Feedback-Driven Incremental Symbolic Execution

Incremental symbolic execution addresses the scalability problem of symbolic execution by concentrating on incremental behaviors that are introduced by the changes during program evolution. However, the state-of-the-art techniques still face the challenge to efficiently and precisely explore incremental program behaviors. In this paper, we present FENSE, a novel approach for incremental symbolic execution which checks whether the current path may subsume different incremental behavior from previous explorations. This is enabled by summarizing previously explored paths by recording the variables that may induce different incremental behaviors at each branch location. Our approach can identify redundant paths which share the same incremental behavior as previous explorations during test generation. Pruning away such redundant paths can lead to a potentially exponential redunction in the number of explored paths. We implemented a prototype of FENSE and conducted experiments on a set of real-world applications. The experimental results show that our approach is effective in reducing the number of explored paths as well as the execution time, compared with the state-of-the-art techniques.