Memories of Bug Fixes

  • View
    1.484

  • Download
    1

Embed Size (px)

Transcript

  • 1. Memories of Bug-Fixes Sunghun Kim, Kai Pan, Jim Whitehead {hunkim, pankai, ejw}@cs.ucsc.edu University of California, Santa Cruz

2. What is a bug (Zeller 2006)?

  • This pointer, being null, is a bug
    • An incorrect program state
  • This software crashes; this is a bug
    • An incorrect program execution
  • This line 11 is buggy
    • An incorrect program code

3. Bugs?

  • //null dereference
  • public nullDeref () {
  • MyObject o = null;if (isGoodDay){
  • o = new MyObject(Hi);
  • }
  • System.out.println(o.toString());}

4. Bugs?

  • //null dereference
  • public nullDeref () {
  • MyObject o = null;if (isGoodDay){
  • o = new MyObject(Hi);
  • }
  • System.out.println(o.toString());}

5. Bugs?

  • //stack buffer overun for sizes greater than 14stack_buffer(void* src, int size ) {char buffer[14]; memcpy(buffer, src, size ); }

6. Bugs?

  • //stack buffer over-run for sizes greater than 14stack_buffer(void* src, int size ) {char buffer[14]; memcpy(buffer, src, size ); }

7. Bugs?

  • if () {
    • setSelectedText("");
    • }

8.

  • There are many bug fix patterns that are specific to an individual project, and may not match one of the static patterns
  • Example fromjEditproject:

Project-Specific Bug Fix Patterns JEditTextArea.java at transaction 114 - setSelectedText(""); + insertTab(); JEditTextArea.javaat transaction 86- setSelectedText(""); + insertTab(); 9. Bug?

    • if (requiredProjectRsc.exists() &&
    • requiredProjectRsc.isOpen()) {
    • }

10.

  • Example from Eclipse project:
    • JavaProject.java, transaction 2024 (Fix for bug 28434)
    • - if (requiredProjectRsc.exists() &&
    • -requiredProjectRsc.isOpen ()) {
    • + if ( JavaProject.hasJavaNature (requiredProjectRsc)) {
    • DeltaProcessor.java, transaction 1945 (Fix for bug 27499)
    • - boolean isOpened= proj.isOpen ();
    • - if (isOpened && this.hasJavaNature(proj))
    • + if ( JavaProject.hasJavaNature (proj))

Project-Specific Bug Fix Patterns 11. Horizontal and Vertical Bug Patterns Bufferover run Horizontal : general bugs Vertical : project specific Nulldereference JEdit example Eclipse example 12. Bug-Fix Memories Basic Idea Extract patterns in bug fix change history Bug fix changes in revision1..n-1 Memory 13. Bug-Fix Memories Basic Idea Extract patterns in bug fix change history Search for patterns against Memory Bug fix changes in revision1..n-1 Memory Code to examine 14. Talk Overview

  • Detection of bug fix changes
  • Mining vertical bugs
    • Abstracting code
  • Evaluation
  • Conclusions
  • Future Work

15. Retrieving Bug Fix Changes

  • Software projects today record their development history using Software Configuration Management tools
  • As developers make changes, they record a reason along with the change
    • In the change log message
  • When developers fix a bug in the software, they tend to record log messages with some variation of the words fixed or bug
    • Fixed null pointer bug
  • It is possible to mine the change history of a software project to uncover thesebug-fix changes
  • That is, we retrospectively recover those changes that developers have marked as containing a bug fix
    • We assume they are not lying

16. Bug-introducing and Bug-fix Changes Development history of foo.java SCM log message:Bug #567 fixed bug fix Bug #567 entered into issue tracking system (bug finally observed and recorded) Software change that introduces the bugbug-introducing 17. Kenyon Processing SCM Repository Filesystem Extract Automated configuration extraction SavePersist gathered metrics & facts Kenyon Repository (RDBMS/ Hibernate) AnalyzeQuery DB, add new facts Analysis Software (e.g., IVA) Compute Fact extraction (metrics, static analysis) Kenyon 18. Commits, Transactions & Configurations transactions configurations CVS file commits Added feature X Fixed null ptr bug Modified button text Added feature Y log message 19. Hunks, and Hunk Pairs Revisionn-1 (hasbughunks) Revisionn (hasfixhunks) modification addition deletion added hunk hunk pair type deleted hunk empty deleted hunk empty added hunk 20. Detecting Vertical Bugs (Patterns)

  • Detecting bug patterns
    • Saving exact code in bug and fix hunks doesnt work, since there is rarely an exact match.
    • Need a method for abstracting changes to find patterns
  • Approach
    • Abstract code in each bug fix change
    • Save abstracted bug and fix code in a database (the bug fix memory)
    • Can search existing code to see if it matches a bug fix pattern
    • Can suggest code to fix the bug

21. Process for Abstracting Code

  • Four step process
    • Raw component extraction
      • Parse source code, and burst out individual syntactic elements
    • Normalization
      • Substitute type names for variables, string literals, constants (abstract to types)
    • Information filtering
      • Remove elements that are too common to yield project-specific patterns
    • Diff filtering
      • Remove code components that are common in bug and fix hunks, yielding only code unique to the change

22. Raw Component Extraction

  • Step 1: Convert statements inside change hunks so they lie on a single line
    • Eliminate whitespace
    • Concatenate multi-line statements to one line
    • Concatenate conditionals for complex statements (if, while, etc.) to one line
  • Step 2: Extractraw components
    • Component is a non-leaf node in the syntax tree of a single line
    • Bursts out complex statements into constituent parts
      • Each portion of a complex conditional is a separate component
    • Additionally, separate out a method call and its parameters

23. Raw Component Extraction Example

  • Initial code
    • if (foo.flag > 5 &&foo.ready()) {
    • i=1;
    • foo.create(example);
    • initiate(6,bar);
    • }
  • Extracted Raw Components
    • foo.flag
    • foo.flag > 5
    • foo.ready()
    • ready()
    • foo.flag > 5 && foo.ready ()
    • if (foo.flag > 5 && foo.ready())
    • i=1
    • example
    • foo.create(.)example
    • create(.) example
    • initiate(,)6, bar

if > && . . foo flag 5 foo ready() ready 24. Normalization

  • To further improve the ability to match code, perform abstraction of instances to types
    • Replace variable instance with its type
      • Permits matching on type, rather than instance
      • foo.flag >= 5Foo.flag >= 5 (type of foo is Foo)
    • For literals, insert new component with type
      • i=1 yields int=1andint=int
    • For method calls, replace each parameter with type of parameter
      • Use * for unknown types (we only do one-pass parse)
      • initiate(,) 6, barinitiate(,) int,*(type of bar is unknown)

25. Information Filtering Goal

  • After normalization, resulting components are candidates for insertion into database
    • Problem: many c