Dynamic Symbolic Execution of Distributed Concurrent Objects

Transcription

1 Dynamic Symboic Execution of Distributed Concurrent Objects Andreas Griesmayer 1, Bernhard Aichernig 1,2, Einar Broch Johnsen 3, and Rudof Schatte 1,2 1 Internationa Institute for Software Technoogy, United Nations University (UNU-IIST), Macao S.A.R., China {agriesma,bka,rschatte}@iist.unu.edu 2 Institute for Software Technoogy, Graz University of Technoogy, Austria {aichernig,rschatte}@ist.tugraz.at 3 Department of Informatics, University of Oso, Norway einarj@ifi.uio.no Abstract. This paper extends dynamic symboic execution to distributed and concurrent systems. Dynamic symboic execution is used to systematicay identify equivaence casses of input vaues and has been shown to scae we to arge systems. Athough mainy appied to sequentia programs, this scaabiity makes it interesting to consider the technique in the distributed and concurrent setting as we. In order to extend the technique to concurrent systems, it is necessary to obtain sucient contro over the scheduing of concurrent activities to avoid race conditions. Creo, a modeing anguage for distributed concurrent objects, soves this probem by abstracting from a particuar scheduing poicy but expicity dening scheduing points. This provides sucient contro to appy the technique of dynamic symboic of intereaved processes. The technique has been formaized in rewriting ogic and executes in Maude. 1 Introduction Distributed and concurrent systems, e.g. web services, are becoming increasingy important for ong-running infrastructure and appications. They typicay consist of oosey couped components which communicate asynchronousy, potentiay running on dierent hardware systems. For critica distributed systems, the use of forma methods, both for design and verication, remains a chaenge. In the genera case, the compexity of such systems makes fu verication seem impossibe, even for medium sized exampes. The chaenge is to nd a verication technique that scaes to the combinatoria exposion in the number of possibe runs in such modes. A promising This research was carried out as part of the EU FP6 project Credo: Modeing and anaysis of evoutionary structures for distributed services (IST-33826).

2 technique that seems to scae we to arge systems is dynamic symboic execution [1, 4, 9]. The idea is to cacuate a symboic execution in parae with the concrete test run of a given forma mode. The resut is a set of conditions over symboic input vaues representing the path of the ast run. The probem is that dynamic symboic execution is of imited use with the concurrency modes of today's programming anguages. The reason is that dynamic symboic execution does not work in settings where the execution of expressions is not atomic. Hence, its main appication so far has been imited to singe-threaded programs and to cient-server appications with simpe seriaized communication ows. In this work we overcome this imitation by choosing a modeing anguage that provides the appropriate eve of concurrency contro: Creo [6], an executabe object oriented modeing anguage whose execution mode was designed to assist in the deveopment of distributed systems. We have impemented the dynamic symboic execution technique in Maude [2], which is the execution patform of Creo, aowing us to perform the symboic run dynamicay whie the concrete run is executed. The too, and an appication to testing, is covered in more detai in [5]. 1.1 Reated Work Symboic execution is a widey used program anaysis technique that represents the vaues of variabes as symboic expressions instead of concrete data. An execution of a program is performed by manipuating those expressions instead of computing concrete vaues. Appication of symboic execution to verication was aready proposed in 1976 by King [7], who shows symboic execution for a simpe sequentia anguage and presents an interactive too EFFIGY to traverse the execution tree. However, there are imits to the feasibiity of this technique, due to the sheer number of possibe execution paths induced by non-determinism. To make the process feasibe for arge systems one can either reduce the amount of information that is tracked, or the number of paths to search. An exampe for the rst kind are static anaysis toos ike ARCHER from Enger et a. [10], which concentrate on certain properties of interest for the anaysis. In this paper, we reduce the number of paths that are searched at a time by dynamic symboic execution. In [1], Boyer et a. show the interactive too SELECT that computes input vaues for a run seected by the user. One of the rst automated toos was DART from Godefroid et a. [4], which automaticay extracts a program's interface and generates a test driver to perform random testing. Severa extensions to these approaches exist, among the most notabe the PEX too from Timann et a. [9] for creating parameterized unit tests for singe-threaded.net programs. We extend dynamic symboic execution to Creo's concurrency mode, incuding the treatment of oca scheduing points in the distributed objects. 2 The Modeing Language Creo Creo is a high-eve executabe modeing anguage targeting distributed systems in which concurrent objects communicate asynchronousy [6]. The an- 2

