Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Learning And Refining Input Grammars For Effective Fuzzing

Learning And Refining Input Grammars For Effective Fuzzing

SBST 2022 Tutorial

Rahul Gopinath

May 10, 2022
Tweet

More Decks by Rahul Gopinath

Other Decks in Research

Transcript

  1. Learning and Refining Input Grammars
    for
    Effective Fuzzing
    Rahul Gopinath
    1

    View full-size slide

  2. Prerequisites
    https://github.com/vrthra/SBST22-tutorial#readme
    • Install Python 3.10

    • Install Graphviz

    • Install Jupyter

    • Start Jupyter
    2

    View full-size slide

  3. Prerequisites
    http://localhost:8888/tree
    • Install Python 3.10

    • Install Graphviz

    • Install Jupyter

    • Start Jupyter
    3

    View full-size slide

  4. http://localhost:8888/notebooks/RoadMap.ipynb
    4

    View full-size slide

  5. http://localhost:8888/notebooks/x0_0_Prerequisites.ipynb
    5

    View full-size slide

  6. Fuzzing
    Program
    Trash deck technique: 1950s - Gerald Weinberg
    7

    View full-size slide

  7. Fuzzing
    Program
    Trash deck technique: 1950s - Gerald Weinberg
    7

    View full-size slide

  8. Fuzzing
    Crash?
    Program
    Trash deck technique: 1950s - Gerald Weinberg
    7

    View full-size slide

  9. 8
    Random Fuzzing
    Program

    View full-size slide

  10. 8
    Random Fuzzing
    $ ./fuzz
    [;x1-GPZ+wcckc];,N9J+?#6^6\e?]9lu

    2_%'4GX"0VUB[E/r ~fApu6b8<{%siq8Z

    h.6{V,hr?;{Ti.r3PIxMMMv6{xS^+'Hq!

    AxB"YXRS@!Kd6;wtAMefFWM(`|J_<1~o}

    z3K(CCzRH JIIvHz>_*.\>JrlU32~eGP?

    lR=bF3+;y$3lodQ)KC-i,c{<[~m!]o;{.'}Gj\(X}EtYetrp

    bY@aGZ1{P!AZU7x#4(Rtn!q4nCwqol^y6

    }0|Ko=*JK~;zMKV=9Nai:wxu{J&UV#HaU

    )*BiC<),`+t*gkaPq>&]BS6R&j?#tP7iaV}-}`\?[_[Z^LBM

    PG-FKj'\xwuZ1=Q`^`5,$N$Q@[!CuRzJ2

    D|vBy!^zkhdf3C5PAkR?V((-%>i2Qx]D$qs4O`1@fevnG'2\11Vf3piU37@

    5:dfd45*(7^%5ap\zIyl"'f,$ee,J4Gw:

    cgNKLie3nx9(`efSlg6#[K"@WjhZ}r[Sc

    un&sBCS,T[/3]KAeEnQ7lU)3Pn,0)G/6N

    -wyzj/MTd#A;r*(ds./df3r8Odaf?/<#r
    Program

    View full-size slide

  11. $ ./fuzz -int | program


    634111569742810193727424069509

    741355925061499451162464719526

    615957331924826555590537407605

    181400079803446874252046374716

    740973770255348279425601333144

    152724057932073828569041216191

    099859446496509919024810271242

    622974988671421938012464630138

    735355134599327240920259675263

    574528613057084231370741920902

    794677842164654990353575580453

    777282305855352378119038096476

    699871306655084953377039862387

    924957554389878352934547664240

    082431556093837288597262675598

    630851919061829885048834738832

    677022429414980917053939970795

    722006987916088650168665471731 yes
    9
    Feedback Driven Fuzzing
    def is_prime(n: int) -> bool:


    """Primality test using 6k+-1 optimization."""


    if n <= 3:


    return n > 1


    if n % 2 == 0 or n % 3 == 0:


    return False


    i = 5


    while i ** 2 <= n:


    if n % i == 0 or n % (i + 2) == 0:


    return False


    i += 6


    return True


    def main():


    num = stdin.read()


    print(num, is_prime(num))

    View full-size slide

  12. http://localhost:8888/notebooks/x1_0_GeneratingSamples.ipynb
    10

    View full-size slide

  13. 11
    Fuzzing Parsers
    $ ./fuzz
    [;x1-GPZ+wcckc];,N9J+?#6^6\e?]9lu

    2_%'4GX"0VUB[E/r ~fApu6b8<{%siq8Z

    h.6{V,hr?;{Ti.r3PIxMMMv6{xS^+'Hq!

    AxB"YXRS@!Kd6;wtAMefFWM(`|J_<1~o}

    z3K(CCzRH JIIvHz>_*.\>JrlU32~eGP?

    lR=bF3+;y$3lodQ)KC-i,c{<[~m!]o;{.'}Gj\(X}EtYetrp

    bY@aGZ1{P!AZU7x#4(Rtn!q4nCwqol^y6

    }0|Ko=*JK~;zMKV=9Nai:wxu{J&UV#HaU

    )*BiC<),`+t*gkaPq>&]BS6R&j?#tP7iaV}-}`\?[_[Z^LBM

    PG-FKj'\xwuZ1=Q`^`5,$N$Q@[!CuRzJ2

    D|vBy!^zkhdf3C5PAkR?V((-%>i2Qx]D$qs4O`1@fevnG'2\11Vf3piU37@

    5:dfd45*(7^%5ap\zIyl"'f,$ee,J4Gw:

    cgNKLie3nx9(`efSlg6#[K"@WjhZ}r[Sc

    un&sBCS,T[/3]KAeEnQ7lU)3Pn,0)G/6N

    -wyzj/MTd#A;r*(ds./df3r8Odaf?/<#r
    Interpreter

    View full-size slide

  14. 11
    Fuzzing Parsers
    $ ./fuzz
    [;x1-GPZ+wcckc];,N9J+?#6^6\e?]9lu

    2_%'4GX"0VUB[E/r ~fApu6b8<{%siq8Z

    h.6{V,hr?;{Ti.r3PIxMMMv6{xS^+'Hq!

