Finding bugs is easy

Subscribe (Full Service)


	Search: The ACM Digital Library The Guide

	Feedback

Finding bugs is easy

Full text

Pdf (105 KB)

Source

Conference on Object Oriented Programming Systems Languages and Applications archive
Companion to the 19th annual ACM SIGPLAN conference on Object-oriented programming systems, languages, and applications table of contents

Vancouver, BC, CANADA

SESSION: Onward! table of contents

Pages: 132 - 136

Year of Publication: 2004

ISBN:1-58113-833-4

Authors

David Hovemeyer	University of Maryland, College Park, MD
William Pugh	University of Maryland, College Park, MD

Sponsors

ACM: Association for Computing Machinery
SIGPLAN: ACM Special Interest Group on Programming Languages

Publisher

ACM New York, NY, USA

Bibliometrics

Downloads (6 Weeks): 9, Downloads (12 Months): 108, Citation Count: 51

Additional Information:

abstract references cited by index terms collaborative colleagues

Tools and Actions:	Request Permissions Review this Article Save this Article to a Binder Display Formats: BibTeX EndNote ACM Ref

DOI Bookmark:	Use this link to bookmark this Article: http://doi.acm.org/10.1145/1028664.1028717 What is a DOI?

ABSTRACT

Many techniques have been developed over the years to automatically find bugs in software. Often, these techniques rely on formal methods and sophisticated program analysis. While these techniques are valuable, they can be difficult to apply, and they aren't always effective in finding real bugs.

<i>Bug patterns</i> are code idioms that are often errors. We have implemented automatic detectors for a variety of bug patterns found in Java programs. In this extended abstract<sup>1</sup>, we describe how we have used bug pattern detectors to find serious bugs in several widely used Java applications and libraries. We have found that the effort required to implement a bug pattern detector tends to be low, and that even extremely simple detectors find bugs in real applications.

From our experience applying bug pattern detectors to real programs, we have drawn several interesting conclusions. First, we have found that even well tested code written by experts contains a surprising number of obvious bugs. Second, Java (and similar languages) have many language features and APIs which are prone to misuse. Finally, that simple automatic techniques can be effective at countering the impact of both ordinary mistakes and misunderstood language features.

REFERENCES

Note: OCR errors may be found in this Reference List extracted from the full text article. ACM has opted to expose the complete List rather than only correct and linked references.

	1	Joshua Bloch, Effective Java programming language guide, Sun Microsystems, Inc., Mountain View, CA, 2001
	2	David Hovemeyer , William Pugh, Finding bugs is easy, ACM SIGPLAN Notices, v.39 n.12, December 2004 [doi>10.1145/1052883.1052895]
	3	D. Hovemeyer and W. Pugh. Finding concurrency bugs in Java. In Proceedings of the PODC Workshop on Concurrency and Synchronization in Java Programs, St. John's, Newfoundland, Canada, July 2004.
	4	PMD, http://pmd.sourceforge.net, 2004.

