SemFix: Program Repair via Semantic...
Transcript of SemFix: Program Repair via Semantic...
SemFix:ProgramRepairviaSemanticAnalysis
YeWang,PhDstudentDepartmentofComputerScience
VirginiaTech
ProblemStatement
• Debuggingtakesmuchtimeandeffort• Evenafterrootcauseofabugisidentified,fixingbugisnon-trivial• Problemsolvedbythispaperishowtoautomaticallyrepairbugs
Example
Tobefixed
Constraint
3 usablevariablesatline4:inhibit,up_sep,down_sep
letbias=f(inhibit,up_sep,down_sep)sothatbias>down_sep canpasstests
Synthesizef(1)tryaconstant:cannotsatisfyconstraint
(2)trytouse"+",{v1+c,v1+v2}:f=up_sep +100
Background
• Statisticalfaultlocalization• Localizeroot-causeofprogramfailurebyexploitingthecorrelationbetweenexecutionoffaultystatementsandprogramfailure
• Component-basedprogramsynthesis• Generateaprogramthatsatisfiesallthegiveninput-outputpairs.
Approach
• Onlygeneratearepairbyalteringonestatement.Thegeneratedfixisalwayswithrespecttoagiventestsuite.• Generaterepairconstraint• Generateafix
Approach
• Generaterepairconstraint• Thepaperfocusesonrepairschangingtherightsideofassignmentsorbranchpredicates
• Nosideeffect:f(…)donotmodifyanyprogramvariable
• RepairconstraintCisaconjunctionofconstraintsderivedfromT.Foreachtestti,thereisaconstraintCi,
Approach
• Generaterepairconstraint• EachCi isapredicateoverthefunctionf• TogenerateCi,thepaperusessymbolicexecutioninanovelfashion.• Traditionalsymbolicexecutiontakesallinputvariablesassymbolic,whilethepaper'ssymbolicexecutionstartswithaconcreteinput.• Executetheprogramconcretelywithinputti tostatements.Denotetheprogramstatebeforeexecutingstatementsas𝜉".Thensettheresultoffunctionf(…)assymbolicandcontinuesymbolicexecutionfromstatements.
Approach
• Generaterepairconstraint• 𝜏":symbolicvalueassignedtoresultoffunctionf(…)• Symbolicexecutionexploresmpaths.• Foreachpath𝜋%,𝑝𝑐% istheassociatedpathcondition,and𝑂% isthesymbolicexpressionofoutput• 𝑂 𝑡" istheexpectedoutputofprogramPwithinput𝑡"• Constraint:
• FirstpartmeansatleastonefeasiblepathalongwhichoutputofprogramPisthesameastheexpectedoutput.• Secondpartbuildsupinput-outputrelationshipoffunctionf
Approach
• Generaterepairconstraint
𝑋 > 110 ∧ 1 = 1 ∨ 𝑋 ≤ 110 ∧ 1 = 0canbesimplified to𝑋 > 110
𝑓 1,11,110 > 110
𝑓 1,11,110 = 𝑋
Approach
• Generateafix• Componentbasedprogramsynthesis• Input-outputpairsofto-be-synthesisprogramareencodedintoconstraintsonasetoflocationvariablesL,avaluationofwhichleadstoaprogramthatsatisfiesthegiveninput-outputpairs.• Constraint𝜓5678 𝐿,𝛼,𝛽 dictatesthatthesynthesizedprogrammustproduceoutput𝛽 whengiveninput𝛼• Input-outputpair 𝜉"<, 𝜏"< isgeneratedwhenfishitatthekth timeintheexecutionofprogramPwithinput𝑡",but 𝜉"<, 𝜏"< issymbolicintermsof 𝜏"<|1 ≤ 𝑘 ≤ 𝜔 ,where𝜔 isnumberoftimesfisexecutedwithinput𝑡"
Approach
• Generateafix• 𝜏"<|1 ≤ 𝑘 ≤ 𝜔 satisfy• 𝑓 shouldsatisfytheconstraint
• Conjoinconstraintsfromallteststogetherwiththewell-formedness constraint𝜓@5A
Approach
• Puttingitalltogether• ThealgorithmtakesasinputsabuggyprogramP,atestsuiteTandarankedlistofsuspiciousprogramstatementsRC• Whensuccessful,thealgorithmproducesarepair,applyingwhichonPmakesPpassalltestsinthetestsuiteT.
