-
Notifications
You must be signed in to change notification settings - Fork 17
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Make symbolic memory parametric and concretise every symbolic address #371
Conversation
7e31305
to
e52ce67
Compare
With the branching changes, now in test-comp we get the following results (on my pc, -w8 and 5s timeout):
No more EDIT: Results for 30s on my local machine
|
These are very good results for 5 seconds and 8 workers! :D |
ff08a33
to
6c8a21e
Compare
@zshipko, FYI, with this PR we observed that most of the tasks where we were not able to handle symbolic memory on the Test-Comp benchmarks are now solved by Owi. It might help a lot when running Owi on Rust code ; and if it's not enough, #338 is going to make the situation much better but we have not benchmarked it yet. |
Parameterizes symbolic memory on an abstract backend with arbitrary address types. Implements a concrete backend that always concretizes symbolic expressions to concrete addresses.
I'm going to benchmark this before merging. The current results on |
Results:
The output of diff compared to main: tool1 had 608 reached and tool2 had 689 reached
tool1 had 532 timeout and tool2 had 526 timeout
tool1 had 075 nothing and tool2 had 000 nothing
tool1 had 001 other and tool2 had 001 other
tool1 had 000 killed and tool2 had 000 killed
tools have 608 reached tasks in common
tool1 had 000 tasks tool2 did not found
tool2 had 081 tasks tool1 did not found
on commonly reached tasks, tool 1 took 1432.690579 sec. (mean 2.356399) and tool 2 took 1400.800041 sec. (mean 2.303947)
on *not commonly* reached tasks, tool 1 took 0.000000 sec. (mean -nan) and tool 2 took 169.033071 sec. (mean 2.086828)
among tasks reached only by tool 1, tool 2 replied 000 nothing, 000 timeout, 00 other and 00 killed
among tasks reached only by tool 2, tool 1 replied 074 nothing, 007 timeout, 00 other and 00 killed So almost all the But actually, this is not as good as we thought, because we have 78 So in short, this is a clear improvement, I'm curious to see if and how #273 is going to make the improvement even better. |
Since this depends on #367, the relevant changes are in 6c8a21e.
Summary
Parameterizes symbolic memory on an abstract backend which allows handling addresses in an isolated way (
symbolic_memory_make.ml
).Implements a concrete backend that always concretizes symbolic expressions to concrete addresses (
symbolic_memory_conrcetizing.ml
).Last remark: I left the original
symbolic_memory.ml
in order to not break concolic execution. It's unclear to me that we will be able to perform concolic execution with the same symbolic execution memory backend that we use forowi sym
.Benchmarking