自动修复工具介绍——SemFix [ICSE 2013]

前言

我现在需要做的事情有：
1）现在都有什么工具（有什么好的idea）；
2）最新的文献，所有2017、18的最新相关文献，都应该好好看一遍。

本文内容

本文旨在讲述现有的自动修复工具，以便对当今修复工具有一个更加全面的了解，重点关注其ieda的来源和内在技术。

emmm, 由于工具太多，不可能写在一篇文章里面，所以本文现将SemFix。

一、SemFix [2013 ICSE, San Francisco, CA, USA]

1.1 文章名

SemFix: Program Repair via Semantic Analysis

作者：Hoang Duong Thien Nguyen; Dawei Qi; Abhik Roychoudhury; Satish Chandra

1.2 一句话概括工作

讲的比较清楚，光读摘要就大概懂了：

Debugging consumes significant time and effort in any major software development project. Moreover, even after the root cause of a bug is identified, fixing the bug is non-trivial.

In this paper, we present an automated repair method based on symbolic execution 符号执行, constraint solving 约束求解 and program synthesis 程序合成.

In our approach, the requirement on the repair code to pass a given set of tests is formulated as a constraint. Such a constraint is then solved by iterating over a layered space of repair expressions 是针对expression的修复？, layered by the complexity of the repair code.这句话没读太懂

1.3 和谁（哪个工具）作比较

We compare our method with recently proposed genetic programming based repair on SIR programs with seeded bugs, as well as fragements of GNU Coreutils with real bugs.
感觉这个fragements of GNU Coreutils值得关注一下。

On these subjects, our approach reports a higher success-rate than genetic programming based repair, and produce a repair faster.

1.4 idea来源

这个就得看related work了，还有Introduction也要看看。

1) Not surprisingly, researchers have recently started looking into automated program repair tools.
[1] Y. Wei, Y. Pei, C. A. Furia, L. S. Silva, S. Buchholz, B. Meyer, and A. Zeller, “Automated fixing of programs with contracts,” in ISSTA, 2010.
[2] W. Weimer, T. Nguyen, C. Le Goues, and S. Forrest, “Automatically finding patches using genetic programming,” in ICSE, 2009.
[3] D. Gopinath, M. Malik, and S. Khurshid, “Specification-based program repair using SAT,” in TACAS, 2011.

2) One of the most successful techniques in recent work that works on general programs is based on syntactic search.
这里解释genprog的原理解释的挺好的。

3) our idea is a combination of three existing techniques:
- fault localization [9]
a statistic fault isolation tool
- statement level specification inference [10]
angelic debugging
- program synthesis [11]
use component-based synthesis idea

[9] B. Liblit, A. Aiken, A. X. Zheng, and M. I. Jordan, “Bug isolation via remote program sampling,” in PLDI, 2003.
[10] S. Chandra, E. Torlak, S. Barman, and R. Bodik, “Angelic debugging,” in ICSE, 2011.
[11] S. Jha, S. Gulwani, S. Seshia, and A. Tiwari, “Oracle-guided component-based program synthesis,” in ICSE, 2010.

the state-of-the-art SMT solvers and program synthesis engines
KLEE [14] is employed for generating repair constraints. KLEE is a static symbolic execution engine which is mainly used for generating high coverage test suites and finding bugs.

1.5 缺陷定位，语句选择策略

Our core program repair then scans through the statement list from the most suspicious one to the least suspicious one until a successful repair is generated.

We first employ Tarantula fault localization [13] for the buggy program using the given test suite.