Technical Report: A Formal Semantics for Java Symbolic Evaluation using Large-Block Encoding

2026-08-05

AI Summary

Existing symbolic execution tools, such as Java Ranger which supports path merging, lack formal verification of their correctness, potentially introducing unsoundness through optimizations and thereby weakening program verification guarantees. This work presents the first comprehensive formal semantic framework for Java symbolic execution with path merging, systematically transforming programs into logical expressions through a sequence of semantics-preserving code transformations. It rigorously establishes the soundness of Large-Block Encoding under a simplified Java semantics, proving that this optimization faithfully preserves program behavior. By formally ensuring that path merging and related optimizations do not introduce semantic deviations, this research significantly enhances the trustworthiness of symbolic execution tools in safety-critical systems.

Abstract

Symbolic execution plays a critical role in software reliability, as they are used to find bugs, generate test cases, and provide correctness guarantees, particularly for safety-critical systems. Yet their own correctness is rarely subject to formal scrutiny, as it is typically established empirically by evaluating tool behavior across many programs. This leaves open the possibility that the tools themselves introduce unsoundness, potentially invalidating the verification results they produce and undermining the very guarantees they are meant to provide. In this paper, we address this gap by providing the formal treatment of symbolic execution with path-merging, an optimization that improves path explosion by summarizing branching code regions into disjunctive constraints rather than exploring each path independently. Specifically, we target Java Ranger, a path-merging tool for Java programs that progressively transforms imperative Java code toward the language of formal logic through a series of code transformations. We formalize each of these transformations and prove their soundness with respect to a simplified version of the Java concrete semantics, establishing that Java Ranger's path-merging process preserves program semantics.

Problem

• symbolic execution
• formal semantics
• soundness
• path-merging
• software reliability

Innovation

• symbolic execution
• path-merging
• formal semantics
• Java Ranger
• soundness