Embed Size (px)
DESCRIPTION
Dongsun's ICSE 2013 Presentation. ACM SIGSOFT Distinguished Paper Award Winner!
Citation preview
Automatic Patch Generation Learned from Human-Written Patches
Dongsun Kim, Jaechang Nam, Jaewoo Song, and Sunghun KimThe Hong Kong University of Science and Technology, China
24 May 2013
the 35th International Conference on Software Engineering (ICSE 2013)
2
Repair
2
Repair
2
Repair GenProgGenProg
3
GenProg
C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.
3
GenProgState-of-the-art
C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.
3
GenProgState-of-the-artGenetic Programming
C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.
3
GenProgState-of-the-artGenetic ProgrammingRandom Mutation
C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.
3
GenProgState-of-the-artGenetic ProgrammingRandom MutationSystematically Evaluated
C. Le Goues, M. Dewey-Vogt, S. Forrest, and W. Weimer, “A systematic study of automated program repair: Fixing 55 out of 105 bugs for $8 each,” in ICSE ’12.
4
Buggy Code
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
4
in Interpreter.java reported as Mozilla Bug #76683
Buggy Code
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
4
in Interpreter.java reported as Mozilla Bug #76683
Buggy Code
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
4
in Interpreter.java reported as Mozilla Bug #76683
Null Pointer Exception
Buggy Code
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
5
GenProg repairs bugs
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�
�
5
GenProg repairs bugs
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
Buggy Code
GenProg
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�
�
5
GenProg repairs bugs
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
Buggy Code
GenProg
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�
�
5
GenProg repairs bugs
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
Buggy Code
GenProg
This patch passes ALL test cases.
6
GenProg repairs bugs1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�
�
6
GenProg repairs bugs1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
6
GenProg repairs bugs1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�deleted.�1507� }�1508� state.parenCount�=�num;�
�
7
Would you accept?
7
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�
�
Would you accept?
7
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�
�
Would you accept?
7
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�
�
Would you accept?
17 Students68 Developers
8
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�
�
Would you accept?
17 Students68 Developers
8
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
�
�
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502 ����� � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� {�1506� � //�do�nothing.�1507� }�1508� state.parenCount�=�num;�
�
Would you accept?
9.4%
90.6%17 Students68 Developers
9
9
9
•Random
9
•Random•Unnatural
9
•Random•Unnatural•Harder to understand
10
10
10
RandomEvolution
10
RandomEvolution
Explores the large search space
10
RandomEvolution
Explores the large search spacebut sometimes
producesrandom results
10
RandomEvolution
IntelligentDesign
Explores the large search spacebut sometimes
producesrandom results
10
RandomEvolution
IntelligentDesign
Explores the large search space Leverages human
knowledgebut sometimes produces
random results
11
Human-written Patches
11
Human-written PatchesReadable
11
Human-written PatchesReadableNatural
11
Human-written PatchesReadableNaturalEasy to understand
11
Human-written PatchesReadableNaturalEasy to understand
We can learn how to generate patches from human knowledge.
12
12
JDT
12
>60,000Patches
JDT
12
ManualClassification
>60,000Patches
JDT
12
ManualClassification
# p
atch
es
Patterns
>60,000Patches
JDT
12
ManualClassification
# p
atch
es
Patterns
>60,000Patches
JDT
12
ManualClassification
# p
atch
es
Patterns
Top frequent patterns account for >20~30%
>60,000Patches
JDT
13
Common Fix PatternsAltering method parameters
obj.method(v1,v2)0→0obj.method(v1,v3)
Altering method parameters
obj.method(v1,v2)0→0obj.method(v1,v3)
13
Common Fix PatternsAdding a checker
obj.m1())→)if(obj'!='null)){obj.m1()}
Adding a checker
obj.m1())→)if(obj'!='null)){obj.m1()}
14
PAR
Pattern-based Automatic Program Repair
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
15
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
15
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
Human Knowledge
16
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
Using Human Knowledge
for patch generation
16
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
Fix Templates
Using Human Knowledge
for patch generation
16
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
Fix TemplatesProgram Edit Script
Using Human Knowledge
for patch generation
16
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
Fix TemplatesProgram Edit Script
Using Human Knowledge
for patch generation
10
16
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
Fix TemplatesProgram Edit Script
Manually created from fix patterns
Using Human Knowledge
for patch generation
10
16
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
Fix TemplatesProgram Edit Script
Manually created from fix patternsHighly reusable
Using Human Knowledge
for patch generation
10
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
17
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
18
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Fault Localization
19
Fault Locations
J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.
19
TP TF
Fault Locations
J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.
19
TP TF
Fault Locations
J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.
19
TP TF
Fault Locations
J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.
19
TP TF
Fault Locations
J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.
19
TP TF
Fault Locations
J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.
