Automatic patch generation learned from human written patches

Post on 25-Jun-2015

7.249 views 0 download

Preview:

Click to see full reader

Tags:

Report this document
SHARE

description

Dongsun's ICSE 2013 Presentation. ACM SIGSOFT Distinguished Paper Award Winner!

Transcript of Automatic patch generation learned from human written patches

Automatic Patch Generation Learned from Human-Written Patches

Dongsun Kim, Jaechang Nam, Jaewoo Song, and Sunghun KimThe Hong Kong University of Science and Technology, China

24 May 2013

the 35th International Conference on Software Engineering (ICSE 2013)

2

Repair

2

Repair

2

Repair GenProgGenProg

3

GenProg

C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.

3

GenProgState-of-the-art

C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.

3

GenProgState-of-the-artGenetic Programming

C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.

3

GenProgState-of-the-artGenetic ProgrammingRandom Mutation

C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.

3

GenProgState-of-the-artGenetic ProgrammingRandom MutationSystematically Evaluated

C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.

4

Buggy Code

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

4

in Interpreter.java reported as Mozilla Bug #76683

Buggy Code

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

4

in Interpreter.java reported as Mozilla Bug #76683

Buggy Code

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

4

in Interpreter.java reported as Mozilla Bug #76683

Null Pointer Exception

Buggy Code

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

5

GenProg repairs bugs

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�

�

5

GenProg repairs bugs

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

Buggy  Code

GenProg

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�

�

5

GenProg repairs bugs

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

Buggy  Code

GenProg

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�

�

5

GenProg repairs bugs

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

Buggy  Code

GenProg

This patch passes ALL test cases.

6

GenProg repairs bugs1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�

�

6

GenProg repairs bugs1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

6

GenProg repairs bugs1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�

�

7

Would you accept?

7

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�

�

Would you accept?

7

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�

�

Would you accept?

7

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�

�

Would you accept?

17  Students68  Developers

8

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�

�

Would you accept?

17  Students68  Developers

8

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

�

�

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�

�

Would you accept?

9.4%

90.6%17  Students68  Developers

9

9

9

•Random

9

•Random•Unnatural

9

•Random•Unnatural•Harder  to  understand

10

10

10

RandomEvolution

10

RandomEvolution

Explores the large search space

10

RandomEvolution

Explores the large search spacebut sometimes

producesrandom results

10

RandomEvolution

IntelligentDesign

Explores the large search spacebut sometimes

producesrandom results

10

RandomEvolution

IntelligentDesign

Explores the large search space Leverages human

knowledgebut sometimes produces

random results

11

Human-written Patches

11

Human-written PatchesReadable

11

Human-written PatchesReadableNatural

11

Human-written PatchesReadableNaturalEasy to understand

11

Human-written PatchesReadableNaturalEasy to understand

We can learn how to generate patches from human knowledge.

12

12

JDT

12

>60,000Patches

JDT

12

ManualClassification

>60,000Patches

JDT

12

ManualClassification

# p

atch

es

Patterns

>60,000Patches

JDT

12

ManualClassification

# p

atch

es

Patterns

>60,000Patches

JDT

12

ManualClassification

# p

atch

es

Patterns

Top frequent patterns account for >20~30%

>60,000Patches

JDT

13

Common Fix PatternsAltering method parameters

obj.method(v1,v2)0→0obj.method(v1,v3)

Altering method parameters

obj.method(v1,v2)0→0obj.method(v1,v3)

13

Common Fix PatternsAdding a checker

obj.m1())→)if(obj'!='null)){obj.m1()}

Adding a checker

obj.m1())→)if(obj'!='null)){obj.m1()}

14

PAR

Pattern-based Automatic Program Repair

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

15

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

15

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

Human Knowledge

16

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

Using Human Knowledge

for patch generation

16

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

Fix Templates

Using Human Knowledge

for patch generation

16

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

Fix TemplatesProgram Edit Script

Using Human Knowledge

for patch generation

16

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

Fix TemplatesProgram Edit Script

Using Human Knowledge

for patch generation

10

16

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

Fix TemplatesProgram Edit Script

Manually created from fix patterns

Using Human Knowledge

for patch generation

10

16

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

Fix TemplatesProgram Edit Script

Manually created from fix patternsHighly reusable

Using Human Knowledge

for patch generation

10

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

17

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

18

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Fault Localization

19

Fault Locations

J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.

