SemFix:ProgramRepairviaSemanticAnalysis

YeWang,PhDstudentDepartmentofComputerScience

VirginiaTech

ProblemStatement

• Debuggingtakesmuchtimeandeffort• Evenafterrootcauseofabugisidentified,fixingbugisnon-trivial• Problemsolvedbythispaperishowtoautomaticallyrepairbugs

Example

Tobefixed

Constraint

3 usablevariablesatline4:inhibit,up_sep,down_sep

letbias=f(inhibit,up_sep,down_sep)sothatbias>down_sep canpasstests

Synthesizef(1)tryaconstant:cannotsatisfyconstraint

(2)trytouse"+",{v1+c,v1+v2}:f=up_sep +100

Background

• Statisticalfaultlocalization• Localizeroot-causeofprogramfailurebyexploitingthecorrelationbetweenexecutionoffaultystatementsandprogramfailure

• Component-basedprogramsynthesis• Generateaprogramthatsatisfiesallthegiveninput-outputpairs.

Approach

• Onlygeneratearepairbyalteringonestatement.Thegeneratedfixisalwayswithrespecttoagiventestsuite.• Generaterepairconstraint• Generateafix

Approach

• Generaterepairconstraint• Thepaperfocusesonrepairschangingtherightsideofassignmentsorbranchpredicates

• Nosideeffect:f(…)donotmodifyanyprogramvariable

• RepairconstraintCisaconjunctionofconstraintsderivedfromT.Foreachtestti,thereisaconstraintCi,

Approach

• Generaterepairconstraint• EachCi isapredicateoverthefunctionf• TogenerateCi,thepaperusessymbolicexecutioninanovelfashion.• Traditionalsymbolicexecutiontakesallinputvariablesassymbolic,whilethepaper'ssymbolicexecutionstartswithaconcreteinput.• Executetheprogramconcretelywithinputti tostatements.Denotetheprogramstatebeforeexecutingstatementsas𝜉".Thensettheresultoffunctionf(…)assymbolicandcontinuesymbolicexecutionfromstatements.

Approach

• Generaterepairconstraint• 𝜏":symbolicvalueassignedtoresultoffunctionf(…)• Symbolicexecutionexploresmpaths.• Foreachpath𝜋%,𝑝𝑐% istheassociatedpathcondition,and𝑂% isthesymbolicexpressionofoutput• 𝑂 𝑡" istheexpectedoutputofprogramPwithinput𝑡"• Constraint:

• FirstpartmeansatleastonefeasiblepathalongwhichoutputofprogramPisthesameastheexpectedoutput.• Secondpartbuildsupinput-outputrelationshipoffunctionf

Approach

• Generaterepairconstraint

𝑋 > 110 ∧ 1 = 1 ∨ 𝑋 ≤ 110 ∧ 1 = 0canbesimplified to𝑋 > 110

𝑓 1,11,110 > 110

𝑓 1,11,110 = 𝑋

Approach

• Generateafix• Componentbasedprogramsynthesis• Input-outputpairsofto-be-synthesisprogramareencodedintoconstraintsonasetoflocationvariablesL,avaluationofwhichleadstoaprogramthatsatisfiesthegiveninput-outputpairs.• Constraint𝜓5678 𝐿,𝛼,𝛽 dictatesthatthesynthesizedprogrammustproduceoutput𝛽 whengiveninput𝛼• Input-outputpair 𝜉"<, 𝜏"< isgeneratedwhenfishitatthekth timeintheexecutionofprogramPwithinput𝑡",but 𝜉"<, 𝜏"< issymbolicintermsof 𝜏"<|1 ≤ 𝑘 ≤ 𝜔 ,where𝜔 isnumberoftimesfisexecutedwithinput𝑡"

Approach

• Generateafix• 𝜏"<|1 ≤ 𝑘 ≤ 𝜔 satisfy• 𝑓 shouldsatisfytheconstraint

• Conjoinconstraintsfromallteststogetherwiththewell-formedness constraint𝜓@5A

Approach

• Puttingitalltogether• ThealgorithmtakesasinputsabuggyprogramP,atestsuiteTandarankedlistofsuspiciousprogramstatementsRC• Whensuccessful,thealgorithmproducesarepair,applyingwhichonPmakesPpassalltestsinthetestsuiteT.

