Koushik Sen's Homepage

<div class="container">
 <nav class="navbar navbar-inverse navbar-default">
 <div class="container-fluid">
 <div>
 <ul id="ks-menu" class="nav navbar-nav">
 <li><a href="#!ks-body=home.md">Home</a></li>
 <li><a href="#!ks-body=list.md">Reading List</a></li>
 <li><a href="#!ks-body=schedule.html">Schedule</a></li>
 <li><a href="#!ks-body=cute.html">Cute Homework</a></li>
 <li><a href="#!ks-body=racefuzzer.html">RaceFuzzer Homework</a></li>
 </ul>
 </div>
 </div>
 </nav>
 <div class="row vertical-divider">
 <div id="ks-body" class="col-md-12 kms-location" style="padding-right: 1em;" data-content="home"></div>
 </div>
 <div class="navbar navbar-inverse navbar-default" style="bottom: 0; height: 2em; padding-left: 2em; padding-top: 1em;">
 © 2015 <a href="https://www.cs.berkeley.edu/~ksen/">Koushik Sen</a>
 </div>
 <script type="text/javascript">
 $('.navbar li').click(function(e) {
 $('.navbar li.active').removeClass('active');
 var $this = $(this);
 if (!$this.hasClass('active')) {
 $this.addClass('active');
 }
 return true;
 });
 </script>
</div>

### Welcome to CS 294-15: Advanced Topics in Testing, Debugging, and Program Analysis: Fall 2016
 
### General Information
 
  * **Instructor:** [Koushik Sen](https://people.eecs.berkeley.edu/~ksen/) (Office: 735 Hall)
  * **Time and Place:** Monday 1:00 pm - 2:30 pm and Tuesday 12:30 pm - 2:00 pm, 320 Soda Hall
  * **Office Hours:** Tuesdays 2 pm - 3 pm, 735 Soda Hall
  * **Credits:** 3 units
  * **Prerequisites:** Students should be familiar with the basics of programming languages and should have moderate programming experience. Please consult the instructor, if you are not sure of your qualifications.
  * **Piazza URL (Discussion and Review website):** [https://piazza.com/berkeley/fall2016/cs29415/](https://piazza.com/berkeley/fall2016/cs29415/)
  * **Course URL:** [https://people.eecs.berkeley.edu/~ksen/cs29415fall16.html](https://people.eecs.berkeley.edu/~ksen/cs29415fall16.html)
 
### Course Description
 
Today's software systems suffer from poor reliability.  NIST estimates that $60 billion is lost annually in the US due to software errors, and such errors in transportation, medicine, and other areas can put lives at risk.  This indicates that our techniques to ensure software reliability are far from the level of maturity attained by other engineering disciplines that create critical infrastructure.  The situation is likely to get worse, as the complexity of software systems increases without a matching increase in the effectiveness of software quality tools and techniques.  Testing is the only predominant technique used by the software industry to make software reliable.  Studies show that testing accounts for more than half of the total software development cost in industry. Although testing is a widely used and a well-established technique for building reliable software, existing techniques for testing are mostly ad hoc and ineffective---serious bugs are often exposed post-deployment.  A number of recent techniques and tools have combined ideas from program analysis, automated theorem proving, constraint solving, and formal methods and have shown great promises in making software reliable and secure. In this graduate seminar, we will study this new trend with a special focus on automated bug finding, debugging, program analysis, and applications of machine learning to software development. 
 
### We will study:
 
  * Automated test generation: 
    * symbolic execution, 
	* fuzz testing, 
	* concurrency testing
  * Automated debugging: 
    * delta debugging, 
	* program slicing
  * Applications of machine learning to programming tools
  * (Dynamic) Program analysis:
 
### Goals of this course:
 
  * To help students start research in the area of program analysis of sequential and concurrent systems.
  * To help students to apply the techniques learned in this course in their ongoing research in other areas such as parallel computing, operating systems, computer networks, security, and database systems.
 
### Lecture Format and Student Workload
 
The course readings will include a selected list of papers. Students will read papers ahead of time, review papers, participate in discussions, and do a research project in small teams or individually.  
 
### Grading Details
 
  * Project (1-2 student team): (50%) A project must involve new research: it may involve designing a new algorithm, improving an existing technique, or performing a large case study. The idea behind each project should be evaluated by experiments on publicly used programs. The evaluation metrics should be performance improvement, scalability, or discovering previously unknown bugs. 
  * Paper review, class participation, and paper presentation: (30%) We will discuss one paper per meeting. A student will submit a short written review (at most 500 words) of each paper. Reviews will be made available to all students.
  * Homework (20%).
  * Must get B in each category to pass the class.
 
### Reference Books
 
This course has no required textbook. Research papers and slides will be posted online as needed.

@inproceedings{GKSpldi05,
  AUTHOR =       {Patrice Godefroid and Nils Klarlund and Koushik Sen},
  TITLE =        {{DART}: Directed Automated Random Testing},
  BOOKTITLE = {ACM SIGPLAN 2005 Conference on Programming Language Design and Implementation (PLDI'05)},
  pages = "213--223",
  year=2005,
    myconfname={PLDI'05},
    myconfurl={http://research.ihost.com/pldi2005/},
    ps={papers/dart.ps},
    pdf={papers/dart.pdf},
    slides={slides/dart-fm.ppt},
	mydate={August 30},
	myspeaker={Koushik Sen}
}

@inproceedings{SMAfse05,
    author={Koushik Sen and Darko Marinov and Gul Agha},
    title={{CUTE}: A Concolic Unit Testing Engine for {C}},
    booktitle={5th joint meeting of the European Software Engineering Conference and
               ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE'05) },
    pages = "263--272",
    year= 2005,
    publisher={ACM},
    myconfname={ESEC/FSE'05},
    myconfurl={http://esecfse05.di.fct.unl.pt/},
    ps={papers/C159-sen.ps},
    pdf={papers/C159-sen.pdf},
    tr={papers/cute-tr.pdf},
    slides = {slides/fse05.ppt},
	mydate={September 6},
	myspeaker={Koushik Sen}
}

