Selective Unification in Constraint Logic Programming Fred Mesnard University of R´ eunion Island Joint work with ´ Etienne Payet (University of R´ eunion Island) and Germ´ an Vidal (Technical University of Valencia) Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 1 / 25
Outline Introduction 1 Selective unification in LP 2 Selective unification in CLP 3 Undecidability of the CSUP 4 A decidable case for the CSUP 5 Conclusion 6 Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 2 / 25
Introduction Test-case generation for automatic software testing Random input data: the most used approach simple, fast, sound, but poor coverage in general Based on symbolic execution: replace concrete inputs by symbolic inputs, extend semantics (add a “path condition” to each state, etc) build a search tree, solve constraints in leaves to produce test cases good coverage, huge search space (incompleteness), complex constraints should be simplified (unsoundness due to abstraction) Alternative: concolic testing Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 3 / 25
Introduction Test-case generation for automatic software testing Random input data: the most used approach simple, fast, sound, but poor coverage in general Based on symbolic execution: replace concrete inputs by symbolic inputs, extend semantics (add a “path condition” to each state, etc) build a search tree, solve constraints in leaves to produce test cases good coverage, huge search space (incompleteness), complex constraints should be simplified (unsoundness due to abstraction) Alternative: concolic testing Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 3 / 25
Introduction Test-case generation for automatic software testing Random input data: the most used approach simple, fast, sound, but poor coverage in general Based on symbolic execution: replace concrete inputs by symbolic inputs, extend semantics (add a “path condition” to each state, etc) build a search tree, solve constraints in leaves to produce test cases good coverage, huge search space (incompleteness), complex constraints should be simplified (unsoundness due to abstraction) Alternative: concolic testing Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 3 / 25
Introduction Concolic testing Very popular in imperative and OO programming languages Java PathFinder (NASA), Cute and jCute (UIUC), Klee,... Useful for test case generation debugging ... Concolic stands for concrete + symbolic execution Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 4 / 25
Introduction Concolic testing Very popular in imperative and OO programming languages Java PathFinder (NASA), Cute and jCute (UIUC), Klee,... Useful for test case generation debugging ... Concolic stands for concrete + symbolic execution Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 4 / 25
� � � � � � Introduction Concolic testing: basic idea Let s 0 be a concrete state Let α 0 be a symbolic state α 0 s 0 − α 0 similar to s 0 but inputs unknown c 1 − symbolic exec. mimicks the concrete one s 1 α 1 − c 1 , . . . , c 4 constraints on the symb. values c 2 − computing alternative (concrete) states: α 2 s 2 c 3 s ′ ¬ c 1 ⇒ 0 s ′′ c 1 ∧ ¬ c 2 ⇒ � α 3 � s 3 0 s ′′′ c 1 ∧ c 2 ∧ ¬ c 3 ⇒ 0 c 4 . . . α 4 s 4 Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 5 / 25
� � � � � � Introduction Concolic testing: basic idea Let s 0 be a concrete state Let α 0 be a symbolic state α 0 s 0 − α 0 similar to s 0 but inputs unknown c 1 − symbolic exec. mimicks the concrete one s 1 α 1 − c 1 , . . . , c 4 constraints on the symb. values c 2 − computing alternative (concrete) states: α 2 s 2 c 3 s ′ ¬ c 1 ⇒ 0 s ′′ c 1 ∧ ¬ c 2 ⇒ � α 3 � s 3 0 s ′′′ c 1 ∧ c 2 ∧ ¬ c 3 ⇒ 0 c 4 . . . α 4 s 4 Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 5 / 25