    AxB"YXRS@!Kd6;wtAMefFWM(`|J_<1~o}

    z3K(CCzRH JIIvHz>_*.\>JrlU32~eGP?

    lR=bF3+;y$3lodQ)KC-i,c{<[~m!]o;{.'}Gj\(X}EtYetrp

    bY@aGZ1{P!AZU7x#4(Rtn!q4nCwqol^y6

    }0|Ko=*JK~;zMKV=9Nai:wxu{J&UV#HaU

    )*BiC<),`+t*gkaPq>&]BS6R&j?#tP7iaV}-}`\?[_[Z^LBM

    PG-FKj'\xwuZ1=Q`^`5,$N$Q@[!CuRzJ2

    D|vBy!^zkhdf3C5PAkR?V((-%>i2Qx]D$qs4O`1@fevnG'2\11Vf3piU37@

    5:dfd45*(7^%5ap\zIyl"'f,$ee,J4Gw:

    cgNKLie3nx9(`efSlg6#[K"@WjhZ}r[Sc

    un&sBCS,T[/3]KAeEnQ7lU)3Pn,0)G/6N

    -wyzj/MTd#A;r*(ds./df3r8Odaf?/<#r
    Parser
    Syntax Error
    Interpreter
    #

    View full-size slide

  15. 12
    Sepcification Free Generators

    View full-size slide

  16. 12
    Sepcification Free Generators

    View full-size slide

  17. 12
    Sepcification Free Generators

    View full-size slide

  18. 12
    Sepcification Free Generators
    A

    View full-size slide

  19. 12
    Sepcification Free Generators
    A
    A ∉ (,+,-,1,2,3,4,5,6,7,8,9,0

    View full-size slide

  20. 12
    Sepcification Free Generators
    A
    (
    A ∉ (,+,-,1,2,3,4,5,6,7,8,9,0

    View full-size slide

  21. 12
    Sepcification Free Generators
    A
    ( 2
    A ∉ (,+,-,1,2,3,4,5,6,7,8,9,0

    View full-size slide

  22. 12
    Sepcification Free Generators
    A
    ( 2
    -
    B
    9
    )
    4 )
    A ∉ (,+,-,1,2,3,4,5,6,7,8,9,0
    B ∉ +,-,1,2,3,4,5,6,7,8,9,0,)
    ) ∉ +,-,1,2,3,4,5,6,7,8,9,0

    View full-size slide

  23. 12
    Sepcification Free Generators
    A
    ( 2
    -
    B
    9
    )
    4 )
    A ∉ (,+,-,1,2,3,4,5,6,7,8,9,0
    B ∉ +,-,1,2,3,4,5,6,7,8,9,0,)
    ) ∉ +,-,1,2,3,4,5,6,7,8,9,0

    View full-size slide

  24. 12
    Sepcification Free Generators
    A
    ( 2
    -
    B
    9
    )
    4 )
    A ∉ (,+,-,1,2,3,4,5,6,7,8,9,0
    B ∉ +,-,1,2,3,4,5,6,7,8,9,0,)
    ) ∉ +,-,1,2,3,4,5,6,7,8,9,0
    (2-94)

    View full-size slide

  25. http://localhost:8888/notebooks/x1_1_TrackingAccess.ipynb
    13

    View full-size slide

  26. 14
    Limitation: Lack of control

    View full-size slide

  27. 15
    Constraining the Search Space


    with


    Input Grammars

    View full-size slide

  28. 17
    Formal Languages
    Formal Language Descriptions

    View full-size slide

  29. 17
    Formal Languages
    Formal Language Descriptions
    3. Regular
    (Chomsky,1956)

    View full-size slide

  30. 17
    Formal Languages
    Formal Language Descriptions
    3. Regular
    Context Free
    (Chomsky,1956)
    Argument Stack

    View full-size slide

  31. 17
    Formal Languages
    Formal Language Descriptions
    3. Regular
    Context Free
    Recursively Enumerable
    (Chomsky,1956)
    Argument Stack
    Return Stack

    View full-size slide

  32. 17
    Formal Languages
    Formal Language Descriptions
    3. Regular
    Context Free
    Recursively Enumerable
    (Chomsky,1956)
    Easy to produce and parse
    Argument Stack
    Return Stack

    View full-size slide

  33. 18
    Grammar
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    Arithmetic expression grammar

    View full-size slide

  34. 18
    Grammar
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    Arithmetic expression grammar

    View full-size slide

  35. 18
    Grammar
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    Arithmetic expression grammar
    key

    View full-size slide

  36. 18
    Grammar
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    Arithmetic expression grammar
    De
    f
    inition for
    key

    View full-size slide

  37. 19
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    Grammar
    Arithmetic expression grammar

    View full-size slide

  38. 19
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    Grammar
    Arithmetic expression grammar
    Expansion Rule

    View full-size slide

  39. 19
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    Grammar
    Arithmetic expression grammar
    Expansion Rule Terminal Symbol

    View full-size slide

  40. 19
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    Grammar
    Arithmetic expression grammar
    Expansion Rule Terminal Symbol
    Nonterminal Symbol

    View full-size slide

  41. 19
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    Grammar
    Arithmetic expression grammar
    Expansion Rule Terminal Symbol
    Nonterminal Symbol

    View full-size slide

  42. http://localhost:8888/notebooks/x0_1_Grammars.ipynb
    20

    View full-size slide

  43. 21
    Grammars
    For Parsing
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]

    View full-size slide

  44. 21
    Grammars
    For Parsing
    (8 / 3) * 49
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]

    View full-size slide

  45. 21
    Grammars
    For Parsing
    (8 / 3) * 49
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]

    View full-size slide

  46. http://localhost:8888/notebooks/x0_3_Parser.ipynb
    22

    View full-size slide

  47. 23
    Grammars
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    For Fuzzing (Hanford 1970)

