Reproducing Failures in Fault Signatures

TL;DR

This paper introduces a method to generate minimal fault signatures from failure locations and source code, enabling easier reproduction and diagnosis of software faults in simplified executable programs.

Contribution

It proposes a novel approach combining static analysis and syntactic patching to create minimal fault signatures that accurately reproduce failures in original programs.

Findings

Fault signatures successfully reproduce original program failures.

Automatic test generation is more effective with fault signatures.

Some failure-inducing inputs transfer directly to original programs.

Abstract

Software often fails in the field, however reproducing and debugging field failures is very challenging: the failure-inducing input may be missing, and the program setup can be complicated and hard to reproduce by the developers. In this paper, we propose to generate fault signatures from the failure locations and the original source code to reproduce the faults in small executable programs. We say that a fault signature reproduces the fault in the original program if the two failed in the same location, triggered the same error conditions after executing the same selective sequences of failure-inducing statements. A fault signature aims to contain only sufficient statements that can reproduce the faults. That way, it provides some context to inform how a fault is developed and also avoids unnecessary complexity and setups that may block fault diagnosis. To compute fault signatures from the failures, we applied a path-sensitive static analysis tool to generate a path that leads to the fault, and then applied an existing syntactic patching tool to convert the path into an executable program. Our evaluation on real-world bugs from Corebench, BugBench, and Manybugs shows that fault signatures can reproduce the fault for the original programs. Because fault signatures are less complex, automatic test input generation tools generated failure-inducing inputs that could not be generated by using the entire programs. Some failure-inducing inputs can be directly transferred to the original programs. Our experimental data are publicly available at https://doi.org/10.5281/zenodo.5430155.