在軟體除錯領域中，許多自動化除錯方式被提出來減少軟體除錯所需耗費的時間。程式碼覆蓋度在尋找可能包含錯誤的程式碼被認可為最有效的一項軟體除錯技術。然而，程式設計者仍需花費大量時間來檢驗程式碼中的每一個變數之狀態。在我們先前的研究中，提出了一個新的軟體除錯技術，稱為程式狀態覆蓋度。但由於先前的程式狀態覆蓋度技術建立於程式碼覆蓋度的基礎之上，其效能仍受程式碼覆蓋度技術所限制。因此，本研究根據先前程式狀態覆蓋度技術的基礎，進一步提供一個以程式切片為依據的方法來改進原本的程式碼覆蓋度技術，稱為優先權判斷器。優先權判斷器協助程式設計者找出在錯誤程式中與錯誤有最高相關度的程式狀態。改進後的程式碼覆蓋度技術首先利用大量測式輸入，包含成功與失敗輸入，與在程式碼中的分支判斷前插入檢查點的修改後程式一起執行，利用一個統計的機率計算公式，計算得到和程式錯誤相關的程式狀態，再利用優先權判斷器來找出這些狀態中與錯誤有最高相關度的程式狀態。利用此高度可疑的程式狀態來加速軟體除錯的速度。我們使用公認的測試程式來驗證我們改進後的方法。實驗結果顯示，程式碼覆蓋度有效地在３６％的程式中準確找到程式的錯誤，先前的程式狀態覆蓋度提高至３９％，而改進後的程式狀態覆蓋度技術進一步提升到４３％，分別為１９％與１０％的改進效率。

Lots of fault localization techniques have been developed to reduce the time in debugging a faulty program. The technique of code coverage has been recognized by its effectiveness in identifying suspicious statements that may contain the fault. However, a programmer still needs to manually examine each variable referenced in a suspicious statement and such a process can become extremely time-consuming.

In our previous work, we proposed a novel technique called state coverage to significantly reduce the time in examining variables. However, the previous state coverage was built on top of code coverage so that its improvement is limited. In this paper, we further propose a slice-based approach to enhance state coverage. We first insert a set of checkpoints to record the state of each variable referenced in a branching statement. We next execute the faulty program by a test suite consisting of both passed and failed cases. A state is statistically considered to be more suspicious if it appears more in failed cases and less in passed cases. State coverage will then elect the program state having highest relativity against the fault. We implemented both code coverage and state coverage in a debugging tool and used a commonly-used benchmark consisting of 61 faulty programs to evaluate their performance. For 49% of these programs, their faults are within 20 statements of the most suspicious statement identified by code coverage. On the other hand, state coverage increases this ratio to 82%, a 67% performance improvement.

References

[1] H. Agrawal and J. Horgan. Dynamic Program Slicing. In Proceedings of ACM SIGPLAN 1990 Conference on Programming Language Design and Implementation (PLDI), pages 246–256, 1990.
[2] H. Agrawal, J. Horgan, S. London, and W.Wong. Fault Localization Using Execution Slices and Dataflow Tests. In Proceedings of the Sixth IEEE Software Reliability Engineering, pages 143–151, 1995.
[3] H. Cleve and A. Zeller. Locating Causes of Program Failures. In Proceedings of 27th International Conference on Software Engineering (ICSE), pages 342–351, 2005.
[4] gcov: A Test Coverage Program. http://gcc.gnu.org/onlinedocs/gcc-3.0/gcc 8.html.
[5] CodeSurfer: A Code Browser that Understands Pointers, Indirect Function Calls, and Whole-Program Effects.
http://www.grammatech.com/products/codesurfer/overview.html.
[6] M. J. Harrold, G. Rothermel, K. Sayre, R.Wu, and L. Yi. An Empirical Investigation of the Relationship Between Spectra Diferences and Regression Faults. Journal of Software Testing, Verification, and Reliability, 10(3):171–194, 2000.
[7] M. Hutchins, H. Foster, T. Goraida, and T. Ostrand. Experiments of the Effectiveness of Dataflow and Controlflow-based Test Adequacy Criteria. In Proceedings of 16th International Conference on Software Engineering (ICSE), pages 191–200, 1994.
[8] J. Jones and M. J. Harrold. Empirical Evaluation of the Tarantula Automatic Fault-Localization Technique. In Proceedings of the 20th IEEE/ACM International Conference
on Automated Software Engineering, pages 273–282, 2005.
[9] J. Jones, M. J. Harrold, and J. Stasko. Visualization of Test Information to Assist Fault Localization. In Proceedings of 24th International Conference on Software
Engineering (ICSE), pages 467–477, 2002.
[10] B. Korel and J. Laski. Dynamic Slicing of Computer Programs. The Journal of Systems and Software, 13(3):187–195, 1990.
[11] X. Z. N. Gupta, H. He and R. Gupta. Locating Faulty Code Using Failure-inducing Chops. In Proceedings of the 20th IEEE/ACM International Conference on Automated Software Engineering, pages 263–272, 2005.
[12] M. Renieris and S. Reiss. Fault Localization with Nearest Neighbor Queries. In Proceedings of the 18th IEEE/ACM International Conference on Automated Software
Engineering, pages 30–39, 2003.
[13] M. Weiser. Program Slicing. In Proceedings of the 5th International Conference on Software Engineering, pages 439–449, 1981.
[14] M. Weiser. Program Slicing. IEEE Transactions on Software Engineering, SE-10(4):352–357, 1982.
[15] N. G. X. Zhang, H. He and R. Gupta. Experimental Evaluation of Using Dynamic Slices for Fault Location. In Proceedings of International Symposium on Automated Analysis-driven Debugging, pages 33–42, 2005.
[16] xSlice: A Tool for Program Debugging. http://xsuds.argreenhouse.com/htmlman/coverpage.html.
[17] A. Zeller. Yesterday, My Program Worked. Today, It Does Not. Why? In Proceedings of ACM SIGSOFT International Symposium on Foundations of Software Engineering, pages 253–267, 1999.
[18] A. Zeller. Isolating Cause-Effect Chains from Computer Programs. In Proceedings of ACM SIGSOFT International Symposium on Foundations of Software Engineering, pages 1–10, 2002.
[19] A. Zeller and R. Hildebrandt. Simplifying and Isolating Failure-Inducing Input. IEEE Transactions on Software Engineering, 28(2):183–200, 2002.
[20] T.-Y. Huang, P.-C. Chao, C.-H. Tsai, and H.-A. Chen. Automated Fault Localization with Statistically Suspicious Program States. Proceedings of the 2007 ACM SIGPLAN/SIGBED Conference on Languages, Compilers, and Tools, pages 11–20,
2007.