libs2eplugins: optionally create test cases when forking states

Add an option ".generateOnStateFork" to the test-case generator (default false).
If enabled, a new test case with suffix "fork" is generated for each newly
forked execution state.

libs2eplugins/src/s2e/Plugins/ExecutionTracers/TestCaseGenerator.cpp

@@ -110,9 +110,16 @@ void TestCaseGenerator::initialize() {
 void TestCaseGenerator::enable() {
     ConfigFile *cfg = s2e()->getConfig();
 
+    bool tcOnFork = cfg->getBool(getConfigKey() + ".generateOnStateFork", false);
     bool tcOnKill = cfg->getBool(getConfigKey() + ".generateOnStateKill", true);
     bool tcOnSegfault = cfg->getBool(getConfigKey() + ".generateOnSegfault", true);
 
+    if (tcOnFork) {
+        m_stateForkConnection.disconnect();
+        m_stateForkConnection =
+            s2e()->getCorePlugin()->onStateFork.connect(sigc::mem_fun(*this, &TestCaseGenerator::onStateFork));
+    }
+
     if (tcOnKill) {
         m_stateKillConnection.disconnect();
         m_stateKillConnection =
@@ -142,6 +149,7 @@ void TestCaseGenerator::enable() {
 }
 
 void TestCaseGenerator::disable() {
+    m_stateForkConnection.disconnect();
     m_stateKillConnection.disconnect();
     m_linuxSegFaultConnection.disconnect();
     m_windowsKernelCrashConnection.disconnect();
@@ -162,6 +170,14 @@ void TestCaseGenerator::onSegFault(S2EExecutionState *state, uint64_t pid, uint6
     generateTestCases(state, ss.str(), TC_FILE);
 }
 
+void TestCaseGenerator::onStateFork(S2EExecutionState *state, const std::vector<S2EExecutionState *> &newStates,
+                                    const std::vector<klee::ref<klee::Expr>> &newConditions) {
+    for (auto *newState : newStates) {
+        if (newState != state)
+            generateTestCases(newState, "fork", TC_FILE);
+    }
+}
+
 void TestCaseGenerator::onStateKill(S2EExecutionState *state) {
     generateTestCases(state, "kill", TC_LOG | TC_TRACE | TC_FILE);
 }

libs2eplugins/src/s2e/Plugins/ExecutionTracers/TestCaseGenerator.h

@@ -245,13 +245,16 @@ class TestCaseGenerator : public Plugin, public IPluginInvoker {
     const ConcreteFileTemplates &getTemplates(S2EExecutionState *state) const;
 
 private:
+    sigc::connection m_stateForkConnection;
     sigc::connection m_stateKillConnection;
     sigc::connection m_linuxSegFaultConnection;
     sigc::connection m_windowsUserCrashConnection;
     sigc::connection m_windowsKernelCrashConnection;
 
     ExecutionTracer *m_tracer;
 
+    void onStateFork(S2EExecutionState *state, const std::vector<S2EExecutionState *> &newStates,
+                     const std::vector<klee::ref<klee::Expr>> &newConditions);
     void onStateKill(S2EExecutionState *state);
     void onSegFault(S2EExecutionState *state, uint64_t pid, uint64_t pc);
     void onWindowsUserCrash(S2EExecutionState *state, const WindowsUserModeCrash &desc);