Papers by Rasool Maghareh
Lecture notes in computer science, 2024
Dynamic Symbolic Execution (DSE) is an important method for the testing of programs. The major ad... more Dynamic Symbolic Execution (DSE) is an important method for the testing of programs. The major advantage of DSE is its path-bypath exploration of the program execution space. However, this often leads to the path explosion problem. To address this issue, a method of abstraction learning has been used. The key step here is the computation of an interpolant to represent the learned abstraction. In Test-Comp 2024, we use two different approaches of interpolant generation viz., Deletion Interpolation and Weakest Precondition Interpolation. The former is our more stable and mature system and briefly discussed in [8]. In this paper, we present the latter approach which is the heart of TracerX. In general, the Weakest Precondition (WP) is the ideal (most general) interpolant. However, WP is intractable to compute and is exponentially disjunctive. A major challenge is to obtain a conjunctive approximation of the WP. Therefore, we generate an approximation of the WP.
Sadly missed, dearly remembered, forever loved. gratitude and appreciations for all his favors. I... more Sadly missed, dearly remembered, forever loved. gratitude and appreciations for all his favors. I am sincerely thankful for his each and every blessings in the past few years. I would like to thank my wife Narjes for her love and support. Without her support, I would not be able to write this thesis. I also like to thank my parents and my wife's parents Mohammad, Zohreh, Ali and Farahnaz and all my family members including our grandparents Morteza, Maryam, Fatemeh, Zahra, my siblings and their families Hossein, Sadegh, Ghazaleh, my brother and sister in laws and their families Motahareh, Ali, Mohammad, Hengameh, Ahmad and Bita. Thank you all for your love, support, pray and bearing with our absence during the course of my PhD studies. You are the true reason I am here today. In the last year of my PhD my wife and I were blessed to have our son Mahdi. The love and joy he brought to our life was a great motivation towards the end of my PhD journey. I would like to extend my sincere gratitude to my thesis advisor, Professor Joxan Jaffar for his guidance and professional insights throughout my PhD. It was only by his support that I embarked on this PhD journey. Thank you Prof. Jaffar for your valuable advices that helped me to be an independent researcher. Besides, I truly appreciate Dr. Duc-Hiep Chu, for all technical help and advices during these years. It was a pleasure to work with him. This thesis would never have come together without Prof. Jaffar and Dr. Chu's continuous guidance and support. I am very much grateful to my lab mates and my friends from School of v vi Acknowledgments Computing at NUS, for all the wonderful time that we had with each other. Finally, I would like to thank National University of Singapore and Agency for Science, Technology and Research (A*STAR) and specifically, Singapore International Graduate Award (SINGA) program and Lee Foundation for providing the financial support for this research. I also feel a deep appreciation for my friends in Singapore, who have made experience of living in Singapore and studying in NUS a unique and unforgettable one:
Toward optimal mc/dc test case generation
Elements, Jul 18, 2021
MC/DC coverage prescribes a set of MC/DC sequences. Such a sequence is defined by a specification... more MC/DC coverage prescribes a set of MC/DC sequences. Such a sequence is defined by a specification of the truth values of certain atomic boolean expressions which appear in predicates (i.e. boolean combinations of atomic boolean expressions) in the program. An execution trace satisfies the sequence if it realizes the atomic boolean conditions in accordance with the truth value specification of the sequence. An MC/DC sequence is feasible if there is one such execution trace. The overall goal for an MC/DC test generator is, for each sequence: if feasible, to generate a test input realizing the sequence; otherwise, to prove that the sequence is infeasible. In this paper, we propose a method whose aim is optimal MC/DC coverage for bounded programs, i.e. for each MC/DC sequence, the method either produces a test input, or proves that sequence is infeasible. The method is based on symbolic execution with interpolation, and in this paper, we present a customized interpolation algorithm. We then present a comprehensive experimental evaluation comparing with the only available system CBMC which can operate on reasonably large programs, and further, which can provide optimal coverage for many examples. We will use a benchmark based on RERS which contains the kinds of reactive programs for which MC/DC was motivated by. We show that our method, by a significant margin, surpasses CBMC. In particular, our method often produces an optimal MC/DC result.
Dynamic Symbolic Execution (DSE) is an important method for the testing of programs. An important... more Dynamic Symbolic Execution (DSE) is an important method for the testing of programs. An important system on DSE is KLEE which inputs a C/C++ program annotated with symbolic variables, compiles it into LLVM, and then emulates the execution paths of LLVM using a specified backtracking strategy. The major challenge in symbolic execution is path explosion. The method of abstraction learning has been used to address this. The key step here is the computation of an interpolant to represent the learnt abstraction. In this paper, we present a new interpolation algorithm and implement it on top of the KLEE system. The main objective is to address the path explosion problem in pursuit of code penetration: to prove that a target program point is either reachable or unreachable. That is, our focus is verification. We show that despite the overhead of computing interpolants, the pruning of the symbolic execution tree that interpolants provide often brings significant overall benefits. We then pe...
