State Space Discovery by Guided Dynamic Analysis

Dynamic constraint inference techniques give precise results, but are usually limited to relatively few properties. This limitation often prohibits a dynamic constraint inference approach from expressing the essential behavior of a given program. This paper introduces the state space partitioning technique which applies the partitions implicit in a program’s source code to effectively introduce several types of disjunctive program-specific properties into the language of dynamic constraint inference. Disjunctive properties considered by our approach include object invariants and transitions between abstract states of the target program. The state space partitioning technique has been implemented in a tool called ContExt, which relies on Daikon for dynamic constraint inference tasks. We demonstrate that our approach specifies the essential behavior on five examples from different domains. In each case pure dynamic constraint inference fails to capture important constraints on the essential behavior of the program under analysis. The primary reason for this failure is the inexpressibility of a general and effectively computable disjunctive constraint in the language of dynamic constraint inference.