@inproceedings{SNGCfse15,
    TITLE = {MultiSE: Multi-Path Symbolic Execution using Value Summaries},
    AUTHOR = {Koushik Sen and George Necula and Liang Gong and Wontae Choi},
    BOOKTITLE = {10th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE'15)},
    publisher = {ACM},
    year = 2015,
    myconfname={ESEC/FSE'15},
    pdf={papers/multise.pdf},
    myconfurl={http://esec-fse15.dei.polimi.it/},
	mydate={September 6},
	myspeaker={Koushik Sen}
}

@inproceedings{cadar2008klee,
  title={KLEE: Unassisted and Automatic Generation of High-Coverage Tests for Complex Systems Programs.},
  author={Cadar, Cristian and Dunbar, Daniel and Engler, Dawson R and others},
  booktitle={OSDI},
  volume={8},
  pages={209--224},
  year={2008},
  pdf={http://hci.stanford.edu/cstr/reports/2008-03.pdf},
  mydate={September 12},
  myspeaker={Nathan Zhang},
  myconfname={OSDI'08},
  myconfurl={https://www.usenix.org/event/osdi08/}
}

@inproceedings{Claessen:2000:QLT:351240.351266,
 author = {Claessen, Koen and Hughes, John},
 title = {QuickCheck: A Lightweight Tool for Random Testing of Haskell Programs},
 booktitle = {Proceedings of the Fifth ACM SIGPLAN International Conference on Functional Programming},
 series = {ICFP '00},
 year = {2000},
 isbn = {1-58113-202-6},
 pages = {268--279},
 numpages = {12},
  pdf={http://www.cs.tufts.edu/~nr/cs257/archive/john-hughes/quick.pdf},
  mydate={September 13},
  myspeaker={Marquita Ellis},
  myconfname={ICFP'00},
  myconfurl={http://www.icfpconference.org/archived/icfp2000/lampwww.epfl.ch/~odersky/icfp2000/}
}

@inproceedings{cha:oakland15,
    author = {Sang Kil Cha and Maverick Woo and David Brumley},
    title = {{Program-Adaptive Mutational Fuzzing}},
    booktitle ={oakland},
    year = {2015},
    pages = {725--741},
	pdf ={http://softsec.kaist.ac.kr/~sangkilc/papers/cha-oakland15.pdf},
  mydate={September 19},
  myspeaker={Sumukh Sridhara},
  myconfname={Oakland'15},
  myconfurl={http://www.ieee-security.org/TC/SP2015/}
}

@inproceedings{aflfast,
title={Coverage-based Greybox Fuzzing as Markov Chain},
author={Marcel Böhme and Van Thuan Pham and Abhik Roychoudhury},
booktitle={23rd ACM Conference on Computer and Communications Security (CCS)},
year={2016},
  pdf={https://www.comp.nus.edu.sg/~mboehme/paper/CCS16.pdf},
  mydate={September 20},
  myspeaker={Caroline Lemieux},
  myconfname={CCS'16},
  myconfurl={https://www.sigsac.org/ccs/CCS2016/}
}

@inproceedings{yang2011finding,
  title={Finding and understanding bugs in C compilers},
  author={Yang, Xuejun and Chen, Yang and Eide, Eric and Regehr, John},
  booktitle={ACM SIGPLAN Notices},
  volume={46},
  number={6},
  pages={283--294},
  year={2011},
  organization={ACM},
  pdf={https://www.cs.utah.edu/~chenyang/papers/pldi11-preprint.pdf},
  mydate={September 26},
  myspeaker={Kevin Laeufer},
  myconfname={PLDI'11},
  myconfurl={http://pldi11.cs.utah.edu/}
}

@inproceedings{holler2012fuzzing,
  title={Fuzzing with code fragments},
  author={Holler, Christian and Herzig, Kim and Zeller, Andreas},
  booktitle={Presented as part of the 21st USENIX Security Symposium (USENIX Security 12)},
  pages={445--458},
  year={2012},
  pdf={https://www.st.cs.uni-saarland.de/publications/files/holler-usenix-2012.pdf},
  mydate={September 27},
  myspeaker={Benjamin Mehne},
  myconfname={USENIX Security'12},
  myconfurl={https://www.usenix.org/conference/usenixsecurity12/technical-sessions/presentation/holler}
}

@inproceedings{agrawal1990dynamic,
  title={Dynamic program slicing},
  author={Agrawal, Hiralal and Horgan, Joseph R},
  booktitle={ACM SIGPLAN Notices},
  volume={25},
  number={6},
  pages={246--256},
  year={1990},
  organization={ACM},
  pdf={http://www.cs.columbia.edu/~junfeng/08fa-e6998/sched/readings/slicing.pdf},
  mydate={October 10},
  myspeaker={Marten Lohstroh},
  myconfname={PLDI'90},
  myconfurl={http://dl.acm.org/citation.cfm?id=93542}
}

@article{zeller2002simplifying,
  title={Simplifying and isolating failure-inducing input},
  author={Zeller, Andreas and Hildebrandt, Ralf},
  journal={IEEE Transactions on Software Engineering},
  volume={28},
  number={2},
  pages={183--200},
  year={2002},
  publisher={IEEE},
  pdf={https://pag-www.gtisc.gatech.edu/courses/common/zeller-tse02.pdf},
  mydate={October 11},
  myspeaker={Koushik Sen},
  myconfname={TSE'02},
  myconfurl={http://ieeexplore.ieee.org/xpl/RecentIssue.jsp?punumber=32}
}

