Jicer: Simplifying Cooperative Android App Analysis Tasks

In Spectrum-Based Fault Localization (SBFL), a suspiciousness score is assigned to each code element based on test coverage and test outcomes. The scores are then used to rank the code elements relative to each other in order to aid the programmer during the debugging process when seeking the source of a fault. However, probably none of the known SBFL formulae are guaranteed to produce different scores for all the program elements, hence ties emerge between the code elements. Based on our experiments, ties in SBFL are prevalent: in Defects4J, 54-56% of buggy methods are members of ties, i.e., there is at least one other method with the same score in these cases (but typically much more, on average 6), and this inevitably reduces the effectiveness of any SBFL approach. In this work, we present a technique to break ties in such cases based on the so-called method calls frequencies. This counts the number of different contexts of method calls (both as callees and as callers) in failing test cases. The intuition is that if a method appears in many different calling contexts during a failing test case, it will be more suspicious and get a higher rank position compared to other methods with the same scores. This method can be applied to any underlying SBFL formula, and can favourably break the occurring ranks in the ties in many cases. The experimental results show that our novel tie-breaking strategy achieved a significant reduction in both size and number of critical ties in our benchmark. In 72-73% of the cases, the ties were completely eliminated and the average reduction rate was more than 80%.

Method Calls Frequency-Based Tie-Breaking Strategy For Software Fault Localization

Fault localization is one of the most time-consuming and error-prone parts of software debugging. There are several tools for helping developers in the fault localization process, however, they mostly target programs written in Java and C/C++ programming languages. While these tools are splendid on their own, we must not look over the fact that Python is a popular programming language, and still there are a lack of easy-to-use and handy fault localization tools for Python developers. In this paper, we present a tool called "CharmFL" for software fault localization as a plug-in for PyCharm IDE. The tool employs Spectrum-based fault localization (SBFL) to help Python developers automatically analyze their programs and generate useful data at run-time to be used, then to produce a ranked list of potentially faulty program elements (i.e., statements, functions, and classes). Thus, our proposed tool supports different code coverage types with the possibility to investigate these types in a hierarchical approach. The applicability of our tool has been presented by using a set of experimental use cases. The results show that our tool could help developers to efficiently find the locations of different types of faults in their programs.

CharmFL: A Fault Localization Tool for Python

QSES: Quasi-Static Executable Slices

Improving Readability of Scratch Programs with Search-based Refactoring

How does Migrating to Kotlin Impact the Run-time Efficiency of Android Apps?

What do Developers Discuss about Code Comments?

Do Comments follow Commenting Conventions? A Case Study in Java and Python

SecuCheck: Engineering configurable taint analysis for software developers

Towards a Taxonomy of Inline Code Comment Smells

D-REX: Static Detection of Relevant Runtime Exceptions with Location Aware Transformer

Measuring source code conciseness across programming languages using compression

Towards a taxonomy for annotation of data science experiment repositories

Bug prediction is helpful for facilitating bug fixes
and improving the efficiency in software development and maintenance.
In the past decades, researchers have proposed numerous
studies on bug prediction by using code metrics. However, most
of the existing studies use syntax-based metrics, there exists little
work building bug prediction models with semantic metrics from
source code. In this paper, we propose a new model, semantic
dependency graph (SDG), to represent semantic relationships
among source files. Based on the SDG, we formally define a
suite of semantic metrics reflecting semantic characteristics of
a project’s source files. Moreover, we create a tool to automate
the generation of our proposed SDG-based metrics. Through our
experimental studies, we have demonstrated that the SDG-based
semantic metrics are effective for building bug prediction models,
and the SDG-based metrics outperform traditional syntactic
metrics on bug prediction. In addition, models using the SDGbased
metrics could achieve a better prediction performance
than two state-of-the-art models that learn semantic features
automatically. Finally, we have also presented that our approach
is applicable in practice in terms of execution time and space.

Formal Definition and Automatic Generation of Semantic Metrics: An Empirical Study on Bug Prediction

While traditional static analysis---albeit its complexity---is a topic that is well understood, we especially struggle when it comes to implementing its concepts. Designing and modeling software that implements static analysis is a challenging task. However, developing usable static analysis implementations and providing toolboxes to researchers and practitioners is key to advance the overall progress in this field. This paper reports on the lessons learned from developing the PhASAR and Soot static data-flow analysis frameworks. We present some of the key mistakes of our first implementations of PhASAR and their corrections. From those corrections we distill guidelines that will be helpful to static analysis developers and their users. In our work, we identified modularity as the key guiding principle supported---directly or indirectly---by virtually all other guidelines.

