Validating SMT solvers via semantic fusion
METADATA ONLY
Loading...
Author / Producer
Date
2020-06
Publication Type
Conference Paper
ETH Bibliography
yes
Citations
Altmetric
METADATA ONLY
Data
Rights / License
Abstract
We introduce Semantic Fusion, a general, effective methodology for validating Satisfiability Modulo Theory (SMT) solvers. Our key idea is to fuse two existing equisatisfiable (i.e., both satisfiable or unsatisfiable) formulas into a new formula that combines the structures of its ancestors in a novel manner and preserves the satisfiability by construction. This fused formula is then used for validating SMT solvers. We realized Semantic Fusion as YinYang, a practical SMT solver testing tool. During four months of extensive testing, YinYang has found 45 confirmed, unique bugs in the default arithmetic and string solvers of Z3 and CVC4, the two state-of-the-art SMT solvers. Among these, 41 have already been fixed by the developers. The majority (29/45) of these bugs expose critical soundness issues. Our bug reports and testing effort have been well-appreciated by SMT solver developers. © 2020 ACM.
Permanent link
Publication status
published
External links
Book title
Proceedings of the 41st ACM SIGPLAN Conference on Programming Language Design and Implementation
Journal / series
Volume
Pages / Article No.
718 - 730
Publisher
Association for Computing Machinery
Event
41st ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI 2020) (virtual)
Edition / version
Methods
Software
Geographic location
Date collected
Date created
Subject
Fuzz testing; Semantic fusion; SMT solvers
Organisational unit
09628 - Su, Zhendong / Su, Zhendong
Notes
Due to the Corona virus (COVID-19) the conference was conducted virtually.