Symbolic Execution of Concurrent Objects in CLP

Concurrency has been with us almost from the beginning of computing. Managing and programming for concurrency is a difficult problem and various solutions have been suggested over the years. Debates on message passing vs. remote procedure call, synchronous vs. asynchronous message passing, bounded vs. unbounded buffers, active vs. passive objects etc. still continue. No solution is entirely satisfactory. Concurrent programming usually depends heavily on the nature of the problem at hand and the architecture of the target machine.

Symbolic execution is a powerful, systematic analysis that has received much visibility in the last decade. Scalability however remains a major challenge for symbolic execution. Compositional analysis is a well-known general purpose methodology for increasing scalability. This paper introduces a new approach for compositional symbolic execution. Our key insight is that we can summarize each analyzed method as a memoization tree that captures the crucial elements of symbolic execution, and leverage these memoization trees to efficiently replay the symbolic execution of the corresponding methods with respect to their calling contexts. Memoization trees offer a natural way to compose in the presence of heap operations, which cannot be dealt with by previous work that uses logical formulas as summaries for compositional symbolic execution. Our approach also enables efficient target oriented symbolic execution for error detection or program coverage. Initial experimental evaluation based on a prototype implementation in Symbolic Path Finder shows that our approach can be up to an order of magnitude faster than traditional non-compositional symbolic execution.

This paper presents ABS, an abstract behavioral specification language for designing executable models of distributed object-oriented systems. The language combines advanced concurrency and synchronization mechanisms for concurrent object groups with a functional language for modeling data. ABS uses asynchronous method calls, interfaces for encapsulation, and cooperative scheduling of method activations inside concurrent objects. This feature combination results in a concurrent object-oriented model which is inherently compositional. We discuss central design issues for ABS and formalize the type system and semantics of Core ABS, a calculus with the main features of ABS. For Core ABS, we prove a subject reduction property which shows that well-typedness is preserved during execution; in particular, “method not understood” errors do not occur at runtime for well-typed ABS models. Finally, we briefly discuss the tool support developed for ABS.

It is reported that Ada95 is a full object-oriented programming language. Ada95's task type mechanism could be considered as a model of a concurrent object-oriented problem solution. However, there is still a gap between the language constructions of Ada95 and the general O-O concept as well as description. The complexity of Loeper's (1997) template of Ada95 codes for concurrent object is convincing evidence. Based on Loeper's concurrent object template, the authors present a user description of concurrent object classes in the general O-O concept and the implementation of automatic generation of Ada95 codes from the description.

Verification of Concurrent Assembly Programs with a Petri Net Based Safety Policy

Modelling concurrent objects running on the TSO and ARMv8 memory models

Embedded specifications in object-oriented (OO) languages such as Eiffel and Sather are based on a rigorous approach towards validation, compatibility and reusability of sequential programs. The underlying method of design-by-contract is based on Hoare logic for which concurrency extensions exist. However concurrent OO languages are still in their infancy. They have inherently imperative facets, such as object identity, sharing, and synchronisation, which cannot be ignored in the semantics. Any marriage of objects and concurrency requires a trade-off in a space of intertwined qualities. The paper summarises our work on a type system, calculus and an operational model for concurrent objects in a minimal extension of the Eiffel and Sather languages (cSather). We omit concurrency control constructs and instead use assertions as synchronisation constraints for asynchronous functions. We show that this provides a framework in which subtyping and concurrency can coexist.

Floating-point programs are challenging for symbolic execution due to the constraint solving problem. To investigate the effectiveness and limitations of the existing methods, we conduct the first empirical study in this paper on five existing symbolic execution methods for floating-point programs. We have implemented the existing methods on the state-of-the-art symbolic execution KLEE and use the real-world representative floatingpoint programs as the benchmarks, which are used to evaluate the existing methods with respect to code coverage and bug finding. The results indicate that the existing methods complement each other in bug finding. Based on the findings of the experimental results, we propose synergizing the existing methods to improve symbolic execution‘s effectiveness. The experimental results demonstrate that our synergic method can detect more bugs.

Symbolic execution is being successfully used to automatically test statically compiled code. However, increasingly more systems and applications are written in dynamic interpreted languages like Python. Building a new symbolic execution engine is a monumental effort, and so is keeping it up-to-date as the target language evolves. Furthermore, ambiguous language specifications lead to their implementation in a symbolic execution engine potentially differing from the production interpreter in subtle ways. We address these challenges by flipping the problem and using the interpreter itself as a specification of the language semantics. We present a recipe and tool (called Chef) for turning a vanilla interpreter into a sound and complete symbolic execution engine. Chef symbolically executes the target program by symbolically executing the interpreter's binary while exploiting inferred knowledge about the program's high-level structure. Using Chef, we developed a symbolic execution engine for Python in 5 person-days and one for Lua in 3 person-days. They offer complete and faithful coverage of language features in a way that keeps up with future language versions at near-zero cost. Chef-produced engines are up to 1000 times more performant than if directly executing the interpreter symbolically without Chef.

Creol is an object-oriented modeling language in which inherently concurrent objects exchange asynchronous method calls. The operational semantics of Creol is written in an actor-based style, formulated in rewriting logic. The operational semantics yields a language interpreter in the Maude system, which can be used to analyze models. Recently, Creol has been applied to the modeling of systems with radio communication, such as sensor systems. With radio communication, messages expire and, if sent simultaneously, they may collide in the air. In order to capture these and other properties of distributed systems, we extended Creol's operational semantics with a notion of time. We exploit the framework of a language interpreter to use a lightweight notion of time, in contrast to that needed for a general purpose specification language. This paper presents a timed extension of Creol, including the semantics and the implementation strategy, and discusses its properties using an extended example. The approach can be generalized to other concurrent object or actor-based systems.