Into the Woods: Experiences from Building a Dataflow Analysis Framework for C/C++

Global variables make software systems hard to maintain and debug, and break local reasoning. They also impose a non-trivial challenge to static analysis which needs to model its effects to obtain sound analysis results. However, global variable initialization, codes of corresponding constructors and destructors as well as dynamic library code executed during load and unload not only affect control flows but data flows, too. The PhASAR static data-flow analysis framework does not handle these special cases and also does not provide any functionalities to model the effects of globals. Analysis writers are forced to model the desired effects in an ad-hoc manner increasing an analysis' complexity and imposing an additional repetitive task. In this paper, we present the challenges of modeling globals, elaborate on the impact they have on analysis information, and present a suitable model to capture their effects, allowing for an easier development of global-aware static data-flow analyses. We present an implementation of our model within the PhASAR framework and show its usefulness for an IDE-based linear-constant propagation that crucially requires correct modeling of globals for correctness.

Modeling the Effects of Global Variables in Data-Flow Analysis for C/C++

Automated source code summarization is a task that generates summarized information about the purpose, usage, and--or implementation of methods and classes to support understanding of these code entities. Multiple approaches and techniques have been proposed for supervised and unsupervised learning in code summarization, however, they were mostly focused on generating a summary for a piece of code. In addition, very few works have leveraged unofficial documentation.
This paper proposes an automatic and novel approach for summarizing Android API methods discussed in Stack Overflow that we consider as unofficial documentation in this research. Our approach takes the API method's name as an input and generates a natural language summary based on Stack Overflow discussions of that API method. We have conducted a survey that involves 16 Android developers to evaluate the quality of our automatically generated summaries and compare them with the official Android documentation.
Our results demonstrate that while developers find the official documentation more useful in general, the generated summaries are also competitive, in particular for offering implementation details, and can be used as a complementary source for guiding developers in software development and maintenance tasks.

Leveraging Unsupervised Learning to Summarize APIs Discussed in Stack Overflow

Static code features are necessary components when using machine learning-based techniques to reason about a program of interest. To extract static code features, researchers develop their own feature extractors specific to their own studies. This causes two problems for the follow-up studies that build on the same set of features. First, the current feature extractors are intertwined with the rest of their codebases, and accessing them alone is time-consuming. Second, new kinds of features that are introduced in the follow-up studies are not incorporated back into the original feature extractors. Therefore, it is a tedious task for researchers to track all these individual feature extractors from different projects. In this work, we present SootFX, a generic stand-alone tool that enables the extraction of static code features from Java and Android programs. We explain its design, which makes it easily extensible for supporting new features and resource providers. We introduce its client APIs in Java as well as in Python, a popular programming language among machine learning practitioners. We illustrate a few of its possible use cases on a set of real-world Java libraries and Android applications.

SootFX: A Static Code Feature Extraction Tool for Java and Android

Welcome to Virtual SCAM 2021 and enjoy the conference!

Opening

Test amplification generates new tests by modifying existing, manually written tests. Up until now, this process preserves statements that were relevant for the original test case but are no longer needed for the behavior of the new test case. These unnecessary statements impact the readability of the tests in question. As a part of the effort to make amplified test cases more readable, we investigate dynamic slicing, taint analysis and static analysis as approaches to remove redundant statements. We design and evaluate a static analysis approach that we implemented as part of the test amplification tool DSpot. Our empirical evaluation on 274 amplified test cases shows that the implemented approach works well: while being rudimentary, it is able to remove a significant portion of the redundant statements in the amplified test cases. While the removal of the statements themselves is fast, verifying that the tests still work as intended through mutation testing is still resource-intensive.