CITED BY 51

	Michael Martin , Benjamin Livshits , Monica S. Lam, Finding application errors and security flaws using PQL: a program query language, ACM SIGPLAN Notices, v.40 n.10, October 2005
	Emmanuel Geay , Eran Yahav , Stephen Fink, Continuous code-quality assurance with SAFE, Proceedings of the 2006 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation, January 09-10, 2006, Charleston, South Carolina
	Brian Chess , Gary McGraw, Static Analysis for Security, IEEE Security and Privacy, v.2 n.6, p.76-79, November 2004
	Jaime Spacco , Jaymie Strecker , David Hovemeyer , William Pugh, Software repository mining with Marmoset: an automated programming project snapshot and testing system, ACM SIGSOFT Software Engineering Notes, v.30 n.4, July 2005
	Christoph Csallner , Yannis Smaragdakis, Check 'n' crash: combining static checking and testing, Proceedings of the 27th international conference on Software engineering, May 15-21, 2005, St. Louis, MO, USA
	Martin Rinard , Cristian Cadar , Huu Hai Nguyen, Exploring the acceptability envelope, Companion to the 20th annual ACM SIGPLAN conference on Object-oriented programming, systems, languages, and applications, October 16-20, 2005, San Diego, CA, USA
	Chadd C. Williams , Jeffrey K. Hollingsworth, Automatic Mining of Source Code Repositories to Improve Bug Finding Techniques, IEEE Transactions on Software Engineering, v.31 n.6, p.466-480, June 2005
	David Hovemeyer , Jaime Spacco , William Pugh, Evaluating and tuning a static analysis to find null pointer bugs, ACM SIGSOFT Software Engineering Notes, v.31 n.1, January 2006
	James Rose , Nikhil Swamy , Michael Hicks, Dynamic inference of polymorphic lock types, Science of Computer Programming, v.58 n.3, p.366-383, December 2005
	Anthony Savidis, Application invariants: Design by Contract augmented with deployment correctness logic, Software—Practice & Experience, v.36 n.3, p.255-282, March 2006
	Diomidis Spinellis , Panagiotis Louridas, A framework for the static verification of api calls, Journal of Systems and Software, v.80 n.7, p.1156-1168, July, 2007
	James Noble , Robert Biddle, Postmodern prospects for conceptual modelling, Proceedings of the 3rd Asia-Pacific conference on Conceptual modelling, p.11-20, January 16-19, 2006, Hobart, Australia
	Joseph R. Ruthruff , John Penix , J. David Morgenthaler , Sebastian Elbaum , Gregg Rothermel, Predicting accurate and actionable static analysis warnings: an experimental approach, Proceedings of the 30th international conference on Software engineering, May 10-18, 2008, Leipzig, Germany
	Chris Andreae , James Noble , Shane Markstrum , Todd Millstein, A framework for implementing pluggable type systems, ACM SIGPLAN Notices, v.41 n.10, October 2006
	Westley Weimer, Patches as better bug reports, Proceedings of the 5th international conference on Generative programming and component engineering, October 22-26, 2006, Portland, Oregon, USA
	Aaron Tomb , Guillaume Brat , Willem Visser, Variably interprocedural program analysis for runtime error detection, Proceedings of the 2007 international symposium on Software testing and analysis, July 09-12, 2007, London, United Kingdom
	Jaime Spacco , David Hovemeyer , William Pugh, Tracking defect warnings across versions, Proceedings of the 2006 international workshop on Mining software repositories, May 22-23, 2006, Shanghai, China
	Polyvios Pratikakis , Jeffrey S. Foster , Michael Hicks, LOCKSMITH: context-sensitive correlation analysis for race detection, ACM SIGPLAN Notices, v.41 n.6, June 2006
	Christoph Csallner , Yannis Smaragdakis, DSD-Crasher: a hybrid analysis tool for bug finding, Proceedings of the 2006 international symposium on Software testing and analysis, July 17-20, 2006, Portland, Maine, USA
	Sunghun Kim , Kai Pan , E. E. James Whitehead, Jr., Memories of bug fixes, Proceedings of the 14th ACM SIGSOFT international symposium on Foundations of software engineering, November 05-11, 2006, Portland, Oregon, USA
	Daniel J. Quinlan , Richard W. Vuduc , Ghassan Misherghi, Techniques for specifying bug patterns, Proceedings of the 2007 ACM workshop on Parallel and distributed systems: testing and debugging, July 09-09, 2007, London, United Kingdom
	Janaki T. Madhavan , E. James Whitehead, Jr., Predicting buggy changes inside an integrated development environment, Proceedings of the 2007 OOPSLA workshop on eclipse technology eXchange, p.36-40, October 21-21, 2007, Montreal, Quebec, Canada
	Jeffrey S. Foster , Michael W. Hicks , William Pugh, Improving software quality with static analysis, Proceedings of the 7th ACM SIGPLAN-SIGSOFT workshop on Program analysis for software tools and engineering, p.83-84, June 13-14, 2007, San Diego, California, USA
	M. Pistoia , S. Chandra , S. J. Fink , E. Yahav, A survey of static analysis methods for identifying security vulnerabilities in software systems, IBM Systems Journal, v.46 n.2, p.265-288, April 2007
	Sarah Smith Heckman, Adaptive Probabilistic Model for Ranking Code-Based Static Analysis Alerts, Companion to the proceedings of the 29th International Conference on Software Engineering, p.89-90, May 20-26, 2007
	Stephen Thomas , Laurie Williams, Using Automated Fix Generation to Secure SQL Statements, Proceedings of the Third International Workshop on Software Engineering for Secure Systems, p.9, May 20-26, 2007
