I wondered how they come up with the specifications. It turns out that they cheat yet again, take existing test suites (probably with horrible coverage) and prove that some new code satisfies the tests and does not crash.

People, hide your test suites from the criminals.