1. Stories of the past and a future topic on API recommendation Qirun Zhang

2. Outline The past The future

3. The past stories

4. Do you recall… Buffer overflow ? Implementation? (What do I want?) 1. Regular expression. 2. Complier infrastructure. 3. Parser (yacc & lex) 4. Gnu-Binutils

5. Regular expression Potential approach Result (failure) Why? Example Printf(“/* int a */”); /* some comments */ char a[4]; char* b;

6. Parser (yacc && lex) Potential approach yacc- LALR parser Result (failure) Why? 1. need help from a preprocessor what if this happens… #define ggg int myfunc() 2. need globe information Node a;

7. Gnu-Binutil Potential approach Result (partial success) But not reliable gcc is an industrial-specified tool Result failure

8. Complier infrastructure Potential approach Result 1. CIL (C Intermediate Language) http://hal.cs.berkeley.edu/cil/ http://hal.cs.berkeley.edu/cil/ 2. Rose Compiler http://rosecompiler.orghttp://rosecompiler.org 3. Non-research purposed solutions ncc http://students.ceid.upatras.gr/~sxanth/ncc/http://students.ceid.upatras.gr/~sxanth/ncc/ tcc(Tiny C Compiler) http://bellard.org/tcc/http://bellard.org/tcc/ failure

9. Anyway, but how?

10. LLVM (The Dreamlover??) Low Level Virtual Machine http://llvm.org/http://llvm.org/ Why llvm Publications in the past: OSDI, SOSP, PLDI, PPoPP, NDSS, ICSE, POPL, FSE, Usenix Security, ASE, ICCAD… Publications of 2010: ICSE(1),EurSys(2),ASPLOS(5)!!! (32/181 ) Industrial focus by Adobe, Apple, Sun, Google... A long road-map

11. Topic in the future: API recommendation

12. What to do? Why API recommendation? A basic scenario fp = fopen(…); fread(fp, …); fclose(fp);

13. Current State-of-The-Art [FSE09]API Hyperlinking via Structural Overlap (altair) [FSE07]Recommending Random Walks (FRAN)

14. Limitations Random Walks (FRAN) – Large searching space(exp) – Candidates are not closely correlated Structural Overlap (Altair) – What if the available information is limited? http://137.189.90.59/lxr/source/srclib/apr/file_io/unix/open.c?v=apache2063#246 – Similar rather than related – A lot of implement issues (wrapper fun, intra- procedural analysis..)

15. Motivation What we can learn from each of them? One solution to address all these problems…. An example to beat both approaches.. Given a function apr_socket_close() Altair recommends: apr_socket_inherit_set, apr_socket_inherit_unset, apr_socket_data_set, apr_wait_for_io_or_timeout, apr_socket_from_file, apr_socket_create_ex, apr_os_sock_put, apr_socket_accept, apr_os_sock_make Let’s see that is apr_socket_close http://137.189.90.59/lxr/source/support/ab.c?v=apache2063#1256 http://137.189.90.59/lxr/source/srclib/apr/network_io/unix/sockets.c?v=apache2063#124

16. Solution In order to do a better job than both of them, we should – Consider the structural overlap (the lesson from why FRAN fails) – Consider the logic correlations (the lesson from why Altair fails) – Mining from the client code – Introduce a BRAND-NEW concept of call graph – Implement issue….

17. Thank you!