    (Purdom 1972)

    View full-size slide

  48. 23
    Grammars8.2 - 27 - -9 / +((+9 * --2 + --+-+-

    ((-1 * +(8 - 5 - 6)) * (-(a-+(((+(4)

    )))) - ++4) / +(-+---((5.6 - --(3 *

    -1.8 * +(6 * +-(((-(-6) * ---+6)) /

    +--(+-+-7 * (-0 * (+(((((2)) + 8 - 3

    - ++9.0 + ---(--+7 / (1 / +++6.37)

    + (1) / 482) / +++-+0)))) + 8.2 - 27

    - -9 / +((+9 * --2 + --+-+-((-1 * +

    (8 - 5 - 6)) * (-(a-+(((+(4))))) - +
    +4) / +(-+---((5.6 - --(3 * -1.8 * +

    (6 * +-(((-(-6) * ---+6)) / +--(+-+-

    7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0

    + ---(--+7 / (1 / +++6.37) + (1) /

    482) / +++-+0)))) * -+5 + 7.513))))

    - (+1 / ++((-84)))))))) * ++5 / +-(-

    -2 - -++-9.0)))) / 5 * --++090 + * -

    +5 + 7.513)))) - (+1 / ++((-84))))))

    )) * 8.2 - 27 - -9 / +((+9 * --2 + -

    -+-+-((-1 * +(8 - 5 - 6)) * (-(a-+((

    (+(4))))) - ++4) / +(-+---((5.6 - --

    (3 * -1.8 * +(6 * +-(((-(-6) * ---+6

    )) / +--(+-+-7 * (-0 * (+(((((2)) +

    8 - 3 - ++9.0 + ---(--+7 / (1 / +++6

    .37) + (1) / 482) / +++-+0)))) * -+5

    + 7.513)))) - (+1 / ++((-84))))))))

    * ++5 / +-(--2 - -++-9.0)))) / 5 *

    --++090 ++5 / +-(--2 - -++-9.0)))) /

    5 * --++090
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    For Fuzzing (Hanford 1970)

    (Purdom 1972)

    View full-size slide

  49. 24
    Grammars
    As effective producers
    8.2 - 27 - -9 / +((+9 * --2 + --+-+-

    ((-1 * +(8 - 5 - 6)) * (-(a-+(((+(4)

    )))) - ++4) / +(-+---((5.6 - --(3 *

    -1.8 * +(6 * +-(((-(-6) * ---+6)) /

    +--(+-+-7 * (-0 * (+(((((2)) + 8 - 3

    - ++9.0 + ---(--+7 / (1 / +++6.37)

    + (1) / 482) / +++-+0)))) + 8.2 - 27

    - -9 / +((+9 * --2 + --+-+-((-1 * +

    (8 - 5 - 6)) * (-(a-+(((+(4))))) - +
    +4) / +(-+---((5.6 - --(3 * -1.8 * +

    (6 * +-(((-(-6) * ---+6)) / +--(+-+-

    7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0

    + ---(--+7 / (1 / +++6.37) + (1) /

    482) / +++-+0)))) * -+5 + 7.513))))

    - (+1 / ++((-84)))))))) * ++5 / +-(-

    -2 - -++-9.0)))) / 5 * --++090 + * -

    +5 + 7.513)))) - (+1 / ++((-84))))))

    )) * 8.2 - 27 - -9 / +((+9 * --2 + -

    -+-+-((-1 * +(8 - 5 - 6)) * (-(a-+((

    (+(4))))) - ++4) / +(-+---((5.6 - --

    (3 * -1.8 * +(6 * +-(((-(-6) * ---+6

    )) / +--(+-+-7 * (-0 * (+(((((2)) +

    8 - 3 - ++9.0 + ---(--+7 / (1 / +++6

    .37) + (1) / 482) / +++-+0)))) * -+5

    + 7.513)))) - (+1 / ++((-84))))))))

    * ++5 / +-(--2 - -++-9.0)))) / 5 *

    --++090 ++5 / +-(--2 - -++-9.0)))) /

    5 * --++090

    View full-size slide

  50. 24
    Grammars
    As effective producers
    Interpreter
    Parser


    8.2 - 27 - -9 / +((+9 * --2 + --+-+-

    ((-1 * +(8 - 5 - 6)) * (-(a-+(((+(4)

    )))) - ++4) / +(-+---((5.6 - --(3 *

    -1.8 * +(6 * +-(((-(-6) * ---+6)) /

    +--(+-+-7 * (-0 * (+(((((2)) + 8 - 3

    - ++9.0 + ---(--+7 / (1 / +++6.37)

    + (1) / 482) / +++-+0)))) + 8.2 - 27

    - -9 / +((+9 * --2 + --+-+-((-1 * +

    (8 - 5 - 6)) * (-(a-+(((+(4))))) - +
    +4) / +(-+---((5.6 - --(3 * -1.8 * +

    (6 * +-(((-(-6) * ---+6)) / +--(+-+-

    7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0

    + ---(--+7 / (1 / +++6.37) + (1) /

    482) / +++-+0)))) * -+5 + 7.513))))

    - (+1 / ++((-84)))))))) * ++5 / +-(-

    -2 - -++-9.0)))) / 5 * --++090 + * -

    +5 + 7.513)))) - (+1 / ++((-84))))))

    )) * 8.2 - 27 - -9 / +((+9 * --2 + -

    -+-+-((-1 * +(8 - 5 - 6)) * (-(a-+((

    (+(4))))) - ++4) / +(-+---((5.6 - --

    (3 * -1.8 * +(6 * +-(((-(-6) * ---+6

    )) / +--(+-+-7 * (-0 * (+(((((2)) +

    8 - 3 - ++9.0 + ---(--+7 / (1 / +++6

    .37) + (1) / 482) / +++-+0)))) * -+5

    + 7.513)))) - (+1 / ++((-84))))))))