� � � � � Introduction main ( X , Y ) main (2 , 3) if ( X > 0) if ( X > 0) c 1 ≡ X > 0 if ( Y < 0) if ( Y < 0) c 2 ≡ Y ≥ 0 � skip skip New test cases: ¬ c 1 ≡ ¬ ( X > 0) ≡ X ≤ 0 ⇒ main (0 , 3) c 1 ∧ ¬ c 2 ≡ ( X > 0) ∧ ¬ ( Y ≥ 0) ⇒ main (2 , − 1) Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 6 / 25
� � � � � Introduction main ( X , Y ) main (2 , 3) if ( X > 0) if ( X > 0) c 1 ≡ X > 0 if ( Y < 0) if ( Y < 0) c 2 ≡ Y ≥ 0 � skip skip New test cases: ¬ c 1 ≡ ¬ ( X > 0) ≡ X ≤ 0 ⇒ main (0 , 3) c 1 ∧ ¬ c 2 ≡ ( X > 0) ∧ ¬ ( Y ≥ 0) ⇒ main (2 , − 1) Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 6 / 25
� � � � � Introduction main ( X , Y ) main (2 , 3) if ( X > 0) if ( X > 0) c 1 ≡ X > 0 if ( Y < 0) if ( Y < 0) c 2 ≡ Y ≥ 0 � skip skip New test cases: ¬ c 1 ≡ ¬ ( X > 0) ≡ X ≤ 0 ⇒ main (0 , 3) c 1 ∧ ¬ c 2 ≡ ( X > 0) ∧ ¬ ( Y ≥ 0) ⇒ main (2 , − 1) Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 6 / 25
� � � � � Introduction main ( X , Y ) main (2 , 3) if ( X > 0) if ( X > 0) c 1 ≡ X > 0 if ( Y < 0) if ( Y < 0) c 2 ≡ Y ≥ 0 � skip skip New test cases: ¬ c 1 ≡ ¬ ( X > 0) ≡ X ≤ 0 ⇒ main (0 , 3) c 1 ∧ ¬ c 2 ≡ ( X > 0) ∧ ¬ ( Y ≥ 0) ⇒ main (2 , − 1) Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 6 / 25
Introduction Concolic testing in LP The good news concrete execution = symbolic execution Main differences unification, nondeterminism and backtracking the way input data to explore alternative paths is computed [ICLP 2015] Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 7 / 25
Introduction Concolic testing in LP The good news concrete execution = symbolic execution Main differences unification, nondeterminism and backtracking the way input data to explore alternative paths is computed [ICLP 2015] Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 7 / 25
Introduction Concolic execution in LP ( ℓ 1 ) p ( s ( a )) . ( ℓ 4 ) q ( a ) . ( ℓ 6 ) r ( a ) . ( ℓ 2 ) p ( s ( W )) ← q ( W ) . ( ℓ 5 ) q ( b ) . ( ℓ 7 ) r ( c ) . ( ℓ 3 ) p ( f ( X )) ← r ( X ) . A concolic execution for, e.g., p ( f ( a )) will combine a concrete execution p ( f ( a )) → id r ( a ) → id true with a symbolic execution for p ( N ): p ( N ) → { N / f ( Y ) } r ( Y ) → { Y / a } true that mimicks the steps of the former derivation despite being more general Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 8 / 25
Introduction The concolic execution actually looks like � p ( f ( a )) id ] [ p ( N ) id � ❀ c ( { ℓ 3 } , { ℓ 1 ,ℓ 2 ,ℓ 3 } ) � r ( a ) id ] [ r ( Y ) { N / f ( Y ) } � � true id ] [ true { N / f ( a ) } � ❀ c ( { ℓ 6 } , { ℓ 6 ,ℓ 7 } ) Choice steps store the labels of the clauses that unified with each concrete and symbolic goals Therefore, when looking for new run time goals that explore alternative paths, one should look for instances of p ( N ) that unify with {} , ✞ ☎ Selective Unification { ℓ 1 } , ✝ ✆ { ℓ 1 , ℓ 2 } , p(N) Atom A Positive atoms H + p(s(a)) { ℓ 1 , ℓ 2 , ℓ 3 } , Negative atoms H − p(s(W)), p(f(X)) { ℓ 2 } , . . . Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 9 / 25
Introduction The concolic execution actually looks like � p ( f ( a )) id ] [ p ( N ) id � ❀ c ( { ℓ 3 } , { ℓ 1 ,ℓ 2 ,ℓ 3 } ) � r ( a ) id ] [ r ( Y ) { N / f ( Y ) } � � true id ] [ true { N / f ( a ) } � ❀ c ( { ℓ 6 } , { ℓ 6 ,ℓ 7 } ) Choice steps store the labels of the clauses that unified with each concrete and symbolic goals Therefore, when looking for new run time goals that explore alternative paths, one should look for instances of p ( N ) that unify with {} , ✞ ☎ Selective Unification { ℓ 1 } , ✝ ✆ { ℓ 1 , ℓ 2 } , p(N) Atom A Positive atoms H + p(s(a)) { ℓ 1 , ℓ 2 , ℓ 3 } , Negative atoms H − p(s(W)), p(f(X)) { ℓ 2 } , . . . Fred Mesnard (U. of R´ eunion Island, France) Selective Unification in CLP PPDP 2017, Namur 9 / 25
Recommend
More recommend
