Giter Club home page Giter Club logo

kex's People

Contributors

abdullinam avatar andreiiurko avatar artemuntila avatar dependabot[bot] avatar despairedcontroller avatar ilma4 avatar ktlo avatar maratdin7 avatar mike-wazovsky avatar niyaznigmatullin avatar sbone-kenobi avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar

kex's Issues

Boolector SMT formula fail

Kex fail with IndexOutofBoundException when trying to analyze kex-test with Boolector solver.
Reason: resulting smt formula does not contain constraints for bound of array node. The model then returns array bounds that are not aligned by 32 bits.

Fix `ListLongTest`

Currently is is ignored, because ContextGuidedSelector fails to correctly traverse all the branches and SymbolicTraceBuilder fails to correctly coolect trace when there is an exception in the external method

NullPointerException in the convertation from json to ExecutionResult

If this function:

private suspend fun collectTrace(method: Method, parameters: Parameters<Descriptor>): ExecutionResult? = tryOrNull {

Change to this:

private suspend fun collectTrace(method: Method, parameters: Parameters<Descriptor>): ExecutionResult? = try {
    val generator = UnsafeGenerator(ctx, method, testNameGenerator.generateName(method, parameters))
    generator.generate(parameters)
    val testFile = generator.emit()

    compilerHelper.compileFile(testFile)
    collectTrace(generator.testKlassName)
} catch (e: Exception) {
    log.debug(e.stackTraceToString())
    null
}

And replace ListConcolicTests with the following class implementation taken from Collections4 (CollectionBag):

public final class ListConcolicTests<E> extends AbstractBagDecorator<E> {
    
    private static final long serialVersionUID = -2560033712679053143L;

    public static <E> Bag<E> collectionBag(final Bag<E> bag) {
        return new ListConcolicTests<>(bag);
    }
    public ListConcolicTests(final Bag<E> bag) {
        super(bag);
    }
    private void writeObject(final ObjectOutputStream out) throws IOException {
        out.defaultWriteObject();
        out.writeObject(decorated());
    }
    @SuppressWarnings("unchecked") // will throw CCE, see Javadoc
    private void readObject(final ObjectInputStream in) throws IOException, ClassNotFoundException {
        in.defaultReadObject();
        setCollection((Collection<E>) in.readObject());
    }
    @Override
    public boolean containsAll(final Collection<?> coll) {
        return coll.stream().allMatch(this::contains);
    }
    @Override
    public boolean add(final E object) {
        return add(object, 1);
    }

    @Override
    public boolean addAll(final Collection<? extends E> coll) {
        boolean changed = false;
        for (final E current : coll) {
            final boolean added = add(current, 1);
            changed = changed || added;
        }
        return changed;
    }
    @Override
    public boolean remove(final Object object) {
        return remove(object, 1);
    }
    @Override
    public boolean removeAll(final Collection<?> coll) {
        if (coll != null) {
            boolean result = false;
            for (final Object obj : coll) {
                final boolean changed = remove(obj, getCount(obj));
                result = result || changed;
            }
            return result;
        }
        // let the decorated bag handle the case of null argument
        return decorated().removeAll(null);
    }
    @Override
    public boolean retainAll(final Collection<?> coll) {
        if (coll != null) {
            boolean modified = false;
            final Iterator<E> e = iterator();
            while (e.hasNext()) {
                if (!coll.contains(e.next())) {
                    e.remove();
                    modified = true;
                }
            }
            return modified;
        }
        // let the decorated bag handle the case of null argument
        return decorated().retainAll(null);
    }
    @Override
    public boolean add(final E object, final int count) {
        decorated().add(object, count);
        return true;
    }
}

And add this dependency to kex-test/pom.xml:

<dependency>
    <groupId>org.apache.commons</groupId>
    <artifactId>commons-collections4</artifactId>
    <version>4.4</version>
</dependency>

