-
|
In order to take a new execution path, CrossHair needs to visit a new node in the search tree. In what order are nodes visited, e.g. breadth first, depth first? And where in the code is this done? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 1 reply
-
|
Great question. Path decisions are made randomly, guided by some heuristics. (though we avoid repeating the exact same paths) Most commonly, the decision is made here. We bias towards picking False for booleans, as it more likely to break us out of loops, hopefully exploring shorter paths first. The search tree will also include nodes that don't obviously correspond to branches in the code under analysis. If this is of interest, I can prioritize doing some sort of write-up about the search tree and the different kinds of nodes - let me know! |
Beta Was this translation helpful? Give feedback.
-
|
Thanks. More write-ups are always good! |
Beta Was this translation helpful? Give feedback.
Great question. Path decisions are made randomly, guided by some heuristics. (though we avoid repeating the exact same paths)
Most commonly, the decision is made here. We bias towards picking False for booleans, as it more likely to break us out of loops, hopefully exploring shorter paths first.
The search tree will also include nodes that don't obviously correspond to branches in the code under analysis. If this is of interest, I can prioritize doing some sort of write-up about the search tree and the different kinds of nodes - let me know!