Evaluation
• UseSemFix torepairseededdefectsandrealdefectsinanopensourcesoftware.Theproposedmethodisalsocomparedwithgeneticprogrammingbasedrepairtechniques.
Evaluation
• Intuitively,itishardertogeneratearepairtopassmoretests• Repairsgeneratedwithsmallnumberoftestsmaynotbevalidforotherteststhatarenotintestsuite.
Evaluation
•
Evaluation
• Differenttypesofbugs
RelatedWork
• Geneticprogramming:• W.Weimer,T.Nguyen,C.LeGoues,andS.Forrest,“Automaticallyfindingpatchesusinggeneticprogramming,”inICSE,2009.• C.LeGoues,M.Dewey-Vogt,S.Forrest,andW.Weimer,“Asystematicstudyofautomatedprogramrepair:Fixing55outof105bugsfor$8each,”inICSE,2012.
• AutoFix-EandAutoFix-E2arebasedontheprogramcontractsinEiffelprograms• Jobstmann,et.al.usesLTLspecificationsforfinitestateprograms
RelatedWork
• Gopinath,et.al.usebehavioralspecificationsandencodethespecificationconstraintonthebuggyprogramintoSATconstraint• RobertandRoderickemploytemplatebasedrepairforlinearexpressions.• Dallmeier,et.al.trytogeneratefixesfromobjectbehavioranomalies.• ClearView followsasimilarschemebutworksondeployedbinaryprogramwhenhighavailabilityisrequired.
RelatedWork
• BugFix suggestsbug-fixthathasbeenusedinasimilardebuggingsituation.• Debroy andWongproposetousemutationforprogramrepair.• PHPRepair focusesonHTMLgenerationerrorsinPHPprograms.• Insteadoffixingabuggyprogram,programsketchingallowsaprogrammertowriteasketchoftheimplementationideawhileleavingthelowleveldetailsomittedasholestobeautomaticallyfilledupbythesketchcomplier.
Conclusion
• TheproposedSemFix isasemanticsbasedprogramrepairtool.• Therepairconstraint,whichisderivedfromasetoftests, issolvedbygeneratingavalidrepair.• SemFix cansynthesizearepaireveniftherepaircodedoesnotexistanywhereintheprogram.
Discussion
• Whichiseasier,fixingabugmanuallyorverifytheauto-generatedbugfix?
Discussion
• Canyouapplyartificialintelligence(AI)toautomaticbugrepairingtoimproveit?• Ifyes,how?
Discussion
• IfyouareasoftwareengineerinanITcompany,willyouuseanautomaticbugrepairingtool?• Ifyes,whichcaseswillyouuseitin?whichcaseswillyounotuseitin?
Discussion
• Thepapersays"thetestsuitecouldbelargeandthusaffectthescalabilityofourtechnique".• Doyouthinkselectingasubsetoftheentiretestsuiteforrepairgenerationisagoodidea?
Discussion
• Thesebasiccomponentsareusedtogeneratearepairs.• Doyouthinktheyareenough?Shouldweaddsomethingmore,likedivision(/)?
Discussion
• Theproposedmethodonlysynthesisanexpression.• Shouldweusesomemorecomplicatedlogics,likeif-condition,for-loop,andwhile-loop?• Ifyes,howwilltheyaffecttheprecisionandspeedofthebugrepairingmethod?
Discussion
• Theproposedmethodonlychangeonestatement.• Doyouthinkchangingmorestatementsisagoodidea?Why?
Discussion
• Tobehonest,nomatterhowmanytestcasesareused,wecannotguaranteethebugfixisright.• Canthebugrepairingmethoduseanotherconstraint,insteadoftests?
Discussion
• CananyotherresearchbedonebasedonSemFix?• Ifyes,talkaboutthedetails.