Compact Symbolic Execution (technical report)

0.31 MB·English

by  Marek Trtík

Compact Symbolic Execution
Marek Trt´ık
Faculty of Informatics, Masaryk University,Brno, Czech Republic
[email protected]
2
1
0 Abstract. We present a generalisation of King’s symbolic execution
2 technique called compact symbolic execution. It is based on a concept
n of templates: a template is a declarative parametric description of such
a a program part, generating paths in symbolic execution tree with regu-
J larities inprogramstatesalongthem.Typicalsourcesofthesepathsare

9 program loops and recursive calls. Using the templates we fold the cor-
2 responding paths into single vertices and therefore considerably reduce
sizeofthetreewithoutlossofanyinformation.Thereareevenprograms

] for which compact symbolic execution trees are finite even though the
E
classic symbolic execution trees are infinite.
S
.
s
c 1 Introduction
[

1 Classic symbolic execution as proposed by King in 1976 [8] systematically ex-
v plores all real paths in an analysed program. There is typically huge (or even
3
infinite) number of real paths even for very small and simple programs. There-
3
fore, exploration of the real paths becomes a serious problem. We speak about
0
6 the path explosion problem.
. Compact symbolic execution also explores all real program paths, but in a
1
0 very compact manner. We analyse a given programbefore we start its symbolic
2 execution. We look for those parts of the program, which might produce real
1 paths with some regularities in program states along them. Typically, program
:
v loops and recursion produces these regularities. We analyse the program parts
i independently from the remainder of the program.If the analysis of a part suc-
X
ceeds,thena resultis atemplate, i.e.a declarativeparametricdescriptionofthe
r
completebehaviouroftheanalysedpart.Therefore,anoutputfromtheprogram
a
analysisisasetoftemplates.Nowwecanexecutetheprogramsymbolicallywith
the templates. Until we reach some of the successfully analysed program parts,
we proceed just like in classic symbolic execution. Let us now suppose we have
justreachedsuchapart.Havingatemplateforthepart,wedonotneedtosym-
bolically execute interior of the part. We just instantiate the template into the
end of the current path and then we jump behind the part, where we continue
with classic symbolic execution again.
Let us consider a symbolic execution reaching a loop. The execution may
fork into a huge number of other symbolic executions during the execution of
the loop. Each such execution has its own path in symbolic execution tree of
classic symbolic execution. But having a template for the loop, we represent
all these paths by a single one with the instantiated template. In other words,
a single path explored by compact symbolic execution may represent a huge
number of paths explored by classic symbolic execution. And that is the cause
of the considerable space savings of compact symbolic execution. On the other
hand, we will see that compact symbolic execution has higher requirements to
performance of SMT solvers then classic one.
The worst case for compact symbolic execution is, when we fail to compute
any template for a givenprogram.Compact symbolic execution then reduces to
classic one, and we gain no space savings.
2 Overview
In this section we give an intuition of compact symbolic execution. For simplic-
ity of presentation we use the following definition of a program. Although our
programs are simple they support typical imperative constructs and recursion.
Definition 1 (Program) A program is a collection of functions and global
variables. Each function has its own local variables. All program variables and
functions have different names. Exactly one function is marked as starting one.
Each function is represented as an oriented graph. Vertices in the graph identify
program locations, while edges define transitions between them. We distinguish a
single entryand exit location in each graph. There is noin-edge toentrylocation
and there is no out-edge from the exit one. We label edges by actions to be taken
when moving between connected locations. An action can be
(1) An assignment of the form <variable>:=<expression>,
(2) Call by value statements
(a) <variable>:=<function-name>(<arg-list>), or
(b) <function-name>(<arg-list>)
(3) A return value statement ret <expression>,
(4) skip statement, which does nothing, or
(5) A boolean expression over program variables.
If an edge e=(u,v)is labelled byone of theactions (1)-(4), then out-degreeof u
is 1. Otherwise, label of e is an action (5), out-degree of u is 2 and its out-edges
are labelled by boolean expressions γ and ¬γ. No action (2) can reference the
starting function and no entry nor exit location is incident with an edge having
an action (2). Each function f is assigned a unique global variable ret used
f
for actions (2a) to save a return value being later assigned to the destination
variable. Andfor simplicity we do not consider pointer arithmetic nor heap allo-
cations. We prevent invalid operations in actions (like division by zero, etc.) by
branchings into error locations. An error location is any location with a single
out-edge heading back to that location and it is labelled with skip action.
