TargetDescriptorConstPtr ConcolicTargetGenerator::permuteTarget(EventHandlerDescriptorConstPtr eventHandler,
TargetDescriptorConstPtr oldTarget,
ExecutionResultConstPtr result) const
{
// Notice that this function can be called multiple times with the same "oldTarget" and "result", because of how Artemis functions.
// In this case the concolic analysis can return new explorations until there is nothing left to explore in the execution tree.
// We only start the symbolic session for the last event to be executed, and permuteTarget is only called for the
// last event in an event sequence! -- we can assume that the event sequence reaching this event is constant.
// oldTarget should be of type ConcolicTargetDescriptor
ConcolicTargetDescriptorConstPtr target = oldTarget.dynamicCast<const ConcolicTarget>();
assert(!target.isNull());
QString eventName = eventHandler->toString();
// Request suggestions of new targets to explore from the concolic analysis.
ConcolicAnalysis::ExplorationResult exploration = target->getAnalysis()->nextExploration();
if (!exploration.newExploration) {
Log::debug("Could not find any new exploration");
outputTree(target->getAnalysis()->getExecutionTree(), eventName, target->getAnalysis()->getExplorationIndex());
return TargetDescriptorConstPtr(NULL);
}
Log::debug("Found solution for new target value:");
printSolution(exploration.solution);
outputTree(target->getAnalysis()->getExecutionTree(), eventName, target->getAnalysis()->getExplorationIndex());
// The symbolic variable for the target will be TARGET_0.
Symbolvalue newTarget = exploration.solution->findSymbol("SYM_TARGET_0");
assert(newTarget.found); // TODO: should probably be a soft requirement once we are sure everything is working??
QString targetXPath = QString::fromStdString(newTarget.string);
// If a target is found, then return a ConcolicTarget with the context and a representation (xpath) of the target.
// The runtime will call "get" on the target in the next iteration and use the xpath to find the real target.
return TargetDescriptorConstPtr(new ConcolicTarget(eventHandler, targetXPath, target->getAnalysis(), exploration.target));
}
TargetDescriptorConstPtr ConcolicTargetGenerator::generateTarget(EventHandlerDescriptorConstPtr eventHandler) const
{
// Create a context and save a reference in the returned target.
// This reference can then be pulled out from oldTarget in permuteTarget below.
ConcolicAnalysisPtr analysis(new ConcolicAnalysis(mOptions, ConcolicAnalysis::QUIET));
analysis->setDomSnapshotStorage(mDomSnapshotStorage);
ConcolicAnalysis::ExplorationHandle explorationTarget = ConcolicAnalysis::NO_EXPLORATION_TARGET;
// No trace has been recorded yet, so we do not suggest any target values intelligently.
// This method should do the naive solution and return a target == base handler (see legacy target impl.)
return TargetDescriptorConstPtr(new ConcolicTarget(eventHandler, "", analysis, explorationTarget));
}
TargetDescriptorConstPtr TargetGenerator::generateTarget(EventHandlerDescriptorConstPtr eventHandler) const
{
return TargetDescriptorConstPtr(new JQueryTarget(eventHandler, mJQueryListener));
}
