Debug-localize-repair: a symbiotic construction for heap manipulations

Abstract

We present Wolverine2, an integrated Debug-Localize-Repair environment for heap manipulating programs. Wolverine2 provides an interactive debugging environment: while concretely executing a program via on an interactive shell supporting common debugging facilities, Wolverine2 displays the abstract program states (as box-and-arrow diagrams) as a visual aid to the programmer, packages a novel, proof-directed repair algorithm to quickly synthesize the repair patches and a new bug localization algorithm to reduce the search space of repairs. Wolverine2 supports “hot-patching” of the generated patches to provide a seamless debugging environment, and also facilitates new debug-localize-repair possibilities: specification refinement and checkpoint-based hopping. We evaluate Wolverine2 on 6400 buggy programs (generated using automated fault injection) on a variety of data-structures like singly, doubly, and circular linked lists, AVL trees, Red-Black trees, Splay Trees and Binary Search Trees; Wolverine2 could repair all the buggy instances within realistic programmer wait-time (less than 5 s in most cases). Wolverine2 could also repair more than 80% of the 247 (buggy) student submissions where a reasonable attempt was made.

A Theoretical analysis of the bug localization algorithm

Let $\mathcal {I}$ be the identity function that copies the $\omega _{pre} \text { or } \omega _{post}$. Then,

• $[\omega ^f_0, \omega ^f_1, \omega ^f_2, \dots , \omega ^f_n] \leftarrow [\mathcal {I}, \Delta _{1, 1}, \Delta _{1, 2}, \dots \Delta _{1, n}] (\omega _{pre}$, P)

• $[\Omega ^b_0, \Omega ^b_1, \Omega ^b_2, \dots , \Omega ^b_n] \leftarrow [\nabla _{n, 1}, \nabla _{n, 2}, \dots \nabla _{n, n}, \mathcal {I}] (\omega _{post}$, P)

• $[\Gamma _0, \Gamma _1, \Gamma _2, \dots , \Gamma _n] \leftarrow [\omega ^f_0, \omega ^f_1, \omega ^f_2, \dots , \omega ^f_n] \otimes [\Omega ^b_0, \Omega ^b_1, \Omega ^b_2, \dots , \Omega ^b_n]$; $\Omega$ is a set of states while $\omega$ is a single state.

Theorem 1

If a real bug is at location i, it implies that i is in the suspicious set

Proof

Let $\hat{P}$ and P denote the correct and buggy programs, respectively.

Assumption: Assume that in the trace $P_n$ (sequence of statements of length n), the ith statement has a real bug and $LHS(s_i)$ be x. Let us define the correct execution as the forward execution states of $\hat{P}$ at each program point. Let $\Delta _{0, i}(\omega _{pre}, \hat{P})[x] = \texttt {n1}$, $\Delta _{0, i}(\omega _{pre}, P)[x] = \texttt {n2}$, $\omega _{post}[x] = \texttt {n3}$ and $\omega _{pre}[x] = \texttt {n0}$. Therefore, the number of nodes and points-to pairs in the datastructure, $\texttt {n} \ge 2$. [Assump1]

Fig. 19

Illustrations for the proof of theorem 1

Case 1

The ith statement is upward exposed: this is illustrated in Fig. 19a.

• 1. $\Delta _{0, i-1}(\omega _{pre}, P)$ = $\Delta _{0, i-1}(\omega _{pre}, \hat{P})$ [Since the bug is in ith stmt]

• 2. $\nabla _{n, i}(\omega _{post}, P)[x] = \omega _{pre}[x]$ [$asgn_{1}$ rule in Fig. 12]

• 3. $\Delta _{0, i-1}(\omega _{pre}, P)[x] = \omega _{pre}[x]$ [Lemma  1]

• 4. $\nabla _{n, i}(\omega _{post}, P)[x] = \Delta _{0, i-1}(\omega _{pre}, P)[x]$ [From 2 and 3]

• 5. $\Gamma _{i-1}[x] = 0$ [Since $\Gamma _{i-1} = (\nabla _{n, i} - \Delta _{0, i-1}) * (multiplying factor)$ and $\nabla _{n, i} - \Delta _{0, i-1} = 0$]

• 6. Also since ith statement is upward exposed there is no previous splitting of states when this statement is backtracked. [Backward Semantics in Fig. 12]

• 7. Without loss of generality, lets say there are already p backtracked states before ith statement is backtracked.

• 8. Subcase 1: There has not been any splitting for x in the backward execution. Therefore for all the p states (in $\nabla _{n, i+1}$), x points-to $\texttt {n3}$ [Stmt is both upward and downward exposed]

• 9. $\Gamma _{i}[x] = p * multiplying factor > 0$ [From 8 and since $\Gamma _{i} = (\nabla _{n, i+1} - \Delta _{0, i}) * (multiplying factor)$]

• 10. Subcase 2: There has been a previous splitting for x in the backward execution. Therefore in atleast one of the p states, the value of $x \ne \texttt {n1}$. This is because splitting happens uniformly across all nodes and there are atleast 2 nodes in the data-structure. [Rules in Fig. 12]

• 11. $\Gamma _{i}[x] > 0$ [From 10]

• 12. Hence for loop at step 5 in Algorithm 4, since $\Gamma _{i-1} \ne \Gamma _{i}, i^{th}$ statement will be added to suspicious set.

Case 2

The ith statement is sandwiched. We add all sandwiched statements to the suspicious set since the program loses all information regarding the correctness of such a statement.

Case 3

The ith statement is downward exposed and not upward exposed: this is illustrated in Fig. 19b.

• 1. There will be splitting of states when ith statement is backtracked. [$asgn_{2}$ rule in Fig. 12]

• 2. Without loss of generality, lets say there are p backtracked states before ith statement is backward executed.

• 3. In all these p states, the value of variable $x = \texttt {n3}$. [Lemma  2]

• 4. Let there be $\texttt {s}$ splits for x until the full backtrack of the program.

• 5. The final number of states after backtracking is $n^{s} = M$, where n is the number of nodes and points-to pairs [Rules in Fig. 12]

• 6. Each of the p states contribute a difference of 1 in $\Gamma _{i} = p * \frac{n^s}{p} = n^s$ [$\Gamma _{i} = (\nabla _{n, i+1} - \Delta _{0, i}) * (multiplying factor)$]

• 7. $\Gamma _{i-1} = \frac{n^s}{p*n} * (n-1)*p = n^s - n^{s-1}$ [Out of n nodes, 1 will match with a node in $\Delta _{0, i}(\omega _{pre}, {P})$; uniform splitting]

• 8. $\Gamma _{i-1} - \Gamma _{i} = n^s - n^{s-1} - n^s \ne 0$, for $n > 1$ [Since number of nodes and points-to pairs> 1]

• 9. Hence, for the loop at step 5 in Algorithm 4, since $\Gamma _{i-1} \ne \Gamma _{i}, i^{th}$ statement will be added to suspicious set.

In all cases, Algorithm 4 successfully catches the buggy statement.

Theorem 2

If C is the set of suspicious locations captured by Algorithm 4, then replacing all statements $s \notin C$ by $lhs = *$ maintains the ground truth repair in the proof-guided repair algorithm.

Proof

Any statement which depends on a buggy statement is also put in the suspicious set by our algorithm. This is natural because upon execution of the buggy statement, an incorrect state is achieved, and any statements which further depend on this state would be buggy with respect to the ground truth state. Hence, we can slice away the statement from repair by making them non-deterministic. $\square$