Automated Formal Static Analysis and Retrieval of Source Code - JKU

2.1. BACKGROUND 9
From the practical point of view, ESC/Java2 is incomplete with respect to the Java language:
no support for multi-threading).
Theoretically, it is not sound nor complete. Incompleteness is due to the lack of power of
the current theorem prover, unsoundness results from the lack of support for integer overflow or
multi-threaded execution.
2.1.2 Symbolic Execution
2.1.2.1 Method Description
Before the symbolic execution technique was used in program proving, the existing approaches
used the notion of a domain for the variables involved in the program execution.
In program proving using symbolic execution ([Kin75]), the numeric values for the input
variables are supplied with symbolic values and the expressions standing for the program variables
are represented by symbolic expressions.
Three notions are involved in the program proving using this approach: state, path condition,
program counter.
A state contains symbolic expressions for each variable used in the program.
A path condition represents a set of assumptions that the inputs must satisfy in order to reach
the respective branch. Basically, the path condition is a conjunction of predicates upon the symbolic
values of the input variables. There exists a path condition corresponding to each program
path.
The program counter determines which statement will be executed next.
For the generation of the path condition it turned out that forward reasoning (used in the the
majority of the systems implementation – see Section 2.1.2.2) is more suitable than backward
reasoning ([How73]), because it follows naturally the execution of a program.
The symbolic execution tree can also characterize the execution of a procedure: each program
statement represents a node and each transition between statements is a directed arc. From nodes
representing conditionals there is more than one arc leaving it; the node associated with the first
statement has not incoming arcs, the terminal node has no outgoing arcs.
If the procedure contains while loops whose number of iterations depend on the input variables
then the associated symbolic execution tree is infinite.
Symbolic execution is used in many approaches for program analysis: path domain checking,
partition analysis, program reduction, program testing, but we are interested in applying symbolic
execution in program proving.
2.1.2.2 Symbolic Execution Systems
The early symbolic execution systems (EFFIGY, SELECT, ATTEST, Interactive Programming
System, etc.) use theorem proving for checking the correctness of programs.
EFFIGY ([Kin75]) follows the rules and principles of the symbolic execution approach. The
language supported by EFFIGY is a simple imperative programming language. The input values
for the programs can be both symbolic and concrete values.