Hardened Flow-Sensitive Trace Formula for Fault Localization

In formula-based fault localization methods, a program under test, which is unrolled to a certain bound, is encoded in a trace formula (TF). The efficiency and precision of the fault localization algorithm depend highly on the way this formula is encoded. The full flow-sensitive TF can cover all potential root causes, but is usually large and scalability problems remain. We propose a new encoding, the hardened flow-sensitive trace formula (HFTF), which reduces the complexity of the formula but does not lose essential control flow graph (CFG) information required for localizing faults. The HFTF is constructed using a concolic execution method that generates both failing and successful executions and uses the coverage information from these executions to simplify the trace formula.

[1]  Xiao Qu,et al.  A Case Study of Concolic Testing Tools and their Limitations , 2011, 2011 International Symposium on Empirical Software Engineering and Measurement.

[2]  Rupak Majumdar,et al.  Cause clue clauses: error localization using maximum satisfiability , 2010, PLDI '11.

[3]  Roderick Bloem,et al.  Automated error localization and correction for imperative programs , 2011, 2011 Formal Methods in Computer-Aided Design (FMCAD).

[4]  L. D. Moura,et al.  The YICES SMT Solver , 2006 .

[5]  Thomas Wies,et al.  Flow-Sensitive Fault Localization , 2013, VMCAI.

[6]  Karem A. Sakallah,et al.  Algorithms for Computing Minimal Unsatisfiable Subsets of Constraints , 2007, Journal of Automated Reasoning.

[7]  Franz Wotawa,et al.  Automated debugging based on a constraint model of the program and a test case , 2012, J. Log. Algebraic Methods Program..

[8]  Gregg Rothermel,et al.  Empirical Studies of a Safe Regression Test Selection Technique , 1998, IEEE Trans. Software Eng..

[9]  Frank Tip,et al.  Directed test generation for effective fault localization , 2010, ISSTA '10.

[10]  Koushik Sen,et al.  DART: directed automated random testing , 2005, PLDI '05.

[11]  Karem A. Sakallah,et al.  On Finding All Minimally Unsatisfiable Subformulas , 2005, SAT.

[12]  Daniel Kroening,et al.  A Tool for Checking ANSI-C Programs , 2004, TACAS.

[13]  Thomas Wies,et al.  Explaining inconsistent code , 2013, ESEC/FSE 2013.

[14]  Sunghun Kim,et al.  How we get there: a context-guided search strategy in concolic testing , 2014, SIGSOFT FSE.

[15]  Mark Weiser,et al.  Programmers use slices when debugging , 1982, CACM.

[16]  Thomas J. Ostrand,et al.  Experiments on the effectiveness of dataflow- and control-flow-based test adequacy criteria , 1994, Proceedings of 16th International Conference on Software Engineering.

[17]  Jian Liu,et al.  Explaining Software Failures by Cascade Fault Localization , 2015, TODE.

[18]  Shinji Kusumoto,et al.  Experimental Evaluation of Program Slicing for Fault Localization , 2002, Empirical Software Engineering.

[19]  Vikram S. Adve,et al.  LLVM: a compilation framework for lifelong program analysis & transformation , 2004, International Symposium on Code Generation and Optimization, 2004. CGO 2004..

[20]  Hiralal Agrawal,et al.  Towards automatic debugging of computer programs , 1992 .

[21]  Koushik Sen,et al.  CUTE: a concolic unit testing engine for C , 2005, ESEC/FSE-13.

[22]  Joao Marques-Silva,et al.  MaxSAT-Based MCS Enumeration , 2012, Haifa Verification Conference.

[23]  Chao Wang,et al.  ConcBugAssist: constraint solving for diagnosis and repair of concurrency bugs , 2015, ISSTA.

[24]  Swapna S. Gokhale,et al.  Locating program features using execution slices , 1999, Proceedings 1999 IEEE Symposium on Application-Specific Systems and Software Engineering and Technology. ASSET'99 (Cat. No.PR00122).

[25]  Mary Jean Harrold,et al.  Empirical evaluation of the tarantula automatic fault-localization technique , 2005, ASE.

[26]  Raymond Reiter,et al.  A Theory of Diagnosis from First Principles , 1986, Artif. Intell..

[27]  Joseph Robert Horgan,et al.  Fault localization using execution slices and dataflow tests , 1995, Proceedings of Sixth International Symposium on Software Reliability Engineering. ISSRE'95.

[28]  Mark N. Wegman,et al.  An efficient method of computing static single assignment form , 1989, POPL '89.

[29]  Shin Nakajima,et al.  A Formula-Based Approach for Automatic Fault Localization of Imperative Programs , 2014, ICFEM.

[30]  Mark Harman,et al.  An empirical study of static program slice size , 2007, TSEM.

[31]  Armin Biere,et al.  A survey of recent advances in SAT-based formal verification , 2005, International Journal on Software Tools for Technology Transfer.