Angelic Debugging Satish Chandra IBM Research satishchandraus - PDF document

1publicintclassify(inta,intb,intc){2intretval;3if(a�=b&&b�=c){4if(a==c||b==c){5if(a==b&&a==c)6retval=EQUILATERAL;7else8retval=ISOSCELES;9}else{10if(aa!=bb+cc){11if(aabb+cc){12retval=ACUTE;13}else{14retval=OBTUSE;15}16}else{17retval=RIGHT;18}19}20}else{21retval=ILLEGAL;22}23returnretval;24}Figure1:TrianglesexamplefromDeMillo[8].dates.Arepaircandidateisinexibleifchangingthecandi-dateexpressioncanrescueaparticularfailingtest,butanychangewouldbreakoneofthepreviouslypassingtests.Ifallrepaircandidatesareeliminatedinthisstep,thenthepro-grammerhaseithernotchosenthescopecorrectly,orthereisindeednoxtotheprogramthatcanpassalltestcases.4.Theprogrammerattemptstodeviseasuitablereplacementexpressionforeachoftheremainingrepaircandidates,oneatatime,untiloneworks.Asuccessfulreplacementexpressionmustgivepassingresultsonthehithertofailinginput,aswellasonthepreviouslypassinginputs.Thesearchforsuchareplacementexpressionisnotcomputerassisted,asthespaceofpossiblesyntacticexpressionsisunbounded.However,theprogrammercandrawinspirationfromthesamplealternatevaluedemonstratedbythesecondstep.Example.ConsiderthecodeinFigure1.ItisaslightlymodiedversionofanexamplefromthepaperbyDeMilloetal.[8]onmu-tationtesting.Theprogramtakesasinputthelengthsofthreesidesofatriangle,presentedinnon-decreasingorder,anditissupposedtoclassifythetriangleasoneofequilateral,isosceles,rightangled,acute,orobtuse.Table1showseightsampleinputstotheprogram,alsotakenfromtheDeMillopaper.ThecodeworkscorrectlyforinputsT1-T7,butnotforT8.Supposetheprogramisknowntobexable,inthespecicsensethatthereisasingleexpressionthat,ifaltered,willletallofthetestinputspass.Itisthetaskoftheprogrammertondthefaultyexpressionandrepairit.Intherststep,theprogrammerhastohypothesizeascope.Weassumethattheentireprogramisinscope.Inthesecondstep,thecomputerguresouttherepaircandidatesforthefailingtestT8.TheseareshowninTable2.Eachrepaircandidatecouldhavesal-vagedthisparticularexecutionbyevaluatingtoadifferentvaluethanitdid.Thecolumntitled“altvalue”liststhealternatevaluethatwouldhavemadeT8pass.Forexample,therstrowintheta-blesaysthatifthevalue7weretobeproducedinplaceofthehigh-lightedexpressiona,whoseruntimevalueis26,T8wouldpass.Forbrevity,wehaveconsideredonlyreadsoflocalvariablesandconstants,butthereisnoconceptualreasontoexcludearithmeticandlogicalexpressions(e.g.,theresultofa==c).Amongthekindsofexpressionsconsidered,thesearetheonlypossiblerepaircandidates.Thethirdstepusesthepassingtestcasestolteroutthein-exiblerepaircandidates,leavingtherightchoiceandonewrongchoice.ThisisshowninthelastcolumnofTable2.Forexam-ple,thelastrowsaysitisnogoodchangingthevalueofACUTEatline12toISOSCELES;doingsowillrescueT8,butbreaktestT6,whoseonlycorrectoutcomeisinfactACUTE.Thismuchwouldbeobvioustoaprogrammer.TheothertwochoicesthatourtechniqueeliminatesfromconsiderationonthebasisoftestT3maynotbeimmediatelyobvious.GiventheinformationinTable2,aprogrammerwouldconsidereachoftheremainingtwocandidatesinturn,andtrytondasyn-tacticreplacementthatproducesanacceptablevalueforT8,andmoreover,worksforalltheothertestcases(T1-T7)aswell.