Automated fault localization techniques assist developers with the task of pointing out program elements that are most probable to be responsible for a detected error. Over the years, many different techniques have been developed [7]. State-based fault localization techniques comprise several different strategies to locate software bugs by monitoring and manipulating the state of a program at various points in its executions, and to then draw conclusions about the cause of the error from the executions’ results. Notable techniques in this category include, e.g., the delta debugging approach [8] and its extension – the cause transition technique [1, 2]. There also exist techniques that alter the outcome of decisions during program execution [9, 6, 5, 4]. A very recent approach uses a decision tree learner to learn input features that are responsible for a specific program behavior [3]. The goal of this topic is to examine and discuss the current state of the art of state-based fault localization techniques, to evaluate their relevancy and to analyze/estimate their capabilities compared to other fault localization techniques.

Until recently, debugging still takes almost 70% of the time in software engineering. The conventional debugging process, based on setting breakpoints and inspecting the states on them, remains the most common and useful way to detect faults. The efficiency of debugging differs a lot as both the selection and inspection of breakpoints are up to programmers. This paper presents a novel breakpoint generating approach based on a new concept named minimum debugging frontier sets (abbr. MDFS). A debugging frontier set describes a set of trace points, which have the ability of bug isolation, and a MDFS is the one with minimum size. Benefiting from the ability of bug isolation, the error suspicious domain will always be narrowed down to one side of the MDFS no matter the state of MDFS is proven correct or not. Breakpoints generated on the basis of MDFS also make the statement instances to be inspected at each breakpoint at the minimum. The paper also establishes a set of criterions to judge the quality of breakpoints. Empirical result indicates that breakpoints generated through this approach not only require low inspecting cost, but also have the ability to accelerate the efficiency of debugging. It also shows that this MDFS-based debugging prototype performs better than the state-of-art fault-localization techniques on the Siemens Suite.

In this paper, we present a novel state-based fault-localization approach called DelFal. Assuming the availability of the execution trace which leads to the reported program execution failure, this new approach successively selects sets of trace points to allow the performance of efficient automatic explorations on program execution states in order to help the developer locate programming faults responsible for the observed execution failure. With each of such sets of trace points, the program state at each trace point is symbolically altered, by negating a certain atomic predicate, to see whether the same failure occurs with symbolic execution continuing from the corresponding program point in the source code. The set of trace points is chosen such that the union of the program states is of the minimum size among all candidate sets. Such a set of trace points is called a minimum debugging frontier set (abr. MDFS). Depending on the result from the symbolic execution, the next MDFS is determined by moving forward or backward on the remaining program trace. This process of trace shortening goes on until the offending faulty code is found. The MDFS approach requires the execution failing location to be provided, but the specification of the desired program state is optional. With such specification, it may achieve a more accurate fault report. To evaluate our approach, we tried it on 15 real bugs from real world programs. Results show that our approach is effective in explaining failures within reasonable time.

Pointers are widely used in C programs,pointer dereference faults are dangerous while they occur frequently.Many tools are designed to detect this kind of faults,but the state-of-art tools cannot meet the practical needs due to inconvenient usage,low detection accuracy and poor scalability.This paper presents a detection approach which is based on flow-sensitive,field-sensitive and context-sensitive propagation engine.The approach successfully lowers the user burden,improves detection accuracy and scalability.The core concept of the approach is fault attribute lattice.The lattice values are computed and propagated through the source code to detect the faults which were characterized via the fault attribute lattice.A prototype system named Propagator based on Open64 compiler has been implemented.Using null-pointer dereference fault detection as one case study,the comparison experiments with Saturn,Splint and Clang-SA on applications such as Apache,OpenSSH,gzip etc.are done.The results show that Propagator uses only 12 seconds on average to finish the fault checking and the false positive rate of Propagator is only 13% on average.Furthermore,Propagator do not report known false negatives.It is clear that Propagator not only improves the scalability but also achieves the high detection accuracy,thus indicates our approach can be used in practical.

May-Happen-in-Parallel (MHP) analysis is a very important and fundamental mechanism to facilitate concurrent program analysis, optimization and even concurrency bug detection. However, the inefficiency in its design and implementation keeps MHP analysis away from being practical and effective. In this paper, we investigate the state-of-art of iterative data flow based (IDFB) MHP analysis and propose a new design and corresponding systematic implementation. Specifically, we address the most severe efficiency problems in node process order of the work-list in the original approach, and resolve them in our design and implementation by using the concept of parallel level to avoid redundant node visits. Our intensive experimental study shows that the proposed design and implementation have a relative speed up of 29.02× compared with the original implementation, moreover, it achieves a relative speed up of 10.00× comparing to the state-of-art of non-IDFB approach which is claimed to be more efficient than the original IDFB approach. Our design and implementation are capable of achieving an order of magnitude efficiency improvement comparing to both IDFB and non-IDFB approaches.

May-Happen-in-Parallel (MHP) analysis is a very important and fundamental mechanism to facilitate concurrent program analysis. But the limitation of its efficiency keep it away from being practical and effective in analyzing large scale real world concurrent programs. We proposed a novel MHP algorithm by performing a reachability analysis on a so-called parallel reachability graph of a program. The MHP algorithm mainly comprises two phases: pre-computation of initial MHP information and top-down propagation of this information along the parallel reachability graph. Our algorithm is fast as it has a low complexity O(|N|+|E|), in which N is the number of nodes in the parallel reachability graph and E is the number of edges in this graph. Our preliminary experiment on 13 concurrent programs indicates that our approach is extremely faster than two state-of-art approaches, respectively achieving a relative geometry average speed up of 395.53× and 136.37×, while yielding the same precision with these two approaches.

May-Happen-in-Parallel (MHP) analysis is a very important and fundamental mechanism to facilitate concurrent program analysis. But the limitation of its efficiency keep it away from being practical and effective in analyzing large scale real world concurrent programs. We proposed a novel MHP algorithm by performing a reachability analysis on a so-called parallel reachability graph of a program. The MHP algorithm mainly comprises two phases: pre-computation of initial MHP information and top-down propagation of this information along the parallel reachability graph. Our algorithm is fast as it has a low complexity O(|N|+|E|), in which N is the number of nodes in the parallel reachability graph and E is the number of edges in this graph. Our preliminary experiment on 13 concurrent programs indicates that our approach is extremely faster than two state-of-art approaches, respectively achieving a relative geometry average speed up of 395.53× and 136.37×, while yielding the same precision with these two approaches.

指针分析是程序分析和编译优化的基础,针对基于包含的指针分析算法的改进一直是指针分析领域研究的热点之一.文中从该指针分析算法改进的两类技术来总结近二十年来相关的研究工作,包括在线优化技术如约束图上的强连通分量的检测和消除等和离线优化技术如变量替换等.通过实验对比了7种较有影响力的分析算法和三种离线优化算法,并从性能、内存开销等方面进行了评述和总结.文章最后阐述了基于包含的指针分析今后潜在的研究方向.