19
TP TF
Fault Locations
Faultlocations
J. A. Jones, M. J. Harrold, and J. Stasko, “Visualization of test information to assist fault localization,” in Proceedings of the 24th International Conference on Software Engineering, New York, NY, USA, 2002, pp. 467–477.
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
20
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Fault Localization
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
21
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
22
Template-basedPatch Candidate Generation
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
Fix Template
Patch Candidate
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMON
Fault Location
23
How a Fix Template works
23
How a Fix Template works
23
How a Fix Template works
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
23
How a Fix Template works
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
23
How a Fix Template works
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
23
How a Fix Template works
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
23
AST Analysis→Collects necessary AST nodes
How a Fix Template works
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
23
AST Analysis→Collects necessary AST nodes
Context Check→Examines applicability
How a Fix Template works
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
23
AST Analysis→Collects necessary AST nodes
Context Check→Examines applicability
Program Editing→Modifies the source code
How a Fix Template works
Using a Fix Template: An Example
24
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
Using a Fix Template: An Example
24
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker
Using a Fix Template: An Example
24
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker
Using a Fix Template: An Example
24
obj ref.: state, parens[i], ...
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker
Using a Fix Template: An Example
24
obj ref.: state, parens[i], ...
Check obj ref.: PASS
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker
Using a Fix Template: An Example
24
obj ref.: state, parens[i], ...
Check obj ref.: PASS
Edit: Insert ... ... + if( ) { state.parens[i].length = 0; + } ... ...
state != null && state.parens[i] != null
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker
Using a Fix Template: An Example
24
obj ref.: state, parens[i], ...
Check obj ref.: PASS
Edit: Insert ... ... + if( ) { state.parens[i].length = 0; + } ... ...
state != null && state.parens[i] != null
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker
Using a Fix Template: An Example
24
obj ref.: state, parens[i], ...
Check obj ref.: PASS
Edit: Insert ... ... + if( ) { state.parens[i].length = 0; + } ... ...
state != null && state.parens[i] != null
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 // deleted. 1507 } 1508 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 if( state != null && state.parens[i] != null) 1507 state.parens[i].length = 0; 1508 } 1509 state.parenCount = num;
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+Null Pointer Checker
Using a Fix Template: An Example
24
obj ref.: state, parens[i], ...
Check obj ref.: PASS
Edit: Insert ... ... + if( ) { state.parens[i].length = 0; + } ... ...
state != null && state.parens[i] != null
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 // deleted. 1507 } 1508 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 if( state != null && state.parens[i] != null) 1507 state.parens[i].length = 0; 1508 } 1509 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 // deleted. 1507 } 1508 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 state.parens[i].length = 0; 1506 state.parenCount = num;
1500 num = state.parenCount; 1501 int kidMatch = matchRENodes(state, (RENode)ren.kid, 1502 stop, index); 1503 if (kidMatch != -1) return kidMatch; 1504 for (int i = num; i < state.parenCount; i++) 1505 { 1506 if( state != null && state.parens[i] != null) 1507 state.parens[i].length = 0; 1508 } 1509 state.parenCount = num;
1500� num�=�state.parenCount;�1501� int�kidMatch�=�matchRENodes(state,�(RENode)ren.kid,�1502������ � � � � stop,�index);�1503� if�(kidMatch�!=�Ş1)�return�kidMatch;�1504� for�(int�i�=�num;�i�<�state.parenCount;�i++)�1505� � state.parens[i].length�=�0;�1506� state.parenCount�=�num;�
25
List of Templates
25
List of Templates
Parameter Replacer
Method Replacer
Parameter Adder and Remover
Expression Replacer
Expression Adder and Remover
Object Initializer
Range Checker
Collection Size Checker
Null Pointer Checker
Class Cast Checker
26
Creating Patch Candidates
26
Creating Patch Candidates
26
Fault location #1
Fault location #2
Fault location #3
Fault location #4
Fault location #N
...
Creating Patch Candidates
26
Fault location #1
Fault location #2
Fault location #3
Fault location #4
Fault location #N
...
Creating Patch Candidates
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
...$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
Fix Templates
26
Fault location #1
Fault location #2
Fault location #3
Fault location #4
Fault location #N
...
Creating Patch Candidates
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
...$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
Fix Templates
...
