Scalable statistical bug isolation

Abstract

We present a statistical debugging algorithm that isolates bugs in programs containing multiple undiagnosed bugs. Earlier statistical algorithms that focus solely on identifying predictors that correlate with program failure perform poorly when there are multiple bugs. Our new technique separates the effects of different bugs and identifies predictors that are associated with individual bugs. These predictors reveal both the circumstances under which bugs occur as well as the frequencies of failure modes, making it easier to prioritize debugging efforts. Our algorithm is validated using several case studies, including examples in which the algorithm identified previously unknown, significant crashing bugs in widely used systems.

Using dynamic analysis to discover polynomial and array invariants

“…The Diduce [32] tool analyzes what happens when an error occurs by looking at the difference between the previous and current values of variables. Statistical Debugging [33] is a fault localization technique that looks for simple relations (e.g., {<, =, >}) between one variable and another variable or constant. The Spin model checker [34] can also find relations over two variables.…”

Spectrum-Based Fault Localization for Diagnosing Concurrency Faults

“…Depending on the amount of knowledge that is required about the system's internal component structure and behavior, the most predominant approaches can be classified as i) statistical approaches or ii) reasoning approaches (for an overview of approaches, see [2]). The former approach uses an abstraction of program traces, dynamically collected at runtime (also known as program spectra [8]), to produce a list of likely candidates to be at fault [3,10,11], whereas the latter combines a static model of the expected behavior with a set of observations to compute the diagnostic report [14]. In this paper, we use a statistical technique, in particular spectrum-based fault localization [3,10] due its effectiveness in locating faults, while entailing low time and space complexity [2].…”

“…In the following, we assume that a program P comprises a set of components C and is executed using a set of test cases T that either pass or fail, with M = |C| and N = |T |, respectively. Program (component) activity is recorded in terms of program spectra [3,10,11]. These data are collected at run-time and typically consist of a number of counters or flags for the different components of a program.…”

“…We have applied spectrum-based fault localization [1,3,10,11] for directly pinpointing code blocks, of which multi-threaded execution leads to concurrency errors. In our approach, we systematically instrument a multi-threaded subject program to force context switch within different code blocks.…”

Diagnosing Distributed Systems with Self-propelled Instrumentation

“…Dynamic program dicing [11,30] and Triage [43] compare the dynamic backward slice for a variable with an incorrect value (a set of program statements or basic blocks affecting the variable) to the slice for a variable with a correct value, e.g., the same variable in a successful run. Finally, Cooperative Bug Isolation CBI) samples various predicates during program runs (e.g., whether each conditional branch in the code was taken) and reports predicates correlated with failures to the analyst [27].…”