Language and Tool Support for Semantic Bug Analysis

Some bugs, among the millions that exist, are similar to each other. When fixing a bug, a programmer tends to search for similar bugs that have been reported and resolved in the past. A fix for a similar bug can help him understand his bug, or even directly fix his bug. Studying bugs with similar symptoms, programmers may determine how to detect or resolve them. Existing work has focused on analyzing bug reports and other unstructured bug information. To tackle the problem of finding similar bugs, we propose and advocate the systematic use of semantic bug information in the form of execution traces, the most practical and precise approximation of semantics. In particular, this paper introduces novel language and tool support for performing semantic querying and analysis of bugs. We describe bug query language (BQL), a flexible query language over execution traces that allows users to express diverse queries. To support and validate our design, we developed the BQL open infrastructure that consists of a bug database, a query processing engine, an execution trace collection engine, and a web-based user interface. Given a bug and a query, BQL exhaustively searches in its database for similar bugs. We also provide tools for recording and uploading bug traces to the BQL infrastructure. We evaluated BQL on a collection of bugs from popular open-source projects. We show that BQL accurately and efficiently finds similar bugs, some of which could have been immediately used to fix open bugs.