DySy

Abstract

Dynamically discovering likely program invariants from concrete test executions has emerged as a highly promising software engineering technique. Dynamic invariant inference has the advantage of succinctly summarizing both "expected" program inputs and the subset of program behaviors that is normal under those inputs. In this paper, we introduce a technique that can drastically increase the relevance of inferred invariants, or reduce the size of the test suite required to obtain good invariants. Instead of falsifying invariants produced by pre-set patterns, we determine likely program invariants by combining the concrete execution of actual test cases with a simultaneous symbolic execution of the same tests. The symbolic execution produces abstract conditions over program variables that the concrete tests satisfy during their execution. In this way, we obtain the benefits of dynamic inference tools like Daikon: the inferred invariants correspond to the observed program behaviors. At the same time, however, our inferred invariants are much more suited to the program at hand than Daikon's hardcoded invariant patterns. The symbolic invariants are literally derived from the program text itself, with appropriate value substitutions as dictated by symbolic execution.We implemented our technique in the DySy tool, which utilizes a powerful symbolic execution and simplification engine. The results confirm the benefits of our approach. In Daikon's prime example benchmark, we infer the majority of the interesting Daikon invariants, while eliminating invariants that a human user is likely to consider irrelevant.

Lightweight precise automatic extraction of exception preconditions in java methods

“…Daikon Ernst et al (2001) was the first, widely successful approach that used dynamic analysis, which offers a different trade-off: it is unsound (the "inferred" specifications are only "likely" to be correct) but it is applicable to any program that can be executed. Daikon approach's practicality also yielded a lot of follow-up work aimed at improving its precision and its flexibility Csallner and Smaragdakis (2006); authorname (2008); Wei et al (2011), or at combining it with static techniques Csallner and Smaragdakis (2006);authorname (2008); Wei et al (2011);Csallner et al (2008);Tillmann et al (2006); . wit is fundamentally based on static analysis, which can be very precise but incomplete Le Goues and Weimer (2009); its heuristics further make it lightweight, and hence applicable to real-world Java projects.…”

Documentation‐based functional constraint generation for library methods

“…Various techniques have been proposed to infer specifications for programmes. Some approaches infer API specifications by statically mining API usage patterns from the client code and constructing common constraints as the specifications [6,28,29], while others detect invariants by dynamically running a programme and using machine learning algorithms to analyse the execution traces [1,2]. Recently, researchers proposed new techniques to infer specifications in a ‘guess and validate’ fashion [30‐32].…”

“…Since manually writing specifications for methods can be prohibitively expensive and error‐prone, researchers have proposed various techniques in the past few years to automatically infer specifications for library methods, for example, through dynamic [1‐5] or static [6,7] programme analysis, so that their implementation details can be abstracted away and complex programme analysis tasks may become possible or scalable. Another line of such work aims to infer specifications for methods from their natural language descriptions, in the form of API documentations [8,9] or code comments [10,11].…”

Complexity and information in invariant inference

“…In invariant inference, Daikon [Ernst et al 2001] initiated the black-box learning of likely program invariants [see e.g. Csallner et al 2008;Sankaranarayanan et al 2008]. In this paper we are interested in inferring necessarily correct inductive invariants.…”