CUSTOM-Interpolation: ISSTA artifact evaluation
This artifact is prepared to regenerate the results for the paper titled "Toward Optimal MC/... more This artifact is prepared to regenerate the results for the paper titled "Toward Optimal MC/DC Test Case Generation", ISSTA-2021. Also, this contains all the raw experimental results.
SIMULATOR.ZIP
This is the simulator code written for our method as well as the code to experiment and run PDDL ... more This is the simulator code written for our method as well as the code to experiment and run PDDL with Metric-FF and NDL.
Worst-Case Execution Time (WCET) is a reliable guarantee for the temporal correctness of hard rea... more Worst-Case Execution Time (WCET) is a reliable guarantee for the temporal correctness of hard real-time systems. In this paper, we propose a novel integrated method for WCET analysis where micro-architectural modeling – with emphasis on caches – and systematic path-sensitivity, are synergized. This would give us very high precision for WCET analysis, but at the same time, it is a huge challenge for scalability. Our contribution in this paper is a dynamic programming algorithm with a powerful concept of reuse. In particular, we capture the situations where reuse is applicable by a concept of interpolation. While interpolation-based methods have been used in program verification for the purpose of pruning the search space of symbolic execution, our setting is novel not just because we are performing analysis instead of verification, but because our interpolation covers reuse under an environment where the timing of program paths are dynamic. In the end, because we are systematically p...
Dynamic Symbolic Execution (DSE) is an important method for the testing of programs. An important... more Dynamic Symbolic Execution (DSE) is an important method for the testing of programs. An important system on DSE is KLEE which inputs a C/C++ program annotated with symbolic variables, compiles it into LLVM, and then emulates the execution paths of LLVM using a specified backtracking strategy. The major challenge in symbolic execution is path explosion. The method of abstraction learning has been used to address this. The key step here is the computation of an interpolant to represent the learnt abstraction. In this paper, we present a new interpolation algorithm and implement it on top of the KLEE system. The main objective is to address the path explosion problem in pursuit of code penetration: to prove that a target program point is either reachable or unreachable. That is, our focus is verification. We show that despite the overhead of computing interpolants, the pruning of the symbolic execution tree that interpolants provide often brings significant overall benefits. We then pe...
Fundamental Approaches to Software Engineering
Dynamic Symbolic Execution (DSE) is an important method for testing of programs. An important sys... more Dynamic Symbolic Execution (DSE) is an important method for testing of programs. An important system on DSE is KLEE [1] which inputs a C/C++ program annotated with symbolic variables, compiles it into LLVM, and then emulates the execution paths of LLVM using a specified backtracking strategy. The major challenge in symbolic execution is path explosion. The method of abstraction learning [7] has been used to address this. The key step here is the computation of an interpolant to represent the learned abstraction. TracerX, our tool, is built on top of KLEE and it implements and utilizes abstraction learning. The core feature in abstraction learning is subsumption of paths whose traversals are deemed to no longer be necessary due to similarity with already-traversed paths. Despite the overhead of computing interpolants, the pruning of the symbolic execution tree that interpolants provide often brings significant overall benefits. In particular, TracerX can fully explore many programs that would be impossible for any non-pruning system like KLEE to do so.
Lecture Notes in Computer Science, 2020
Dynamic Symbolic Execution (DSE) is an important method for testing of programs. An important sys... more Dynamic Symbolic Execution (DSE) is an important method for testing of programs. An important system on DSE is KLEE [1] which inputs a C/C++ program annotated with symbolic variables, compiles it into LLVM, and then emulates the execution paths of LLVM using a specified backtracking strategy. The major challenge in symbolic execution is path explosion. The method of abstraction learning [7] has been used to address this. The key step here is the computation of an interpolant to represent the learned abstraction. TracerX, our tool, is built on top of KLEE and it implements and utilizes abstraction learning. The core feature in abstraction learning is subsumption of paths whose traversals are deemed to no longer be necessary due to similarity with already-traversed paths. Despite the overhead of computing interpolants, the pruning of the symbolic execution tree that interpolants provide often brings significant overall benefits. In particular, TracerX can fully explore many programs that would be impossible for any non-pruning system like KLEE to do so.
Extending DPC++ with Support for Huawei Ascend AI Chipset
International Workshop on OpenCL
Toward optimal mc/dc test case generation
Proceedings of the 30th ACM SIGSOFT International Symposium on Software Testing and Analysis
Optimal MC/DC Test Case Generation
2019 IEEE/ACM 41st International Conference on Software Engineering: Companion Proceedings (ICSE-Companion)
Symbolic execution for memory consumption analysis
Proceedings of the 17th ACM SIGPLAN/SIGBED Conference on Languages, Compilers, Tools, and Theory for Embedded Systems - LCTES 2016, 2016
Precise Cache Timing Analysis via Symbolic Execution
2016 IEEE Real-Time and Embedded Technology and Applications Symposium (RTAS), 2016
Enhancement of Template-Based Face Detection by Belief Propagation in Ordered Component Search
Lecture Notes in Electrical Engineering, 2012
Uploads
Papers by Rasool Maghareh