    * ++5 / +-(--2 - -++-9.0)))) / 5 *

    --++090 ++5 / +-(--2 - -++-9.0)))) /

    5 * --++090

    View full-size slide

  51. 25
    Grammars
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    As efficient producers

    View full-size slide

  52. 25
    Grammars
    :=
    := '+'
    | '-'
    | '/'
    | '*'
    | '(' ')'
    |
    :=
    | '.'
    :=
    |
    := [0-9]
    As efficient producers
    def start():
    expr()
    def expr():
    match (random() % 6):
    case 0: expr(); print('+'); expr()
    case 1: expr(); print('-'); expr()
    case 2: expr(); print('/'); expr()
    case 3: expr(); print('*'); expr()
    case 4: print('('); expr(); print(')')
    case 5: number()
    def number():
    match (random() % 2):
    case 0: integer()
    case 1: integer(); print('.'); integer()
    def integer():
    match (random() % 2):
    case 0: digit(); integer()
    case 1: digit()
    def digit():
    match (random() % 10):
    case 0: print('0')
    case 1: print('1')
    case 2: print('2')
    case 3: print('3')
    case 4: print('4')
    case 5: print('5')
    case 6: print('6')
    case 7: print('7')
    Compiled Grammar (F1)

    View full-size slide

  53. http://localhost:8888/notebooks/x0_2_GrammarFuzzer.ipynb
    26

    View full-size slide

  54. 27
    Where to Get the Input Grammar From?

    View full-size slide

  55. http://localhost:8888/notebooks/x2_0_MiningGrammar.ipynb
    28

    View full-size slide

  56. 29
    Where to Get the Grammar From?
    Hand-written parsers already encode the grammar

    View full-size slide

  57. 29
    Where to Get the Grammar From?
    1. Extract the input string accesses

    2. Attach control
    fl
    ow information (context-managers)
    Hand-written parsers already encode the grammar

    View full-size slide

  58. 30
    How to Extract This Grammar?

    View full-size slide

  59. 30
    How to Extract This Grammar?
    • Inputs + control
    fl
    ow -> Dynamic Control Dependence Trees

    View full-size slide

  60. 30
    How to Extract This Grammar?
    • Inputs + control
    fl
    ow -> Dynamic Control Dependence Trees
    • DCD Trees -> Parse Tree

    View full-size slide

  61. 31
    Control Dependence Graph
    Statement B is control dependent on A if A determines whether B executes.
    def parse_csv(s,i):


    while s[i:]:


    if is_digit(s[i]):


    n,j = num(s[i:])


    i = i+j


    else:


    comma(s[i])


    i += 1

    View full-size slide

  62. 31
    Control Dependence Graph
    Statement B is control dependent on A if A determines whether B executes.
    def parse_csv(s,i):


    while s[i:]:


    if is_digit(s[i]):


    n,j = num(s[i:])


    i = i+j


    else:


    comma(s[i])


    i += 1
    CDG for parse_csv

    View full-size slide

  63. 31
    Control Dependence Graph
    Statement B is control dependent on A if A determines whether B executes.
    def parse_csv(s,i):


    while s[i:]:


    if is_digit(s[i]):


    n,j = num(s[i:])


    i = i+j


    else:


    comma(s[i])


    i += 1
    CDG for parse_csv
    while: determines

    whether

    if: executes

    View full-size slide

  64. 32
    def parse_csv(s,i):


    while s[i:]:


    if is_digit(s[i]):


    n,j = num(s[i:])


    i = i+j


    else:


    comma(s[i])


    i += 1
    CDG for parse_csv
    Dynamic Control Dependence Tree
    Each statement execution is represented as a separate node

    View full-size slide

  65. 32
    def parse_csv(s,i):


    while s[i:]:


    if is_digit(s[i]):


    n,j = num(s[i:])


    i = i+j


    else:


    comma(s[i])


    i += 1
    CDG for parse_csv
    Dynamic Control Dependence Tree
    Each statement execution is represented as a separate node
    DCD Tree for call parse_csv()

    View full-size slide

  66. 33
    def parse_csv(s,i):


    while s[i:]:


    if is_digit(s[i]):


    n,j = num(s[i:])


    i = i+j


    else:


    comma(s[i])


    i += 1
    DCD Tree ~ Parse Tree
    •No tracking beyond input bu
    ff
    er

    •Characters are attached to nodes where they are accessed last
    "12,"
    "12,"

    View full-size slide

  67. 33
    def parse_csv(s,i):


    while s[i:]:


    if is_digit(s[i]):


    n,j = num(s[i:])


    i = i+j


    else:


    comma(s[i])


    i += 1
    '1' '2' ','
    DCD Tree ~ Parse Tree
    •No tracking beyond input bu
    ff
    er

    •Characters are attached to nodes where they are accessed last
    "12,"
    "12,"

    View full-size slide

  68. 34
    def is_digit(i): return i in '0123456789'


    def parse_num(s,i):


    n = ''


    while s[i:] and is_digit(s[i]):


    n += s[i]


    i = i +1


    return i,n


    def parse_paren(s, i):


    assert s[i] == '('


    i, v = parse_expr(s, i+1)


    if s[i:] == '': raise Ex(s, i)


    assert s[i] == ')'


    return i+1, v


    def parse_expr(s, i = 0):


    expr, is_op = [], True


    while s[i:]:


    c = s[i]


    if isdigit(c):


    if not is_op: raise Ex(s,i)


    i,num = parse_num(s,i)


    expr.append(num)


    is_op = False


    elif c in ['+', '-', '*', '/']:


    if is_op: raise Ex(s,i)


    expr.append(c)


    is_op, i = True, i + 1


    elif c == '(':


    if not is_op: raise Ex(s,i)


    i, cexpr = parse_paren(s, i)


    expr.append(cexpr)


    is_op = False


    elif c == ')': break


    else: raise Ex(s,i)


    if is_op: raise Ex(s,i)


    return i, expr
    9+3/4
    Parse tree for parse_expr('9+3/4')

