1. Ongoing projects in the Program Analysis Group Marcelo d’Amorim Informatics Center, Federal University of Pernambuco (UFPE) Belo Horizonte, MG-Brazil, UFMG, 2010

2. Our approach is to explore best of each verification technique. Our goal is to find errors in software as opposed to prove their correctness. http://pan.cin.ufpe.br

3. Student members  Elton is a first year MS student interested in automated debugging * MS=Master Student, URI=Undergraduate Research Initiation.

4. Student members  Mateus Borges and Matheus Souza are URI students interested in constraint solving for automated testing * MS=Master Student, URI=Undergraduate Research Initiation.

5. Active projects  Improved precision for lightweight debugging  Elton Alves (MS)  Improved solving of complex constraints  Mateus Borges and Matheus Souza (URI)  Other projects…

6. Goal of this talk is to present our areas of interest and approach

7. Improved precision for lightweight debugging  People involved:  Elton Alves (UFPE)  Milos Gligoric, and Vilas Jagananth (University of Illinois)

8. Context and Problem  Context  Debugging is important. Manual debugging is time-consuming.  Lightweight debugging (LD) has been proposed to complement precise but more expensive automated debuggers (e.g., DD)  Problem  Lightweight debugging can be rather imprecise Precision measured with number of statements the user needs to inspect.

9. Quick outlook: TARANTULA*  Identify which statements contribute more to failures These statements appear relatively more in failing runs than in passing * J. Jones et al. Empirical Evaluation of test information to assist fault localization. ICSE 2002.

10. Quick outlook: TARANTULA  Identify which statements contribute more to failures These statements appear relatively more in failing runs than in passing Precision of debugging measured with the position of * in this rank

11. Observation  Two approaches to improve precision of LD  Use evolution information  Discard statements covered but unrelated to bug Filter changed code (lossy)

12. Observation  Two approaches to improve precision of LD  Use evolution information  Discard statements covered but unrelated to bug Dynamic slice the code (sound) Filter changed code (lossy)

13. Quick outlook: Dynamic Slicing*  Identify which statements influence the evaluation of variables at specific points * Agrawal and Horgan. Dynamic Progam Slicing. PLDI 1990. class Foo { int x,y,z;.. void method bar() { if (x > y) { y = 20; z = 10; } @Test void test() { Foo foo = new Foo(10,5); foo.bar(); assert(foo.z > 10); } class Foo {.. void method bar() { if (x > y) { y = 20; z = 10; }

14. Proposal  Change-aware forward slicing computation  A statement is related if it appears in the slice. It is relevant if it is related and depends on changed code.  Number of lines  Approach: Modify Forward Dynamic Slicing  A set is relevant only if it depends on a modified location  Set union can ignore irrelevant sets! covered (baseline) > related > relevant

15. Improved solving of complex constraints  People involved:  Mateus Borges and Matheus Souza (UFPE)  Corina Pasareanu (NASA/CMU)

16. Context and Problem  Context  Symbolic execution (SE)  Problem Execution engine foo($x) Solver foo(10) foo(0) foo(int x) { x = x + 1; if (x > 10) { // PC: $x + 1 > 10 } else { // PC: $x + 1 <= 10 } PC: $x + 1 > 10 PC: $x + 1 <= 10

17. Context and Problem  Context  Symbolic execution (SE)  Problem Execution engine foo($x) Solver foo(?) foo(double x) { x = x + 1; if (x > Math.pow(Math.sin(x),2)){ // PC: $x + 1>($x + 1)^2 } else { // PC: $x + 1<=($x + 1)^2 } PC: $x + 1 > sin($x + 1)^2 PC: $x + 1 <= sin($x + 1)^2

18. Context and Problem  Context  Symbolic execution (SE)  Problem  Inability to deal with complex constraints! Execution engine foo($x) Solver foo(?) foo(double x) { x = x + 1; if (x > Math.pow(Math.sin(x),2)){ // PC: $x + 1>($x + 1)^2 } else { // PC: $x + 1<=($x + 1)^2 } PC: $x + 1 > sin($x + 1)^2 PC: $x + 1 <= sin($x + 1)^2 constraints are non-linear and use mathematical functions!

19. Proposal  Use heuristic search to find solutions to path constraints  Path constraint: AND [b 1,…, b n ]  Fitness function: weighted sum of clause scores  Score measures distance to satisfaction. Range is 0.0..1.0.  Status  Particle Swarm Optimization search performed best  Compared CORAL with CVC3, Choco, and Yices  Two case studies from NASA  Integrated with NASA’s Symbolic PathFinder

20. Future Projects  Evaluation of set implementations for dynamic slicing  Interactive constraint solving  FindBugs + Java PathFinder  Static Symbolic Execution

21. New Recife ~1.5 million people ~77F (25C) avg. temp. Intl. airport with flights to major cities Old Recife

22. Informatics Center (CIn) on Federal University of Pernambuco (UFPE) http://pan.cin.ufpe.br

23. Interactive testing  People involved:  Francisco Airton, Thiago Vieira, and Sabrina Souto (UFPE Prospective Students)

24. Context and Problem  Context  Automated test generation  Problem  No automation is problematic  For certain problems: tedious and time-consuming  Full automation is challenging  Huge problem space

25. Proposal  A method where the user actively interacts with a tool to generate tests - interactive testing 1. Specify goal and generate requirements 2. Check quality of the test suite to satisfy requirements 3. Update the test suite

26. Proposal  A method where the user actively interacts with a tool to generate tests - interactive testing 1. Specify goal and generate requirements 2. Check quality of the test suite to satisfy requirements 3. Update the test suite  Supported by a tool – Y-tix  Build test requirements from control and call graphs  Check “how close” the tests are from satisfying requirements  Use dynamic slicing to help the user to “get closer”

27. Illustration: pre-process + search sqrt(x+y)=sqrt(c), sin(z) > cos(y)

28. Illustration: pre-process + search sqrt(x+y)=sqrt(c), sin(z) > cos(y) x+y=c, sin(z) > cos(y) Rewrite

29. Illustration: pre-process + search sqrt(x+y)=sqrt(c), sin(z) > cos(y) x+y=c, sin(z) > cos(y) Rewrite x=c-y, sin(z) > cos(y) Rewrite

30. Illustration: pre-process + search sqrt(x+y)=sqrt(c), sin(z) > cos(y) x+y=c, sin(z) > cos(y) Rewrite x=c-y, sin(z) > cos(y) Rewrite sin(z) > cos(y) EQ_DP x=c-y Value of x depends on y.

31. Illustration: pre-process + search sqrt(x+y)=sqrt(c), sin(z) > cos(y) x+y=c, sin(z) > cos(y) Rewrite x=c-y, sin(z) > cos(y) Rewrite sin(z) > cos(y) EQ_DP Search z, y Infer value ranges of z and y from context before starting the search.

32. Quick outlook: heuristic search 4.811.00 sqrt(exp(x+z))) 0, y>1, z>1, y<x+2, 4.811.002.192.9120.29.99 … 1.9128.21.99 Identify best fit individuals with a fitness functions 2 3 4 4 Individuals Fitness scores

33. Quick outlook: heuristic search sqrt(exp(x+z))) 0, y>1, z>1, y<x+2, 4.811.00 4.811.002.19 2.9120.29.99 … 1.9128.21.99 Best individuals guide next generation! 2.9120.29.99 … 1.9128.21.99

34. Quick outlook: heuristic search sqrt(exp(x+z))) 0, y>1, z>1, y<x+2, Stop when find solution or timeouts x=4.31, y=6.08, z=9.51 4.316.089.51 Individuals Fitness scores 5