19

TP TF

Fault Locations

J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.

19

TP TF

Fault Locations

J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.

19

TP TF

Fault Locations

J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.

19

TP TF

Fault Locations

J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.

19

TP TF

Fault Locations

J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.

19

TP TF

Fault Locations

Faultlocations

J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

20

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Fault Localization

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

21

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

22

Template-basedPatch Candidate Generation

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

Fix Template

Patch Candidate

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMON

Fault Location

23

How a Fix Template works

23

How a Fix Template works

23

How a Fix Template works

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

23

How a Fix Template works

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

23

How a Fix Template works

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

23

How a Fix Template works

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

23

AST Analysis→Collects necessary AST nodes

How a Fix Template works

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

23

AST Analysis→Collects necessary AST nodes

Context Check→Examines applicability

How a Fix Template works

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

23

AST Analysis→Collects necessary AST nodes

Context Check→Examines applicability

Program Editing→Modifies the source code

How a Fix Template works

Using a Fix Template: An Example

24

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

Using a Fix Template: An Example

24

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker

Using a Fix Template: An Example

24

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker

Using a Fix Template: An Example

24

obj ref.: state, parens[i], ...

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker

Using a Fix Template: An Example

24

obj ref.: state, parens[i], ...

Check obj ref.: PASS

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker

Using a Fix Template: An Example

24

obj ref.: state, parens[i], ...

Check obj ref.: PASS

Edit: Insert ... ... + if( ) { state.parens[i].length = 0; + } ... ...

state != null && state.parens[i] != null

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker

Using a Fix Template: An Example

24

obj ref.: state, parens[i], ...

Check obj ref.: PASS

Edit: Insert ... ... + if( ) { state.parens[i].length = 0; + } ... ...

state != null && state.parens[i] != null

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker

Using a Fix Template: An Example

24

obj ref.: state, parens[i], ...

Check obj ref.: PASS

Edit: Insert ... ... + if( ) { state.parens[i].length = 0; + } ... ...

state != null && state.parens[i] != null

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 // deleted. 1507 } 1508 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 if( state != null && state.parens[i] != null) 1507 state.parens[i].length = 0; 1508 } 1509 state.parenCount = num;

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker

Using a Fix Template: An Example

24

obj ref.: state, parens[i], ...

Check obj ref.: PASS

Edit: Insert ... ... + if( ) { state.parens[i].length = 0; + } ... ...

state != null && state.parens[i] != null

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 // deleted. 1507 } 1508 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 if( state != null && state.parens[i] != null) 1507 state.parens[i].length = 0; 1508 } 1509 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 // deleted. 1507 } 1508 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;

1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 if( state != null && state.parens[i] != null) 1507 state.parens[i].length = 0; 1508 } 1509 state.parenCount = num;

1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�

25

List of Templates

25

List of Templates

Parameter Replacer

Method Replacer

Parameter Adder and Remover

Expression Replacer

Expression Adder and Remover

Object Initializer

Range Checker

Collection Size Checker

Null Pointer Checker

Class Cast Checker

26

Creating Patch Candidates

26

Creating Patch Candidates

26

Fault location #1

Fault location #2

Fault location #3

Fault location #4

Fault location #N

...

Creating Patch Candidates

26

Fault location #1

Fault location #2

Fault location #3

Fault location #4

Fault location #N

...

Creating Patch Candidates

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

...$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

Fix Templates

26

Fault location #1

Fault location #2

Fault location #3

Fault location #4

Fault location #N

...

Creating Patch Candidates

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

...$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

Fix Templates

...

PatchCandidates

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

27

Template-basedPatch Candidate Generation

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

Fix Template

Patch Candidate

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMON

Fault Location

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

28

Patch Evaluation

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

29

Patch Evaluation

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

29

Patch Evaluation

T Repaired

TestCases

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

29

Patch Evaluation

T Repaired

TestCases

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

29

Patch Evaluation

T Repaired

PassTestCases

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

29

Patch Evaluation

T Repaired

T Repaired

PassTestCases

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

29

Patch Evaluation

T Repaired

T Repaired

Pass

Fail

TestCases

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

29

Patch Evaluation

T Repaired

T Repaired

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

Fix Template

Patch Candidate

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMON

Fault Location

Pass

Fail

TestCases

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

30

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

30

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

30

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

30

31

Evaluation: Experiment Design

31

Evaluation: Experiment Design

31

Evaluation: Experiment Design

PAR GenPro

31

Evaluation: Experiment Design

PAR GenPro

31

Evaluation: Experiment Design

PAR GenPro

31

Evaluation: Experiment Design

PAR GenPro

# #

32

RQ1(Fixability): How many bugs are fixed successfully?