    View full-size slide

  69. 34
    def is_digit(i): return i in '0123456789'


    def parse_num(s,i):


    n = ''


    while s[i:] and is_digit(s[i]):


    n += s[i]


    i = i +1


    return i,n


    def parse_paren(s, i):


    assert s[i] == '('


    i, v = parse_expr(s, i+1)


    if s[i:] == '': raise Ex(s, i)


    assert s[i] == ')'


    return i+1, v


    def parse_expr(s, i = 0):


    expr, is_op = [], True


    while s[i:]:


    c = s[i]


    if isdigit(c):


    if not is_op: raise Ex(s,i)


    i,num = parse_num(s,i)


    expr.append(num)


    is_op = False


    elif c in ['+', '-', '*', '/']:


    if is_op: raise Ex(s,i)


    expr.append(c)


    is_op, i = True, i + 1


    elif c == '(':


    if not is_op: raise Ex(s,i)


    i, cexpr = parse_paren(s, i)


    expr.append(cexpr)


    is_op = False


    elif c == ')': break


    else: raise Ex(s,i)


    if is_op: raise Ex(s,i)


    return i, expr
    9+3/4
    Parse tree for parse_expr('9+3/4')

    View full-size slide

  70. 36
    def is_digit(i): return i in '0123456789'


    View full-size slide

  71. 36
    def is_digit(i): return i in '0123456789'


    View full-size slide

  72. 37
    3 * (9 + 1)

    View full-size slide

  73. 37
    3 * (9 + 1)

    View full-size slide

  74. 37
    (9 + 1) * 3
    3 * (9 + 1)

    View full-size slide

  75. 37
    (9 + 1) * 3
    3 * (9 + 1)

    View full-size slide

  76. 37
    (9 + 1) * 3
    3 * (9 + 1)

    View full-size slide

  77. 38
    3 * (9 + 1)

    View full-size slide

  78. 38
    3 * (9 + 1)

    View full-size slide

  79. 38
    9 + 1
    3 * (9 + 1)

    View full-size slide

  80. 38
    9 + 1
    3 * (9 + 1)

    View full-size slide

  81. 38
    9 + 1
    3 * (9 + 1)

    View full-size slide

  82. 39
    3 * (9 + 1)

    View full-size slide

  83. 39
    3 (9 + 1) *
    3 * (9 + 1)

    View full-size slide

  84. 39
    3 (9 + 1) *
    3 * (9 + 1)

    View full-size slide

  85. 39
    3 (9 + 1) *
    3 * (9 + 1)

    View full-size slide

  86. 42
    3*(1)
    1
    :=

    :=

    View full-size slide

  87. :=
    |
    |
    |
    :=
    :=
    |
    :=
    := '3' | '1'
    := '(' ')'
    :=
    := '*'
    43

    View full-size slide

  88. :=
    :=
    |
    :=
    |
    |
    |
    :=
    :=
    |
    :=
    := '3' | '1'
    := '(' ')'
    :=
    := '*'
    43

    View full-size slide

  89. 44
    def is_digit(i): return i in '0123456789'


    :=


    |


    :=


    |


    := '(' ')'


    |


    := '*' | '+' | '-' | '/'


    :=


    |


    : [0-9]


    calc.py Recovered Arithmetic Grammar

    View full-size slide

  90. 45
    :=


    :=


    |


    :=


    |


    := '(' ')'


    |


    := '*' | '+' | '-' | '/'


    :=


    |


    : [0-9]


    View full-size slide

  91. 45
    8.2 - 27 - -9 / +((+9 * --2 + --+-+-

    ((-1 * +(8 - 5 - 6)) * (-(a-+(((+(4)

    )))) - ++4) / +(-+---((5.6 - --(3 *

    -1.8 * +(6 * +-(((-(-6) * ---+6)) /

    +--(+-+-7 * (-0 * (+(((((2)) + 8 - 3

    - ++9.0 + ---(--+7 / (1 / +++6.37)

    + (1) / 482) / +++-+0)))) + 8.2 - 27

    - -9 / +((+9 * --2 + --+-+-((-1 * +

    (8 - 5 - 6)) * (-(a-+(((+(4))))) - +
    +4) / +(-+---((5.6 - --(3 * -1.8 * +

    (6 * +-(((-(-6) * ---+6)) / +--(+-+-

    7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0

    + ---(--+7 / (1 / +++6.37) + (1) /

    482) / +++-+0)))) * -+5 + 7.513))))

    - (+1 / ++((-84)))))))) * ++5 / +-(-

    -2 - -++-9.0)))) / 5 * --++090 + * -

    +5 + 7.513)))) - (+1 / ++((-84))))))

    )) * 8.2 - 27 - -9 / +((+9 * --2 + -

    -+-+-((-1 * +(8 - 5 - 6)) * (-(a-+((

    (+(4))))) - ++4) / +(-+---((5.6 - --

    (3 * -1.8 * +(6 * +-(((-(-6) * ---+6

    )) / +--(+-+-7 * (-0 * (+(((((2)) +

    8 - 3 - ++9.0 + ---(--+7 / (1 / +++6

    .37) + (1) / 482) / +++-+0)))) * -+5

    + 7.513)))) - (+1 / ++((-84))))))))

    * ++5 / +-(--2 - -++-9.0)))) / 5 *

    --++090 ++5 / +-(--2 - -++-9.0)))) /

    5 * --++090
    :=


    :=


    |


    :=


    |


    := '(' ')'


    |


    := '*' | '+' | '-' | '/'


    :=


    |


    : [0-9]