@inproceedings{hybrid,
 author = {O'Callahan, Robert and Choi, Jong-Deok},
 title = {Hybrid Dynamic Data Race Detection},
 booktitle = {Proceedings of the Ninth ACM SIGPLAN Symposium on Principles and Practice of Parallel Programming},
 series = {PPoPP '03},
 year = {2003},
 isbn = {1-58113-588-2},
 location = {San Diego, California, USA},
 pages = {167--178},
 numpages = {12},
 url = {http://doi.acm.org/10.1145/781498.781528},
 doi = {10.1145/781498.781528},
 acmid = {781528},
 publisher = {ACM},
 address = {New York, NY, USA},
  pdf={http://web5.cs.columbia.edu/~junfeng/09fa-e6998/papers/hybrid.pdf},
  mydate={October 17},
  myspeaker={TBD},
  myconfname={PPoPP'03},
  myconfurl={http://ppopp.lcs.mit.edu/}
}

@inproceedings{JPSNpldi09,
    TITLE = {A Randomized Dynamic Program Analysis Technique for Detecting Real Deadlocks},
    AUTHOR = {Pallavi Joshi and Chang-Seo Park and Koushik Sen and Mayur Naik},
    BOOKTITLE = {ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI'09)},
    publisher={ACM},
pages     = {110--120},
    year = 2009,
    myconfname={PLDI'09},
    myconfurl={http://www-plan.cs.colorado.edu/~pldi09/},
    pdf = {https://people.eecs.berkeley.edu/~ksen/papers/deadlock.pdf},
  mydate={October 18},
  myspeaker={TBD}
}

@inproceedings{GPSfse15,
    TITLE = {JITProf: Pinpointing JIT-unfriendly JavaScript Code},
    AUTHOR = {Liang Gong and Michael Pradel and Koushik Sen},
    BOOKTITLE = {10th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE'15)},
    publisher = {ACM},
    year = 2015,
    myconfname={ESEC/FSE'15},
    pdf={papers/jitprof.pdf},
    myconfurl={http://esec-fse15.dei.polimi.it/},
  mydate={October 24},
  myspeaker={Liang Gong}
}

@inproceedings{JSSCfse15,
    TITLE = {MemInsight: Platform-Independent Memory Debugging for JavaScript},
    AUTHOR = {Simon Jensen and Manu Sridharan and Koushik Sen and Satish Chandra},
    BOOKTITLE = {10th Joint Meeting of the European Software Engineering Conference and the ACM SIGSOFT Symposium on the Foundations of Software Engineering (ESEC/FSE'15)},
    publisher = {ACM},
    year = 2015,
    myconfname={ESEC/FSE'15},
    pdf={papers/meminsight.pdf},
    myconfurl={http://esec-fse15.dei.polimi.it/},
  mydate={October 25},
  myspeaker={Koushik Sen}
}

@inproceedings{chess,
 author = {Musuvathi, Madanlal and Qadeer, Shaz},
 title = {Iterative Context Bounding for Systematic Testing of Multithreaded Programs},
 booktitle = {Proceedings of the 28th ACM SIGPLAN Conference on Programming Language Design and Implementation},
 series = {PLDI '07},
 year = {2007},
 pages = {446--455},
 numpages = {10},
 publisher = {ACM},
    myconfname={PLDI'07},
    pdf={https://www.microsoft.com/en-us/research/wp-content/uploads/2016/02/chess-pldi07-iterativecontextbounding.pdf},
    myconfurl={http://dblp.uni-trier.de/db/conf/pldi/pldi2007.html},
  mydate={November 7},
  myspeaker={Alex Reinking}
}

@inproceedings{dpor,
 author = {Flanagan, Cormac and Godefroid, Patrice},
 title = {Dynamic Partial-order Reduction for Model Checking Software},
 booktitle = {Proceedings of the 32Nd ACM SIGPLAN-SIGACT Symposium on Principles of Programming Languages},
 series = {POPL '05},
 year = {2005},
 isbn = {1-58113-830-X},
 location = {Long Beach, California, USA},
 pages = {110--121},
 numpages = {12},
 publisher = {ACM},
    myconfname={POPL'05},
    pdf={https://users.soe.ucsc.edu/~cormac/papers/popl05.pdf},
    myconfurl={https://www.cs.princeton.edu/~dpw/popl/05/},
  mydate={November 8},
  myspeaker={Rafael Dutra}
}

@inproceedings{localness,
 author = {Tu, Zhaopeng and Su, Zhendong and Devanbu, Premkumar},
 title = {On the Localness of Software},
 booktitle = {Proceedings of the 22Nd ACM SIGSOFT International Symposium on Foundations of Software Engineering},
 series = {FSE 2014},
 year = {2014},
 isbn = {978-1-4503-3056-5},
 location = {Hong Kong, China},
 pages = {269--280},
 numpages = {12},
 publisher = {ACM},
    myconfname={FSE'05},
    pdf={http://macbeth.cs.ucdavis.edu/cache-model.pdf},
    myconfurl={https://fse22.gatech.edu/},
  mydate={November 14},
  myspeaker={Michael Knyszek}
}

@inproceedings{Bielik2016PHOGPM,
  title={PHOG: Probabilistic Model for Code},
  author={Pavol Bielik and Veselin Raychev and Martin T. Vechev},
  booktitle={ICML},
  year={2016},
      myconfname={ICML'16},
    pdf={http://www.srl.inf.ethz.ch/papers/icml16_phog.pdf},
    myconfurl={http://icml.cc/2016/},
  mydate={November 15},
  myspeaker={Rohan Padhye}
}

