feasible executions.
• To offer a user-friendly, fully automatic method that requires no expert input beyond the source code, with outputs that are real, executable program paths.

Proposed method

• Formalizes program execution using a reachability verification condition—a logical formula that encodes all feasible executions of a loop-free program, with helper variables to track control-flow paths.
• Unwinds loops a bounded number of times to transform the program into a loop-free form, enabling finite encoding of all feasible executions.
• Employs theorem proving to find satisfying valuations of the reachability verification condition, which directly map to concrete program executions.
• Introduces two algorithms: one using blocking clauses to avoid revisiting the same path, and another using enabling clauses to prioritize unvisited program blocks.
• Computes procedure summaries as under-approximations of feasible executions by extracting input-output pairs from generated test cases.
• Uses on-demand summary recomputation when existing summaries fail to capture feasible executions in a calling context, improving scalability.

Experimental results

Research questions

• RQ1 Can a bounded approach to infeasible code detection be designed such that all generated test cases correspond to real, terminating executions?
• RQ2 How can a logical formula be constructed to represent all feasible executions of a program, with direct mapping from satisfying valuations to actual program paths?
• RQ3 Can two distinct algorithms be developed to compute feasible path and statement coverage that are both sound and complete for bounded loop-free programs?
• RQ4 To what extent can procedure summaries computed from feasible executions improve scalability for larger programs?
• RQ5 How does the performance of the proposed method compare to existing approaches in terms of coverage completeness and execution efficiency?

Key findings

• The proposed algorithms for feasible path and statement cover are complete for loop-free programs and can be implemented efficiently using standard theorem provers.
• The method guarantees that any program statement not covered by the generated test cases is in fact infeasible within the given loop unwinding bounds.
• Preliminary evaluation shows the approach outperforms existing tools in detecting infeasible code under bounded execution.
• Computing a feasible path cover is nearly as efficient as computing a feasible statement cover, even for procedures up to 300 lines of code.
• The use of procedure summaries enables sound under-approximation of feasible executions, improving scalability, though current limitations in translation and oracle support hinder full practical deployment.
• The approach is sound but not complete when the theorem prover fails to find satisfying valuations—particularly in the presence of non-linear arithmetic—highlighting a need for integration with dynamic analysis in practice.