Incorrectness Logic (IL) has recently been advanced as a logical theory for compositionally
proving the presence of bugs—dual to Hoare Logic, which is used to compositionally prove …

Search-based software testing (SBST) generates tests using search algorithms guided by
measurements gauging how far a test case is away from exercising a coverage goal. The …

Symbolic execution is a well established method for test input generation. Despite of having
achieved tremendous success over numerical domains, existing symbolic execution …

We introduce a novel decision procedure to the satisfiability problem in array separation
logic combined with general inductively defined predicates and arithmetic. Our proposal …

Bounded exhaustive input generation (BEG) is an effective approach to reveal software
faults. However, existing BEG approaches require a precise specification of the valid inputs …

Heap-manipulating programs are known to be challenging to reason about. We present a
novel verifier for heap-manipulating programs called S2TD, which encodes programs …

In separation logic, bi-abduction-a combination of abductive inference and frame inference-
is the key enabler for compositional reasoning, helping to scale up verification significantly …

Analyzing and verifying heap-manipulating programs automatically is challenging. A key for
fighting the complexity is to develop compositional methods. For instance, many existing …

Separation logic is a formalism for the verification of programs that make extensive use of
dynamic resources, such as heap-allocated memory. Separation logic enables modular …

Shape analysis is of great importance for the verification of the correctness and memory-
safety of heap-manipulating programs, yet such analyses have been shown to be highly …