(NotethattheconcretevaluesthatourtechniquesuggestsarespecictoT8.)Ofthesetwocandidates,therstchoiceisinfactfutile,butwecannotgetthatinformationfromthepassingtests.Thesecondchoiceistherealbug:itshouldbebinplaceofc.Wecallourmethodologyangelicdebugging,becauseitreliesonangelicnondeterminism.Imaginethatanexpressionisreplacedwithacalltoanoraclethatreturnsavalue,chosennondeterminis-tically.Theoracleisbothomniscientandco-operative,inthesensethatifasuitablevalueexists—onethatmakesthefailinginputnowpass—theoracleisguaranteedtoreturnit.Whilesupportingan-gelicnondeterminismiscomputationallyexpensive,itisbecomingincreasinglyviableforselectiveuse,thankstorecentadvancementsindecisionprocedures.Inourcase,angelicnon-determinismisusedonlyononeexpressionatatime.Thislimitsthekindsofdefectsonwhichourtechniqueiseffective,butenhancescomputa-tionalfeasibility.Nondeteminismhaslongbeenusedintestingtocreateanadversary(ademonicoracle),butitsuseasanallyislesscommon.Akeynoveltyinthisworkisinhowweuseinformationfrompassingteststolteroutrepaircandidatesthatwillnotworkout.Whiletheprogrammerstillneedstogothroughthelaborioustaskofndingreplacementexpressionsformultiplerepaircandidates,hedoesnotneedtocarryouttheSisypheaneffortinlookingforreplacementexpressionsforrepaircandidatesthatare“doomed”byanothertestcase.Withoutrstpositingareplacementexpression,hewouldnotknowwhetheritwouldworkoutornot,andthespaceofreplacementexpressionscanbehuge.Previousworkonfaultlocalizationthathasleveragedinforma-tionfromasuiteofpassingtestshasreliedonindirectinformation.Thebasicideaisthatafailingrunhasananomalousbehaviorin Test a b c Expectedoutcome T1 2 12 27 ILLEGAL T2 5 4 3 RIGHT T3 26 14 14 ISOSCELES T4 19 19 19 EQUILATERAL T5 9 6 4 OBTUSE T6 24 23 21 ACUTE T7 7 5 6 ILLEGAL T8 26 26 7 ISOSCELES actualoutcome:ACUTE Table1:InputsforFig.1 inputI.IfeisnotvisitedwhileexecutingPonI,Eval(P;I;e)isundenedandFlexTest(P;I;e)istriviallytrue.GivenafailinginputIfandpassinginputsIp1:::Ipk,thegoodrepaircandidatesare:fejAngelicTest(P;If;e)^8i2[1::k]:FlexTest(P;Ipi;e)gForexample,considerthelastrowofTable2.Theonlypassingtestcaseinwhichline12isvisitedisT6,soitispertinenttoaskthequestiononlyforT6.T6canpassonlywhenthevalueofretvalatline12isACUTE;noothervaluewouldletT6pass.Hence,T6rulesoutthatrepaircandidate.Line12setsthe(constant)returnvalue,whichobviouslyisnottherightxand,theexibilitytestdiscoversthatitisnottherightx.Inothercases,inexibilitymightnotbeimmediatelyobvious,e.g.,therepaircandidatesruledoutbyT3.Wenotethatthereisnoguaranteethatforevery“good”repaircandidatesthatourtechniqueproduces,thereexistsasuitablere-placementexpression(i.e.,onethatwouldworkoutforthefailingaswellasallthepassingtests.)Thevalueofourtechniqueisineliminatingfromconsiderationthoserepaircandidatesforwhichnosuitablereplacementexpressionislikelytoexist.RationaleforFlexTest.Ifanexpressioneintheprogramistherightrepaircandidate,itmustbenetoreplaceewithsomeas-yet-undeterminedexpressione0.Theexpressioneisnottherightrepaircandidateifreplacingitwithanyexpressione0willmakeoneormoreofthepassingtestcasesfail.Canwetakeadvantageofpassingtestcaseswithoutknowinge0?Theidealexibilityquestionthatwewanttoaskisthis:(Ideal)Givenarepaircandidate—i.e.,anexpressione—andgivenapassingtestcaseT,isitpossibleforTtocontinuetopassifwereplaceebyadifferentexpressione0?Iftheanswerisno,thenwedonotconsideretobetheplacetox,becauseitcanbreakT(andweareallowedonlyonextotheprogram.)Sincetheidealquestionistooexpensivetoanswer,FlexTestcar-riesoutamorereadilyanswerable,butapproximatecheck.Itasksthefollowingquestiononvalues:(Approximate)Givenarepaircandidatee,andgivenapassingtestcaseT