We can see an example of a program at Figure 1 (a). The depicted function
linSrchreturnsthe leastindexiintothearrayAsuchthatA[i]==x.If xisnot
in A at all, then it returns -1.
2
We first briefly describe classic symbolic execution as proposed by King [8].
Insteadofpassingconcretedataintoparametersofthestartingfunction,wepass
symbols from a set {α ,α ,...}. Let us suppose we pass symbols α and α to
0 1 0 1
variables a and b respectively. After executing an action c:=2*a+b the variable
cwillcontainasymbolic expression 2α +α asitsvalue. Symbolic memory isa
0 1
function θ from program variables to a set of symbolic expressions. We further
maintain a boolean symbolic expression ϕ called path condition. It represent a
complete identifier ofa particularprogrampath takenduring anexecution. ϕ is
initially true andit canbe updated atprogrambranchings.Let θ be a symbolic
memory having θ(a)=α , θ(b)=α and θ(c)=2α +α and let c-a>2*band
0 1 0 1
c-a<=2*bbeactionsofout-edgesofanbranchinglocation.Forthefirstactionwe
proceedasfollows.We evaluatethe actioninθ.Theresultisabooleansymbolic
expression α +α > 2α . If ϕ → (α +α > 2α ) is satisfiable, we update
0 1 1 0 1 1
ϕ to ϕ∧(α +α > 2α ) and we continue the execution by crossing the edge
0 1 1
having the action. Then we proceed similarly for the second action. Note that
if both implications are satisfiable, we fork the execution into two parallel and
independent executions. Besides a symbolic memory and a path condition we
commonly have a call stack Ξ and we also need to identify a current program
locationl.Putting allthe things togetherwe geta program state representedby
atuples=(θ,ϕ,Ξ,l).Notethatweunderstandacallstackrecordaspairs(σ,l),
where l is a return locationand σ is a restrictionof a symbolic memory to local
variables. Further, we commonly describe the symbolic execution of a program
byatreestructurecalledsymbolic execution tree.Verticesofthe treearerelated
to program locations visited during the execution and edges reflect transitions
between the locations. Each vertex of the tree is labelled by a related program
state.But insteadoflabels T andF for branchingedges(as proposedby King),
welabelthembyevaluatedactionsofthebranchingedges.Figure1(b)depictsa
partof symbolic execution tree of the example programfromFigure 1 (a) (with
omitted programstates labelling the vertices). Please ignore grey regions in the
tree for now. We assume that classic symbolic execution of the programstarted
with an initial symbolic memory θ ={(i,α ),(n,α ),(x,α ),(A,α )}.
0 1 2 3
We often use the following dot-notation to access elements of tuples. If s =
(θ,ϕ,Ξ,l)isaprogramstate,thens.θ denotesitssymbolicmemory,s.ϕdenotes
its path condition, s.Ξ is its call stack and s.l is a current program location.
Further, if u is a vertex of symbolic execution tree, then u.s denotes program
state labellingthe vertex.Andinsteadofu.s.θ,u.s.ϕ, u.s.Ξ andu.s.l we simply
write u.θ, u.ϕ, u.Ξ andu.l.Finally, ifΞ is acallstackthen we use dot-notation
to access record at the top of the call stack. So, for example Ξ.l denotes return
location of record at the top of Ξ.
Symbols {α ,α ,...} in classic symbolic execution represent input values
0 1
to whole program. We generalise this concept to allow independent symbolic
executionofparts ofananalysedprogramindependentlytotheremainder.Each
such a part uses the symbols {α ,α ,...} relative to a chosen entry location to
0 1
the part. Then using a composition of program states (defined later) we can
expressanyrunofclassicsymbolicexecutionasacompositionofprogramstates
3
resulting from analyses of the parts. Let s = (θ,ϕ,Ξ,l) be a program state
resulting from a symbolic execution from a program location l (e.g. the entry
0
location of the starting function), up to an entry location l of an independently
analysedprogrampart.Lets′ =(θ′,ϕ′,Ξ′,l′)be aprogramstateresultingfrom
the analysis of the part, i.e. s′ represents a symbolic execution from the entry
location l to some exit location l′ from the part. Then s ◦ s′ = (θ ◦ θ′,ϕ ∧
θhϕ′i,Ξ◦(θ◦Ξ′),l′)iscomposedprogramstaterepresentingsymbolicexecution
from l to l′ through the analysed part (entered in location l). We can see that
0
compositionofprogramstatesisimplementedascompositionoftheirindividual
components. We discuss very details of these operationsin Section 3. Only note
that composed path condition is ϕ∧θhϕ′i rather then ϕ∧ϕ′. This is because
ϕ′ may contain some symbols. But they are related to the entry location l of
the analysed part and not to the location l . Therefore, we have to compose ϕ′
0
with θ first to express ϕ′ in terms of symbols relative to location l . We do the
0
similar effect of shifting symbols from location l to l in the compositions θ◦θ′
0
and θ◦Ξ′.
