https://adrbqt.ch/tags/llvm/ Recent content in LLVM on Adrien's Dashbook Hugo en-us Fri, 09 Jun 2023 00:00:00 +0000 https://adrbqt.ch/writings/llvm-query-estimator/llvm-query-estimator/ Fri, 09 Jun 2023 00:00:00 +0000 https://adrbqt.ch/writings/llvm-query-estimator/llvm-query-estimator/ <p><em>This paper was written under the supervision of Ph. D. candidates Solal Pirelli and Can Cebeci from DSLAB at EPFL and is available in PDF format on <a href="https://github.com/abouquet27/BachelorProject/blob/main/project/Bachelor_report.pdf" target="_blank">this repository</a></em>.</p> <html xmlns="http://www.w3.org/1999/xhtml" lang="" xml:lang=""> <meta charset="utf-8" /> <meta name="generator" content="pandoc" /> <meta name="viewport" content="width=device-width, initial-scale=1.0, user-scalable=yes" /> <meta name="author" content="Adrien Alain Bouquet" /> <style> /* Warning */ /* CSS for citations */ div.csl-bib-body {} div.csl-entry { clear: both; margin-bottom: 0em; } .hanging-indent div.csl-entry { margin-left: 2em; text-indent: -2em; } div.csl-left-margin { min-width: 2em; float: left; } div.csl-right-inline { margin-left: 2em; padding-left: 1em; } div.csl-indent { margin-left: 2em; } </style> <script defer="" src="https://cdn.jsdelivr.net/npm/katex@latest/dist/katex.min.js"></script> <script>document.addEventListener("DOMContentLoaded", function () { var mathElements = document.getElementsByClassName("math"); var macros = []; for (var i = 0; i < mathElements.length; i++) { var texText = mathElements[i].firstChild; if (mathElements[i].tagName == "SPAN") { katex.render(texText.data, mathElements[i], { displayMode: mathElements[i].classList.contains('display'), throwOnError: false, macros: macros, fleqn: false }); } } }); </script> <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/katex@latest/dist/katex.min.css" /> <body> <h2 id="introduction">Introduction</h2> <p>When you’re trying to test code, symbolic execution is an effective way of doing this by automatically generating tests and finding bugs. However, its cost in terms of performance can be heavy due to path explosion and this state explosion. To counter this problem, one approach is to merge states obtained on different paths in order to reduce the total exploration cost. However, merging two states can potentially increase costs and therefore decrease performance rather than the opposite. In order to determine which states to merge or not, researchers at the Dependable Systems Lab (DSLAB) at the Ecole Polytechnique Fédéral de Lausanne (EPFL) have published “Efficient State Merging in Symbolic Execution” in 2012 <span class="citation" data-cites="kuznetsov_state_merging"><a href="#ref-kuznetsov_state_merging" role="doc-biblioref">[1]</a></span>, in which they present two methods for reducing costs of state merging, especially deployed on KLEE, a symbolic execution engine <span class="citation" data-cites="klee"><a href="#ref-klee" role="doc-biblioref">[2]</a></span>. The first one is a query count estimation which computes the impact of each symbolic variable on solver queries and indicates which one provides benefits to merge. The second one is dynamic state merging which “interacts favorably with search strategies in automated test case generation and bug finding tools”. In this report, we will be working on an implementation of the query count estimation based on its description. The goal of the report is first to explain the implementation of the LLVM pass <span class="citation" data-cites="llvm"><a href="#ref-llvm" role="doc-biblioref">[3]</a></span> chosen to be as close as possible to that described in the paper, and then to test its effectiveness and robustness on different examples and the <code>GNU COREUTILS</code>. <span class="citation" data-cites="coreutils"><a href="#ref-coreutils" role="doc-biblioref">[4]</a></span></p>