@inproceedings{reps,
  title={Program analysis via graph reachability},
  author={Thomas Reps},
  booktitle={Information and Software Technology},
  year={1998},
      myconfname={IST'98},
    pdf={http://www.cs.wisc.edu/wpis/papers/tr1386.pdf},
    myconfurl={http://www.journals.elsevier.com/information-and-software-technology/},
  mydate={November 21},
  myspeaker={Koushik Sen}
}

@inproceedings{Bravenboer:2009:SDS:1640089.1640108,
 author = {Bravenboer, Martin and Smaragdakis, Yannis},
 title = {Strictly Declarative Specification of Sophisticated Points-to Analyses},
 booktitle = {Proceedings of the 24th ACM SIGPLAN Conference on Object Oriented Programming Systems Languages and Applications},
 series = {OOPSLA '09},
 year = {2009},
 isbn = {978-1-60558-766-0},
 location = {Orlando, Florida, USA},
 pages = {243--262},
 numpages = {20},
 url = {http://doi.acm.org/10.1145/1640089.1640108},
 doi = {10.1145/1640089.1640108},
 acmid = {1640108},
 publisher = {ACM},
 address = {New York, NY, USA},
 keywords = {DOOP, bdds, datalog, declarative, points-to analysis},
      myconfname={OOPSLA'09},
    pdf={http://yanniss.github.io/doop-oopsla09prelim.pdf},
    myconfurl={http://www.oopsla.org/oopsla2009/},
  mydate={November 22},
  myspeaker={Koushik Sen}
}

<h2>Introduction</h2>
In this assignment, you need to implement a test input generation tool, similar to DART and CUTE. Contact Koushik Sen with any questions. The slides explaining the assignment can be found at&nbsp;<a href="http://srl.cs.berkeley.edu/~ksen/Assignment.ppt">http://srl.cs.berkeley.edu/~ksen/Assignment.ppt</a>&nbsp;.
<h2>Requirement</h2>
Windows or Linux or Mac OS X. Sun's JDK 1.6 and ant (<a href="http://ant.apache.org/)">http://ant.apache.org/)</a>.
You need to make sure that you are running JDK 1.6. The implementation will not work on higher versions of Java. Follow the instructions at <a href="http://stackoverflow.com/questions/21964709/how-to-set-or-change-the-default-java-jdk-version-on-os-x">this</a> URL to temporarily switch to Java 1.6 on a Mac. 
<h2>Installation</h2>
The infrastructure required to implement the tool can be downloaded from&nbsp;<a href="http://srl.cs.berkeley.edu/~ksen/hw1.zip" search_id="undefined">http://srl.cs.berkeley.edu/~ksen/hw1.zip</a>&nbsp;.&nbsp;&nbsp;Invoke the following commands to install the infrastructure.
<pre>
uncompress hw1.zip
cd hw1
ant
ant instrument-benchmarks
</pre>
<h2>Description</h2>
Input: A Java program, say Testme.java.&nbsp;&nbsp;The following library functions can used to provide primitive inputs to a Java program
<pre>
int edu.berkeley.cs.wise.concolic.Concolic.input.Integer()
long edu.berkeley.cs.wise.concolic.Concolic.input.Long()
short edu.berkeley.cs.wise.concolic.Concolic.input.Short()
byte edu.berkeley.cs.wise.concolic.Concolic.input.Byte()
char edu.berkeley.cs.wise.concolic.Concolic.input.Character()
boolean edu.berkeley.cs.wise.concolic.Concolic.input.Boolean()
</pre>

See the Java files in the directory benchmarks/edu/berkeley/cs/wise/benchmarks/&nbsp;to understand the usage of these functions. In this assignment, we will assume that inputs can only be of integral primitive types, such as int, char, long, short, byte, long.

Given a Java program, we want to generate inputs using concolic execution.&nbsp;&nbsp;The generated inputs should explore all feasible execution paths of the program. The infrastructure provides two scripts: run-jcute.sh and runall.sh. &nbsp;Run "ant instrument-benchmarks" to instrument all Java files under the directory benchmarks/. &nbsp;The instrumented classes are generated in the&nbsp;tmpclasses/ directory.

If we execute an instrumented Java class, it generates a file called &ldquo;trace&rdquo;. Try the following commands to see the trace file.
<pre>
java -cp tmpclasses:classes&nbsp;edu.berkeley.cs.wise.benchmarks.Testme
cat trace
</pre>

An execution of the instrumented executable file reads a special file &ldquo;input&rdquo;, if present, to initialize the inputs. If the input file is absent, then all the inputs are initialized to 0 during the execution. A complete snapshot of the above 3 commands is given below.

