Skip to content

[solvers/symex] Add ConcolicInputSpec and SymExOptions to CFG symbolic execution engine. - #4892

Closed
copybara-service[bot] wants to merge 1 commit into
mainfrom
test_974256904
Closed

copybara-service[bot] wants to merge 1 commit into
mainfrom
test_974256904

Conversation

@copybara-service

Copy link
Copy Markdown

[solvers/symex] Add ConcolicInputSpec and SymExOptions to CFG symbolic execution engine.

Adds ConcolicInputSpec and SymExOptions to configure symbolic path
exploration. ConcolicInputSpec supports binding concrete parameter values
programmatically. SymExOptions bundles concolic inputs with
path exploration limits (max_paths), enabling upfront branch pruning
and preventing path explosion.

  • ConcolicInputSpec (concolic_input_spec.{h,cc}): Encapsulates concrete
    parameter assignments with fluent builder methods.
  • SymExOptions (cfg_symex_engine.h): Configuration struct for ExplorePaths
    holding concrete parameter specifications and optional max_paths limit.
  • CfgSymExEngine (cfg_symex_engine.{h,cc}): Uses SymExOptions to bind
    concrete constants and enforce path limits during forward DFS traversal.
  • Tests:
    • concolic_input_spec_test.cc: Unit tests for ConcolicInputSpec construction
      and parameter querying.
    • cfg_symex_engine_test.cc: Unit tests verifying concolic branch pruning and
      max_paths limit.
    • symex_e2e_test.cc: Integration test demonstrating ALU path pruning with
      concrete opcode.

…c execution engine.

Adds `ConcolicInputSpec` and `SymExOptions` to configure symbolic path
exploration. `ConcolicInputSpec` supports binding concrete parameter values
programmatically. `SymExOptions` bundles concolic inputs with
path exploration limits (`max_paths`), enabling upfront branch pruning
and preventing path explosion.

- ConcolicInputSpec (concolic_input_spec.{h,cc}): Encapsulates concrete
  parameter assignments with fluent builder methods.
- SymExOptions (cfg_symex_engine.h): Configuration struct for ExplorePaths
  holding concrete parameter specifications and optional max_paths limit.
- CfgSymExEngine (cfg_symex_engine.{h,cc}): Uses SymExOptions to bind
  concrete constants and enforce path limits during forward DFS traversal.
- Tests:
  - concolic_input_spec_test.cc: Unit tests for ConcolicInputSpec construction
    and parameter querying.
  - cfg_symex_engine_test.cc: Unit tests verifying concolic branch pruning and
    max_paths limit.
  - symex_e2e_test.cc: Integration test demonstrating ALU path pruning with
    concrete opcode.

PiperOrigin-RevId: 974256904
@copybara-service copybara-service Bot closed this Sep 8, 2026
@copybara-service
copybara-service Bot deleted the test_974256904 branch September 8, 2026 20:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant