Finding Inputs that Reach a Target Expression

Authors:
Matthew Naylor;Colin Runciman
Affiliations:
University of York, UK;University of York, UK
Venue:
SCAM '07 Proceedings of the Seventh IEEE International Working Conference on Source Code Analysis and Manipulation
Year:
2007

Citing 0
Cited 5

A functional-logic library for wired

Haskell '07 Proceedings of the ACM SIGPLAN workshop on Haskell workshop
Uniform boilerplate and list processing

Haskell '07 Proceedings of the ACM SIGPLAN workshop on Haskell workshop
Smallcheck and lazy smallcheck: automatic exhaustive testing for small values

Proceedings of the first ACM SIGPLAN symposium on Haskell
Not all patterns, but enough: an automatic verifier for partial but sufficient pattern matching

Proceedings of the first ACM SIGPLAN symposium on Haskell
Comparing libraries for generic programming in haskell

Proceedings of the first ACM SIGPLAN symposium on Haskell

Quantified Score

Hi-index	0.00

Visualization

Abstract

We present an automated program analysis, called Reach, to compute program inputs that cause evaluation of explicitly-marked target expressions. Reach has a range of applications including property refutation, assertion breaking, program crashing, program covering, program understanding, and the development of customised data generators. Reach is based on lazy narrowing, a symbolic evaluation strategy from functional-logic programming. We use Reach to analyse a range of programs, and find it to be a useful tool with clear performance benefits over a method based on exhaustive input generation. We also explore different methods for bounding the search space, the selective use of breadth-first search to find the first solution quickly, and techniques to avoid evaluation that is unnecesary to reach a target.