Towards Attribute Grammar Mining by Symbolic Execution

The specification of program inputs is a requirement for many software engineering tasks, but often does not exist or is out of date. To tackle this problem, software engineers may apply program analysis techniques to extract parts of a specification from the source code that processes the program input. Today there are analysis techniques for the extraction of constraints (mathematical formulas) for individual program inputs (e.g. function parameters) as well as emerging techniques for inferring context-free grammars that specify the syntax of program input strings. However, such techniques focus on a single aspect (e.g., constraints or grammars) of the specification only and neglect the other one. We propose to integrate such analysis techniques by extending existing approaches for mining input grammars with the extraction of constraints. Constraints are integrated with a grammar in the form of attributes and context constraints on grammar symbols, resulting in an attribute grammar as specification format. To achieve this goal, we choose the analysis method dynamic symbolic execution (DSE), which is already an established technique for the extraction of constraints and beneficial for grammar mining (e.g., through automatic input generation) as well. Thus, DSE not only covers both aspects but also—as a single analysis method—should facilitate the integration of these two aspects. In this paper, we describe the basic idea of the proposed integration and report the first results on DSE-based grammar extraction.