	Sunghun Kim , Michael D. Ernst, Prioritizing Warning Categories by Analyzing Software History, Proceedings of the Fourth International Workshop on Mining Software Repositories, p.27, May 20-26, 2007
	Sunghun Kim , Michael D. Ernst, Which warnings should I fix first?, Proceedings of the the 6th joint meeting of the European software engineering conference and the ACM SIGSOFT symposium on The foundations of software engineering, September 03-07, 2007, Dubrovnik, Croatia
	William W. Pugh, Finding bugs in eclipse, Companion to the 22nd ACM SIGPLAN conference on Object oriented programming systems and applications companion, October 21-25, 2007, Montreal, Quebec, Canada
	Steven P. Reiss, Incremental Maintenance of Software Artifacts, IEEE Transactions on Software Engineering, v.32 n.9, p.682-697, September 2006
	Michael Martin , Monica S. Lam, Automatic generation of XSS and SQL injection attacks with goal-directed model checking, Proceedings of the 17th conference on Security symposium, p.31-43, July 28-August 01, 2008, San Jose, CA
	Xin Qi , Andrew C. Myers, Masked types for sound object initialization, Proceedings of the 36th annual ACM SIGPLAN-SIGACT symposium on Principles of programming languages, January 21-23, 2009, Savannah, GA, USA
	Gang Tan , Greg Morrisett, Ilea: inter-language analysis across java and c, ACM SIGPLAN Notices, v.42 n.10, October 2007
	Mark Gabel , Zhendong Su, Symbolic mining of temporal specifications, Proceedings of the 30th international conference on Software engineering, May 10-18, 2008, Leipzig, Germany
	Michael D. Bond , Nicholas Nethercote , Stephen W. Kent , Samuel Z. Guyer , Kathryn S. McKinley, Tracking bad apples: reporting the origin of null and undefined value errors, ACM SIGPLAN Notices, v.42 n.10, October 2007
	Steven P. Reiss, Tracking source locations, Proceedings of the 30th international conference on Software engineering, May 10-18, 2008, Leipzig, Germany
	Monica S. Lam , Michael Martin , Benjamin Livshits , John Whaley, Securing web applications with static and dynamic information flow tracking, Proceedings of the 2008 ACM SIGPLAN symposium on Partial evaluation and semantics-based program manipulation, p.3-12, January 07-08, 2008, San Francisco, California, USA
	Christoph Csallner , Yannis Smaragdakis , Tao Xie, DSD-Crasher: A hybrid analysis tool for bug finding, ACM Transactions on Software Engineering and Methodology (TOSEM), v.17 n.2, p.1-37, April 2008
	Westley Weimer , George C. Necula, Exceptional situations and program reliability, ACM Transactions on Programming Languages and Systems (TOPLAS), v.30 n.2, p.1-51, March 2008
	Sarah Heckman , Laurie Williams, On establishing a benchmark for evaluating static analysis alert prioritization and classification techniques, Proceedings of the Second ACM-IEEE international symposium on Empirical software engineering and measurement, October 09-10, 2008, Kaiserslautern, Germany
	Cristina Cifuentes , Bernhard Scholz, Parfait: designing a scalable bug checker, Proceedings of the 2008 workshop on Static analysis, p.4-11, June 12-12, 2008, Tucson, Arizona
	Beat Fluri , Jonas Zuberbühler , Harald C. Gall, Recommending method invocation context changes, Proceedings of the 2008 international workshop on Recommendation systems for software engineering, November 09-09, 2008, Atlanta, Georgia
	Stephen Thomas , Laurie Williams , Tao Xie, On automated prepared statement generation to remove SQL injection vulnerabilities, Information and Software Technology, v.51 n.3, p.589-598, March, 2009
	Lile Hattori , Gilson dos Santos Jr , Fernando Cardoso , Marcus Sampaio, Mining software repositories for software change impact analysis: a case study, Proceedings of the 23rd Brazilian symposium on Databases, October 13-17, 2008, Campinas, Sao Paulo, Brazil
	Nathaniel Ayewah , William Pugh, Using checklists to review static analysis warnings, Proceedings of the 2nd International Workshop on Defects in Large Software Systems: Held in conjunction with the ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA 2009), July 19-19, 2009, Chicago, Illinois
	Ohad Shacham , Martin Vechev , Eran Yahav, Chameleon: adaptive selection of collections, ACM SIGPLAN Notices, v.44 n.6, June 2009
	Satish Chandra , Stephen J. Fink , Manu Sridharan, Snugglebug: a powerful approach to weakest preconditions, ACM SIGPLAN Notices, v.44 n.6, June 2009
	Derek Rayside , Zev Benjamin , Rishabh Singh , Joseph P. Near , Aleksandar Milicevic , Daniel Jackson, Equality and hashing for (almost) free: Generating implementations from abstraction functions, Proceedings of the 2009 IEEE 31st International Conference on Software Engineering, p.342-352, May 16-24, 2009
	Herve Chang , Leonardo Mariani , Mauro Pezze, In-field healing of integration problems with COTS components, Proceedings of the 2009 IEEE 31st International Conference on Software Engineering, p.166-176, May 16-24, 2009
	Stephanie Forrest , ThanhVu Nguyen , Westley Weimer , Claire Le Goues, A genetic programming approach to automated software repair, Proceedings of the 11th Annual conference on Genetic and evolutionary computation, July 08-12, 2009, Montreal, Québec, Canada
	Stephen Nelson , David J. Pearce , James Noble, Implementing relationships using Affinity, Proceedings of the Workshop on Relationships and Associations in Object-Oriented Languages, p.5-8, July 07-07, 2009, Genova, Italy