Software Tools Detect Bugs By Inferring Programmer's Intentions

Computer science professor Yuanyuan Zhou and her students have assembled a suite of software tools that can find and correct bugs by inferring the programmer's intentions. The tools draw from observations on how programmers write code.

“Most bug-detection tools require reproduction of bugs during execution,” Zhou said. “The program is slowed down significantly and monitored by these tools, which watch for certain types of abnormal behavior. Most of our tools, however, work by only examining the source code for defects, requiring little effort from programmers.”

Copy-pasted code, for example, often appears in large programs. While saving considerable programming effort, copy-pasted code can be the source of numerous bugs. Zhou's copy-paste tool, called CP-Miner, uses data-mining techniques to find copy-pasted code in the program and examine and correct that code for consistent modifications.

CP-Miner has found many bugs in the latest versions of large open-source software used in the information technology industry, Zhou said. CP-Miner is fast and efficient – it can scan 3-4 million lines of code for copy-paste and related bugs in less than 30 minutes.

Large programs also tend to follow many implicit rules and assumptions, so Zhou and her students developed a related tool, called PR-Miner, to detect when those rules have been broken. Like CP-Miner, PR-Miner is based on data-mining techniques.

“First, we mine the source code for patterns, repetitions and correlations that point to implicit programming rules and assumptions,” Zhou said. “Then we check that those rules and assumptions have not been violated.”

PR-Miner also is very fast and has found many bugs in the latest open-source software. It takes PR-Miner only a few minutes to scan 4 million lines of code.

Not only are their efforts directed toward detecting, diagnosing and fixing bugs, Zhou and her students also are exploring techniques that allow software to survive in the presence of bugs. Rx, for example, is a recovery tool that allows software to survive by treating bugs like allergies.

“If you are allergic to cats, you try to avoid cats,” Zhou said. “In much the same way, Rx is avoidance therapy for software failure. If the software fails, Rx rolls the program back to a recent checkpoint, and re-executes the program in a modified environment.”

A fourth tool, called Triage, diagnoses software failures at the end-user site. Following a human-like diagnosis protocol, Triage rapidly identifies the nature of the problem and provides valuable input to help programmers quickly understand the failure and fix the bug.

“If something bad happens or the software crashes, Triage's diagnosis protocol will start automatically and quickly suggest a temporary fix until programmers can release a fixing patch,” Zhou said.

In addition to being fast and efficient, Zhou's software tools are scalable and can be tailored for specific software programs, including programs running on parallel processors.

The work was funded by the National Science Foundation and the Intel Corp.