2017年自动修复概述——Automatic Software Repair： A Survey [来自软件工程顶刊 TSE 2017]

前言

本文旨在介绍2017年自动修复概述——Automatic Software Repair: A Survey [来自软件工程顶刊 TSE 2017]。

1 按照惯例，基本信息

讲道理，这篇文章我之前写论文的时候引用过，所以有点印象。

作者：Luca Gazzola, Daniela Micucci Member, IEEE and Leonardo Mariani Senior Member, IEEE

引用格式：Gazzola L, Micucci D, Mariani L. Automatic software repair: A survey[J]. IEEE Transactions on Software Engineering, 2017.

2 摘要说什么了

1）温故知新
Despite their growing complexity and increasing size, modern software applications must satisfy strict release requirements
that impose short bug fixing and maintenance cycles, putting significant pressure on the developers who are responsible for timely
producing high-quality software.

原来是因为现代的软件应用需要满足严格的发布要求、规范（impose short bug fixing and maintenance cycles 导致非常短的缺陷修复和维护周期），这样的话程序员压力很大，所以，APR出现了。

2）作者对现在缺陷修复的理解：
To reduce developers workload, repairing and healing techniques have been extensively investigated
as solutions for efficiently repairing and maintaining software in the last few years. In particular, repairing solutions have been able to
automatically produce useful fixes for several classes of bugs that might be present in software programs.
A range of algorithms, techniques, and heuristics have been integrated, experimented, and studied, producing a heterogeneous and
articulated research framework where automatic repair techniques are proliferating

疑问：为什么是a range of algorithms, techniques, and heuristics, 为什么heuristic 和 techniques，algorithms并列呢，讲道理heuristic是techniques，algorithms下面的一个分支吧。？

没想到还有 healing techniques。

VERB 激增；剧增
If things proliferate, they increase in number very quickly.

可以，这个词可以。

articulated
英 [ɑ:ˈtɪkjuleɪtɪd] 美 [ɑ:rˈtɪkjuleɪtɪd]
n.& adj. 铰接（的），枢接（的），有关节（的）
v. 清楚地表达( articulate的过去式和过去分词 );形成关节;与…合成整体

(BrE) (of a vehicle 车辆) 铰接的
with two or more sections joined together in a way that makes it easier to turn corners
an articulated lorry/truck
铰接式卡车

heterogeneous
英 [ˌhetərəˈdʒi:niəs] 美 [ˌhɛtərəˈdʒiniəs, -ˈdʒinjəs]
adj.
各种各样的;成分混杂的

3 作者是怎么找到“软件缺陷带来巨大损失”的参考文献的？

For instance, recent studies
showed that debugging activities often account for about
50% of the overall development cost of software products [1], [2].

[1] T. Britton, L. Jeng, G. Carver, and P. Cheak, “Reversible debugging software - quantify the time and cost saved using reversible debuggers,” 2013.
[2] Undo Software, “Increasing software development productivity with reversible debugging,” Undo Software, Tech. Rep. white paper, 2014

我觉得作者应该是搜索关键字：“software” “debugging” “cost”

但是为什么两篇文章都有个“reversible”呢？

reversible
英 [rɪˈvɜ:səbl] 美 [rɪˈvɜ:rsəbl]
adj.
可逆的; 步骤、行动或疾病可恢复原状的; 可医治的;衣服、材料等可翻转的

4 现在的自动修复大概都这么几个步骤：

In particular, the debugging process requires analyzing and
understanding failed executions, identifying the causes of
the failures, implementing fixes, and validating that the
fixed program works correctly, that is, the problem has been
fixed without introducing any side effect [3], [4], [5]. Most
of these activities are executed manually or with partial tool
support.

1) understanding failed executions,
2) identifying the root causes,
3) implementing fixes,
4) validating that the fixed program works correctly. (make sure that the fixes do not introduce any side effects)

都是这四步，然而第一步，理解错误的执行信息，我感觉一般都是缺陷定位SFL。

[3] M. A. Mullerburg, “The role of debugging within software en- ¨
gineering environments,” ACM SIGSOFT Software Engineering
Notes, vol. 8, no. 4, pp. 81–90, 1983, doi: 10.1145/1006147.1006165.
[4] B. Hailpern and S. Padmanabhan, “Software debugging, testing,
and verification,” IBM Systems Journal, vol. 41, no. 1, pp. 4–12,
2002, doi: 10.1147/sj.411.0004.
[5] A. Zeller, Why Programs Fail, Second Edition: A Guide to Systematic
Debugging, 2nd ed. Morgan Kaufmann, 2009.