a
a
0<α1 b 0≥α1
i:=0 α3(0)=α2 cα3(0)6=α2 f
i<n b i>=n e d
g
a
A[i]=x c ++i f g 1<α1 b 1≥α1
α3(1)=α2 cα3(1)6=α2 f b s
e A[i]!=x d e d g γe γf
ret -1
g b e s′e s′f f
ret i
g g g
(a) (b) (c)
Fig.1. (a) A program with a function linSrch(A,n,x). (b) Symbolic execution tree
of function linSrch. (c) Compact symbolic execution treeof function linSrch.
In symbolic execution tree at Figure 1 (b) there is a single path highlighted
by a sequence of grey regions. Vertices in each region are related to the same
sequence of program locations: b,c,d,b. Moreover, we enter the path at vertex
referencinglocationb andwecanleavethe patheither bystepping intoavertex
referencing location e or into a vertex referencing location f. Let us denote the
entry vertex into the path as b and the exit vertices from the path referencing
0
locationseandf ase ,e ,... andf ,f ,... respectivelybeing indexedfromthe
0 1 0 1
top down. Our goal is to completely eliminate the path in grey from the tree,
while still representing all real programpaths. One way to do so is to represent
4
whole the path by a single vertex, b say, with two direct successors. The first
successor,e say,representsallthe exit verticese fromthe path andthe second,
i
f say,representingalltheexitsf .Notethatnamesoftheverticesb,eandf also
i
representprogramlocationstheyreference.Welabelthevertexbbytheprogram
state labelling b . But the question is what program states we should assign to
0
the vertices e and f. Note that two different vertices e and e may be labelled
i j
bydifferentprogramstates.So,forthe vertexewe needtointroduce aprogram
state e.sJκK, parametrised by a parameter κ, such that each program state e .s
i
can be equivalently expressed by e.sJκK, when κ is substituted by some number
ν. Ofcourse,fordifferent states e .s ande .s there are differentnumbers,sayν
i j i
and ν , for parameter substitution. We similarly need a parametrised program
j
state f.sJκK for the vertex f. We compute the states e.sJκK and f.sJκK before
we start symbolic execution of the program from the Figure 1 (a) by analysing
the following its part. The part consists of all the locations b,c,d,e,f discussed
above and of all the edges between them. Note that the sequence b,c,d,b of
locations forms a cyclic path inside the analysedpart. This cycle is actually the
source of the path in grey regions. Nevertheless, we want to describe program
statesatexits formthepart.Theexitsfromthe partaretargetverticesofthose
edges of the part, which do not belong to the cycle. Therefore, locations e and
f are the exits from the part. We also identify the location b as entry location
intothepart,sincewecanenterthepartbysteppingintolocationb.Thepartis
completely defined now.We analyse it independently from the remainder of the
program. It mainly means that if we use some symbols α in the analysis, then
i
they are relatedto the entry locationb of the partandnotto the entry location
of the whole program. At this point we are more concerned about formulation
of a result from the analysis and its usage then the analysis itself. Therefore,
we postpone its description to Section 5. We assume here that key properties
e.sJκK and f.sJκK from the analysis are already computed, so we may formulate
an output from the analysis of the part as the following template
t=(b,2,{(θ ,ϕ ,[],e)JκK,(θ ,ϕ ,[],f)JκK}),
e e f f
wherebistheentrylocationtotheanalysedpart,thenumber2identifiesnumber
of following parametrised program states and the remaining two tuples are the
parametrisedprogramstatese.sJκKandf.sJκKrespectively.Notethat[]identifies
empty call stack. The template contains all the information we need to build
compact symbolic execution tree, where the path in grey is folded as described
above.
Let us symbolically execute the program at Figure 1 (a) with the template
t. We construct a compact symbolic execution tree during the execution. The
tree is depicted at Figure 1 (c). We apply classic symbolic execution, until we
reach the entry location t.b. Let b be the vertex in the tree, when we reach the
locationt.bandletsbetheprogramstateb.s.We nowinstantiatethe template.
