Interprocedural searcher

[mxprshn]

New searcher, which selects (hopefully 😺) a state closest to not covered yet instruction, calculating distance considering whole call stack (current ShortestDistance works only within a function)

How it works:

A "CallTree" data structure is maintained: it is like a persistent call stack, saving all call chains which appeared during execution. In each tree node (stack frame in fact) we save distance from it's return point to the closest not covered basic block.

We have:

D1 --- distance from the current location to the closest return
D2 --- distance from the return point of the current method to the closest not covered basic block (which we save in CallTree)
D3 --- distance from the current location to the closest not covered basic block in current method

Then the final distance is calculated recursively as follows:

If state's method location is not in coverage zone: D1 + D2
If state's method location is in coverage zone: min(D3, D1 + D2)

This distance is used as states' weight.

Distance itself is not just a number: it also can be Approximate or Precise. Approximate means that there are some calls in the path for which we don't know how deep they would be. In precise distances all calls are known and already considered. Approximate distances are always considered "bigger" than precise ones.

When we finish the exploration of method without calls, distances are recalculated, as some approximate distances become precise in this moment.

Another case when distances are recalculated is test generation event: not covered basic blocks could become covered