一句话：提出生态级依赖分析与符号约束求解结合的方法，识别跨项目缺陷真正影响的下游模块。
软件项目日益形成依赖生态系统，上游缺陷可经跨项目依赖影响大量下游项目，但下游即使调用缺陷函数也未必满足触发条件，影响范围难以确定。本文提出跨项目缺陷影响分析方法：给定已知根因函数及触发前置条件，先通过生态级依赖分析收集调用该函数的下游候选模块，再将到达调用点的路径编码为符号约束，与触发前置条件联合求解，识别真正可能受影响的下游模块。作者在科学 Python 生态系统（22 个热门项目、121 个版本、约 1600 万行代码）上评估 31 个上游缺陷：从 25490 个候选模块中识别出可触发的 1132 个，剪枝 95.6%，无漏报，平均误报率 7.9%，而其中仅 49 个此前被报告受影响。
Software projects are increasingly forming social-technical ecosystems within which individual projects rely on the infrastructures or functional components provided by other projects, leading to complex inter-dependencies. Through inter-project dependencies, a bug in an upstream project may have profound impact on a large number of downstream projects, resulting in cross-project bugs. This emerging type of bugs has brought new challenges in bug fixing due to their unclear influence on downstream projects. In this paper, we present an approach to estimating the impact of a cross-project bug within its ecosystem by identifying the affected downstream modules (classes/methods). Note that a downstream project that uses a buggy upstream function may not be affected as the usage does not satisfy the failure inducing preconditions. For a reported bug with the known root cause function and failure inducing preconditions, we first collect the candidate downstream modules that call the upstream function through an ecosystem-wide dependence analysis. Then, the paths to the call sites of the buggy upstream function are encoded as symbolic constraints. Solving the constraints, together with the failure inducing preconditions, identifies the affected downstream modules. Our evaluation of 31 existing upstream bugs on the scientific Python ecosystem containing 121 versions of 22 popular projects (with a total of 16 millions LOC) shows that the approach is highly effective: from the 25490 candidate downstream modules that invoke the buggy upstream functions, it identifies 1132 modules where the upstream bugs can be triggered, pruning 95.6% of the candidates. The technique has no false negatives and an average false positive rate of 7.9%. Only 49 downstream modules (out of the 1132 we found) were reported before to be affected.
@inproceedings{paperbot5599,
title = {Impact analysis of cross-project bugs on software ecosystems},
author = {Wanwangying Ma and Lin Chen and Xiangyu Zhang and Yang Feng and Zhaogui Xu and Zhifei Chen and Yuming Zhou and Baowen Xu},
booktitle = {ICSE},
year = {2020},
doi = {10.1145/3377811.3380442}
}