Automated Repair of Heap-Manipulating Programs Using Deductive Synthesis

Abstract

We propose a novel method to automatically repairing buggy heap-manipulating programs using constraint solving and deductive synthesis. Given an input program C and its formal specification in the form of a Hoare triple: {P} C {Q}, we use a separation-logic-based verifier to verify if program C is correct w.r.t. its specifications. If program C is found buggy, we then repair it in the following steps. First, we rely on the verification results to collect a list of suspicious statements of the buggy program. For each suspicious statement, we temporarily replace it with a template patch representing the desired statements. The template patch is also formally specified using a pair of unknown pre-and postcondition. Next, we use the verifier to analyze the temporarily patched program to collect constraints related to the pre-and postcondition of the template patch. Then, these constraints are solved by our constraint solving technique to discover the suitable specifications of the template patch. Subsequently, these specifications can be used to synthesize program statements of the template patch, consequently creating a candidate program. Finally, if the candidate program is validated, it is returned as the repaired program. We demonstrate the effectiveness of our approach by evaluating our implementation and a state-of-the-art approach on a benchmark of 231 buggy programs. The experimental results show that our tool successfully repairs 223 buggy programs and considerably outperforms the compared tool.

Deductive Synthesis of Programs with Pointers: Techniques, Challenges, Opportunities

“…But what if the program is already written previously but is buggy-would it be possible to automatically find a fix for it if we know what its specification is? This line of research, employing deductive synthesis for automated program repair [30], known as deductive program repair, has been explored in the past for functional programs [42] and simple memory safety properties [90], and only recently has been extended to heap-manipulating programs using the approach pioneered by SuSLik [63]. The SL-based deductive repair relies on existing automated deductive verifiers [17] to identify a buggy code fragment (which breaks the verification), followed by the discovery of the correct specification, which is used for the subsequent synthesis of the patch.…”

Trident: Controlling Side Effects in Automated Program Repair

“…Static Program Repair Algorithms: Two exemplars of this class are an approach by Nguyen et al [53] and Footpatch [54]. The approach of Nguyen et al [53] can synthesize patches with side effects and provide formal correctness guarantees, but requires formal specification, and was only demonstrated to repair small programs. TRIDENT scales to real-world programs, but relies on a test suite, so it is subject to test-overfitting.…”

HIPPODROME: Data Race Repair using Static Analysis Summaries

“…Automated program repair (APR) [21] is an emerging technology paradigm for automatically fixing logical bugs via search [54], semantic reasoning [45] and learning [38]. The recent works on semantic program repair [42,45] make use of advances in program synthesis [14,41,46,48] to automatically generate one-line or multi-line fixes. However, these approaches have been mostly studied for sequential programs.…”