Automatic Program Repair Using Formal Verification and Expression Templates

Nguyen, Thanh-Hung; Ta, Quang-Trung; Chin, Wei-Ngan

doi:10.1007/978-3-030-11245-5_4

Cited by 18 publications

(10 citation statements)

References 26 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For our evaluation, we have used programs from two benchmarks: TCAS and Codeflaws. The TCAS benchmark is part of the Siemens suite [12], and is frequently used for program repair evaluation [5,34,38]. The TCAS program implements a traffic collision avoidance system for aircrafts, and consists of approximately 180 lines of code.…”

Section: Resultsmentioning

confidence: 99%

“…The TCAS benchmark was recently used also in [34], where AllRepair's performance was compared to that of four other automated repair tools: Angelix [29], GenProg [26], FoRenSiC [5] and Maple [34]. AllRepair was found to be faster by an order of magnitude than all of the compared tools, taking only 16.9 seconds to find a repair on average, where the other tools take 1540.7, 325.4, 360.1, and 155.3 seconds, respectively.…”

Section: Comparison With Other Repair Methodsmentioning

confidence: 99%

“…The tool MUT-APR [ 3 ] fixes binary operator faults in C programs, but only targets faults that require one line modification. The tools FoREnSiC [ 5 ] and Maple [ 34 ] repair C programs with respect to a formal specification, but they do so by replacing expressions with templates, which are then patched and analysed. SemGraft [ 28 ] conducts repair with respect to a reference implementation, but relies on tests for SBFL fault localization of the original program.…”

Section: Related Workmentioning

confidence: 99%

See 2 more Smart Citations

Must Fault Localization for Program Repair

Rothenberg

Grumberg

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This work is concerned with fault localization for automated program repair. We define a novel concept of a must location set. Intuitively, such a set includes at least one program location from every repair for a bug. Thus, it is impossible to fix the bug without changing at least one location from this set. A fault localization technique is considered a must algorithm if it returns a must location set for every buggy program and every bug in the program. We show that some traditional fault localization techniques are not must. We observe that the notion of must fault localization depends on the chosen repair scheme, which identifies the changes that can be applied to program statements as part of a repair. We develop a new algorithm for fault localization and prove that it is must with respect to commonly used schemes in automated program repair. We incorporate the new fault localization technique into an existing mutation-based program repair algorithm. We exploit it in order to prune the search space when a buggy mutated program has been generated. Our experiments show that must fault localization is able to significantly speed-up the repair process, without losing any of the potential repairs.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Comparison With Other Repair Methodsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

See 1 more Smart Citation

Must Fault Localization for Program Repair

Rothenberg

Grumberg

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…Another extension to the repair process is changing the program behavior, rather than blocking it. Examples for such a mutationbased approach to program repair are [41,6,35].…”

Section: Discussionmentioning

confidence: 99%

Assume, Guarantee or Repair -- A Regular Framework for Non Regular Properties (full version)

Frenkel¹,

Grumberg²,

Păsăreanu³

et al. 2022

Preprint

View full text Add to dashboard Cite

We present Assume-Guarantee-Repair (AGR) -a novel framework which verifies that a program satisfies a set of properties and also repairs the program in case the verification fails. We consider communicating programs -these are simple C-like programs, extended with synchronous actions over communication channels. Our method, which consists of a learning-based approach to assume-guarantee reasoning, performs verification and repair simultaneously: in every iteration, AGR either makes another step towards proving that the (current) system satisfies the required properties, or alters the system in a way that brings it closer to satisfying the properties. To handle infinite-state systems we build finite abstractions, for which we check the satisfaction of complex properties that contain first-order constraints, using both syntactic and semantic-aware methods. We implemented AGR and evaluated it on various communication protocols. Our experiments present compact proofs of correctness and quick repairs.

show abstract

“…Likewise, Logozzo and Ball [31] use abstract interpretation [9] as a way to detect and fix mistakes in programs, but only for a limited number of issues that are captured by the employed analyzer. Similar to our approach, Maple [39] uses program specifications to detect bugs and validate candidate patches in numerical programs.…”

Section: Related Workmentioning

confidence: 99%

Automated Repair of Heap-Manipulating Programs Using Deductive Synthesis

Nguyen

Sergey

et al. 2021

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

We propose a novel method to automatically repairing buggy heap-manipulating programs using constraint solving and deductive synthesis. Given an input program C and its formal specification in the form of a Hoare triple: {P} C {Q}, we use a separation-logic-based verifier to verify if program C is correct w.r.t. its specifications. If program C is found buggy, we then repair it in the following steps. First, we rely on the verification results to collect a list of suspicious statements of the buggy program. For each suspicious statement, we temporarily replace it with a template patch representing the desired statements. The template patch is also formally specified using a pair of unknown pre-and postcondition. Next, we use the verifier to analyze the temporarily patched program to collect constraints related to the pre-and postcondition of the template patch. Then, these constraints are solved by our constraint solving technique to discover the suitable specifications of the template patch. Subsequently, these specifications can be used to synthesize program statements of the template patch, consequently creating a candidate program. Finally, if the candidate program is validated, it is returned as the repaired program. We demonstrate the effectiveness of our approach by evaluating our implementation and a state-of-the-art approach on a benchmark of 231 buggy programs. The experimental results show that our tool successfully repairs 223 buggy programs and considerably outperforms the compared tool.

show abstract

Automatic Program Repair Using Formal Verification and Expression Templates

Cited by 18 publications

References 26 publications

Must Fault Localization for Program Repair

Must Fault Localization for Program Repair

Assume, Guarantee or Repair -- A Regular Framework for Non Regular Properties (full version)

Automated Repair of Heap-Manipulating Programs Using Deductive Synthesis

Contact Info

Product

Resources

About