Evaluation

• UseSemFix torepairseededdefectsandrealdefectsinanopensourcesoftware.Theproposedmethodisalsocomparedwithgeneticprogrammingbasedrepairtechniques.

Evaluation

• Intuitively,itishardertogeneratearepairtopassmoretests• Repairsgeneratedwithsmallnumberoftestsmaynotbevalidforotherteststhatarenotintestsuite.

Evaluation

•

Evaluation

• Differenttypesofbugs

RelatedWork

• Geneticprogramming:• W.Weimer,T.Nguyen,C.LeGoues,andS.Forrest,“Automaticallyfindingpatchesusinggeneticprogramming,”inICSE,2009.• C.LeGoues,M.Dewey-Vogt,S.Forrest,andW.Weimer,“Asystematicstudyofautomatedprogramrepair:Fixing55outof105bugsfor$8each,”inICSE,2012.

• AutoFix-EandAutoFix-E2arebasedontheprogramcontractsinEiffelprograms• Jobstmann,et.al.usesLTLspecificationsforfinitestateprograms

RelatedWork

• Gopinath,et.al.usebehavioralspecificationsandencodethespecificationconstraintonthebuggyprogramintoSATconstraint• RobertandRoderickemploytemplatebasedrepairforlinearexpressions.• Dallmeier,et.al.trytogeneratefixesfromobjectbehavioranomalies.• ClearView followsasimilarschemebutworksondeployedbinaryprogramwhenhighavailabilityisrequired.

RelatedWork

• BugFix suggestsbug-fixthathasbeenusedinasimilardebuggingsituation.• Debroy andWongproposetousemutationforprogramrepair.• PHPRepair focusesonHTMLgenerationerrorsinPHPprograms.• Insteadoffixingabuggyprogram,programsketchingallowsaprogrammertowriteasketchoftheimplementationideawhileleavingthelowleveldetailsomittedasholestobeautomaticallyfilledupbythesketchcomplier.

Conclusion

• TheproposedSemFix isasemanticsbasedprogramrepairtool.• Therepairconstraint,whichisderivedfromasetoftests, issolvedbygeneratingavalidrepair.• SemFix cansynthesizearepaireveniftherepaircodedoesnotexistanywhereintheprogram.

Discussion

• Whichiseasier,fixingabugmanuallyorverifytheauto-generatedbugfix?

Discussion

• Canyouapplyartificialintelligence(AI)toautomaticbugrepairingtoimproveit?• Ifyes,how?

Discussion

• IfyouareasoftwareengineerinanITcompany,willyouuseanautomaticbugrepairingtool?• Ifyes,whichcaseswillyouuseitin?whichcaseswillyounotuseitin?

Discussion

• Thepapersays"thetestsuitecouldbelargeandthusaffectthescalabilityofourtechnique".• Doyouthinkselectingasubsetoftheentiretestsuiteforrepairgenerationisagoodidea?

Discussion

• Thesebasiccomponentsareusedtogeneratearepairs.• Doyouthinktheyareenough?Shouldweaddsomethingmore,likedivision(/)?

Discussion

• Theproposedmethodonlysynthesisanexpression.• Shouldweusesomemorecomplicatedlogics,likeif-condition,for-loop,andwhile-loop?• Ifyes,howwilltheyaffecttheprecisionandspeedofthebugrepairingmethod?

Discussion

• Theproposedmethodonlychangeonestatement.• Doyouthinkchangingmorestatementsisagoodidea?Why?

Discussion

• Tobehonest,nomatterhowmanytestcasesareused,wecannotguaranteethebugfixisright.• Canthebugrepairingmethoduseanotherconstraint,insteadoftests?

Discussion

• CananyotherresearchbedonebasedonSemFix?• Ifyes,talkaboutthedetails.