Darwin: an approach for debugging evolving programs

ABSTRACT

Debugging refers to the laborious process of finding causes of program failures. Often, such failures are introduced when a program undergoes changes and evolves from a stable version to a new, modified version. In this paper, we propose an automated approach for debugging evolving programs. Given two programs (a reference, stable program and a new, modified program) and an input that fails on the modified program, our approach uses concrete as well as symbolic execution to synthesize new inputs that differ marginally from the failing input in their control flow behavior. A comparison of the execution traces of the failing input and the new inputs provides critical clues to the root-cause of the failure. A notable feature of our approach is that it handles hard-to-explain bugs like code missing errors by pointing to the relevant code in the reference program. We have implemented our approach in a tool called DARWIN. We have conducted experiments with several real-life case studies, including real-world web servers and the libPNG library for manipulating PNG images. Our experience from these experiments points to the efficacy of DARWIN in pinpointing bugs. Moreover, while localizing a given observable error, the new inputs synthesized by DARWIN can reveal other undiscovered errors.

REFERENCES

• 1: Apache webserver. http://httpd.apache.org/.
• 2: libPNG library. http://www.libpng.org.
• 3: Miniweb webserver. http://miniweb.sourceforge.net/.
• 4: QEMU emulator. http://www.qemu.org.
• 5: Savant webserver. http://savant.sourceforge.net/info.html.
• 6: T. Apiwattanapong, A. Orso, and M. Harrold. A differencing algorithm for object-oriented programs. In ASE, 2004.
• 7: T. Ball, M. Naik, and S. Rajamani. From symptom to cause: Localizing errors in counterexample traces. In POPL, 2003.
• 8: D. Brumley, J. Caballero, Z. Liang, J. Newsome, and D. Song. Towards automatic discovery of deviations in binary implementations with applications to error detection and fingerprint generation. In USENIX Security Conf., 2007.
• 9: K.-M. Chao, R. Hardison, and W. Miller. Recent developments in linear space alignment methods: A survey. Journal of Computational Biology, 1, 1994.
• 10: Y. Chen, D. Rosenblum, and K. Vo. Testtube: a system for selective regression testing. In ICSE, 1994.
• 11: C. Csallner and Y. Smaragdakis. DSD-Crasher: a hybrid analysis tool for bug finding. In ISSTA, 2006.
• 12: L. de Moura and N. Bjorner. Z3: An efficient SMT solver. In TACAS, 2008.
• 13: H. Do, S. G. Elbaum, and G. Rothermel. Supporting controlled experimentation with testing techniques: An infrastructure and its potential impact. Empirical Software Engineering, 2005. http://www.cse.unl.edu/~galileo/sir.
• 14: S. Elbaum, A. Malishevsky, and G. Rothermel. Prioritizing test cases for regression testing. In ISSTA, 2000.
• 15: V. Ganesh and D. Dill. A decision procedure for bit-vectors and arrays. In CAV, 2007.
• 16: O. Giroux and M. Robillard. Detecting increases in feature coupling using regression tests. In FSE, 2006.
• 17: L. Guo, A. Roychoudhury, and T.Wang. Accurately choosing execution runs for software fault localization. In CC, 2006.
• 18: S. Horowitz. Identifying the semantic and textual differences between two versions of a program. In PLDI, 1990.
• 19: D. Hovemeyer and W. Pugh. Finding bugs is easy. In OOPSLA Onward!, 2004.
• 20: B. Liblit. Cooperative Bug Isolation. PhD thesis, UC Berkeley, 2005.
• 21: B. Liblit, M. Naik, A. Zheng, A. Aiken, and M. Jordan. Scalable statistical bug isolation. In PLDI, 2005.
• 22: X. Ren, F. Shah, F. Tip, B. Ryder, and O. Chesley. Chianti: a tool for change impact analysis of java programs. In OOPSLA, 2004.
• 23: M. Renieris and S. P. Reiss. Fault localization with nearest neighbor queries. In ASE, 2003.
• 24: G. Rothermel and M. J. Harrold. A safe efficient regression test selection technique. TOSEM, 6, 1997.
• 25: R. Santelices, P. Chittimalli, T. Apiwattanapong, A. Orso, and M. Harrold. Test-suite augmentation for evolving software. In ASE, 2008.
• 26: R. Seacord, D. Plakosh, and G. Lewis. Modernizing Legacy Systems: Software Technologies, Engineering Processes, and Business Practices. Addison-Wesley, 2003.
• 27: J. Sillito, G. Murphy, and K. De Volder. Questions programmers ask during software evolution tasks. In FSE, 2006.
• 28: D. Song et al. Bitblaze: A new approach to computer security via binary analysis. In ICISS (Keynote Invited Paper), 2008. http://bitblaze.cs.berkeley.edu.
• 29: M. Sridharan, S. Fink, and R. Bodik. Thin slicing. In PLDI, 2007.
• 30: A. Srivastava and J. Thiagarajan. Effectively prioritizing tests in a development environment. In ISSTA, 2002.
• 31: A. Zeller. Yesterday, my program worked. Today, it does not. Why? In ESEC/FSE, 1999.
• 32: A. Zeller. Isolating cause-effect chains from computer programs. In FSE, 2002.
• 33: A. Zeller and R. Hildebrandt. Simplifying and isolating failure-inducing input. IEEE Transactions on Software Engineering, 28:2002, 2002.
• 34: X. Zhang, N. Gupta, and R. Gupta. Pruning dynamic slices with confidence. In PLDI, 2006.
• 35: X. Zhang, S. Tallam, N. Gupta, and R. Gupta. Towards locating execution omission errors. In PLDI, 2007.

INDEX TERMS

Primary Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.5 Testing and Debugging
          Subjects: Debugging aids

Additional Classification:
  D. Software
  D.2 SOFTWARE ENGINEERING
      D.2.5 Testing and Debugging
          Subjects: Symbolic execution
  D.3 PROGRAMMING LANGUAGES
      D.3.4 Processors
          Subjects: Debuggers

General Terms:
Experimentation, Reliability

Keywords:
debugging, software evolution, symbolic execution