3 guage decoupes communication from synchronization. Furthermore, it aows oca scheduing to be eft underspecied but controed through expicity decared process reease points. The anguage has a forma semantics dened in rewriting ogic [8] and executes on the Maude patform [2]. In the remainder of this section, we present Creo and point out its essentia features for DSE. A concurrent object in Creo executes a number of processes that have access to its oca state. Each process corresponds to the activation of one of the object's methods; a specia method run is automaticay activated at object creation time, if present, and captures the object's active behavior. Objects execute concurrenty: each object has a processor dedicated to executing the processes of that object, so processes in dierent objects execute in parae. In contrast to, e.g., Java, each Creo object stricty encapsuates its state; i.e., externa manipuation of the object state happens via cas to the object's methods ony. Ony one process can be active in an object at a time; the other processes in the object are suspended. A process can be reeased using Creo's await statement, in which case another proces may be activated. Communication in Creo is based on method cas. These are a priori asynchronous; method repies are assigned to abes (aso caed future variabes, see [3]). There is no synchronization associated with caing a method. Reading a repy from a abe, however, is a bocking operation and aows the caing object to synchronize with the caee. A method ca that is directy foowed by a read operation modes a synchronous ca. Thus, the caing process may decide at runtime whether to ca a method synchronousy or asynchronousy. The anguage syntax of the subset of Creo used in this paper is presented in a Java-ike stye. We omit some features of Creo, incuding interfaces, inheritance, non-deterministic choice and many buit-in data types and their operations. For a fu overview of Creo, see for exampe [6]. 2.1 Representation of a Run A run of a Creo system captures the parae execution of processes in dierent concurrent objects. Such a run may be perceived as a sequence of execution steps where each step contains a set of oca transitions on a subset of the system's objects. However, ony one process may be active at a time in each object and dierent objects operate on disjoint data. Therefore, the transitions in each execution step may be performed in a truy concurrent manner or in any sequentia order, as ong as a transitions in one step are competed before the next execution step commences. For the purposes of dynamic symboic execution the run is represented as a sequence of statements which manipuate the state variabes, together with the conditions which determine the contro ow. Due to space restrictions, we concentrate on statements for the concurrency mode, namey asymchronous method cas and await statements. The representation of the other statements is straight forward and can be studied in more detai in [5]. An asynchronous method ca in the run is reected in four execution steps (the abe vaue uniquey identies the steps that beong to the same method 3

4 ca): o 1 o 2.m(e) represents the ca of method m in object o 2 from object o 1 with arguments e; o 1 o 2.m(v) represents when the caed objects starts execution, where v are the oca names of the parameters for m; o 1 o 2.m(e) represents the emission of the return vaues from the method execution; and o 1 o 2.m(v) represents the corresponding reception of the vaues. These four events fuy describe method caing in Creo. In this execution mode the events reecting a specic method ca aways appear in the same order, but they can be intereaved with other statements. Conditiona statements in Creo are side eect free and therefore ony represented in form of the statements of the branch that was actuay executed. For the sake of computing the input vaues, however, the condition of the taken branch is recorded as g. Remark that statements await g requires carefu treatment: if it evauates to fase, no code is executed. To reect the information that the interpreter faied to execute a process because the condition g of the await statement evauated to fase, the negated condition g is recorded. 3 Dynamic Symboic Execution of Distributed Objects Conventiona symboic execution uses symbos to represent arbitrary vaues during execution. When encountering a conditiona branch statement, the run is forked. This resuts in a tree covering a paths in the program. In contrast, dynamic symboic execution cacuates the symboic execution in parae with a concrete run that is actuay taken, avoiding the usua probem of eiminating infeasibe paths. Decisions on branch statements are recorded, resuting in a set of conditions over the symboic vaues that have to evauate to true for the path to be taken. We ca the conjunction of these conditions the path condition; it represents an equivaence cass of concrete input vaues that coud have taken the same path. Note, in the case of non-determinism, there is no guarantee that a inputs wi take this path. We extend this method to the concurrency mode of Creo and dene the rues to actuay compute the symboic vaues for a given run. The formuas given in this section very cosey resembe the rewrite rues of Creo's simuation environment [6], dened in rewriting ogic [8] and impemented in Maude [2]. The rues are presented here in a sighty simpied manner to improve readabiity. Denote by s the representation of program statements. Let σ = v 1 e 1, v 2 e 2,... v n e n = v e be a map which records keyvaue entries v e, where a variabe v is bound to a symboic vaue e. The vaue assigned to key v is accessed by vσ. For an expression e and a map σ, dene a parae substitution operator eσ which repaces a occurrences of every variabe v in e with the expression vσ (if v is in the domain of σ). For simpicity, et eσ denote the appication of the parae substitution to every expression in the ist e. Furthermore, et the operator σ 1 σ 2 combine two maps σ 1 and σ 2 such that, when entries with the same key exist in both maps, the entry in σ 2 is taken. These operators are dened as equations in rewriting ogic and are evauated in between the rewrite steps. 4