PatchCandidates
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
27
Template-basedPatch Candidate Generation
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
Fix Template
Patch Candidate
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMON
Fault Location
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
28
Patch Evaluation
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
29
Patch Evaluation
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
29
Patch Evaluation
T Repaired
TestCases
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
29
Patch Evaluation
T Repaired
TestCases
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
29
Patch Evaluation
T Repaired
PassTestCases
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
29
Patch Evaluation
T Repaired
T Repaired
PassTestCases
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
29
Patch Evaluation
T Repaired
T Repaired
Pass
Fail
TestCases
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
29
Patch Evaluation
T Repaired
T Repaired
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
Fix Template
Patch Candidate
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMON
Fault Location
Pass
Fail
TestCases
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
30
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
30
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
30
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
30
31
Evaluation: Experiment Design
31
Evaluation: Experiment Design
31
Evaluation: Experiment Design
PAR GenPro
31
Evaluation: Experiment Design
PAR GenPro
31
Evaluation: Experiment Design
PAR GenPro
31
Evaluation: Experiment Design
PAR GenPro
# #
32
RQ1(Fixability): How many bugs are fixed successfully?
RQ2(Acceptability): Which approach can generate more acceptable bug patches?
Evaluation: Research Questions
#
33
Subject # bugs LOC # test cases
Rhino 17 51,001 5,578
AspectJ 18 180,394 1,602
log4j 15 27,855 705
Math 29 121,168 3,538
Lang 20 54,537 2,051
Collections 20 48,049 11,577
Total 119 351,406 25,051
Experiment Subjects
34
RQ1: Fixability
34
RQ1: Fixability
PAR GenProg06
12182430
34
RQ1: Fixability
PAR GenProg06
12182430
27
34
RQ1: Fixability
PAR GenProg06
12182430
27
16
34
RQ1: Fixability
PAR GenProg06
12182430
27
16PAR GenProg
27 16>
35
RQ2: Acceptability
35
RQ2: Acceptability
User Study #1: Ranking between PAR and GenProg
36
36
PAR
36
PAR GenProg
36
PAR GenProg
5
37
User Study #1Ranking Patches
37
User Study #1Bug DescriptionRanking Patches
37
User Study #1Bug Description
Buggy Code
Ranking Patches
37
User Study #1Bug Description
Buggy Code
Anonymized Patch #1
Ranking Patches
37
User Study #1Bug Description
Buggy Code
Anonymized Patch #1
Anonymized Patch #2
Ranking Patches
37
User Study #1Bug Description
Buggy Code
Anonymized Patch #1
Anonymized Patch #2
Anonymized Patch #3
Ranking Patches
37
User Study #1Bug Description
Buggy Code
Anonymized Patch #1
Anonymized Patch #2
Anonymized Patch #3
Ranking Patches
37
User Study #1Bug Description
Buggy Code
Anonymized Patch #1
Anonymized Patch #2
Anonymized Patch #3
Rank patches
17 Students68 Developers
Ranking Patches
37
User Study #1Bug Description
Buggy Code
Anonymized Patch #1
Anonymized Patch #2
Anonymized Patch #3
2
1
3
Rank patches
17 Students68 Developers
Ranking Patches
User Study #1: ResultsStudent group (avg. ranking)
38
(the lower the better)Developer group (avg. ranking)
(the lower the better)
User Study #1: ResultsStudent group (avg. ranking)
38
0
0.75
1.5
2.25
3
1.72 1.57
2.67
PAR GenProgHuman
(the lower the better)Developer group (avg. ranking)
(the lower the better)
User Study #1: ResultsStudent group (avg. ranking)
38
0
0.75
1.5
2.25
3
1.72 1.57
2.67
PAR GenProgHuman
(the lower the better)Developer group (avg. ranking)
(the lower the better)
SignificantlyDifferent
User Study #1: ResultsStudent group (avg. ranking)
38
0
0.75
1.5
2.25
3
1.72 1.57
2.67
PAR GenProgHuman
(the lower the better)Developer group (avg. ranking)
1
1.35
1.7
2.05
2.4
1.81 1.82
2.36
(the lower the better)
PARGenPro
gHuman
SignificantlyDifferent
User Study #1: ResultsStudent group (avg. ranking)
38
0
0.75
1.5
2.25
3
1.72 1.57
2.67
PAR GenProgHuman
(the lower the better)Developer group (avg. ranking)
1
1.35
1.7
2.05
2.4
1.81 1.82
2.36
(the lower the better)
PARGenPro
gHuman
SignificantlyDifferent
SignificantlyDifferent
User Study #1: ResultsStudent group (avg. ranking)
38
0
0.75
1.5
2.25
3
1.72 1.57
2.67
PAR GenProgHuman
(the lower the better)Developer group (avg. ranking)
1
1.35
1.7
2.05
2.4
1.81 1.82
2.36
(the lower the better)
PARGenPro
gHuman
SignificantlyDifferent
SignificantlyDifferentPAR generates better ranking
patches than GenProg
39
RQ2: Acceptability
User Study #1: Ranking between PAR and GenProg
39
RQ2: Acceptability
User Study #1: Ranking between PAR and GenProg
User Study #2: Pair-wise Comparison between
Human-written PatchesVs.
