1. CSV 889: Concurrent Software Verification Subodh Sharma Indian Institute of Technology Delhi State merging, Concolic Execution

2. Concolic Execution Works well on interprocedural bugs, use of library calls

3. Concolic Execution Falls back on concrete values when – Non linear arithmetic – pointers pointing to input values

4. Concolic execution with dynamic data No way to know whether a->c is overwritten. With initial random values, Concolic falls back to concrete values

5. Nonlinear arithmetic

6. Problems with Concolic Testing Limited exploration when decision procedures encounter: – Floats, nonlinear arithmetic, 3 rd party components – symbolic pointers

7. Symbolic Execution with Concurrency Scheduling explosion - an additional headache Solution: Check for feasible interleavings under a “causal model”

8. Example Symbolic execution of a path along with the schedule Does there exist a bad schedule?

9. Example Lamport’s HB Causality -- Respect read-after-write pairs to the same shared var. Not sufficient to expose the error

10. Solution: Allow all interleavings As long as they follow SC semantics What happens in our running example?

11. Preliminaries Concurrent program P: finite set of threads, finite set of shared vars SV Each thread t i has finite set of local vars LV i Symbolic execution trace: where

12. Preliminaries Symbolic execution trace: where action:, assert(c) state is a map s: V -> Val

13. Sym. Exec. of Example

14. Concurrent Trace Program CTP of : Feasible linearization of

15. CSSA – Concurrent SSA

17. SAT Encoding based on CSSA

18. Path Constraints

19. Property Constraints HB Constraints

20. PO Ordering

21. VD Constraints

22. Phi Constraints

23. CSSA Encoding

24. Context bounding What is a context and a context switch? Context bounding – restrict the number of context switches allowed! In our example: What happens when we bound the contexts to 1? What happens when it is increased to 2?

25. CTP with Context Bounding For this to happen, we change the HB definition slightly

26. Acknowledgements