Since we have exactly two program states in t, we create exactly two successor
vertices e and f of the vertex b in the tree. The vertices e and f references lo-
cations t.e and t.f respectively and they are further labelled by program states
5
s ◦ (t.θ , t.ϕ , [], t.e)JκK and s ◦ (t.θ , t.ϕ , [], t.f)JκK respectively. We
e e f f
finish the instantiation of t by creating edges (b,e) and (b,f) labelled by sym-
bolicexpressionss.θht.ϕ JκKiands.θht.ϕ JκKirespectively.Thesituationisalso
e f
depicted at Figure 1 (c). Then we continue from both vertices e and f inde-
pendentlyusingclassicsymbolicexecutionagain.Thesebothexecutionsreaches
functionexitlocationg inonestepandcompactsymbolicexecutionterminates.
Let us now have a look at Figure 2 (a) depicting a programwith a function
countIf.ThefunctioncountsnumberofelementsinarrayAhavingvaluesequal
tox.WeshowthesymbolicexecutiontreeoftheprogramatFigure2(b).There
wecanseeseveralsequencesofgreyregions.Accordingtoourexperiencewiththe
previous example we can easily detect that all that paths in grey are generated
by a single program part consisting of locations c,d,e,f,g and edges between
them. But there are two cyclic paths π = c,d,e,f,c and π′ = c,d,f,c inside
the part.Nevertheless,the greyregionshighlightonlythe cycle π.So,weignore
the cycle π′ and π is therefore the only cycle we consider.The remainderis now
obvious.Thelocationsf andg areexitsfromthepartandcistheentrylocation
into the part. The analysis of the path (discussed later in Section 5) computes
the following template
t=(c,2,{(θ ,ϕ ,[],f)JκK,(θ ,ϕ ,[],g)JκK})
f f g g
Compact symbolic execution with the template t computes compact symbolic
executiontreedepictedatFigure2(c).Thetreeisbasicallyasinglelinklist.Note
thatwe instantiate the template eachtime we reachthe locationc.Butfor each
suchinstantiationweneedafreshparametertopreventparametercollisionsfrom
previous instantiations. We assume we have infinitely many different names for
theparameters.Therefore,expressionsandprogramstatesatFigure2(c)areas
follows: γi = si.θht.ϕ Jκ Ki, γi = si.θht.ϕ Jκ Ki, si = si.θ◦(t.θ ,t.ϕ ,[],g)Jκ K
g c g i f c f i g c g g i
and si =si.θ◦(t.θ ,t.ϕ ,[],f)Jκ K.
f c f f i
The sequences of grey regions in the tree at Figure 2 (b) goes bottom left.
But imagine they would go bottom right. Then each region would represent a
sequence of program locations c,d,f,c. If we analysed closer these sequences of
grey regions, we would realise that there is a part of the program from Fig-
ure 2 (a) consisting of vertices c,d,f,e,g, where c,d,f,c is the only cycle in the
part, c is the entry location into the part and locations e and g are exits from
the part. If we further built a template from the part and run compact sym-
bolicexecutionwithit,wewouldalsoreceiveacompactsymbolicexecutiontree
forming basically a single linked list.
Besides cyclic paths, recursive calls also produce real program paths with
regularities in program states along them. At Figure 3 (a) there is a recursive
function linSrchRecwhich is equivalent to the function linSrch discussed be-
fore. Symbolic execution tree of the function is depicted at Figure 3 (b). The
root of the tree is the left-most vertex referencing program location a. There
are two sequences of grey regions. The top sequence represents recursive calls,
while the bottom sequence represents returning from the calls. We see that top
sequence goes from left to the right. The bottom sequence goes in the opposite
6
a
a
k:=0
b
b γ1
i:=0 s1g g g c s1
γ1
i<n c i>=n h f sf1
f
γ2
d ++i g s2g g g c s2
A[i]=x γ2
A[i]!=x ret k h f sf2
f
e f
++k h
(a) (c)
a
b
c0≥α1g h
0<α1
α3(0)=α2 d α3(0)6=α2
e f
f c1≥α1g h
c1≥α1g h α3(1)1=<αα21d α3(1)6=α2
1<α1 e f
α3(1)=α2 d α3(1)6=α2
e f f c2≥α1g h
f c2≥α1g h c2≥α1g α3(2)2=<αα21d α3(2)6=α2
c2≥α1g α3(2)2=<αα21d α3(2)2=<αα21d h e f
2<α1 e αf3(2)6=α2e αf3(2)6=α2 f c
α3(2)=α2 d h
α3(2)6=α2
e f f c f c c
f c c c
c
(b)
Fig.2. (a) A program with a function countIf(A,n,x). (b) Symbolic execution tree
of function countIf. (c) Compact symbolic execution treeof function countIf.