RQ2(Acceptability): Which approach can generate more acceptable bug patches?

Evaluation: Research Questions

#

33

Subject # bugs LOC # test cases

Rhino 17 51,001 5,578

AspectJ 18 180,394 1,602

log4j 15 27,855 705

Math 29 121,168 3,538

Lang 20 54,537 2,051

Collections 20 48,049 11,577

Total 119 351,406 25,051

Experiment Subjects

34

RQ1: Fixability

34

RQ1: Fixability

PAR GenProg06

12182430

34

RQ1: Fixability

PAR GenProg06

12182430

27

34

RQ1: Fixability

PAR GenProg06

12182430

27

16

34

RQ1: Fixability

PAR GenProg06

12182430

27

16PAR GenProg

27 16>

35

RQ2: Acceptability

35

RQ2: Acceptability

User Study #1: Ranking between PAR and GenProg

36

36

PAR

36

PAR GenProg

36

PAR GenProg

5

37

User Study #1Ranking Patches

37

User Study #1Bug DescriptionRanking Patches

37

User Study #1Bug Description

Buggy Code

Ranking Patches

37

User Study #1Bug Description

Buggy Code

Anonymized Patch #1

Ranking Patches

37

User Study #1Bug Description

Buggy Code

Anonymized Patch #1

Anonymized Patch #2

Ranking Patches

37

User Study #1Bug Description

Buggy Code

Anonymized Patch #1

Anonymized Patch #2

Anonymized Patch #3

Ranking Patches

37

User Study #1Bug Description

Buggy Code

Anonymized Patch #1

Anonymized Patch #2

Anonymized Patch #3

Ranking Patches

37

User Study #1Bug Description

Buggy Code

Anonymized Patch #1

Anonymized Patch #2

Anonymized Patch #3

Rank patches

17  Students68  Developers

Ranking Patches

37

User Study #1Bug Description

Buggy Code

Anonymized Patch #1

Anonymized Patch #2

Anonymized Patch #3

2

1

3

Rank patches

17  Students68  Developers

Ranking Patches

User Study #1: ResultsStudent  group  (avg.  ranking)

38

(the lower the better)Developer  group  (avg.  ranking)

(the lower the better)

User Study #1: ResultsStudent  group  (avg.  ranking)

38

0

0.75

1.5

2.25

3

1.72 1.57

2.67

PAR GenProgHuman

(the lower the better)Developer  group  (avg.  ranking)

(the lower the better)

User Study #1: ResultsStudent  group  (avg.  ranking)

38

0

0.75

1.5

2.25

3

1.72 1.57

2.67

PAR GenProgHuman

(the lower the better)Developer  group  (avg.  ranking)

(the lower the better)

SignificantlyDifferent

User Study #1: ResultsStudent  group  (avg.  ranking)

38

0

0.75

1.5

2.25

3

1.72 1.57

2.67

PAR GenProgHuman

(the lower the better)Developer  group  (avg.  ranking)

1

1.35

1.7

2.05

2.4

1.81 1.82

2.36

(the lower the better)

PARGenPro

gHuman

SignificantlyDifferent

User Study #1: ResultsStudent  group  (avg.  ranking)

38

0

0.75

1.5

2.25

3

1.72 1.57

2.67

PAR GenProgHuman

(the lower the better)Developer  group  (avg.  ranking)

1

1.35

1.7

2.05

2.4

1.81 1.82

2.36

(the lower the better)

PARGenPro

gHuman

SignificantlyDifferent

SignificantlyDifferent

User Study #1: ResultsStudent  group  (avg.  ranking)

38

0

0.75

1.5

2.25

3

1.72 1.57

2.67

PAR GenProgHuman

(the lower the better)Developer  group  (avg.  ranking)

1

1.35

1.7

2.05

2.4

1.81 1.82

2.36

(the lower the better)

PARGenPro

gHuman

SignificantlyDifferent

SignificantlyDifferentPAR generates better ranking

patches than GenProg

39

RQ2: Acceptability

User Study #1: Ranking between PAR and GenProg

39

RQ2: Acceptability

User Study #1: Ranking between PAR and GenProg

User Study #2: Pair-wise Comparison between

Human-written PatchesVs.

