vorpal-research / kex Goto Github PK
View Code? Open in Web Editor NEWA platform for analysis of Java bytecode
License: Apache License 2.0
A platform for analysis of Java bytecode
License: Apache License 2.0
Kex fail with IndexOutofBoundException when trying to analyze kex-test
with Boolector solver.
Reason: resulting smt formula does not contain constraints for bound of array node. The model then returns array bounds that are not aligned by 32 bits.
Currently is is ignored, because ContextGuidedSelector
fails to correctly traverse all the branches and SymbolicTraceBuilder
fails to correctly coolect trace when there is an exception in the external method
ListLongTest is seems to be very dependent on the initial seed for EasyRandom.
Examples of failing seeds:
3735928561
3735928570
Include built in native dependencies from solvers to improve the usability
If this function:
Change to this:
private suspend fun collectTrace(method: Method, parameters: Parameters<Descriptor>): ExecutionResult? = try {
val generator = UnsafeGenerator(ctx, method, testNameGenerator.generateName(method, parameters))
generator.generate(parameters)
val testFile = generator.emit()
compilerHelper.compileFile(testFile)
collectTrace(generator.testKlassName)
} catch (e: Exception) {
log.debug(e.stackTraceToString())
null
}
And replace ListConcolicTests with the following class implementation taken from Collections4 (CollectionBag):
public final class ListConcolicTests<E> extends AbstractBagDecorator<E> {
private static final long serialVersionUID = -2560033712679053143L;
public static <E> Bag<E> collectionBag(final Bag<E> bag) {
return new ListConcolicTests<>(bag);
}
public ListConcolicTests(final Bag<E> bag) {
super(bag);
}
private void writeObject(final ObjectOutputStream out) throws IOException {
out.defaultWriteObject();
out.writeObject(decorated());
}
@SuppressWarnings("unchecked") // will throw CCE, see Javadoc
private void readObject(final ObjectInputStream in) throws IOException, ClassNotFoundException {
in.defaultReadObject();
setCollection((Collection<E>) in.readObject());
}
@Override
public boolean containsAll(final Collection<?> coll) {
return coll.stream().allMatch(this::contains);
}
@Override
public boolean add(final E object) {
return add(object, 1);
}
@Override
public boolean addAll(final Collection<? extends E> coll) {
boolean changed = false;
for (final E current : coll) {
final boolean added = add(current, 1);
changed = changed || added;
}
return changed;
}
@Override
public boolean remove(final Object object) {
return remove(object, 1);
}
@Override
public boolean removeAll(final Collection<?> coll) {
if (coll != null) {
boolean result = false;
for (final Object obj : coll) {
final boolean changed = remove(obj, getCount(obj));
result = result || changed;
}
return result;
}
// let the decorated bag handle the case of null argument
return decorated().removeAll(null);
}
@Override
public boolean retainAll(final Collection<?> coll) {
if (coll != null) {
boolean modified = false;
final Iterator<E> e = iterator();
while (e.hasNext()) {
if (!coll.contains(e.next())) {
e.remove();
modified = true;
}
}
return modified;
}
// let the decorated bag handle the case of null argument
return decorated().retainAll(null);
}
@Override
public boolean add(final E object, final int count) {
decorated().add(object, count);
return true;
}
}
And add this dependency to kex-test/pom.xml:
<dependency>
<groupId>org.apache.commons</groupId>
<artifactId>commons-collections4</artifactId>
<version>4.4</version>
</dependency>
When on the test execution several NullPointerExceptions will occur (can be found in kex-test.log). Here is an example:
java.lang.NullPointerException: null cannot be cast to non-null type org.vorpal.research.kfg.ir.value.instruction.Instruction
./kex.sh -cp kex-test/target/kex-test-0.0.1-jar-with-dependencies.jar --config kex.ini
Exception in thread "main" java.lang.NoSuchMethodError: kotlin.collections.CollectionsKt.maxOrNull(Ljava/lang/Iterable;)Ljava/lang/Comparable;
at org.jetbrains.research.kfg.builder.cfg.impl.FrameState.appendFrame(FrameState.kt:147)
at org.jetbrains.research.kfg.builder.cfg.CfgBuilder.convertFrame(CfgBuilder.kt:694)
at org.jetbrains.research.kfg.builder.cfg.CfgBuilder.buildInstructions(CfgBuilder.kt:998)
at org.jetbrains.research.kfg.builder.cfg.CfgBuilder.build(CfgBuilder.kt:1025)
at org.jetbrains.research.kfg.ClassManager.initialize(ClassManager.kt:184)
at org.jetbrains.research.kfg.ClassManager.initialize(ClassManager.kt:164)
at org.jetbrains.research.kex.Kex.<init>(kex.kt:156)
at org.jetbrains.research.kex.MainKt.main(main.kt:9)
При запуске через kex.sh из командной строки вылетает exception. Собран jar через mvn clean package -Pz3
. При запуске через идею всё работает нормально.
