Fault localization using value replacement

Abstract

We present a value profile based approach for ranking program statements according to their likelihood of being faulty. The key idea is to see which program statements exercised during a failing run use values that can be altered so that the execution instead produces correct output. Our approach is effective in locating statements that are either faulty or directly linked to a faulty statement. We present experimental results showing the effectiveness and efficiency of our approach. Our approach outperforms Tarantula [9] which, to our knowledge, is the most effective prior approach for statement ranking based fault localization using the benchmark programs we studied.

Ask the Mutants: Mutating Faulty Programs for Fault Localization

“…A branch predicate is considered suspicious if the changed branch outcome makes a failing execution pass. Similarly, Jeffrey et al [11] change the value of a variable in a failing execution with the values with other executions; Chandra et al [2] simulate possible value changes of a variable in a failing execution through symbolic execution. Those techniques are similar to MUSE in a sense that generating diverse program behaviours to localize faults.…”

Comprehensive evaluation of association measures for fault localization

“…Other spectrum-based techniques [20], [25], [43], [52] only use failed executions as the input and systematically alter the program structure or program runtime states to locate faults. Zhang et al [52] search for faulty program predicates by switching the states of program predicates at runtime.…”

“…While their tool, ChipperJ, works on syntax trees for Java programs, Gupta et al [20] work on program dependency graphs and use the intersection of forward and backward program slices to reduce the sizes of failure-relevant code for further inspection. Jeffrey et al use a value profile based approach to rank program statements according to their likelihood of being faulty [25]. These fault localization techniques do not compare the spectra of failed executions with those of successful executions, and association measures are generally not applicable to them.…”

Isolating bugs in multithreaded programs using execution suppression

“…This approach involves substituting state (the values of variables) between passing and failing runs. A related Value Replacement idea was proposed [61] that attempts to replace the values used at certain statement instances with alternate sets of values; if any value replacement causes a failing run to become successful, then the statement associated with the value replacement may be erroneous. Predicate Switching [62] attempts to isolate erroneous code by identifying 'critical' predicates whose outcomes can be altered during a failing run to cause it to become successful.…”