Flow-Sensitive Fault Localization
Identifying the cause of an error is often the most time-consuming part in program debugging. Fault localization techniques can help to automate this task. Particularly promising are static proof-based techniques that rely on an encoding of error traces into trace formulas. By identifying irrelevant portions of the trace formula, the possible causes of the error can be isolated. One limitation of these approaches is that they do not take into account the control flow of the program and therefore miss common causes of errors, such as faulty branching conditions. This limitation is inherent to the way the error traces are encoded. In this paper, we present a new flow-sensitive encoding of error traces into trace formulas. The new encoding enables proof-based techniques to identify irrelevant conditional choices in an error trace and to include a justification for the truth value of branching conditions that are relevant for the localized cause of an error. We apply our new encoding to the fault localization technique based on error invariants and show that it produces more meaningful error explanations than previous approaches.
KeywordsModel Checker Fault Localization Trace Formula Recursive Call Successful Execution
Unable to display preview. Download preview PDF.
- 1.Ball, T., Naik, M., Rajamani, S.K.: From symptom to cause: localizing errors in counterexample traces. SIGPLAN Not., 97–105 (2003)Google Scholar
- 8.Groce, A., Kroening, D.: Making the Most of BMC Counterexamples. ENTCS, 67–81 (2005)Google Scholar
- 11.Jose, M., Majumdar, R.: Cause clue clauses: error localization using maximum satisfiability. In: PLDI 2011, pp. 437–446. ACM (2011)Google Scholar
- 12.McMillan, K.L.: An interpolating theorem prover. Theor. Comput. Sci., 101–121 (2005)Google Scholar
- 14.Qi, D., Roychoudhury, A., Liang, Z., Vaswani, K.: Darwin: an approach for debugging evolving programs. In: ESEC/SIGSOFT FSE, pp. 33–42 (2009)Google Scholar
- 15.Renieris, M., Reiss, S.P.: Fault localization with nearest neighbor queries. In: ASE, pp. 30–39 (2003)Google Scholar
- 16.Tip, F.: A survey of program slicing techniques. Journal of Programming Languages 3, 121–189 (1995)Google Scholar
- 17.Wang, T., Roychoudhury, A.: Automated path generation for software fault localization. In: ASE, pp. 347–351. ACM (2005)Google Scholar
- 18.Wong, W.E., Debroy, V.: Software fault localization (2009)Google Scholar
- 19.Zeller, A.: Isolating cause-effect chains from computer programs. In: SIGSOFT FSE, pp. 1–10 (2002)Google Scholar