PAR or GenProg
40
40
PAR
27
40
PAR
27
GenProg
16
41
User Study #2Pair-wise Comparison
41
User Study #2Bug DescriptionPair-wise Comparison
41
User Study #2Bug Description
Buggy Code
Pair-wise Comparison
41
User Study #2Bug Description
Buggy Code
Anonymized Patch #1
Pair-wise Comparison
41
User Study #2Bug Description
Buggy Code
Anonymized Patch #1
Anonymized Patch #2
Pair-wise Comparison
41
User Study #2Bug Description
Buggy Code
Anonymized Patch #1
Anonymized Patch #2
Choose acceptablepatch(es)
72 Students96 Developers
Pair-wise Comparison
41
User Study #2Bug Description
Buggy Code
Anonymized Patch #1
Anonymized Patch #2
Patch #1 Patch #2
Both Not sure
Choose acceptablepatch(es)
72 Students96 Developers
Pair-wise Comparison
User Study #2: Results
GenProg
42
PAR
User Study #2: Results
GenProg
42
0
10
20
30
40
21
28
37
14resp
onse
s (%
)
PAR HumanBoth NotSure
PAR
User Study #2: Results
GenProg
42
0
10
20
30
40
21
28
37
14resp
onse
s (%
)
PAR HumanBoth NotSure
PAR
0
15
30
45
60
20
12
51
17re
spon
ses
(%)
GenProg HumanBoth NotSure
User Study #2: Results
GenProg
42
0
10
20
30
40
21
28
37
14resp
onse
s (%
)
PAR HumanBoth NotSure
PAR
0
15
30
45
60
20
12
51
17re
spon
ses
(%)
GenProg HumanBoth NotSure
49%
User Study #2: Results
GenProg
42
0
10
20
30
40
21
28
37
14resp
onse
s (%
)
PAR HumanBoth NotSure
PAR
0
15
30
45
60
20
12
51
17re
spon
ses
(%)
GenProg HumanBoth NotSure
49%
32%
User Study #2: Results
GenProg
42
0
10
20
30
40
21
28
37
14resp
onse
s (%
)
PAR HumanBoth NotSure
PAR
0
15
30
45
60
20
12
51
17re
spon
ses
(%)
GenProg HumanBoth NotSure
49%
32%PAR generates more
acceptable patches than GenProg
43
Limitations
• Fix templates are written manually.• But it is one-time cost, these are highly reusable.
• We entirely re-implemented GenProg by Java.
• All subjects are collected from open source projects.
• Some participants may not be thoroughly qualified.
44
Summary
44
Summary
Observed common patches
# p
atch
es
Patterns
44
Summary
Observed common patches
# p
atch
es
Patterns
Fix Templates and PARif(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
44
Summary
Can fix more bugs with more acceptability
Observed common patches
# p
atch
es
Patterns
Fix Templates and PARif(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
0
6
12
18
24
30
16
27
0
0.75
1.5
2.25
3
1
1.35
1.7
2.05
2.4
0
10
20
30
40
PAR HumanBoth NotSure
0
15
30
45
60
GenProg HumanBoth NotSure
49%
32%
45
Future Work
Automatic Fix Template Identification• More templates can fix more bugs.
More Test Cases• More test cases may lead us to better patches.
46
Acknowledgement
Special Thanks to:
Westley Weimer, Claire Le Goues,
Thomas Zimmermann, and Christian Bird
47
Summary
Fix Templates and PAR
Can fix more bugs with more acceptability
Observed common patches
# p
atch
es
Patterns
if(lhs == DBL_MRK) lhs = ...; if(lhs == undefined) { lhs = strings[pc + 1]; } Scriptable calleeScope = ...;
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Buggy Program
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
(a) Fault Localization
$VJDGVIDVGIDVOGMJONDMDVJDGI��O+6GOMNIONDVMGI�OMDVGOIMVGO-GVIVDGIVGDIVGDVGONIMGDVOM+
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO-++
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
GVIVDGIVGDIVGDVGONIMGDVOM
(b) Template-based Patch Candidate Generation
Fail
Pass
(c) Patch Evaluation
T Repaired
Fix Template
Patch Candidate
VGDJNOMODNZMHIUOZMHIVGMON�
DDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
VGDJNOMODNZMHIUOZMHIVGMONDDKOMDOMODMIO�GVNOMKVGONMIGVDI
$VJDGVIDVGIDVOGMJONDMDVJDGI��O
6GOMNIONDVMGI�OMDVGOIMVGO
GVIVDGIVGDIVGDVGONIMGDVOM
ONDVMIONMVGDONIMOGNVDMIONGVDM
Repaired Program
Fault Location
0
6
12
18
24
30
16
27
0
0.75
1.5
2.25
3
1
1.35
1.7
2.05
2.4
0
10
20
30
40
PAR HumanBoth NotSure
0
15
30
45
60
GenProg HumanBoth NotSure
49%
32%