PAR or GenProg

40

40

PAR

27

40

PAR

27

GenProg

16

41

User Study #2Pair-wise Comparison

41

User Study #2Bug DescriptionPair-wise Comparison

41

User Study #2Bug Description

Buggy Code

Pair-wise Comparison

41

User Study #2Bug Description

Buggy Code

Anonymized Patch #1

Pair-wise Comparison

41

User Study #2Bug Description

Buggy Code

Anonymized Patch #1

Anonymized Patch #2

Pair-wise Comparison

41

User Study #2Bug Description

Buggy Code

Anonymized Patch #1

Anonymized Patch #2

Choose acceptablepatch(es)

72  Students96  Developers

Pair-wise Comparison

41

User Study #2Bug Description

Buggy Code

Anonymized Patch #1

Anonymized Patch #2

Patch #1 Patch #2

Both Not sure

Choose acceptablepatch(es)

72  Students96  Developers

Pair-wise Comparison

User Study #2: Results

GenProg

42

PAR

User Study #2: Results

GenProg

42

0

10

20

30

40

21

28

37

14resp

onse

s (%

)

PAR HumanBoth NotSure

PAR

User Study #2: Results

GenProg

42

0

10

20

30

40

21

28

37

14resp

onse

s (%

)

PAR HumanBoth NotSure

PAR

0

15

30

45

60

20

12

51

17re

spon

ses

(%)

GenProg HumanBoth NotSure

User Study #2: Results

GenProg

42

0

10

20

30

40

21

28

37

14resp

onse

s (%

)

PAR HumanBoth NotSure

PAR

0

15

30

45

60

20

12

51

17re

spon

ses

(%)

GenProg HumanBoth NotSure

49%

User Study #2: Results

GenProg

42

0

10

20

30

40

21

28

37

14resp

onse

s (%

)

PAR HumanBoth NotSure

PAR

0

15

30

45

60

20

12

51

17re

spon

ses

(%)

GenProg HumanBoth NotSure

49%

32%

User Study #2: Results

GenProg

42

0

10

20

30

40

21

28

37

14resp

onse

s (%

)

PAR HumanBoth NotSure

PAR

0

15

30

45

60

20

12

51

17re

spon

ses

(%)

GenProg HumanBoth NotSure

49%

32%PAR generates more

acceptable patches than GenProg

43

Limitations

• Fix templates are written manually.• But it is one-time cost, these are highly reusable.

• We entirely re-implemented GenProg by Java.

• All subjects are collected from open source projects.

• Some participants may not be thoroughly qualified.

44

Summary

44

Summary

Observed common patches

# p

atch

es

Patterns

44

Summary

Observed common patches

# p

atch

es

Patterns

Fix Templates and PARif(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

44

Summary

Can fix more bugs with more acceptability

Observed common patches

# p

atch

es

Patterns

Fix Templates and PARif(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

0

6

12

18

24

30

16

27

0

0.75

1.5

2.25

3

1

1.35

1.7

2.05

2.4

0

10

20

30

40

PAR HumanBoth NotSure

0

15

30

45

60

GenProg HumanBoth NotSure

49%

32%

45

Future Work

Automatic Fix Template Identification• More templates can fix more bugs.

More Test Cases• More test cases may lead us to better patches.

46

Acknowledgement

Special Thanks to:

