A Case Study on Executing Instrumented Code in Java PathFinder

Dynamic program analysis is widely used for detecting faults in software systems. Dynamic analysis tools conceptually either use a modified execution environment or inject instrumentation code into the system under test (SUT). Tools based on a modified environment, such as Java PathFinder (JPF), have full access to the state of the SUT but at the cost of a higher runtime overhead. Instrumentation-based tools have lower overhead but at the cost of less convenient control of runtime such as thread schedules. Combinations of these two approaches are largely unexplored, and to our knowledge, have never been done in JPF. We present a case study of adapting an existing instrumentation-based tool to run inside JPF. To keep the instrumentation unchanged, we limited our changes to the code invoked by the instrumentation. Ultimately, the required changes were few and essentially reduce to properly dividing the analysis-related state and logic between the JPF and host JVM levels. Others can benefit from our experience to quicker adapt their instrumentation-based tools to run in JPF.