DSD-Crasher is a bug finding tool that follows a three-step approach to program analysis: D. Capture the program's intended execution behavior with dynamic invariant detection. The derived invariants exclude many unwanted values from the program's input domain. S. Statically analyze the program within the restricted input domain to explore many paths. D. Automatically generate test cases that focus on verifying the results of the static analysis. Thereby confirmed results are feasible.
This three-step approach yields benefits compared to past two-step combinations in the literature. In our evaluation with third-party applications, we demonstrate higher precision over tools that lack a dynamic step and higher efficiency over tools that lack a static step.
DSD-Crasher adds a dynamic analysis step at the
front of the static-dynamic pipeline used by
Check 'n' Crash.
The goal of this first dynamic step is to infer the testee's intended behavior
from existing test cases. DSD-Crasher feeds inferred invariants to
Check 'n' Crash by annotating the testee.
This enables DSD-Crasher to suppress bug
warnings that are not relevant to the intended uses of the program.
In this example, the inferred invariant excludes negative input values.
DSD-Crasher therefore does not produce a warning about -1 causing
an exception as Check 'n' Crash might do.
PPT overview slides updated on
October 18, 2007.
Video of the
Microsoft Research talk I gave in Redmond, Washington on 28 August 2007.
PDF slides I used at ISSTA
in Portland, Maine on July 20, 2006.
Video of the Google tech talk
I gave in Mountain View, California on July 13, 2006.
PDF slides I used at ICSE
for the Check 'n' Crash talk in St. Louis, Missouri on May 20, 2005.
overview paper compares DSD-Crasher to its predecessors Check 'n' Crash and JCrasher. It appeared in the
Proceedings of the First International Conference on Tests And Proofs (TAP), February 2007.
The DSD-Crasher paper appeared in the Proceedings of the International Symposium on Software Testing and Analysis
(ISSTA), July 2006.
DSD-Crasher is a successor of and contains Check 'n' Crash. The Check 'n' Crash paper appeared in the Proceedings of the
27th International Conference on Software Engineering (ICSE), May 2005.
Check 'n' Crash is a successor of and contains JCrasher. The JCrasher paper appeared in Software--Practice & Experience, September 2004.
The DSD-Crasher paper received an
ACM SIGSOFT Distinguished Paper Award
at ISSTA 2006.