Re:Symbolic Execution: Intuition and Implementation
by Chris2048 on Friday March 09, 2018 @08:53AM
(#16551713)
I actually started building something similar in Python: it uses Mockito like 'mock"/"spy" objects to record calls to its methods, and the idea was to eventually branch at every test condition to automatically derive possible execution paths. Might go back to that :-)
The trick would be that conditions are tested via magic methods that return True/False (e.g. for > or ==), so you just need to branch at every test. You don't even need specific test values, just substitute object e.g if the test is X > Y, you don't need actual numbers, just an X that returns True/False for __gt__, and any Y since the actual evaluation is X.__gt__(Y). If more nuance is needed (consistency so that X > Y always has the same answer... unless you want to test for exotic things like inconstant 'number' objects) then you can have X return True/False depending on if passed argument 'is' the Y object. Maybe embed Y in X or a shared data-struct so that it can make this identification.
The trick would be that conditions are tested via magic methods that return True/False (e.g. for > or ==), so you just need to branch at every test. You don't even need specific test values, just substitute object e.g if the test is X > Y, you don't need actual numbers, just an X that returns True/False for __gt__, and any Y since the actual evaluation is X.__gt__(Y). If more nuance is needed (consistency so that X > Y always has the same answer... unless you want to test for exotic things like inconstant 'number' objects) then you can have X return True/False depending on if passed argument 'is' the Y object. Maybe embed Y in X or a shared data-struct so that it can make this identification.