direction.Wecanfurtherseethereisonetoonecorrespondencebetweenregions
ofbothsequences.Beloweachregioninthetopsequence,thereisasingleregion
of bottom sequence. Paths in both sequences of regions are connected in the
7
a
i<n i>=n
f f
0≥α1 1≥α1
b f
a a
A[i]=x
A[i]!=x α3(0)=α2 0<α1 α3(0)=α2 1<α1
c e α3e(0)6=α2b α3e(1)6=α2b γf a γe
t:=linSrch( ret i c c f sf e se
A,i+1,n,x) ret -1
d d g s1 g s2
d
ret t g g g g s1 g s2
g g
(a) (b) (c)
Fig.3.(a)Aprogram witharecursivefunctionlinSrch(A,i,n,x). (b)Symbolicexe-
cution tree of the recursive function linSrch. (c) Compact symbolic execution tree of
therecursive function linSrch.
tree. But this is not shown in the figure. The connection happens, when all the
recursivecallsaredoneandsomebasiccaseisexecutedintherecursivefunction.
Then we get to the path of the bottom regions.
Letus firstfocus onthe pathatthe topsequence ofregions.Vertices ineach
regionarerelatedtothesamesequenceofprogramlocations:a,b,c,a.Moreover,
we enter the path in a vertex referencing location a and we can leave the path
eitherbysteppingintoavertexreferencinglocationf orintoavertexreferencing
locatione.Ifwelookattheprogram(atFigure3(a)),thesequencea,b,c,aforms
a cyclic path in it. Of course, the edge (c,a) is not explicit in the program. But
we consider it as a meta-edge labelled by an action simulating the effect of the
function call, as defined by action of edge (c,d). We now define a programpart,
say P , consisting of the cyclic path, the entry location a and two exit locations
1
f ande.Thepartrepresentthe phaseofrecursivecallsofthe functionlinSrch.
Nowwesimilarlyanalysethepathinbottomsequenceofregions.Eachregion
repeats the same sequence of program locations g,d,g. The path is entered in
vertex referencing location g, but there is no exit from the path. The sequence
g,d,g of locations forms a cyclic path in the program (at Figure 3 (a)). Note,
thatweassumethereisanartificialedge(g,d)enclosingthecycle.Actionofthis
edgeissupposedtosimulatetheeffectofreturnfromthefunctioncall,asdefined
by action of edge (c,d). We want to define a program part P representing the
2
phase of returning from recursive calls. We have the cyclic path and we have
the entry location g to the part. But there is no exit from the part. Obviously,
the recursive calls ends in location g, where we leave the function. Therefore,
our exit location is g and we have the program part P . Note that if we want
2
to formally match the exit location detection algorithm introduced for previous
examples, we may imagine there is an edge from g back to g and labelled by
skip action.
8
Forthe programpartsP andP wecompute the followingtemplates t and
1 2 1
t as described in the previous examples.
1
t =(a,2,{(θ ,ϕ ,[],f)JκK,(θ ,ϕ ,[],e)JκK})
1 f f e e
t =(g,1,{(θ JκK,true,[],g)}).
2 g
Notethatthepathconditionoft issimplytrue,sincewecannotescapefromthe
2
path.Inotherwords,asthereisnobranchingalongthepath,thepathcondition
cannot be updated from its initial value true. It is important to note, that both
templatesuseexactlythesameparameter.Theuseofthesameparametercreates
a link between the number of recursive calls and number of returns from them.