Constructor inlining breaks some of the Intrinsics.assertReachable()
conditions in BasicLongTest.testIcfpc2018
Looks like operand shoud be negated.
public void foo(char[][] a) {
if (a.length > 10) {
if (a[0].length < 2) {
System.out.println("s");
}
}
}
ExecutorAS2Printer::printReflectionNewArray
does not expect to see nested array type
Z3 fails when converting floating point expressions when analyzing fescar-core project.
Command to run:
./kex.sh --jar fescar-core-0.1.0-SNAPSHOT.jar --target com.alibaba.fescar.core.*
Error message:
#
# A fatal error has been detected by the Java Runtime Environment:
#
# SIGSEGV (0xb) at pc=0x00007fc4d5664cc0, pid=3034021, tid=0x00007fc51f6f0700
#
# JRE version: OpenJDK Runtime Environment (8.0_242-b08) (build 1.8.0_242-b08)
# Java VM: OpenJDK 64-Bit Server VM (25.242-b08 mixed mode linux-amd64 compressed oops)
# Problematic frame:
# C [libz3.so+0x1f7cc0] Z3_mk_fpa_to_fp_float+0x60
#
# Core dump written. Default location: /home/abdullin/workspace/kex/core or core.3034021
#
# An error report file with more information is saved as:
# /home/abdullin/workspace/kex/hs_err_pid3034021.log
#
# If you would like to submit a bug report, please visit:
# http://bugreport.java.com/bugreport/crash.jsp
# The crash happened outside the Java Virtual Machine in native code.
# See problematic frame for where to report the bug.
#
Current CoverageCounter only counts basic block coverage. It is not perfect and it does not use any of the generated test cases for experiments.
We can improve two things:
rt-1.8.jar
java/util/logging/FileHandler::generate(java/lang/String, int, int): java/io/File
options:
[loop]
derollCount = 3
maxDerollCount = 0
causes failure
Current random object generation library (easy-random
) often fails to generate complex objects. Maybe we can consider switching to another library (or writing custom generator)
When comparing these two runs:
https://github.com/vorpal-research/kex/actions/runs/2630735116
https://github.com/vorpal-research/kex/actions/runs/2681554661
Currently Reanimator uses custom codegen classes to generate test cases both in Java and in Kotlin. Consider switching to specialized code generation libraries
Implement more optimized path selector for symbolic executor
Implement an analysis that maps invoke dynamic instructions to understandable code snippets
Predicate state for sample has no branches for cases a == 0
and a == 2
. Checked on KEX version from master branch.
fun whenExprTest(a: Int) = when (a) {
0, 1 -> 0
2, 3 -> 1
else -> 10
}
State:
(BEGIN
<OR> (
@P arg$0 = 1
@S %1 = 0
), <OR> (
@P arg$0 = 3
@S %1 = 1
), <OR> (
@P arg$0 !in (0, 1, 2, 3)
@S %1 = 10
) END) -> (
@S <retval> = %1
)
Current test suite covers a very small percentage of code base and checks only one mode.
States with size more than a 100 000 predicates may take very long time (up to 2-3 hours) to be converted into an SMT formula, especially for z3.
Analyze how that conversion process can be optimized
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.