    View full-size slide

  92. 46
    ::=
    ::= '"'
    | '['
    | '{'
    |
    | 'true'
    | 'false'
    | 'null'
    ::= +
    | + 'e' +
    ::= '+' | '-' | '.' | [0-9] | 'E' | 'e'
    ::= * '"'
    ::= ']'
    | (',')* ']'
    | ( ',' )+ (',' )* ']'
    ::= '}'
    | ( '"' ':' ',' )*
    '"' ':' '}'
    ::= ' ' | '!' | '#' | '$' | '%' | '&' | '''
    | '*' | '+' | '-' | ',' | '.' | '/' | ':' | ';'
    | '<' | '=' | '>' | '?' | '@' | '[' | ']' | '^'
    | '_', ''',| '{' | '|' | '}' | '~'
    | '[A-Za-z0-9]'
    | '\'
    ::= '"' | '/' | 'b' | 'f' | 'n' | 'r' | 't'
    stm.next()


    View full-size slide

  93. 49
    We Found A Crash

    View full-size slide

  94. 49
    We Found A Crash

    View full-size slide

  95. Why Did My Program Crash?
    50

    View full-size slide

  96. Why Did My Program Crash?
    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.

    6 - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +-

    -(+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(

    --+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) +

    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.6

    - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +--

    (+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(-

    -+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) * -

    +5 + 7.513)))) - (+1 / ++((-84)))))))) * ++5 / +-

    (--2 - -++-9.0)))) / 5 * --++090 + * -+5 + 7.513)

    ))) - (+1 / ++((-84)))))))) * 8.2 - 27 - -9 / +((

    +9 * --2 + --+-+-((-1 * +(8 - 5 - 6)) * (-(a-+
    (((+(4))))) - ++4) / +(-+---((5.6 - --(3 * -1.8 *

    +(6 * +-(((-(-6) * ---+6)) / +--(+-+-7 * (-0 * (

    +(((((2)) + 8 - 3 - ++9.0 + ---(--+7 / (1 / +++6.

    37) + (1) / 482) / +++-+0)))) * -+5 + 7.513)))) -

    (+1 / ++((-84)))))))) * ++5 / +-(--2 - -++-9.0)))

    ) / 5 * --++090 ++5 / +-(--2 - -++-9.0)))) / 5 *

    --++090
    50

    View full-size slide

  97. Why Did My Program Crash?
    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.

    6 - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +-

    -(+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(

    --+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) +

    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.6

    - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +--

    (+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(-

    -+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) * -

    +5 + 7.513)))) - (+1 / ++((-84)))))))) * ++5 / +-

    (--2 - -++-9.0)))) / 5 * --++090 + * -+5 + 7.513)

    ))) - (+1 / ++((-84)))))))) * 8.2 - 27 - -9 / +((

    +9 * --2 + --+-+-((-1 * +(8 - 5 - 6)) * (-(a-+
    (((+(4))))) - ++4) / +(-+---((5.6 - --(3 * -1.8 *

    +(6 * +-(((-(-6) * ---+6)) / +--(+-+-7 * (-0 * (

    +(((((2)) + 8 - 3 - ++9.0 + ---(--+7 / (1 / +++6.

    37) + (1) / 482) / +++-+0)))) * -+5 + 7.513)))) -

    (+1 / ++((-84)))))))) * ++5 / +-(--2 - -++-9.0)))

    ) / 5 * --++090 ++5 / +-(--2 - -++-9.0)))) / 5 *

    --++090
    DD Minimized Input
    ((4))
    50

    View full-size slide

  98. Why Did My Program Crash?
    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.

    6 - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +-

    -(+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(

    --+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) +

    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.6

    - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +--

    (+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(-

    -+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) * -

    +5 + 7.513)))) - (+1 / ++((-84)))))))) * ++5 / +-

    (--2 - -++-9.0)))) / 5 * --++090 + * -+5 + 7.513)

    ))) - (+1 / ++((-84)))))))) * 8.2 - 27 - -9 / +((

    +9 * --2 + --+-+-((-1 * +(8 - 5 - 6)) * (-(a-+
    (((+(4))))) - ++4) / +(-+---((5.6 - --(3 * -1.8 *

    +(6 * +-(((-(-6) * ---+6)) / +--(+-+-7 * (-0 * (

    +(((((2)) + 8 - 3 - ++9.0 + ---(--+7 / (1 / +++6.

    37) + (1) / 482) / +++-+0)))) * -+5 + 7.513)))) -

    (+1 / ++((-84)))))))) * ++5 / +-(--2 - -++-9.0)))

    ) / 5 * --++090 ++5 / +-(--2 - -++-9.0)))) / 5 *

    --++090
    DD Minimized Input
    ((4))
    00000 ?
    50

    View full-size slide

  99. Why Did My Program Crash?
    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.

    6 - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +-

    -(+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(

    --+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) +

    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.6

    - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +--

    (+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(-

    -+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) * -

    +5 + 7.513)))) - (+1 / ++((-84)))))))) * ++5 / +-

    (--2 - -++-9.0)))) / 5 * --++090 + * -+5 + 7.513)

    ))) - (+1 / ++((-84)))))))) * 8.2 - 27 - -9 / +((

    +9 * --2 + --+-+-((-1 * +(8 - 5 - 6)) * (-(a-+
    (((+(4))))) - ++4) / +(-+---((5.6 - --(3 * -1.8 *

    +(6 * +-(((-(-6) * ---+6)) / +--(+-+-7 * (-0 * (

    +(((((2)) + 8 - 3 - ++9.0 + ---(--+7 / (1 / +++6.

