一句话：提出基于语义谱的故障定位框架 SemLoc，将推断的语义不变式索引到程序结构，大幅缩小候选故障行范围。
现有故障定位技术通常借助结构代理（如覆盖率谱）把失败与执行行为关联起来，但当失败源于语义意图的违背——例如数值不变式、值关系、状态或时序一致性——而不改变执行结构时，这类代理便会失效。本文提出 SemLoc，一个以程序结构为锚点的语义谱故障定位框架。其核心思想是：语义属性可以被推断出来并显式地索引到程序结构上。SemLoc 首先从代码中推断领域特定约束，将其索引到函数、基本块与数据流上，并在运行时对约束求值以找出被违反的不变式；随后利用反事实验证剪除不正确或不完整的推断约束，从而精化定位结果。初步结果显示，SemLoc 将候选故障行减少 74.4%，相比基于谱的故障定位减少 5.2 倍，相比 delta debugging 减少 6.2 倍，并在所有评估对象上匹配真实故障位置。该工作自然可推广到基于数据特征、值分布或学习表示的谱。
Fault localization identifies program locations responsible for observed failures. Existing techniques often rely on structural proxies to correlate failures with execution behavior. Such proxies collapse when failures arise from violations of semantic intent, such as numeric invariants, value relations, and state or temporal consistency, without altering execution structure. In this paper, we propose SemLoc, a fault localization framework based on semantic spectra anchored to program structures. The key essence is that semantic properties can be inferred and explicitly indexed to program structure. SemLoc first infers domain-specific constraints from code, indexes them across functions, blocks, and dataflows, and evaluates them at runtime to identify violated invariants. It then applies counterfactual verification to refine localization by pruning inferred constraints that are incorrect or incomplete. Our preliminary results indicate that SemLoc reduces the candidate faulty lines by 74.4%, corresponding to 5.2× reduction compared with spectrum-based fault localization and 6.2× reduction compared with delta debugging, while matching the ground-truth faulty locations on all evaluated subjects. The investigation of semantic spectra indexed to program structure naturally generalizes to future spectra based on data characteristics, value distributions, or learned representations.