Multi-core processors are present in everyone's daily life. Consequently, concurrent programming has reemerged as a pressing concern for everyone interested in exploring all the potential computational power in these machines. But, the emergence of new concurrency models and programming languages also brings new challenges in terms of how one can deal with abnormal occurrences, much due to the heterogenous parallel control flow. Unexpectedly, sequential Exception Handling models remain as the most used tool for robustness, even in the most recent concurrent programming languages. Though, the appearance of more complex models, such as programming languages with implicit concurrency, might pose a challenge too big for these sequential mechanisms. In this article we will provide evidences why such models are not generally suited to deal with faults in programs with implicit concurrency and, in the light of more recent advances in concurrent Exception Handling, we will discuss the attributes of a model for addressing this problem.

Background Software developers are increasingly required to write concurrent code. However, most developers find concurrent programming difficult. To better help developers, it is imperative to understand their interest and difficulties in terms of concurrency topics they encounter often when writing concurrent code.Aims In this work, we conduct a large-scale study on the textual content of the entirety of Stack Overflow to understand the interests and difficulties of concurrency developers.Method First, we develop a set of concurrency tags to extract concurrency questions that developers ask. Second, we use latent Dirichlet allocation (LDA) topic modeling and an open card sort to manually determine the topics of these questions. Third, we construct a topic hierarchy by repeated grouping of similar topics into categories and lower level categories into higher level categories. Fourth, we investigate the coincidence of our concurrency topics with findings of previous work. Fifth, we measure the popularity and difficulty of our concurrency topics and analyze their correlation. Finally, we discuss the implications of our findings.Results A few findings of our study are the following. (1) Developers ask questions about a broad spectrum of concurrency topics ranging from multithreading to parallel computing, mobile concurrency to web concurrency and memory consistency to run-time speedup. (2) These questions can be grouped into a hierarchy with eight major categories: concurrency models, programming paradigms, correctness, debugging, basic concepts, persistence, performance and GUI. (3) Developers ask more about correctness of their concurrent programs than performance. (4) Concurrency questions about thread safety and database management systems are among the most popular and the most difficult, respectively. (5) Difficulty and popularity of concurrency topics are negatively correlated.Conclusions The results of our study can not only help concurrency developers but also concurrency educators and researchers to better decide where to focus their efforts, by trading off one concurrency topic against another.

The authors present the issues in concurrent program execution, and survey some of the current research in this area. Programs for multiprocessor systems require a completely different approach from those for uniprocessor systems. The effective use of multiprocessor systems requires a program representation which clearly indicates sections (tasks) that can be executed concurrently, mechanisms for synchronizing these different concurrent modules, methods for ensuring data integrity, and algorithms that schedule and allocate these modules to the available processors efficiently. Most current work in these areas make very limiting assumptions about the nature of the program, or the nature of the underlying hardware architecture, so that they are not truly flexible. >

Symbolic execution of Android applications is challenging as it involves either building a customized VM for Android or modeling the Android libraries. Since the Android Runtime evolves from one version to another, building a high-fidelity symbolic execution engine involves modeling the effect of the libraries and their evolved versions. Without simulating the behavior of Android libraries, path divergence may occur due to constraint loss when the symbolic values flow into Android framework and these values later affect the subsequent path taken. Previous works such as JPF-Android have relied on the modeling of execution environment such as libraries. In this work, we build a dynamic symbolic execution engine for Android apps, without any manual modeling of execution environment. Environment (or library) dependent control flow decisions in the application will trigger an on-demand program synthesis step to automatically deduce a representation of the library.This representation is refined on-the-fly by running the corresponding library multiple times.The overarching goal of the refinement is to enhance behavioral coverage and to alleviate the path divergence problem during symbolic execution. Moreover, our library synthesis can be made context-specific. Compared to traditional synthesis approaches which aim to synthesize the complete library code, our context-specific synthesis engine can generate more precise expressions for a given context. The evaluation of our dynamic symbolic execution engine, built on top of JDART, shows that the library models obtained from program synthesis are often more accurate than the semi-manual models in JPF-Android. Furthermore, our symbolic execution engine could reach more branch targets, as compared to using the JPF-Android models.

Symbolic execution [1] is an effective technique that is commonly used to analyse sequential [2, 3] and concurrent programs. However, when baseline symbolic algorithm is applied to system testing of multithreaded programs [4, 5, 6], the performance is limited by the space explosion problem [7, 8] of thread interleavings. Such a space explosion problem is raised by trying to explore all impossible interleavings that are intra-thread and inter-thread; this is due to the exponentially increment of the number of all possible thread interleavings which is influenced by the increase of the sum of threads. Many techniques have been proposed to address this problem, including the hybrid execution [9, 10, 20], the use of function summaries [11], the dependence analysis [12], partial order reduction [13, 14, 15, 21], and lazy annotation [16]. We present a framework named SYMAC that combined the symbolic algorithm with the hierarchical coverage criteria to reduce the space of thread interleavings. We give a new definition of Hierarchical Coverage Criteria based on History-aware Predecessor Set that is called HaPSet and can be generated from concurrent programs, and implemented an improved Symbolic algorithm based on the HaPSet. We combined the improved Symbolic algorithm with an assertion guided pruning framework that prunes the interleavings which is guaranteed not to raise error by summarizing the reason why previous interleaving cannot leading to an error. We also use precise slicing of concurrent programs to further mitigate the influence of state space explosion. We have implemented the newly method and conducted a series of experiments. Our experiment results show that the new method is crucial in finding satisfactory trade-offs between the cost and performance in concurrent program testing.