感觉这个[3, 4, 5]我没太明白，看来三个都和side effects有关。而不是APR有关。

5 什么是delta debugging？感觉总是看到

Techniques that identify specific inputs and specific states that may trigger failures are often based on the wellknown Delta Debugging technique [9]. The intuition is that by iteratively refining and reducing the input [10] and the state space [11], it should be possible to identify the smallest input and the smallest portion of the application state that cannot be eliminated to trigger the failure. This information is relevant to understand the conditions that may trigger failures

这里解释的不错啊。

[9] A. Zeller, “Yesterday, my program worked. Today, it does not. Why?” in Proceedings of the Joint Meeting of the European Software Engineering Conference and the Symposium on Foundations of Software Engineering (ESEC/FSE), 1999, pp. 253–267, doi: 10.1007/3- 540-48166-4 16.
[10] A. Zeller and R. Hildebrandt, “Simplifying and isolating failure inducing input,” IEEE Transactions on Software Engineering, vol. 28, no. 2, pp. 183–200, 2002, doi: 10.1109/32.988498.

[11] A. Zeller, “Isolating cause-effect chains from computer programs,” in Proceedings of the Symposium on Foundations of Software Engineering (FSE), 2002, pp. 1–10, doi: 10.1145/587051.587053.

我对这篇文章很感兴趣，但是我不确定这篇文章真的能够将这个错误链很好的分开？？？
好奇。

6 文中提到的anomaly detection techniques 是啥？

Finally, anomaly detection techniques can detect the
operations that are executed by an application during failures but not during correct executions. These operations
may explain why and how an application failed. Anomaly
detection techniques usually exploit specification mining
approaches [16], [17], [18], [19] to automatically generate
models that represent the legal behavior of an application,
and then use these models to analyze the failed executions
and determine the anomalous events [12], [13], [14], [15].

anomaly
英 [əˈnɒməli] 美 [əˈnɑ:məli]
n.
异常现象;异常，反常;不规则;畸形人（物）
N-COUNT 反常（事物）；异常（现象）
If something is an anomaly, it is different from what is usual or expected.

[16] M. D. Ernst, J. Cockrell, W. G. Griswold, and D. Notkin, “Dynamically discovering likely program invariants to support program evolution,” IEEE Transactions on Software Engineering (TSE), vol. 27, no. 2, pp. 99–123, 2001, doi: 10.1145/302405.302467.
[17] D. Lorenzoli, L. Mariani, and M. Pezze, “Automatic generation of software behavioral models,” in Proceedings of the International Conference on Software Engineering (ICSE), 2008, pp. 501–510, doi: 10.1145/1368088.1368157.
[18] M. Gabel and Z. Su, “Testing mined specifications,” in Proceedings of the International Symposium on the Foundations of Software Engineering (FSE), 2012, pp. 4:1–4:11, doi: 10.1145/2393596.2393598.
[19] I. Krka, Y. Brun, and N. Medvidovic, “Automatic mining of specifications from invocation traces and method invariants,” in Proceedings of the International Symposium on Foundations of Software Engineering (FSE), 2014, pp. 178–189, doi:10.1145/2635868.2635890.

我经常看到这位 M. D. Ernst，目测软工大牛。
以后记得看一看他们实验室的论文。

[12] L. Mariani and F. Pastore, “Automated identification of failure causes in system logs,” in Proceedings of the International Symposium on Software Reliability Engineering (ISSRE), 2008, pp. 117–126, doi: 0.1109/ISSRE.2008.48.
[13] A. Babenko, L. Mariani, and F. Pastore, “AVA: Automated interpretation of dynamically detected anomalies,” in Proceedings
of the International Symposium on Software Testing and Analysis (ISSTA), 2009, pp. 237–248, doi: 10.1145/1572272.1572300.
[14] L. Mariani, F. Pastore, and M. Pezze, “Dynamic analysis for diagnosing integration faults,” IEEE Transactions on Software Engineering (TSE), vol. 37, no. 4, pp. 486–508, 2011, doi:10.1109/TSE.2010.93.
[15] D. Zuddas, W. Jin, F. Pastore, L. Mariani, and A. Orso, “MIMIC: locating and understanding bugs by analyzing mimicked executions,” in Proceedings of the International Conference on Automated Software Engineering (ASE), 2014, pp. 815–826, 10.1145/2642937.2643014