<pre>
Koushik-Sens-MacBook-Pro:hw1 ksen$ ant instrument-benchmarks
Buildfile: /Users/ksen/hw1/build.xml
init:
build-project:
 [echo] wise: /Users/ksen/hw1/build.xml
build-benchmarks:
 [echo] wise: /Users/ksen/hw1/build.xml
build:
instrument-benchmarks-clean:
 [delete] Deleting: /Users/ksen/hw1/iidToLine.map
 [delete] Deleting: /Users/ksen/hw1/iidToLine.map.html
instrument-benchmarks:
 [java] Soot started on Wed Sep 07 22:10:53 PDT 2011
 [java] No main class given. Inferred 'edu.berkeley.cs.wise.benchmarks.BellmanFord' as main class.
 [java] Transforming edu.berkeley.cs.wise.benchmarks.BellmanFord... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.BinaryTreeSearch$1... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.BinaryTreeSearch$BinaryTree$Node... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.BinaryTreeSearch$BinaryTree... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.BinaryTreeSearch... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.BuggyDijkstra... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.Dijkstra... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.HeapInsertJDK15... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.InsertionSort... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.java15.lang.Math... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.java15.util.AbstractCollection... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.java15.util.AbstractQueue... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.java15.util.Arrays... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.java15.util.PriorityQueue$1... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.java15.util.PriorityQueue$Itr... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.java15.util.PriorityQueue... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.Linear... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.MergeSortJDK15... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.QuickSortJDK15... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.rbtree.Node... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.rbtree.RedBlackTree... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.rbtree.RedBlackTreeNode... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.RedBlackTreeSearch... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.SimpleObject... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.SortedListInsert$List... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.SortedListInsert... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.Testme... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.Tsp$TspSolver... 
 [java] Transforming edu.berkeley.cs.wise.benchmarks.Tsp... 
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/BellmanFord.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/BinaryTreeSearch$1.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/BinaryTreeSearch$BinaryTree$Node.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/BinaryTreeSearch$BinaryTree.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/BinaryTreeSearch.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/BuggyDijkstra.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/Dijkstra.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/HeapInsertJDK15.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/InsertionSort.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/lang/Math.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/AbstractCollection.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/AbstractQueue.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/Arrays.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/PriorityQueue$1.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/PriorityQueue$Itr.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/PriorityQueue.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/Linear.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/MergeSortJDK15.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/QuickSortJDK15.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/rbtree/Node.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/rbtree/RedBlackTree.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/rbtree/RedBlackTreeNode.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/RedBlackTreeSearch.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/SimpleObject.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/SortedListInsert$List.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/SortedListInsert.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/Testme.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/Tsp$TspSolver.class
 [java] Writing to tmpclasses/edu/berkeley/cs/wise/benchmarks/Tsp.class
 [java] Soot finished on Wed Sep 07 22:11:03 PDT 2011
 [java] Soot has run for 0 min. 9 sec.
 [java] Java2HTML Version 1.5
 [java] Copyright (c) 1999-2007, Enterprise Solution Consultants Limited, All Rights Reserved.
 [java] New Versions available from http://www.java2html.com
 [java] (type j2h with no arguments to get help)
 [java] Created /Users/ksen/hw1/tmpclasses/stylesheet.css
 [java] Created /Users/ksen/hw1/tmpclasses/front.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/SimpleObject.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/Testme.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/rbtree/Node.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/BinaryTreeSearch.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/MergeSortJDK15.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/QuickSortJDK15.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/AbstractQueue.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/rbtree/RedBlackTree.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/Linear.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/RedBlackTreeSearch.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/Dijkstra.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/Tsp.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/SortedListInsert.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/AbstractCollection.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/HeapInsertJDK15.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/lang/Math.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/InsertionSort.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/PriorityQueue.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/BellmanFord.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/java15/util/Arrays.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/BuggyDijkstra.java.html
 [java] Created: /Users/ksen/hw1/tmpclasses/edu/berkeley/cs/wise/benchmarks/rbtree/RedBlackTreeNode.java.html
BUILD SUCCESSFUL
Total time: 12 seconds
Koushik-Sens-MacBook-Pro:hw1 ksen$ java -cp tmpclasses:classes edu.berkeley.cs.wise.benchmarks.Testme
0 0 x=0 y=0
I am fine here
Koushik-Sens-MacBook-Pro:hw1 ksen$ cat trace
(65537,_) = (int)(x1,_)
(65538,_) = (int)(x2,_)
(131073,_) = (65537,_)
(131091,_) = (0,2) * (131073,0)
(65539,_) = (131091,_)
else:537 (65539,0) != (65538,0)
(65553,_) = (65538,0) + (0,10)
else:539 (65537,0) == (65553,10)
Koushik-Sens-MacBook-Pro:hw1 ksen$ 
</pre>
A trace gives a sequence of instructions executed by the program. Instructions can be of three types: assignments or conditionals or error. We next describe these three types of instructions in details.

An error instruction is simply the string

error

An error instruction appears at the end of a trace if the program execution does not reach the end of the main method.

An assignment instruction can be of the following form:

lvalue = rvalue + rvalue
lvalue = rvalue - rvalue
lvalue = rvalue * rvalue
lvalue = rvalue / rvalue
lvalue = rvalue % rvalue
lvalue = rvalue op rvalue&nbsp;
lvalue = rvalue
lvalue = - rvalue
lvalue = op rvalue

where op could be any arbitrary operator (i.e. an operator that we cannot handle in our decision procedure), an lvalue or a rvlaue is a pair of memory address and the value stored at the memory address. Thus a lvalue or a rvalue can be of the form

(m,*m)

If the memory address m is 0, then the pair represents a constant. If the value *m is _, then the value of *m is not required for the symbolic execution and we can ignore it. The value stored at a memory address, i.e. *m, is used if the symbolic state has no mapping for m during concolic execution. A special kind of assignment statement is of the following form.

(m,_) = (type)(xn,_)

This statement assigns the symbolic input value xn to the memory location m. An example of such an instruction is

(2280636,_) = (int)(x2,_)

A conditional instruction is always of the following forms.

then:branchid true
then:branchid rvalue &lt; rvalue
then:branchid rvalue &lt;= rvalue
then:branchid rvalue &gt; rvalue
then:branchid rvalue &gt;= rvalue
then:branchid rvalue == rvalue
then:branchid rvalue != rvalue
then:branchid rvalue op rvalue
then:branchid op rvalue

else:branchid true
else:branchid rvalue &lt; rvalue
else:branchid rvalue &lt;= rvalue
else:branchid rvalue &gt; rvalue
else:branchid rvalue &gt;= rvalue
else:branchid rvalue == rvalue
else:branchid rvalue != rvalue
else:branchid rvalue op rvalue
else:branchid op rvalue

where the prefix then:branchid means that we have taken the &ldquo;then&rdquo; branch of some &ldquo;if-then-else&rdquo; statement in the execution and the prefix else:branchid means that the execution has taken the &ldquo;else&rdquo; branch of some &ldquo;if-then-else&rdquo; statement.&nbsp;&nbsp;The &ldquo;branchid&rdquo; statically identifies the &ldquo;then&rdquo; or &ldquo;else&rdquo; branch---each &ldquo;then&rdquo; or &ldquo;else&rdquo; branch in the program has a unique branch id.&nbsp;&nbsp;The suffix gives the actual instruction executed during the execution. A suffix &ldquo;true&rdquo; means that the execution of the conditional generates the trivial symbolic constraint &ldquo;true&rdquo;.