Removing Redundant Statements in Amplified Test Cases

Which parts of a software system can be accessed by an attacker is a common question in software security.
The answer to this question defines where to look for input validation vulnerabilities, which parts of a system to respect during Microsoft’s Threat Modeling, or how to calculate security metrics. Identifying entry points of an application is, therefore, a frequently occurring problem. Additionally, identifying entry points is relevant when analysing many framework-based applications since they no longer have a simple main method. While different analyses implement entry point detection, the presented tool eNYPD explicitly focuses on answering this question for Java-based systems in an analysis-independent manner. It extracts information on entry points statically and persists this information to a separate file. Therefore, it allows reusing the information in different analyses, and researchers do not need to implement a custom entry point detection for each analysis. The presented tool is explained using Jakarta Server Faces, a user-interface technology for Web-based business applications implemented using Java. The paper presents the implemented extraction approach, the internal data model, and the results stored. Finally, in an evaluation, the statically assessed results of eNYPD are compared to a dynamically determined set of entry points. This comparison allows us to demonstrate the correctnes of the extracted information.

eNYPD---Entry Point Detector

Locating bugs is an important, but effort-intensive and time-consuming task, when dealing with large-scale systems. To address this, Information Retrieval (IR) techniques are increasingly being used to suggest potential buggy source code locations, for given bug reports. While IR techniques are very scalable, in practice their effectiveness in accurately localizing bugs in a software system remains low. Results of empirical studies suggest that the effectiveness of bug localization techniques can be augmented by the configuration of queries used to locate buggy code. However, in most IR-based bug localization techniques, presented by researchers, the impact of the queries’ configurations is not fully considered. In a similar vein, techniques consider all code elements as equally suspicious of being buggy while localizing bugs, but this is not always the case either.
In this paper, we present a new method-level, informationretrieval-based bug localization technique called BoostNSift”. BoostNSift exploits the important information in queries by ‘boost’ing that information, and then ‘sift’s the identified code elements, based on a novel technique that emphasizes the code elements’ specific relatedness to a bug report over its generic relatedness to all bug reports. To evaluate the performance of BoostNSift, we employed a state-of-the-art empirical design that has been commonly used for evaluating file level IR-based bug localization techniques: 6851 bugs are selected from commonly used Eclipse, AspectJ, SWT, and ZXing benchmarks and made openly available for method-level analyses. The performance of BoostNSift is compared with the penly-available state-of-the-art IR-based BugLocator, BLUiR, and BLIA techniques. Experiments show that BoostNSift improves on BLUiR by up to 324%, on BugLocator by up to 297%, and on BLIA up to 120%, in terms of Mean Reciprocal Rank (MRR). Similar improvements are observed in terms of Mean Average Precision (MAP) and Top-N evaluation measures. 

BoostNSift: A Query Boosting and Code Sifting Technique for Method Level Bug Localization

Static analysis is a technique for gathering some meaningful information during compilation-time and using it for further processing. This technique is applied in bug finding, code comprehension and in many other areas. However, static analysis gives a static view of the source and provides limited information about the dynamic behavior of a program. This limitation is generally considered to be a major barrier for dynamically typed languages, like Python, since in many situations it is hard to derive the most basic properties of variables or functions, sometimes we can’t even find the location of their definition. In this paper we present our experimental results that show this is not necessary a hard barrier in practical industrial projects. We analyzed open-source Python libraries, including the Python Standard Library itself as part of the CodeCompass code comprehension framework, and found that in a high number of the cases it was possible to decide the mentioned important features in unambiguous way. The consistent coding conventions make it possible to reduce unambiguity in static analysis of dynamic languages.

Unambiguity of Python Language Elements for Static Analysis

This paper presents IntraCFG, a declarative and language-independent framework for constructing precise intraprocedural control-ﬂow graphs (CFGs) based on the reference attribute grammar system JastAdd. Unlike most other frameworks, which build CFGs on an Intermediate Representation level, e.g., bytecode, our approach superimposes the CFGs on the Abstract Syntax Tree, enabling accurate client analysis. Moreover, IntraCFG overcomes expressivity limitations of an earlier RAG-based framework, allowing the construction of ASTUnrestricted CFGs: CFGs whose shape is not conﬁned to the AST structure. We evaluate the expressivity of IntraCFG with IntraJ, an application of IntraCFG to Java 7, by comparing two data ﬂow analyses built on top of IntraJ against tools from academia and from the industry. The results demonstrate that IntraJ is effective at building precise and efﬁcient CFGs and enables analyses with competitive performance.

A Precise Framework for Source-Level Control-Flow Analysis

Welcome to the 21st IEEE International Working Conference on Source Code Analysis and Manipulation (SCAM 2021)! 

We hope that you enjoy the conference and that it will inspire you in your future research.

Should you require a certificate of participation please contact Alexander Serebrenik, the general chair of SCAM, at a.serebrenik@tue.nl.

For questions related to the Morressier virtual platform please contact support@morressier.com.