Path Optimization in Programs and Its Application to Debugging

Abstract

We present and solve a path optimization problem on programs. Given a set of program nodes, called critical nodes, we find a shortest path through the program's control flow graph that touches the maximum number of these nodes. Control flow graphs over-approximate real program behavior; by adding dataflow analysis to the control flow graph, we narrow down on the program's actual behavior and discard paths deemed infeasible by the dataflow analysis. We derive an efficient algorithm for path optimization based on weighted pushdown systems. We present an application for path optimization by integrating it with the Cooperative Bug Isolation Project (CBI), a dynamic debugging system. CBI mines instrumentation feedback data to find suspect program behaviors, called bug predictors, that are strongly associated with program failure. Instantiating critical nodes as the nodes containing bug predictors, we solve for a shortest program path that touches these predictors. This path can be used by a programmer to debug his software. We present some early experience on using this hybrid static/dynamic system for debugging.

High-Coverage Symbolic Patch Testing

“…Synthesizing inputs which cover a target is an essential problem in automated test generation and debugging [1,16,27,29,30,32]. While we borrow ideas from the state of the art in these areas, and combine symbolic execution, static analysis and various heuristics, our approach differs by treating the task as an optimization problem with the goal of exploring paths that minimize the estimated distance to the target.…”

“…Similarly, generating inputs with the same effect as a crashing input but which do not leak sensitive data, is used in bug reporting to preserve user privacy [7]. In the context of automated debugging, execution synthesis [32] and path optimization [16] attempt to solve a similar problem: generating an input or a path starting from a set of 'waypoints' through which execution has to pass.…”

Lightweight and Statistical Techniques for Petascale Debugging: Correctness on Petascale Systems (CoPS) Preliminry Report

“…Some of these models constitute advances in pure machine learning [4], while others represent novel hybrids between static and dynamic/statistical sources of information. As an example of the later, work with Lal et al [23] uses both statistical failure models and a static interprocedural dataflow analysis (based on weighted pushdown systems [38]) to identify failure-inducing program paths.…”

Statistical Debugging Using Latent Topic Models

“…In that case, one would prefer to investigate runs where the weight for that bug topic is very high compared to the weight for all other bug topics, as those runs would be likely to be the most pure embodiments of the bug. For another example, prior work has shown how to automatically construct extended paths through multiple suspect program points [21]; ∆LDA offers a model whereby the aggregate scores along such paths can be given a sensible probabilistic interpretation. While we have not yet explored these alternate uses in detail, they hint at the power of a statistical debugging approach that is both well-founded in theory and highly effective in practice.…”