Problem

You need to write a program (in any language such as Java, C, C++, Perl, or Python), say mycute, which will take a trace file and generate an input file. A sample input file is shown below. An input file gives a mapping from symbolic input values to concrete values.

sat
(= x1 -10)
(= x2 -20)

where each xi is a symbolic input value encountered during the execution and each integer is the concrete value that should be used in the next execution. Once you have produced a file &ldquo;input&rdquo;, if you re-execute the instrumented executable, then the program will take input values from the &ldquo;input&rdquo; file. Note that during the first execution of the instrumented executable, the input file should not be present. In the first execution, the program will initialize all inputs with 0. In subsequent executions, the instrumented executable will use inputs from the file &ldquo;input&rdquo;.

Your program will thus take a &ldquo;trace&rdquo; file and use it to perform concolic execution and generate the file &ldquo;input&rdquo; that will force the program to take a different path in the next execution. Like DART, you need to only worry about linear arithmetic and you should use the yices 1.0.29 theorem prover for constraint solving. The details on how to use yices can be found at&nbsp;<a href="http://yices.csl.sri.com/.">http://yices.csl.sri.com/.</a>&nbsp;&nbsp;The following guidelines must be followed to get full points.

1. The search must be DFS; so you may need to maintain extra files between executions.&nbsp;&nbsp;Specifically, your algorithm should maintain the &ldquo;stack&rdquo; data structure (see Figure 3, 4, 5 of the DART paper) across executions.&nbsp;&nbsp;

2. Symbolic execution of statements and predicates should be done according to Figure 5 and 6 of the CUTE paper.&nbsp;&nbsp;If a memory location maps to a constant, the mapping should be removed from the symbolic state.&nbsp;&nbsp;This helps to save memory.

3. For every statement of the form (m,_) = (type)(xi,_), you must generate a couple of symbolic constraints: (xi &lt;= MAX_type) and (xi &gt;= MIN_type), where MIN_type and MAX_type are minimum and maximum values that a variable of &ldquo;type&rdquo; can store, respectively.

4. Your program &ldquo;mycute&rdquo; must return 1, when it has explored all paths in the program and 0, otherwise.

5. You should report the total number of unique branches covered, total number of paths explored, and total number of erroneous paths (i.e. paths that throw an exception) &nbsp;for each benchmark.

6. You should implement the three optimizations mentioned in the CUTE paper to get bonus points.

A sample sequence of commands to test Testme.java would be the following.

<pre>
rm input
java -cp tmpclasses:classes edu.berkeley.cs.wise.benchmarks.Testme
./mycute
java -cp tmpclasses:classes edu.berkeley.cs.wise.benchmarks.Testme
./mycute
java -cp tmpclasses:classes edu.berkeley.cs.wise.benchmarks.Testme
./mycute
</pre>
After the last call to mycute, you should notify that a complete search has been done (since Testme.java has 3 execution paths.) Note that we invoke the two commands

<pre>
java -cp tmpclasses:classes&nbsp;edu.berkeley.cs.wise.benchmarks.Testme
./mycute
</pre>

iteratively to generate inputs one by one. The script run-jcute.sh can be used to automatically perform this iteration. Therefore, if you do not want to invoke the commands automatically, you can call

<pre>
./run-jcute.sh ./mycute edu.berkeley.cs.wise.benchmarks.Testme -i 3
</pre>

where -i 3 says that we want to generate 3 inputs. Your program mycute must return 1 when a complete exploration of the computation tree is over; otherwise, it should return 0.

The directory benchmarks/edu/berkeley/cs/wise/benchmarks/&nbsp;has a number of sample Java programs that you need to test. A script runall.sh is provided to perform these tests in a batch.&nbsp;

<h1 align="center">CUTE Homework Part 2</h1>

In part 1, you implemented a depth first search (DFS) of the path space.&nbsp;&nbsp;However, DFS is not quite efficient in quickly achieving high branch coverage.&nbsp;&nbsp;In part 2, you need to implement your own search algorithm so that you can quickly achieve high branch coverage.&nbsp;&nbsp;Specifically, in each iteration, you need to pick a branch to negate according to some different strategy.&nbsp;&nbsp;You need to run your implementation on&nbsp;edu.berkeley.cs.wise.benchmarks.Replace&nbsp;and report the number of branches covered, number of iterations performed, and number of erroneous paths.&nbsp;&nbsp;The fewer the number of iterations and the higher the number of branches covered, the better is your algorithm.

September 28, 2016.
<h2>&nbsp;</h2>

<h2>How to submit?</h2>

You should email me a link to the entire archive before 11:59 pm on September 28, 2016 along with instructions to run it.&nbsp;&nbsp;Ideally, I will run the runall.sh script and see if your implementation generates exactly the same set of inputs as CUTE. Please come to my office on October 4, 2016&nbsp;afternoon to give me a demo.&nbsp;