,supposethateproducesthevaluewwhenTisrun.IsispossibleforTtocontinuetopassifeisreplacedbysomew0wherew6=w0?IfTdoesnotencountere,thecheckreturnstruebydefault.Fromtheperspectiveofapassingtest,iftheanswertotheap-proximatequestionisyes,thentheanswertotheidealquestionisalsoyes.Ontheotherhand,iftheanswertoapproximatequestionisno,thentheanswertotheidealquestionisprobablyno;butitisnotguaranteedtobenegative.Considerthefollowingexample:t=x+ySupposethateisy;e0is1;andtmustbex+1laterintheexecution.Then,onapassingtestcaseforwhichyhappenstobeexactly1atthispointinthecode,theapproximatecheckwouldsayitisinexibile.Theidealcheck,however,wouldhaveallowede0.Webelievethatinpracticethisisnotaproblem;indeed,wehavenotfoundthistobeaprobleminusinganimplementationofthisideaonvariousexamples.Sincetheerroris“onesided”,wecanreducethemathematicallikelihoodofbeingwrong—eliminatingarepaircandidateunnecessarily—byrelyingonmanypassingtests,togetherwithmakingthenotionofexibilityfromaBooleantoaquantitativepropertythatwouldestimatethelikelihoodthatanexpressionisexible.Limitations.Ifthedesiredxtoaprogramisasingleexpressionthatneedstobealtered—oranyoneofasetofsingleexpressions—ourtechniquewilleventuallyndit.Wecallsuchprograms1-xable.Ifaprogramisnot1-xable,thenourtechniquecansuggestarepaircandidatethatisnotthedesiredx,butthatcanoftenin-spiretheactualx.Forexample,iftheprogramismissingacer-tainassignmenttoaeld,thenaxmightbesuggestedatapointdownstreamwheretheeldisused(assumingthereisjustonesuchuse.)Ourtechniquealsoinheritsthelimitationsofconstraintsolversusedintheimplementationoftheangelicnondeterminism.Itiswellknownthatrealprogramscandefeatthecapabilitiesofcur-rentgenerationconstraintsolvers.Supplementingthesolverwithdynamicexecutionwillsidesteptheseproblems,potentiallyatthecostofreducingscalability.3.ANGELICEXECUTIONTherearemanywaystorealizetheangelicexecutionenviron-mentdescribedintheprevioussection(e.g.,[5]).Ourtool,AN-GELINA,employsasymbolicexecution[18]enginethatisbasedonanexplicit-statemodelchecker[15].Itimplementsthefunc-tionsAngelicTestandFlexTestinthreesteps.Intherststep,weexecutethefailingtestconcretely,collect-ingthelabelsofallexecutedstatementsinatracef.Eachlabelinfgivesauniqueidentitytoadynamicallyoccurringbytecodeinstruction.Itcanbethoughtofasthebytecodeindexthatanex-ecutedinstructionwouldhaveifallloopsintheprogramwereun-woundandallmethodcallsinlined.Inthesecondstep,thefailingtestisre-executedjfjtimestondallstatementsinfthatarepotentialrepaircandidates.Theithexecutioninthisphaseisconcreteuntilitreachestheithstate-mentf[i],atwhichpointwereplacetheconcretevaluereturnedbyf[i]withasymbolicvaluesi.Fromthenon,thevaluesofallbranchpredicatesthatdependontheoutputoff[i]areencodedasconstraintsoversi.Section3.1describesthisprocessinmoredetail.Ifthereisapaththroughtheprograminwhichallbranchconstraintsaresatised,andwhichdoesnotleadtoafailure,thenwehavefoundavaluethatxesthefailingtestandf[i]isplacedintherepaircandidatesetR.ThethirdstepoftheanalysisusestheavailablepassingteststopruneR.Eachpassingtestisrstexecutedconcretelytocollectatracep.Next,foreachstatementp[i]thatisinR,weexecutetheprexp[0::i]ofpconcretely.Thisincludesthestatementp[i],whoseconcreteexecutionproducestheconcretevalueci.Wethenreplaceciwithasymbolicvaluesiandsearchforafailure-freepaththroughtheprograminwhichsiisdifferentfromci.Ifsuchapathisfound,wesaythatp[i]isexibleandkeepitasarepaircandidate.Otherwise,p[i]isinexible,andweremoveitfromR.3.1SymbolicexecutionSymbolicexecutionofintegerprograms.Toexecuteaprograminwhichaninteger-valuedexpressionistreatedsymbolically,ourtoolemploystheclassicapproach[18]ofsearchingforafailure-freepathintheprogram'ssymbolicexecutiontree.AnexampleofsuchatreeisshowninFig.3.Thenodesinthetreerepresentpro- classNode{intval=0;Nodenext=null;}1Noden1=newNode();2Noden2=newNode();3n1.next=n2;4if(n2.next==n1){5assertn1.valn2.val;6}else{7assertfalse;8} Figure4:Asymbolicexecutiontreeforaheap-manipulatingprogram.Thetreerepresentsasymbolicexecutionofthesampleprograminwhichthereferencevalueproducedbythenewexpressiononline2istreatedsymbolically.OnesubtleissueariseswhenFlexTest(seeSec.2)isperformedonareference.Sinceoursolutiontoheapconstraintsallowsmanu-factureofnewobjects,therequirementofdis-equality(6=)betweentheEvalvalueandthenewlyconstructedvalue()issatisedtriv-ially.Ifaprogrammer'snotionofequalityisnotbasedonrefer-enceequality,butratheronanequalspredicate,thentheexibilitycheckisnotmeaningful.Toimplementameaningfulequalitytest,wepreserveasnapshotoftheeldvaluesasobservedinthedefaultexecution—i.e.,ascomputedbyEval.Inprinciple,wewouldthenhaveJPFexecutetheprogrammer-providedequalsmethodtocom-parethesnapshottothereplacementvalue.Thisissomewhatintricatetoimplement,however,soourcurrentprototypecarriesoutashallowcomparisonofthetop-levelelds.4.EVALUATIONToassessthefeasibilityandusefulnessofangelicdebugging,weappliedANGELINAtoseveralprogramswithknowndefects.Thissectionpresentstheresultsweobtainedontworepresentativesamples:asmallintegerprogramandalargeheap-manipulatingapplication.4.1ZunebugexampleOurintegerexample,showninFigure5,istakenfromWeimeretal.[28].Theprogramtakesasinputanumberofdaysasinput,andreturnstheyearinwhichthatmanydayswouldelapsestartingfrombeginningof1980.(Table3showssamplesofinputandoutputofthisprogram.)WehavechangeditslightlyfromWeimer'sversiontomakeit1-xable.Theoriginalbuggyprogramrequiredbothastatementinsertionandastatementdeletiontoxit.Wehave1publicstaticintzunebug(intdays){2intyear=1980;3while(days�365){4booleanleap=isLeapYear(year);5if(leap){6if(days�366){7days�=366;8year+=1;9}else{10}11days�=366;12}else{13days�=365;14year+=1;15}16}17returnyear;18}Figure5:Zunebugcode.carriedouttheinsertion,sotheonlybugisasuperuousstatementthatneedstobedeleted.TheprogramwastestedoninputsshowninTable3;T6isthefailinginput.Therepaircandidates,andtheinexibilitiesfoundarereportedinTable4.Thereturnstatementwasexcludedfromscope.Notethatinthisprogram,alternatevaluesareoneofpotentiallymanyvalidpossibilities.ThecodeinsideisLeapYearwasexcludedfromscope.Ofthe7repaircandidates,2areruledoutasinexiblebypass-ingtests.Therealxisatline7:thelineshouldbeomitted,or Test days Expectedoutcome T1 1 1980 T2 365 1980 T3 366 1980 T4 367 1981 T5 731 1981 T6 732 1982 actualoutcome:1981 Table3:TestsforZunebug.line#code altvalue(T6) inhibitor 3(2nd)while(days�365){ 366,-1 11days-=366 0 8year+=1 2 T4,T57days-=366 0 5if(leap){ false T34leap=isLeapYear(year) 1981 