When on the test execution several NullPointerExceptions will occur (can be found in kex-test.log). Here is an example:

java.lang.NullPointerException: null cannot be cast to non-null type org.vorpal.research.kfg.ir.value.instruction.Instruction

Exception when running with kex.sh

./kex.sh -cp kex-test/target/kex-test-0.0.1-jar-with-dependencies.jar --config kex.ini
Exception in thread "main" java.lang.NoSuchMethodError: kotlin.collections.CollectionsKt.maxOrNull(Ljava/lang/Iterable;)Ljava/lang/Comparable;
        at org.jetbrains.research.kfg.builder.cfg.impl.FrameState.appendFrame(FrameState.kt:147)
        at org.jetbrains.research.kfg.builder.cfg.CfgBuilder.convertFrame(CfgBuilder.kt:694)
        at org.jetbrains.research.kfg.builder.cfg.CfgBuilder.buildInstructions(CfgBuilder.kt:998)
        at org.jetbrains.research.kfg.builder.cfg.CfgBuilder.build(CfgBuilder.kt:1025)
        at org.jetbrains.research.kfg.ClassManager.initialize(ClassManager.kt:184)
        at org.jetbrains.research.kfg.ClassManager.initialize(ClassManager.kt:164)
        at org.jetbrains.research.kex.Kex.<init>(kex.kt:156)
        at org.jetbrains.research.kex.MainKt.main(main.kt:9)

При запуске через kex.sh из командной строки вылетает exception. Собран jar через mvn clean package -Pz3. При запуске через идею всё работает нормально.

Z3 floating point conversion fail

Z3 fails when converting floating point expressions when analyzing fescar-core project.

Command to run:

./kex.sh --jar fescar-core-0.1.0-SNAPSHOT.jar --target com.alibaba.fescar.core.*

Error message:

#
# A fatal error has been detected by the Java Runtime Environment:
#
#  SIGSEGV (0xb) at pc=0x00007fc4d5664cc0, pid=3034021, tid=0x00007fc51f6f0700
#
# JRE version: OpenJDK Runtime Environment (8.0_242-b08) (build 1.8.0_242-b08)
# Java VM: OpenJDK 64-Bit Server VM (25.242-b08 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C  [libz3.so+0x1f7cc0]  Z3_mk_fpa_to_fp_float+0x60
#
# Core dump written. Default location: /home/abdullin/workspace/kex/core or core.3034021
#
# An error report file with more information is saved as:
# /home/abdullin/workspace/kex/hs_err_pid3034021.log
#
# If you would like to submit a bug report, please visit:
#   http://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#

fescar-core-0.1.0-SNAPSHOT.zip

Better coverage counting

Current CoverageCounter only counts basic block coverage. It is not perfect and it does not use any of the generated test cases for experiments.

We can improve two things:

  1. also count branch coverage
  2. use JaCoCo for coverage

Better random object generator

Current random object generation library (easy-random) often fails to generate complex objects. Maybe we can consider switching to another library (or writing custom generator)

Better codegen in Reanimator

Currently Reanimator uses custom codegen classes to generate test cases both in Java and in Kotlin. Consider switching to specialized code generation libraries

Missing branches in tableswitch

Predicate state for sample has no branches for cases a == 0 and a == 2. Checked on KEX version from master branch.

    fun whenExprTest(a: Int) = when (a) {
        0, 1 -> 0
        2, 3 -> 1
        else -> 10
    }

State:

(BEGIN
 <OR> (
  @P arg$0 = 1
  @S %1 = 0
),  <OR> (
  @P arg$0 = 3
  @S %1 = 1
),  <OR> (
  @P arg$0 !in (0, 1, 2, 3)
  @S %1 = 10
) END) -> (
  @S <retval> = %1
)

KFG seems to be correct:
image

Proper tests

Current test suite covers a very small percentage of code base and checks only one mode.

Optimize SMT converting for big states

States with size more than a 100 000 predicates may take very long time (up to 2-3 hours) to be converted into an SMT formula, especially for z3.

Analyze how that conversion process can be optimized

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.