Westley Weimer, Claire Le Goues,

Thomas Zimmermann, and Christian Bird

http://thomas-zimmermann.com/
http://thomas-zimmermann.com/

47

Summary

Fix Templates and PAR

Can fix more bugs with more acceptability

Observed common patches

# p

atch

es

Patterns

if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Buggy Program

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

(a) Fault Localization

$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO-++

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

GVIVDGIVGDIVGDVGONIMGDVOM

(b) Template-based Patch Candidate Generation

Fail

Pass

(c) Patch Evaluation

T Repaired

Fix Template

Patch Candidate

VGDJNOMODNZMHIUOZMHIVGMON�

DDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI

$VJDGVIDVGIDVOGMJONDMDVJDGI��O

6GOMNIONDVMGI�OMDVGOIMVGO

GVIVDGIVGDIVGDVGONIMGDVOM

ONDVMIONMVGDONIMOGNVDMIONGVDM

Repaired Program

Fault Location

0

6

12

18

24

30

16

27

0

0.75

1.5

2.25

3

1

1.35

1.7

2.05

2.4

0

10

20

30

40

PAR HumanBoth NotSure

0

15

30

45

60

GenProg HumanBoth NotSure

49%

32%

Top related

Managing Software Patches 10/15/20151. Introducing Solaris OE Patches A patch contains collection of files and directories Patch replaces existing files.
 Documents
SRI International Bioinformatics Update your computers! To install a patch: Tools => Instant Patch => Download and Activate All Patches.
 Documents
Patchwork - reducing your patch workload · Patchwork basics Patches parsed from mailing list Maintainer updates state Depending on patch review Patch flow is tracked
 Documents
Microsoft Patch Analysis for Exploitation...12/21/2016 12:00 AM 18,796,032 edgehtml.dll 1 File(s) 18,796,032 bytes 2 Dir(s) 45,532,430,336 bytes free Patch Diffing • Security patches
 Documents
Giant Garbage Patches What can you do?. Lets review what we learned yesterday.
 Documents
CUSTOM JACKET PATCHES - Jostens · mascots and additional patches. club initials, shapes and flag patches please use the patch codes, listed below the samples, on your order form.
 Documents
How to Mend and Patch Your Jeans with Style: Sharecropper Patches
 Documents
Patch Management · Patch Management is the process by which security fixes ... a structured approach to identifying and implementing security patches ... vulnerability and patch
 Documents
Patch and Badge Placement - Cub Scout Pack 222 - …pack222.weebly.com/.../8034891/patch_and_badge_placement.pdfAll other patches are to be sewn onto a red patch vest or blanket. This
 Documents
ESX Server 3 Patch Management Guide (remote CLI). For information on vihostupdate, see “ESX Server Patch Management Tools” on page 42. ... Software patches provide immediate fixes
 Documents
Analysis of spatial patterns of forest fragmentationshodhganga.inflibnet.ac.in/bitstream/10603/54555/12... · Fragmentation parameters such as patch size, patch shape, number of patches,
 Documents
RDS12016 SP Trans Info REV1 · Transdermal Patch To cut or not to cut? Although manufacturers DO NOT recommend cutting any transdermal patches, there are case reports of cut patches
 Documents
Navajo Lodge Pow Wow Patches - SageVenture · 2016. 4. 24. · Navajo Lodge Pow Wow Patches Continued Issue # BB Year Additional Information 10/25/02 - 3 - Navajo Lodge Pow Wow Patch
 Documents
...XtraSize Team Jacket (52XXL-58XXXL) plus Tall With Fleece Liner, patches, embroidery, reflective patch on back Service Jacket, Black (34 Sm.- 46 L) with patches, embroidery, reflective
 Documents
MAKING OF A PATCH - Scout Shop › m2pdf › BePrepared_Vol_5_No_11.… · MAKING OF A PATCH In the centuries before Scouting, patches were embroidered by hand, ... hinges. Home Repairs
 Documents
akstats.weebly.com · Nicotine patches are often used to help smokers quit. Does giving medicine to smokers to receive nicotine patches and another 7115 to receive both a patch and
 Documents
How to Use Transdermal Patches - SafeMedication.com · How to Use Transdermal Patches Read the patient information for use before using your patch. Each product will have specific
 Documents
Butec 5 microgram/hour Transdermal Patch Butec 10 ... for Butec Transdermal Patches (informed consent). Butec Transdermal Patches are used to relieve moderate, long-lasting pain that
 Documents
Learned Multi-Patch Similarity · Learned Multi-Patch Similarity Wilfried Hartmann1 Silvano Galliani1 Michal Havlena2 Luc Van Gool3,4 Konrad Schindler1 1Photogrammetry and Remote
 Documents
Patch for Ubuntu - User's Guide€¦ · Ubuntu 14.04 LTS x86 and AMD64 Patches for Ubuntu 1404 Ubuntu 16.04 LTS x86 and AMD64 Patches for Ubuntu 1604 Ubuntu 18.04 LTS AMD64 Patches
 Documents

Copyright © 2022 FDOCUMENTS