    37) + (1) / 482) / +++-+0)))) * -+5 + 7.513)))) -

    (+1 / ++((-84)))))))) * ++5 / +-(--2 - -++-9.0)))

    ) / 5 * --++090 ++5 / +-(--2 - -++-9.0)))) / 5 *

    --++090
    DD Minimized Input
    ((4))
    00000 ?
    ((5)) ?
    50

    View full-size slide

  100. Why Did My Program Crash?
    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.

    6 - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +-

    -(+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(

    --+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) +

    8.2 - 27 - -9 / +((+9 * --2 + --+-+-((-1 * +(8 -

    5 - 6)) * (-(a-+(((+(4))))) - ++4) / +(-+---((5.6

    - --(3 * -1.8 * +(6 * +-(((-(-6) * ---+6)) / +--

    (+-+-7 * (-0 * (+(((((2)) + 8 - 3 - ++9.0 + ---(-

    -+7 / (1 / +++6.37) + (1) / 482) / +++-+0)))) * -

    +5 + 7.513)))) - (+1 / ++((-84)))))))) * ++5 / +-

    (--2 - -++-9.0)))) / 5 * --++090 + * -+5 + 7.513)

    ))) - (+1 / ++((-84)))))))) * 8.2 - 27 - -9 / +((

    +9 * --2 + --+-+-((-1 * +(8 - 5 - 6)) * (-(a-+
    (((+(4))))) - ++4) / +(-+---((5.6 - --(3 * -1.8 *

    +(6 * +-(((-(-6) * ---+6)) / +--(+-+-7 * (-0 * (

    +(((((2)) + 8 - 3 - ++9.0 + ---(--+7 / (1 / +++6.

    37) + (1) / 482) / +++-+0)))) * -+5 + 7.513)))) -

    (+1 / ++((-84)))))))) * ++5 / +-(--2 - -++-9.0)))

    ) / 5 * --++090 ++5 / +-(--2 - -++-9.0)))) / 5 *

    --++090
    DD Minimized Input
    ((4))
    00000 ?
    ((5)) ?
    (++5) ?
    50

    View full-size slide

  101. 52
    Issue 386 from Rhino
    var A = class extends (class {}){};
    Issue 2937 from Closure
    const [y,y] = [];
    var {baz:{} = baz => {}} = baz => {};
    Issue 385 from Rhino
    {while ((l_0)){ if ((l_0)) {break;;var l_0; continue }0}}
    Issue 2842 from Closure

    View full-size slide

  102. 52
    Issue 386 from Rhino
    var A = class extends (class {}){};
    Issue 2937 from Closure
    const [y,y] = [];
    var {baz:{} = baz => {}} = baz => {};
    Issue 385 from Rhino
    {while ((l_0)){ if ((l_0)) {break;;var l_0; continue }0}}
    Issue 2842 from Closure

    View full-size slide

  103. 52
    Issue 386 from Rhino
    var A = class extends (class {}){};
    Issue 2937 from Closure
    const [y,y] = [];
    var {baz:{} = baz => {}} = baz => {};
    Issue 385 from Rhino
    {while ((l_0)){ if ((l_0)) {break;;var l_0; continue }0}}
    Issue 2842 from Closure

    View full-size slide

  104. 52
    Issue 386 from Rhino
    var A = class extends (class {}){};
    Issue 2937 from Closure
    const [y,y] = [];
    var {baz:{} = baz => {}} = baz => {};
    Issue 385 from Rhino
    {while ((l_0)){ if ((l_0)) {break;;var l_0; continue }0}}
    Issue 2842 from Closure

    View full-size slide

  105. 52
    Issue 386 from Rhino
    var A = class extends (class {}){};
    Issue 2937 from Closure
    const [y,y] = [];
    var {baz:{} = baz => {}} = baz => {};
    Issue 385 from Rhino
    {while ((l_0)){ if ((l_0)) {break;;var l_0; continue }0}}
    Issue 2842 from Closure
    Delta Minimization is useful but not su
    ff
    i
    cient

    View full-size slide

  106. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    53

    View full-size slide

  107. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    54

    View full-size slide

  108. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    55

    View full-size slide

  109. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    ✓ Did not reproduce the failure
    1 * (2 - 3)
    55

    View full-size slide

  110. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    56

    View full-size slide

  111. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    c
    57

    View full-size slide

  112. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    c
    58

    View full-size slide

  113. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    c
    ✓ Did not reproduce the failure
    1 + 3 + 4
    58

    View full-size slide

  114. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    c
    c
    59

    View full-size slide

  115. 3 * 4
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    c
    c
    60

    View full-size slide

  116. 3 * 4
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    c
    c
    ✓ Did not reproduce the failure
    60

    View full-size slide

  117. ( ( 4 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    c
    c
    c
    c
    c
    c
    c
    61

    View full-size slide

  118. ( ( 1 - 2 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    c
    c
    c
    c
    c
    c
    c
    ( ( 1 - 2 ) )
    62

    View full-size slide

  119. ( ( 1 - 2 ) )
    :=
    := ' + '
    | ' - '
    |
    := ' * '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '.'
    |
    :=
    |
    := [0-9]
    c
    c
    c
    c
    c
    c
    c
    ✘ reproduced the failure
    ( ( 1 - 2 ) )
    62

    View full-size slide

  120. ( ( 1 - 2 ) )
    c
    c
    c
    c
    c
    c
    c
    ( ( 1 - 2 ) )
    63

    View full-size slide

  121. ( ( 1 - 2 ) )
    c
    c
    c
    c
    c
    c
    c

    ( ( 1 - 2 ) )
    63

    View full-size slide

  122. ( ( 1 - 2 ) )
    c
    c
    c
    c
    c
    c
    c

    ( ( 1 - 2 ) )
    ( ( 2 * 3 + 4 ) )
    64

    View full-size slide

  123. ( ( 1 - 2 ) )
    c
    c
    c
    c
    c
    c
    c

    ( ( 1 - 2 ) )

    ( ( 2 * 3 + 4 ) )
    64

    View full-size slide

  124. ( ( 1 - 2 ) )
    c
    c
    c
    c
    c
    c
    c

    ( ( 1 - 2 ) )

    ( ( 2 * 3 + 4 ) )
    ( ( - 2 / 1 ) )
    65

    View full-size slide

  125. ( ( 1 - 2 ) )
    c
    c
    c
    c
    c
    c
    c

    ( ( 1 - 2 ) )

    ( ( 2 * 3 + 4 ) )

    ( ( - 2 / 1 ) )
    65

    View full-size slide

  126. ( ( 1 - 2 ) )
    c
    c
    c
    c
    c
    c
    c

    ( ( 1 - 2 ) )

    ( ( 2 * 3 + 4 ) )