万万没想到这么多论文，看来学海无涯，自己还得抓紧。

7 APR领域的contributions

The contributions in the area have been preliminary analyzed by Khalilian et al. [32], who compared three repair techniques, and Monperrus et al. [33], [34] who discussed repair and self-healing techniques focusing on the oracle problem.

[32] A. Khalilian, A. Baraani-Dastjerdi, and B. Zamani, “On the evaluation of automatic program repair techniques and tools,” in Proceedings of the Iranian Conference on Electrical Engineering (ICEE), 2016, pp. 61–66, doi: 10.1109/IranianCEE.2016.7585390.
[33] M. Monperrus, “Automatic Software Repair: a Bibliography,” University of Lille, Tech. Rep. hal-01206501, 2015.
[34] M. Monperrus and B. Baudry, “Two Flavors in Automated Software Repair: Rigid Repair and Plastic Repair,” in Dagstuhl Seminar n. 13061 ”Fault Prediction, Localization, and Repair”, 2013.

没想到这些文章竟然讲了APR的意义，我觉得值得一看。

8 文章有36页，5页参考文献，1页开源工具，然而，这么多我一下还是看不完，所以先看一下大概说了啥（从 the rest of the paper is organized as follows. 里面就可以看到）

The paper is organized as follows.

Section 2 describes the procedure we followed to select the papers for this survey and presents statistics about the selected papers.
也就是说了我们这个survey的文章选择和统计。
Section 3 introduces software repair solutions contrasting them with software self-healing solutions.
哦，原来是repair 和 self-healing的比较，我觉得好像之前那篇 Monperrus 的ACM CSUR中的behavioral repair和state repair。？不过我也不确定。
Section 4 introduces a running example, consisting of multiple faulty versions of a same program that are used throughout the paper to illustrate repairing techniques.
一个小例子。估计是方便人理解的
Section 5 presents the fault localization techniques that have been exploited as part of the program repair solutions.
重点讲缺陷定位的
Section 6 presents the algorithms for generating fixes.
自动修复的算法（也就是工具吧）
Section 7 extends the discussion to techniques recommending fixes that can be turned into an actual fix with small manual effort.
这个比较新颖，我之前没看到过这样的话题。
Section 8 presents the main empirical findings that have been obtained so far.
这个说的啥？APR还是FL？
Section 9 discusses open challenges and future research directions.
挑战。
Section 10 provides final remarks.
结论吧。估计还有一些展望。

每个章节大概有重点的看看吧。

9 最后一页，开源工具的地址，有必要提一下

APR开源工具地址

话说我是第一次知道RSRepair原来也叫TrpAutoRepair。

10 section 3

我果然没猜错

Both healing and repairing techniques react to failures by
executing some operations. We distinguish between healing
operations, which are the operations applied at runtime
to turn a failed or a failing execution into a successful
execution, and repair operations, which are the operations
performed on the program source code to remove the fault
that caused a failure

这个healing确实是修复runtime。 done at runtime。

但是，为什么repair techniques是failed execution？？？

疑问

11 section 5：localization

We distinguish two main classes of approaches for the choice of the location: fault localization and fix locus localization.

这个很关键
感觉有点东西，因为这个fix locus localization我从来没看到过。

以后有机会一定要好好研究下

其中，fix locus localization 下面竟然包含了Angelic Fix Localization，这个不是nopol用到的修复吗，而且Nopol还用了SBFL。
感觉得好好研究下。

12 section 6：fix generation

We distinguish two main classes of approaches depending on the way Prepair is defined and addressed: generate-andvalidate and semantics-driven approaches.

Generate-and-validate approaches produce fixes by defining and exploring a space Srepair of the potential solutions to Prepair (note that Srepair may contain both elements that solve and do not solve Prepair).
Semantics-driven approaches (also known as correct-byconstruction approaches) encode the problem Prepair formally, either explicitly or implicitly, and once they find a solution, the solution is guaranteed to solve Prepair.