<h1 style="text-align: center;">RaceFuzzer Homework</h1>
<h1 style="text-align: center;">&nbsp;</h1>
<h1>Introduction</h1>
Active testing has recently been introduced to effectively test concurrent programs.&nbsp; Active testing works in two phases. It first uses imprecise off-the-shelf static or dynamic program analyses to identify potential concurrency bugs, such as data races, deadlocks, and atomicity violations.&nbsp; In the second phase, active testing uses the reports from these imprecise analyses to explicitly control the underlying scheduler of the concurrent program to accurately and quickly discover real concurrency bugs, if any, with very high probability and little overhead.&nbsp; In this homework, you will be implementing the RaceFuzzer algorithm described in the following paper:
K. Sen, "Race Directed Randomized Testing of Concurrent Programs," in Proc. ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI'08), 2008, pp. 11-21.
<h1>Requirements</h1>
Windows or Linux or Mac OS X.&nbsp; You need pre-installed Sun&rsquo;s JDK 1.5 for Windows or Linux, or Apple&rsquo;s latest JDK for Mac OS X.&nbsp; You also need Apache&rsquo;s ANT (<a href="http://ant.apache.org/">http://ant.apache.org/</a>) for building and running your code. You need to make sure that you are running JDK 1.6. The implementation will not work on higher versions of Java. Follow the instructions at <a href="http://stackoverflow.com/questions/21964709/how-to-set-or-change-the-default-java-jdk-version-on-os-x">this</a> URL to temporarily switch to Java 1.6 on a Mac. 
<h1>Installation</h1>
The infrastructure required to implement RaceFuzzer can be downloaded from <a href="http://srl.cs.berkeley.edu/%7Eksen/calfuzzer.tar.gz">http://srl.cs.berkeley.edu/~ksen/calfuzzer.tar.gz</a>.&nbsp; Make sure that java, javac, and ant are in your PATH.&nbsp; Invoke the following commands to install the infrastructure.
tar zxvf calfuzzer.tar.gz
cd calfuzzer
ant
We have provided a simplified implementation of DeadlockFuzzer described in the following paper.
P. Joshi, C.-S. Park, K. Sen, and M. Naik, "A Randomized Dynamic Program Analysis Technique for Detecting Real Deadlocks," in Proc. ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI'09), 2009.
This is a reference implementation to show how the infrastructure works.&nbsp; You can test DeadlockFuzzer by running the following command.
ant &ndash;f run.xml deadlockfuzzer
In this homework, you will run
ant &ndash;f run.xml racefuzzer
and make sure it finds race conditions in the benchmark programs.&nbsp; Take a look at the target &ldquo;racefuzzer&rdquo; in run.xml to get acquainted with the benchmark programs on which you will be running your implementation.
<h1>Description</h1>
Read the papers raced.pdf and hybrid.pdf provided with the infrastructure to understand the algorithms that you are going to implement.&nbsp; Read the paper activetool.pdf to get a high-level description of the infrastructure.
You need to implement the classes
calfuzzer/src/javato/activetesting/HybridAnalysis.java
calfuzzer/src/javato/activetesting/RaceFuzzerAnalysis.java
Open these classes and see the inline comments.&nbsp; HybridAnalysis.java need to implement the Phase I described in the raced.pdf and RaceFuzzerAnalysis.java need to implement Phase 2 described in the same paper.&nbsp;
An implementation of an active testing algorithm, such as RaceFuzzer, AtomFuzzer, or DeadlockFuzzer, works in three steps:
In Step 1, the code under test is instrumented using the SOOT Compiler framework.&nbsp; The target &ldquo;instr&rdquo; in run.xml shows the actions taken by the instrumentor.&nbsp;&nbsp; The target &ldquo;test_race1&rdquo; in run.xml shows how to invoke the target &ldquo;instr&rdquo;.&nbsp; The instrumentor inserts various static method calls inside the bytecode under test.&nbsp; The set of methods that are inserted by the instrumentor is the set of all static methods starting with &ldquo;my&rdquo; in the file calfuzzer/src/javato/activetesting/analysis/ObserverForActiveTesting.java. The infrastructure provides an implementation of the instrumentor and you do not need to re-implement it.
In Step 2, the instrumented code is run once with an imprecise dynamic analysis, such as Hybrid Race Detector or iGoodlock.&nbsp; The target &ldquo;analysis-once&rdquo; in run.xml shows the action taken by an imprecise analysis.&nbsp; The following
<pre>
&lt;antcall target="analysis-once">
 &lt;param name="javato.activetesting.analysis.class" value="javato.activetesting.HybridAnalysis"/>
&lt;/antcall>
</pre>
shows how to invoke an imprecise analysis (Hybrid Race Detector in this case) by specifying the Java property &ldquo;javato.activetesting.analysis.class&rdquo;.&nbsp; An analysis class, such as HybridAnalysis needs to extend the abstract class javato.activetesting.analysis.AnalysisImpl (which implements the interface javato.activetesting.analysis.Analysis) and implement the following methods
<pre>
public interface Analysis {

public void initialize();

public void lockBefore(Integer iid, Integer thread, Integer lock);

public void unlockAfter(Integer iid, Integer thread, Integer lock);

public void newExprAfter(Integer iid, Integer object,Integer oInv);

public void methodEnterBefore(Integer iid);

public void methodExitAfter(Integer iid);

public void startBefore(Integer iid, Integer parent,Integer child);

public void waitAfter(Integer iid, Integer thread, Integer lock);

public void notifyBefore(Integer iid, Integer thread,Integer lock);

public void notifyAllBefore(Integer iid,Integer thread,Integer l);

public void joinAfter(Integer iid, Integer parent, Integer child);

public void readBefore(Integer iid, Integer thread, Long memory);

public void writeBefore(Integer iid, Integer thread, Long memory);

public void finish();

}
</pre>
The above methods get called before or after the execution of various instructions of the code under test.&nbsp; For example,
public void lockBefore(Integer iid, Integer thread, Integer lock);
gets called before thread with unique id &ldquo;thread&rdquo; acquires the lock with unique id &ldquo;lock&rdquo;.&nbsp; Similarly,
public void writeBefore(Integer iid, Integer thread, Long memory);
gets called before thread with unique id &ldquo;thread&rdquo; writes the memory location with address &ldquo;memory&rdquo;.&nbsp; In each method, the first argument &ldquo;iid&rdquo; gives a unique id to each statically inserted method call.&nbsp; The method javato.activetesting.analysis.Observer.getIidToLine(iid) could be used to get a String containing the file name and line number where the method call has been inserted.&nbsp;
See javato.activetesting.PrintTraceAnalysis for a simple analysis implementation that simply prints the trace of an execution.&nbsp; Run
ant &ndash;f run.xml print_trace
to test javato.activetesting.PrintTraceAnalysis.&nbsp; In step 2, you need to implement the class javato.activetesting.HybridAnalysis.&nbsp; This class should track vector clocks, locks sets, and a database of events and dump the potential races in the file error.log in a suitable format.&nbsp; You need to read error.log in the next step to identify the program locations where you need to pause during active testing.&nbsp; In my implementation of the hybrid race detector, I store a pair of iid to denote a potential race.
In step 3, the instrumented code is run repeatedly.&nbsp; If step 2 reports nRace number of potential race conditions, the instrumented code is run N*nRace times to perform active testing.&nbsp; In our examples, N = 10.&nbsp; The first N runs are run with javato.activetesting.common.Parameters.errorId set to 1, the second N runs are run with javato.activetesting.common.Parameters.errorId set of 2, etc.&nbsp; This number (i.e. javato.activetesting.common.Parameters.errorId) should be used in conjunction with the file &ldquo;error.log&rdquo; to get the program locations where you need to pause.
The target &ldquo;active-loop&rdquo; in run.xml shows the actions that active testing takes in each N executions of the program under test. The following
<pre>
&lt;antcall target="active-loop">
 &lt;param name="javato.activetesting.analysis.class" value="javato.activetesting.RaceFuzzerAnalysis"/>
&lt;/antcall>
</pre>
shows how to invoke an active tester (RaceFuzzer in this case) by specifying the Java property &ldquo;javato.activetesting.analysis.class&rdquo;.&nbsp; An analysis class, such as RaceFuzzerAnalysis needs to extend the abstract class javato.activetesting.analysis.CheckerAnalysisImpl, which is almost identical to the class javato.activetesting.analysis.CheckerAnalysisImpl, except that javato.activetesting.analysis.CheckerAnalysisImpl starts a couple of threads that breaks any potential system stalls and livelocks created by the active tester. See section 4 of raced.pdf to learn why such system stalls (i.e. deadlocks) or livelocks could happen.&nbsp; In step 3, you need to implement the class javato.activetesting.RaceFuzzerAnalysis.&nbsp; This class needs to use the ActiveChecker class in order to bias the random scheduler.
An active checker is implemented by extending the class javato.activetesting.activechecker.ActiveChecker declared below.
<pre>
public class ActiveChecker {

final protected void block(int milliSeconds) { … }

final protected void unblock(int milliSeconds) { … }

final public static void blockIfRequired() { … }

public void check(Collection<ActiveChecker> checkers) { block(0);}

final public void check() { … }

}
</pre>
An instance of a subclass of ActiveChecker (e.g. you should implement RaceChecker) is equivalent to a transition in Algorithm 1 in activetool.pdf.&nbsp; The check() method defined by this class should be used by RaceFuzzerAnalysis to check if a real race has been created and also to decide whether to pause the current thread or un-pause a paused thread.&nbsp; This method in turn calls the method check(Collection&lt;ActiveChecker&gt; checkers).&nbsp; A subclass of ActiveChecker (such as RaceChecker) should override the check(Collection&lt;ActiveChecker&gt; checkers) method.&nbsp; The argument &ldquo;Collection&lt;ActiveChecker&gt; checkers&rdquo; is a list of active checkers (i.e. threads or transitions) that has been paused.&nbsp; An implementation of the method check(Collection&lt;ActiveChecker&gt; checkers) could either block (i.e. pause) the current thread or activate (i.e. un-pause) some other thread that is already paused.&nbsp; In order to pause the current thread, the method block(int milliSeconds) should be called.&nbsp; If &ldquo;milliseconds&rdquo; is 0, then the current thread is paused indefinitely; otherwise, the thread is paused for &ldquo;milliseconds&rdquo;.&nbsp; In order to activate some other instance of ActiveChecker inside the check(Collection&lt;ActiveChecker&gt; checkers) method, unblock(int milliSeconds) should be called on the instance.&nbsp; The target thread is activated after &ldquo;milliseconds&rdquo;.
Note that the global lock ActiveChecker.lock is used to protect all code that you write.&nbsp; This is done to prevent any data race in your analysis code.&nbsp; Therefore, a call to ActiveChecker.block(0) by a thread while the thread is holding the lock ActiveChecker.lock could cause a system stall.&nbsp; Therefore, a call to ActiveChecker.block(0) does not pause the thread immediately, but records the fact that the thread needs to be paused as soon as&nbsp; it releases the lock ActiveChecker.lock.&nbsp; Therefore, we call the method ActiveChecker.blockIfRequired() after the lock ActiveChecker.lock has been released.&nbsp; If the current thread has been booked to pause then ActiveChecker.blockIfRequired() actually blocks the current thread.&nbsp; See DeadlockFuzzerAnalysis and the comments in RaceFuzzerAnalysis to see how ActiveChecker.blockIfRequired() should be used.
<h1>Due Date</h1>
November 22, 2016.
<h1>How to Submit?</h1>
You should email me a link to the entire archive before noon on November 22, 2016 along with instructions to run it.&nbsp; Ideally, I will run ant &ndash;f run.xml racefuzzer and see if your implementation reports exactly the same set of races reported by my implementation of RaceFuzzer. Come to my office on November 22, 2016 2-4pm to give me a demo.