5 In the symboic state σ, a expanded variabe names are bound to symboic expressions. However, operations for method cas do not change the vaue of the symboic state, but generate or receive messages that are used to communicate actua parameter vaues between the caing and receiving objects. Simiar to the expressions bound to variabes in the symboic state σ, the symboic representations of these actua parameters are bound in a map Θ to the actua and unique abe vaue provided for each method ca by Creo's operationa semantics. Finay, the conditions of contro statements aong an execution path are coected in a ist C; the concatenation of a condition c to C is denoted by Cˆc. The congurations of the rewrite system for dynamic symboic execution are given by s [ Θ, σ, C ], where s is a run represented as a sequence of statements, Θ and σ are the maps for messages and symboic variabe assignments as described above, and C is the ist of conditions. The run s (as described in Section 2.1) is generated on the y by the concrete rewrite system for Creo. Again, we concentrate on the statements for method cas and process reease. A method ca emits a message with the expressions for the method: o 1 o 2.m(e); s [ Θ, σ, C ] = s [ Θ eσ, σ, C ] Because of the asynchronous behavior of Creo, the ca might be received at a ater point in the run (or not at a if the execution terminates before the method was seected for execution) by another rue, that handes the binding of a ca to a new process and assigns the symboic representation of the actua parameter vaues to the oca variabes in the new process (σ v Θ ). The emission and reception of return vaues are handed simiary to ca statements and ca reception. For conditionas, the oca variabes in the condition are repaced by their symboic vaues ( g ; s [ Θ, σ, C ] = s [ Θ, σ, Cˆ gσ ] ). This process is identica for the dierent kinds of conditiona statements (if, whie, await). The statement itsef acts as a skip statement; it changes no variabes and does not produce or consume messages. The resuting expression gσ directy characterizes the equivaence cass of input vaues that reach and fu the condition. 3.1 Appication to Testing Approaches to test case generation for structura coverage intend to nd test sets that perform runs in the system for a specic coverage criterion. Two runs that cover the same parts of a system can be considered equivaent. A good test set shoud maximize the coverage, whie minimizing the number of equivaent runs in order to avoid superuous eorts in executing the tests. Dynamic symboic execution on a run gives the set of conditions that are combined to the path condition C = 1 i n c i (for n conditions), characterizing exacty the equivaence cass of t S that can repeat the same execution path. Ony one test case that fus C is required. A new test case is then chosen to specicay avoid that a particuar branch is taken by vioating the respective c i. To maximize decision coverage (DC), for instance, test cases have to be created 5

6 such that for each of the conditions c i, there is aso a test case that vioates this condition. The process of generating new test cases ends after a combinations required for the coverage criteria are expored. More detais and exampes on how to use DSE to generate test cases in distributed systems can be found in the technica report to this paper [5]. 4 Concusions The main contribution of this work is the nove extension of dynamic symboic execution to non-trivia distributed and concurrent object modes. This has been achieved by expoiting the properties of the Creo modeing anguage; in particuar oca scheduing contro of the processes and strict encapsuation of the object state. This paper demonstrates how dynamic symboic execution, combined with the executabe architectura modes of Creo, can be used to systematicay derive equivaent input vaues, whie avoiding the combinatoria exposion inherent in distributed concurrent systems. Our approach has been formaized in rewriting ogic and impemented in Maude. References 1. R. S. Boyer, B. Espas, and K. N. Levitt. Seect-A forma system for testing and debugging programs by symboic execution. SIGPLAN Not., 10(6):234245, M. Cave, F. Durán, S. Eker, P. Lincon, N. Martí-Oiet, J. Meseguer, and J. F. Quesada. Maude: Specication and programming in rewriting ogic. Theoretica Computer Science, 285:187243, Aug F. S. de Boer, D. Carke, and E. B. Johnsen. A compete guide to the future. In R. de Nicoa, editor, Proc. 16th European Symposium on Programming (ESOP'07), voume 4421 of LNCS, pages Springer, Mar P. Godefroid, N. Karund, and K. Sen. DART: directed automated random testing. In PLDI '05: Proceedings of the 2005 ACM SIGPLAN conference on Programming anguage design and impementation, pages ACM, A. Griesmayer, B. Aichernig, E. B. Johnsen, and R. Schatte. Dynamic symboic execution of distributed concurrent objects. Technica Report No. 408, UNU-IIST, March E. B. Johnsen and O. Owe. An asynchronous communication mode for distributed concurrent objects. Software and Systems Modeing, 6(1):3558, Mar J. King. Symboic execution and program testing. Communications of the ACM, 19(7):385394, J. Meseguer. Conditiona rewriting ogic as a unied mode of concurrency. Theoretica Computer Science, 96:73155, N. Timann and J. de Haeux. Pex - white box test generation for.net. In Proc. of the 2nd Internationa Conference on Tests and Proofs (TAP'08), voume 4966 of LNCS, pages Springer, Y. Xie, A. Chou, and D. Enger. Archer: using symboic, path-sensitive anaysis to detect memory access errors. In ESEC/FSE-11: Proceedings of the 9th European software engineering conference hed jointy with 11th ACM SIGSOFT internationa symposium on Foundations of software engineering, pages ACM,