??????????? ?????? (theorem proving)

1
????????????? ??????????? ????????????
????????????

• ??????? ????????
• ?. ???????

2
?????? ???????????

• ??????????
• ?????????? ??????
• ??????????? ?????? (theorem proving)
• ???????? ??????? (model checking)
• ???????? ??????????????? (conformance checking)
• ??????????? ??????
• ???????? ?????? ????????????
• ????? ???????? ??????
• ???????????? ??????
• ??????????
• ???????? ??????

3
????????? ???????
?????????? ???????????
??????????
??????????? ??????????? ??????
??????????? ??????
?????????? ??????????
??????????? ??????
????????????? ??????????
?????????? ???????????
????????????? ??????????? ?????
??????????? ??????
???????? ??????
???????? ???????
4
????????????? ??????????

• Symbolic execution 1976
• James C. King (IBM)
• Lori A. Clark (University of Massachusetts)
• if(x gt 0) y x2
• else if(x gt -1) y x1
• else y x
• (x gt 0) ? (y x2) (x 0 x gt -1) ? (y
  x1)
• (x -1) ? (y x)

5
??????????? ?????? (abstract domains)

• ??????????? ????????????? 1977
• Patrick Cousot, Radhia Cousot
• CNRS
• ??????????????? ?x ? y a
• ????????
• ?????? ???????? (heap structures)
• ??????? ???????

... while ( (x 0) (2f(x) lt zg(y/2.5))
) ... x ...
... while ( B ) ... B false ...
6
??????????? ??????????? ??????

• ESC/Modula 3 1998 DECGreg Nelson, K. Rustan M.
  Leino et al.
• ESC/Java 2000 CompaqLeino, Cormac Flanagan
• ASTREE 2002 Cousot http//www.astree.ens.fr/
• ESC/Java 2 2004http//kind.ucd.ie/products/opens
  ource/ESCJava2/
• Simplify
• Spec Checker 2004 Microsoft ResearchLeinohttp
  //research.microsoft.com/SpecSharp/
• Boogie

7
?????????? ??????????

• Runtime verification 1999 NASA
• Klaus Havelund, Willem Visser
• Java Path Finder ????????????? ??????????

8
?????????? ???????????

• Daikon 1999 MITMichael D. Ernsthttp//groups.c
  sail.mit.edu/pag/daikon/
• , ?, lt, , ax by cz d 0, x y2, x y
  0
• ?, ?, ?, ?, A?B?, subsequence, no duplicates,
  reverse
• Houdini 2001 Flanagan, Leino
• DIDUCE 2002 Stanford University
• Agitator 2003 Agitar

9
?????????? ???????????

• Solvers
• SMT solvers Satisfiability modulo Theory
• CVC 2002 StanfordDavid L. Dill, Clarke W.
  Barrett, Aaron Stump
• Yices 2005 SRI InternationalBruno Dutertre,
  Leonardo de Moura
• Z3 2006 Microsoft ResearchLeonardo de Moura,
  Nikolaj S. Bjørner

10
????????? ??????????? ??????

• ??????????? ?? ???????? ????? ? ????
• ?????? ?????????? ??????????NullPointer,
  IndexOutOfBounds, ClassCast, DivideByZero,
  IllegalArgument
• ????????? ???????? ?????? ? ???????????????????
• ?????????
• ????????????? ?????????
• ????????????? ??????????
• ???????
• ?????
• ??????????? ???????????? ????????????
• ????????? ?????? ?? ????????

11
?????

• Yannis Smaragdakis, Christoph Csallner
• JCrasher 2004 http//www.cc.gatech.edu/jcrasher/
• Check-n-Crash 2005
• DSD-Crasher 2006

Daikon
ESC/Java 2
solver
12
??????????? ???????????? ????? I

• Patrice Godefroid, Gul Agha, Koushik Sen
• DART 2005
• CUTE 2005 Consolic testing (concrete
  symbolic)
• jCUTE 2006

??????? ??????????
?????????
????? ????? ?????
????????????? ??????????
13
??????????? ???????????? ????? II

• SAGE 2007
• SMART 2007
• CREST 2008 http//code.google.com/p/crest/

00000000h 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 00 ................ 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 ................ 00000040h 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
................ 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 00 00 00 00 00 00 00 00 00
00 00 00 RIFF............ 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 ................ 00000040h 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
................ 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 00 00 00 00 20 00
00 00 00 RIFF.... .... 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 ................ 00000040h 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
................ 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 3D 00 00 00 20 00
00 00 00 RIFF... .... 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 00 00 00 00 00 00 00 00 00 00
00 00 ................ 00000040h 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
................ 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 3D 00 00 00 20 00
00 00 00 RIFF... .... 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 73 74 72 68 00 00 00 00 00 00
00 00 ....strh........ 00000040h 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
................ 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 3D 00 00 00 20 00
00 00 00 RIFF... .... 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 73 74 72 68 00 00 00 00 76 69
64 73 ....strh....vids 00000040h 00 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00
................ 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 3D 00 00 00 20 00
00 00 00 RIFF... .... 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 73 74 72 68 00 00 00 00 76 69
64 73 ....strh....vids 00000040h 00 00 00 00
73 74 72 66 00 00 00 00 00 00 00 00
....strf........ 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 3D 00 00 00 20 00
00 00 00 RIFF... .... 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 73 74 72 68 00 00 00 00 76 69
64 73 ....strh....vids 00000040h 00 00 00 00
73 74 72 66 00 00 00 00 28 00 00 00
....strf....(... 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 3D 00 00 00 20 00
00 00 00 RIFF... .... 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 73 74 72 68 00 00 00 00 76 69
64 73 ....strh....vids 00000040h 00 00 00 00
73 74 72 66 00 00 00 00 28 00 00 00
....strf....(... 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 C9 9D E4 4E ............É?äN 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 3D 00 00 00 20 00
00 00 00 RIFF... .... 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 73 74 72 68 00 00 00 00 76 69
64 73 ....strh....vids 00000040h 00 00 00 00
73 74 72 66 00 00 00 00 28 00 00 00
....strf....(... 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 01 00 00 00 ................ 0000
0060h 00 00 00 00
....
00000000h 52 49 46 46 3D 00 00 00 20 00
00 00 00 RIFF... .... 00000010h 00 00 00
00 00 00 00 00 00 00 00 00 00 00 00 00
................ 00000020h 00 00 00 00 00 00 00
00 00 00 00 00 00 00 00 00 ................ 0000
0030h 00 00 00 00 73 74 72 68 00 00 00 00 76 69
64 73 ....strh....vids 00000040h 00 00 00 00
73 74 72 66 B2 75 76 3A 28 00 00 00
....strf²uv(... 00000050h 00 00 00 00 00 00 00
00 00 00 00 00 01 00 00 00 ................ 0000
0060h 00 00 00 00
....
Generation 0 initial input 100 bytes of 00
Generation 1
Generation 2
Generation 3
Generation 4
Generation 5
Generation 6
Generation 7
Generation 8
Generation 9
Generation 10 bug ID 1212954973! Found after
only 3 generations starting from well-formed
seed file
14
????????? ?????? ?? ????????

• David Notkin, Tao Xie
• Wolfram Schulte, Nikolai Tillmann, Jonathan de
  Halleux
• Symstra 2005
• MUTT 2006
• Pex 2008http//research.microsoft.com/Pex/defaul
  t.aspx

15
?????? ???????????

• Eclat 2005
• EXE 2005
• Randoop 2007

16
?????
??????? ?? ????????