    ( ( - 2 / 1 ) )
    ( ( 98 - 0 ) )
    66

    View full-size slide

  127. ( ( 1 - 2 ) )
    c
    c
    c
    c
    c
    c
    c

    ( ( 1 - 2 ) )

    ( ( 2 * 3 + 4 ) )

    ( ( - 2 / 1 ) )

    ( ( 98 - 0 ) )
    66

    View full-size slide

  128. )
    (
    ( )
    ( ( )
    4 )
    ( ( 4 ) )
    c
    c
    c
    c
    c
    c
    c
    A
    67

    View full-size slide

  129. )
    (
    ( )
    ( ( )
    4 )
    ( ( 4 ) )
    c
    c
    c
    c
    c
    c
    c
    A
    68

    View full-size slide

  130. ( ( 4 ) )
    c
    c
    c
    c
    c
    c
    c
    A
    ( ( ) )

    ( ( ) )
    4
    Minimized Input
    Abstract Failure Inducing Input
    def check(parsed):
    if parsed.is_nested() and parsed.child.is_nested():
    raise Exception()
    return input
    69

    View full-size slide

  131. 70
    :=
    := ' + '
    | ' + '
    | ' - '
    | ' - '
    |
    := ' * '
    | ' * '
    | ' / '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '(' ')'
    :=
    :=
    := '(' ')'
    Specialized Grammar
    is (())

    View full-size slide

  132. 70
    :=
    := ' + '
    | ' + '
    | ' - '
    | ' - '
    |
    := ' * '
    | ' * '
    | ' / '
    | ' / '
    |
    := '+'
    | '-'
    | '(' ')'
    | '(' ')'
    :=
    :=
    := '(' ')'
    ((1)) + 2
    (23 * ((3)) - 34)
    (344- 4 + ((223)))
    (1) - 3 * 773 + (-22 + 1)
    1798 - 889 / ((333-1)) * 2 / 3 + 1
    34 + ((4)) -334 + (334 - (22) + 919 * 0 + 1
    98435747+ 88 + (((0))) + (1) - 1 * 7 / 4 * 889 - 2
    8 + ((8)) + --1 + 11223 / 344 - 39 + (1) - 456 + 134 / 45
    437 + 8 - 1 * ((9 + ((1))) - 1 + 99111948 + 3 --1 + (112) - 2 + 445) + 0
    74 + 334 + ((178 - 88 / (3393-1) * 1002 / 3 + 1+ 3439)) * 223 - 1233 + 334672
    2 * ((9)) - (1798 - 889 / (333-1) * 2 / 3 + 100012 + 3434392 + 234 ----6 * 1798 - 889 / (33
    778 - (((1) - 3 * 773 + (-22 + 1) * (4545) - 23 - ((2)) * 773 + (-22 + 1) / 3434 + ---1 + 1 / 34343 + 112
    349 + (((1) - 3 * 3 + (-22 + 1) ((+ (-22 + 1) * (4545) - 23 - (2) * 773 + ((-22 + 1)) / 3434 + ---1 + 1 / 34343 + 1123
    8 + ((8)) + --1 + / 1 - 39 + (1) - 456 + 134 / 45 ))(((1) - 2334 + ((((1)) - 3 * 773 + (-22 + 1) * (2) - 23 - (2) * 773 + (-22 + 1) / 3
    74 + 3 + ((178 - 88 / (3393-1) * 1002 / 3 + 1+ 3439)) * - 1233 + 334672)) ((8 + ((8)) + --1 + / 344 - 39 + (1) - 456 + 134 / 45 ))(((1) - 3 * 773
    1+ 33+ 24343433 +23343 - ((74 + 334 + ((178 - 88 / (3393-1) * 1002 / 3 + 1+ 3439)) * - 1233 + 334672)) ((8 + ((8)) + --1 + / 344 - 39 + (1) - 456 + 134 / 4

    Specialized Grammar
    is (())

    View full-size slide

  133. Input Algebras
    71

    View full-size slide

  134. def jsoncheck(json):
    ...
    {...}
    73

    View full-size slide

  135. def jsoncheck(json):
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    {"abc": null}

    74

    View full-size slide

  136. def jsoncheck(json):
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    {"abc": null}

    is : null
    74

    View full-size slide

  137. {"abc": []}

    def jsoncheck(json):
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    75

    View full-size slide

  138. {"abc": []}

    no is : null
    def jsoncheck(json):
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    75

    View full-size slide

  139. {"abc": 124}

    no is "" :
    def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    process(json)
    76

    View full-size slide

  140. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    process(json)
    {"": 124}

    is "" :
    77

    View full-size slide

  141. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    78

    View full-size slide

  142. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    {"": 124}

    is "" :
    no is : null
    &
    79

    View full-size slide

  143. def jsoncheck(json):
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    {"abc": null}

    is : null
    Start Symbol
    80

    View full-size slide

  144. def jsoncheck(json):
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    {"abc": []}
    no is : null

    Start Symbol
    81

    View full-size slide

  145. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    process(json)
    {"abc": 124}

    is "" :
    Start Symbol
    82

    View full-size slide

  146. is "" :
    no is : null
    &
    def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    {"": 124}

    Start Symbol
    83

    View full-size slide

  147. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    Evogram
    84

    View full-size slide

  148. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    Evogram
    84

    View full-size slide

  149. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    Evogram
    Automatically Derived
    84

    View full-size slide

  150. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    85

    View full-size slide

  151. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    85

    View full-size slide

  152. def jsoncheck(json):
    if no_key_is_empty_string(json):
    fail(’one key must be empty’)
    if any_key_has_null_value(json):
    fail(’key value must not be null’)
    process(json)
    Automatically Derived
    85

    View full-size slide

  153. Supercharged Pattern Matchers



    where


    is "":


    is :null



    where


    is (())


    is / 0



    where


    is "0"


    is "0x"



    where


    is ";;"


    is "()"


    is "()"


    Alternative to Regular Expressions
    86

    View full-size slide