Table4:RepaircandidatesforZunebug.equivalentlydaysshouldbedecrementedby0.Thisxcausesthewhilelooptobeexecutedtwotimes,asrequiredfortheinputvalueof732.Therepaircandidatesalsoshow4alternatewaysinwhichthiscanbeachievedfromtheperspectiveofthefailingrun.Specif-ically,oneoptionistogettheloopconditiontopassonemoretimeasshownbytherstlineinthetable.Althoughitmightseemasiftheloopcondition—thesecondinstanceofit—isexible,infactitsoperandsaretheonesthatareexible,nottheconditionitself.Thatmeansthatforeachpassingrun,eitherofthoseoperandscouldhavehadatleastoneothervaluewithoutimpactingtheoutcomeoftherun;thisiseasytohappenwithinequalities.4.2JTopascasestudyOurmaincasestudyfocusedonJTOPAS[16],anopensourceJavalibraryforparsingarbitrarytext.Weanalyzedversion0.4ofthelibraryfromtheSoftware-artifactInfrastructureRepository(SIR)[24],whichcomeswith10seededfaults.ANGELINAcanhelpdiagnosefourofthesefaults.Theremainingfaultsareeithernot1-xable(andthereisnoobviouswaymakethemso)ortheycouldnotbeanalyzedduetoourlimitedhandlingofarrays.Ta-ble7showsashortdescriptionofeachfault;whyitcouldnotbeanalyzedbythetool;or,ifanalyzed,whatscopeandcodemodi-cationswereapplied.Faults1,2and6.Table5showstheresultsofapplyingAN-GELINAtoJTOPASfaults1,2and6.The“repaircand.”columndisplaysthetotalnumberofrepaircandidatesforeachfault.The“time”columnspeciestherunningtimeinseconds;“loadedcode”showsthenumberofclassesandmethodsloadedbyJPF;“instruc-tions”isthenumberofexecutedbytecodeinstructions;and“heap”showsthenumberofnewobjectscreatedbyJPF'svirtualmachinewhileexecutingthesystemundertest.Multiplerowsofdataforfault6indicatethatitsdetectionrequiredrepeatedapplicationofthetool.Weshowtheresultsforeachapplicationseparately,start-ingwiththetop-levelscope.Faults1and2wereminor,andtheirdetailsarefullycoveredbythedescriptioninTable7.Fault6,however,wasintricate,anditinvolvedalargeamountofcode.Wethereforeanalyzeditinamodularfashion—thatis,onemethodatatime—startingwiththetop-leveltestmethodshowninFig.6.Thetop-levelmethodteststheJTOPASJavaandJavadoctok-enizersbycheckingthattheiroutputssatisfytwoproperties:(1) fault repair time loadedcode executed heap cand. (sec) classesmethods instructions 1 2 2 98 1259 6,063 940 2 2 1 981,258 4,052 539 6 13 45 140 2,094 300,219 2,864 4 29 140 2,093 312,430 4,955 1 24 139 2,091 257,847 4,778 Table5:TheresultsofapplyingANGELINAtothreeknownfaultsinJTOPAS.the`@'tokenisfollowedbyakeywordinsideofaJavadoccom-ment1(line39),and(2)thenumberofopenbracesisthesameasthenumberofclosedbraces(line44).Thetokenizationprocesshastwomodes:theJavaparsingmode,handledjavaTokenizer(line2),andtheJavadocparsingmode,handledbydocTokenizer(line4).WestartintheJavamode(line6)andthenswitch(lines27-32)betweenthetwomodesdependingontheconsumedtokens.The`/**'tokentriggerstheswitchfromJavatoJavadoc(line15),and`*/'doestheopposite(line18).WhentestJavaTokenizerisexecutedontheJavasnippet2inFig.7(a),itfailswithanassertionviolationonline39.Inparticular,the`author'tokenthatfollowsthe`@'characterisnotinterpretedasakeyword,againstexpectation.ExecutingthetestonthesnippetinFig.7(b)resultsinnormaltermination.Giventhesesnippetsasin-puts,andthewhileloopinthetestmethodasthescope,ANGELINAproducestherepaircandidatesshowninTable6.Thecandidatesinhibitedbythepassingtestareshadedingray.AccordingtotheresultsinTable6,thefailingtestcanberes-cuedinessentiallyoneofthreeways:(1)pretendthattherstreadisnot`/**'butsomeother(non-special)string;(2)pretendthatthesecondtokenisnotthe`@'character;and(3)pretendthatthethirdtoken(`author')hasthetypeKEYWORD.Therstxcouldbeappliedonlines25,26,28and30oftherstiteration,causingthetokenizationprocesstoremainintheJavamode.Sincethe`@'characterhasnomeaningintheJavamode,itisnotassociatedwiththeatSignobject,andtheconditionalonline37wouldevaluatetofalse.Thisx,however,isruledoutbythepassingtest.Ifthepass-ingtestremainsintheJavamode,byinterpretingthersttokenasanythingotherthan'/**'inthepassingtest,theexecutionwillalwaysviolatethebalancedbracespropertyonline44.Thesecondx—pretendingthat`@'issomethingelse—canbeappliedintheseconditeration,onlines25,26,28,30and37.Itrescuesthetestcaseinthesamewayastherstx,byensuringthattheconditionalonline37evaluatestofalse.Liketherstx,thesecondxisessentiallyequivalenttochangingtheinput,whichisnotanacceptablesolution.ThethirdxsuggeststhattheprogramcouldberescuedbychangingtheoutputofnextTokenonline38toproduceatokenoftypeKEYWORD.Thisis,infact,therealx.GiventhebuggycalltonextTokenasthescope,ANGELINAre-turnsfourrepaircandidates.(Forreference,nextTokenconsistsof80linesofcode.)Threeofthecandidatessimplyreplacethereturnvalueofthemethodwithanangelictokenthathastherighttype,essentiallyignoringthecomputationofthenexttoken.There-mainingcandidatesuggestscallingthemethodtest4Normalwithadifferentinputtoken.Whentheanalysisisscopedtotest4Normal,thetoolpinpointstheseededfaultyexpressionastheonlyrepaircandidate. 1RecallthataJavadoccommentisablockcommentthatstartswiththesequence`/**”.2ThetestinputweretrievedfromSIRwastoolargeforourin-frastructuretohandle,sowemanuallyminimizedittothesnippetshownhere. 1publicvoidtestJavaTokenizer()throwsThrowable{2InputStreamTokenizerjavaTokenizer=3newInputStreamTokenizer(m_reader);4InputStreamTokenizerdocTokenizer=5newInputStreamTokenizer(m_reader);6AbstractTokenizercurrTokenizer=javaTokenizer;7ObjectopenBlock=newObject();8ObjectcloseBlock=newObject();9ObjectatSign=newObject();1011intblockBalance=0;12Tokentoken;13javaTokenizer.addTokenizer(docTokenizer);1415javaTokenizer.addSpecialSequence("/",docTokenizer);16javaTokenizer.addSpecialSequence("{",openBlock);17javaTokenizer.addSpecialSequence("}",closeBlock);18docTokenizer.addSpecialSequence("/",javaTokenizer);19docTokenizer.addSpecialSequence("@",atSign);20//...21docTokenizer.addKeyword("author");22//...2324while(currTokenizer.hasMoreToken()){25Tokentoken=currTokenizer.nextToken();26switch(token.getType()){27caseToken.SPECIAL_SEQUENCE:28if(token.getCompanion()instanceofAbstractTokenizer){29AbstractTokenizertokenizer=30(AbstractTokenizer)token.getCompanion();31currTokenizer.switchTo(tokenizer);32currTokenizer=tokenizer;33}elseif(token.getCompanion()==openBlock){34blockBalance++;35}elseif(token.getCompanion()==closeBlock){36blockBalance��;37}elseif(token.getCompanion()==atSign){38Tokentoken=currTokenizer.nextToken();39asserttoken.getType()==Token.KEYWORD;40}41break;42}43}44assertblockBalance==0;45//...46}Figure6:JTOPAStestthatexposesFault6.moreexpressionscanbefoundtobeinexible,leavingasideonlytheexpressionsatwhichtheprogramcanbexed.Notethatourcurrentfocusinangelicdebuggingisonlyonthelocationofthedesiredmutant,andnotonhowtocreatethemutantintermsofmutationoperations.Indeed,notallbugscanbecor-rectedbyastandardsetofmutations,soweareunabletosimplytryallmutationsofarepaircandidateonallpassingtestcases.UsingSlicingForDebugging.Alargebodyofworkexistsondebuggingbasedonstaticanddynamicslicing(e.g.