13 Generate-and-Validate

14 讲真我只想明白 generate-and-validate 和 semantics-driven 到底啥区别。

前者：主要特征是change operators，有三种——
1）Atomic change operators modify P in a single point；
2）Pre-defined template operators change P according to potentially complex pre-defined patterns. （这让我想到了很多文章，template-based repair，貌似SPR和prophet就是。？）
3）Pre-defined template operators change P according to potentially complex pre-defined patterns.（HDRepair？？？）

Some techniques do not only apply the change operators to P only, but also to the candidate solutions [22], [27], [36], [38], [63], [64], [96], [97]
还有这种操作？
[22] D. Kim, J. Nam, J. Song, and S. Kim, “Automatic patch generation learned from human-written patches,” in Proceedings of the International Conference on Software Engineering (ICSE), 2013, pp. 802–811, doi: 10.1109/ICSE.2013.6606626.
噢噢，原来是par。那还行吧。

15 这里有疑问——可行补丁真的可以simplify the implementation of the actual fix？

Regardless of the need of editing an automatically generated
fix, the availability of an automatic fix already helps developers understanding the fault in the code and simplifies the
implementation of the actual fix.

话是这么说，这个更像是一种intuitively 层面上的思考。
然而，现在不是已经有研究表明，错误的可行补丁会降低程序员修复的效率吗？（忘记哪篇文章了）

16 整理一下文章中罗列出来的工具

6.1.1 Atomic Change Operators
6.1.1.1 General Search-Based Techniques

GenProg [20], [64], [65], [87], [88], [101],
Marriagent [96],
RSRepair [29] ( formerly TrpAutoRepair [106]),
SCRepair [98],
JAFF [63], [99],
pyEDB [27],
MUT-APR [36],
CASC [50], [97], [108],

6.1.1.2 General Brute-Force Techniques

PACHIKA [25],
AE [111],
Kali [110] ,

这种随机地修复，我觉得还得再仔细研究下，不知道和 search-based repair的具体区别在哪？

6.1.2 Pre-Defined Templates
6.1.2.1 Search-Based Techniques for Concurrency Faults

ARC [37], [38]

6.1.2.2 General Brute-Force Techniques

AutoFix-E [92]，
SPR [28]，
Prophet [113], [114]

6.1.2.3 Brute-Force Techniques for Buffer Overflow Faults

PASAN [115],
AutoPAG [117]

6.1.3 Example-Based Templates

History-driven repair [118], PAR [22], Relifix [119], and R2Fix [120].

就知道是HDRepair

6.1.3.1 General Search-Based Techniques

History-driven repair [118], [122]
PAR [22]，
Relifix [119]

6.1.3.2 General Brute-Force Techniques

R2Fix [120]

6.1.3.3 Brute-Force Techniques for Buffer Overflow Faults

CodePhage [24]

17 讲真这是我看过最详细的关于APR自动修复工具的介绍，竟然还有简单易懂的例子？？？！！！震惊，作者太给力了。我觉得很有用。

以后有空，一定要仔细；了解一下啊。

18 来来来 Semantics-Driven Repair 安排一下

6.2.2 General Techniques

SemFix [21]; DirectFix [128]; Angelix [95]; SearchRepair [44]

6.2.3 Wrong Conditions and Missing Preconditions

NOPOL [23], [129] ; Dynamoth [130]; Infinitel [26];

6.2.4 Concurrency Faults

AFix [82]; CFix [131] ; HFix [132]; Surendran et al. [133] ; Axis [135]; Grail [136] ;Lin et al. [137] ; DFixer [53]

6.2.5 HTML Generation Faults

PHPQuickFix

6.2.6 String Sanitization

SemRep [139]; Yu et. al [52], [140]

6.2.7 Access Control Violation

FixMeUp

6.2.8 Memory Leaks

LeakFix [54]

19 看来天下APR工具之多，实在是如天下英雄一般，不乏英才，百花齐放，自己还得很努力的加油

20 小结

有点看累了，36页太多了。

这篇记录（recording）还有待完善吧。

来日方长，但绝无浪费的理由和借口。