Having the templates we are able to formulate the template t for the recursive
function linSrchRec.
t=(a,2,{(θ ,ϕ ,[],f)JκK,(θ ,ϕ ,[],e)JκK},θ JκK,g)
f f e e g
Thetemplatetcontainswholethetemplatet ,butittookonlysymbolicmemory
1
θ and the exit location g from the template t .
g 2
Wearereadytostartcompactsymbolicexecutionwiththetemplatet.Sym-
bolic execution tree for the program is depicted at Figure 3 (c). First we step
into the program location a. The tree contains only the root vertex referenc-
ing location a. The location a is the entry location of t. Hence, we instantiate
the first part of t (related to phase of recursive calls, i.e. related to t ) into the
1
tree. The number 2 in t identifies, that the root will have two successor ver-
tices referencing locations f and e and they will be labelled by program states
s = (θ ,ϕ ,[(t,κ)] ◦ [],f)JκK and s = (θ ,ϕ ,[(t,κ)] ◦ [],e)JκK respectively.
f f f e e e
Note that we omitted composition of these states with the initial programstate
labelling the root. We could do that, since composition of initial program state
with any other state produces the other state again. Also note that call stacks
of both states (i.e. []) are composed with a call stack containing a single special
record of the form (t,κ). This type of call stack record is introduced only for
templates of recursive functions. First of all, this single record represents any
number of subsequent recursive calls done by classic symbolic execution. And
the record also saves reference to the template t and the parameter κ used in
the instantiation.Wenote thatedgesfromthe rootto itssuccessorsarelabelled
by expressions γ ≡ t.ϕ JκK and γ ≡ t.ϕ JκK. Having computed successors of
f f e e
the root, we continue by classic symbolic execution independently from both
of these vertices, until we reach the location g. For both the executions we do
the same think at the location g. Let us consider execution continuing from the
successor referencing location f. We need to instantiate the second part of the
template representingreturnsfromthe recursivecalls.So,we removethe record
(t,κ) fromthe topofthe callstack,but we takethe template t andthe parame-
ter κ stored in the record (t,κ). In general, between both instantiation parts of
a given template, there might be executed any code, there can be instantiated
many other templates and there can even be instantiated the same template
several times always with different (fresh) parameters. That is why we save the
template and the parameter in the stack record. Let s be a program state of
1
9
the current leaf vertex of the tree. We create its only successor vertex labelled
with program state s1 = (s .θ ◦t.θJκ K,s .ϕ,[],g). We see that there are two
g 1 1 1
differencesbetweenstatess ands1.Firstofallcallstackofs1 doesnotcontain
1 g g
the special record (t,κ) as we have popped it from the stack. And second, the
symbolicmemoryofs1 isthecompositions .θ◦t.θJκ K.Furtherclassicsymbolic
g 1 1
execution form the vertex terminates, since we are leaving exit location of the
starting function. We proceed similarly for the other run of symbolic execution
(from the second successor of the root), where we get the final program state
s2 =(s .θ◦t.θJκK,s .ϕ,[],g).
g 2 2
To summarise, a general scheme for compact symbolic execution of the ex-
amples above is as follows. We enumerate parts in a given program producing
paths with regularities in program states along them. Such sources are mainly
cyclic paths and pairs of cyclic paths representing recursion. For each enumer-
ated part we compute a template. Then we run compact symbolic execution
with the computed templates.
3 Definition
In this section, we give precise definition of templates parametrised by a single
parameter. Templates for recursion consists of two parts instantiated indepen-
dently into symbolic execution tree. These instances share the same parameter.
We therefore show a process of information passing between different instances
ofthe same template.And we further presentcompactsymbolic executionalgo-
rithm using templates with one parameter with possible information exchange
between instances.We startwith basic terms valid for compactsymbolic execu-
tion with any kinds of templates. We assume for the rest of this section that P
is a program.
An injective function Θ from a set of all program variables of P to a set of
symbols {α ,α ,α ,...} is an initial symbolic memory of P. For each program
0 1 2
variable a its symbol Θ(a) represents some yet unknown value of that variable.
So, Θ(a) must belong to a domain of a (i.e. Θ(a) is of a’s type). Further, nu-
meric symbolic expression is application of operators to numeric constants and
symbols. Boolean symbolic expression is either an equality or inequality predi-
cate over numeric symbolic expressions, or an application of logical connectives
to other boolean symbolic expressions. Symbolic expression is either numeric or
boolean symbolic expression. We have already given the definition of symbolic
memory, call stack and program state in Section 2. But we in addition define
for any programstate s=(θ,ϕ,Ξ,l) that θ(a)=Θ(a), for each local variable a
undefined at location l. Also note that Θ is just a special symbolic memory.
The pseudo-code of Algorithm 1 represents two algorithms. If we consider
only unmarked lines, we get algorithm of classic symbolic execution. If we add
lines markedwith (cid:3) we get algorithmof compact symbolic executionwith tem-
plates with a single parameter. The lines marked by ∗ are responsible for con-
struction of symbolic execution tree. Obviously, both classic and compact sym-
10