[2,33,29]).Thebasicintuitionisthatthebackwardslicewithrespecttothestatementthatmanifeststhebugoftencontainsthecauseofthebug.Twoideasintheliteratureonslicingbearcloserelationtoourwork./@author//{/(a)Failinginput(b)PassinginputFigure7:InputsforthetestinFig.6.Dicingisamongtherstideastoleverageinformationfrompassingteststohelpwithdebuggingoffailingtests[1].Infaultlocalizationbasedondices,onecomputesportionsofslicesthatappearinfailinginputsbutnotonpassinginputs.Criticalslicing[9],whichalsorelatestomutationtesting,usesaspecickindofmutation—statementdeletion—todeterminewhichstatementshaveabearingonthenaloutcomeintermsofvaluesofselectedoutputvariables.Ifthevalueofthoseoutputvariablesdoesnotchangeevenafterthestatementisdeleted,thestatementisnotcritical.Forassignmentstatements,criticalslicingcheckswhetherchangingt=etot=tcanpossiblyimpactexecutionofafailingtestcase.Ourtechniqueperforms(athighercost)amoregeneral,existentialcheck:couldthereexistane0suchthatreplacingtheassignmentwitht=e0canxtheprogram.FaultLocalizationbyComparingExecutions.Severalresearchershaveproposedtechniquestousepassingrunstolocalizefaultsinfailingruns.TheTarantulatechnique[14,13]comparesstatementcoveragespectrumtakenfromanumberofpassingruns,tothecoverageobtainedfromafailingrun.Thisworksontheempiricalobservationthatfaultlocationsarecorrelatedwithstatementsthataremuchmorelikelytoappearinthefailingrunthatinapass-ingone.Inotherwords,thestatementcoverageproleofthefail-ingrunisananomaly[31].Anomaliescanbedetectedonotherkindsof“signatures”ofprogramexecutions.Forexample,Liblitetal.[19]showexcellentcorrelationbetweenfaultsandanoma-lousreturnvaluesoffunctions,whereasHangalandLam[11]de-tectsanomaliesondiscoveredinvariants.Repsetal.[23]solvestheY2Kproblembycomparingexecutionsexecutedbeforeandafterthecriticaldate,bothsummarizedwithpathprolespectra.Othershavefocusedonnding“nearby”passingrunstocom-paretoafailingrun,withtheintentionofgettingmoreprecisefaultlocalization.Forexample,RenierisandReiss[22]selectapassingrunbasedonminimizinganearest-neighborsimilaritymetricwithrespecttoafailingrun;andArtzietal.[3]usemixedsymbolicandconcreteexecutiontogeneratenearbypassingtestcases.Comparingpassingandfailingexecutionshavealsobeenusedinexplainingcounterexamplesinmodelchecking.InworksofBalletal.[4],andGroceandVisser[10],theideaistocompareasinglepassingtracewithafailingtrace,andndprogrampointsatwhichthetwobegintodiverge.Ourworkshareswiththesetechniquestheintentionofgettingusefulinformationfrompassingruns.However,thegoalorourworkistopinpointexpressionsthataregoodrepaircandidates.Ourlineitr.code 25 1 Tokentoken=currTokenizer.nextToken()252Tokentoken=currTokenizer.nextToken() 26 1 switch(token.getType())262switch(token.getType()) 28 1 if(token.getCompanion()...)282if(token.getCompanion()...) 30 1 (AbstractTokenizer)token.getCompanion()372elseif(token.getCompanion()==atSign)372elseif(token.getCompanion()==atSign)382Tokentoken=currTokenizer.nextToken()392token.getType()==Token.KEYWORD392token.getType()==Token.KEYWORD392token.getType()==Token.KEYWORD Table6:RepaircandidatesfortestJavaTokenizer.Grayshad-inghighlightsthecandidatesthatwereinhibitedbythepassinginput. [29]M.Weiser.Programslicing.InICSE'81,pages439–449,1981.[30]A.Zeller.Isolatingcause-effectchainsfromcomputerprograms.InFSE'02,pages1–10,2002.[31]A.Zeller.WhyProgramsFail:AGuidetoSystematicDebugging.MorganKaufmannPublishersInc.,SanFrancisco,CA,USA,2005.[32]X.Zhang,N.Gupta,andR.Gupta.Locatingfaultsthroughautomatedpredicateswitching.InICSE'06,pages272–281,2006.[33]X.Zhang,H.He,N.Gupta,andR.Gupta.Experimentalevaluationofusingdynamicslicesforfaultlocation.InAADEBUG'05,pages33–42,2005.