一句话：仅对程序值的正确性而非完整语义进行概率建模，在故障定位的有效性与可扩展性之间取得平衡。
基于测试的故障定位依赖通过测试与失败测试的执行差异来定位缺陷，而故障能否被测试触发与程序语义密切相关。现有方法要么建模完整程序语义（如基于变异的故障定位与天使调试），导致可扩展性差；要么完全忽略语义（如基于频谱的故障定位），导致定位不精确。本文提出只建模程序值的正确性而非其完整语义，以在有效性与可扩展性之间取得平衡。为此作者引入概率方法建模程序语义，并融合静态分析与动态执行轨迹信息，实现工具 SmartFL。在真实数据集 Defects4J 上的评估显示，其语句级 top-1 准确率为 21%，优于当前最先进方法，且每个故障平均耗时 210 秒，而捕获完整语义的现有方法通常慢 10 倍以上。
Testing-based fault localization has been a significant topic in software engineering in the past decades. It localizes a faulty program element based on a set of passing and failing test executions. Since whether a fault could be triggered and detected by a test is related to program semantics, it is crucial to model program semantics in fault localization approaches. Existing approaches either consider the full semantics of the program (e.g., mutation-based fault localization and angelic debugging), leading to scalability issues, or ignore the semantics of the program (e.g., spectrum-based fault localization), leading to imprecise localization results. Our key idea is: by modeling only the correctness of program values but not their full semantics, a balance could be reached between effectiveness and scalability. To realize this idea, we introduce a probabilistic approach to model program semantics and utilize information from static analysis and dynamic execution traces in our modeling. Our approach, SmartFL (SeMantics bAsed pRobabilisTic Fault Localization), is evaluated on a real-world dataset, Defects4J. The top-1 statement-level accuracy of our approach is 21%, which is the best among state-of-the-art methods. The average time cost is 210 seconds per fault while existing methods that capture full semantics are often 10x or more slower.
@inproceedings{ZengWY0Z022,
title = {Fault localization via efficient probabilistic modeling of program semantics},
author = {Muhan Zeng and Yiqian Wu and Zhentao Ye and Yingfei Xiong and Xin Zhang and Lu Zhang},
booktitle = {ICSE},
year = {2022},
doi = {10.1145/3510003.3510073}
}