search

resess / Slicer4J

Slicer4J is an accurate, low-overhead dynamic slicer for Java programs.
MIT License
39 stars 17 forks source link

Possible soundness bug in the presence of recursive methods #5

Closed asoifer closed 2 years ago

asoifer commented 2 years ago

Hi, I'm a PhD student from the University of Buenos Aires, I read your paper, Slicer4J: A Dynamic Slicer For Java, and in my opinion, this is a great contribution. So, thank you so much, I appreciate your research on this topic.   I wanted to try to use it on some programs... but I had a soundness problem in the presence of recursive methods. I don't know if this is a known issue or if I'm doing something wrong. 

I'm attaching the complete source code for reproducing this issue (2 files), the log and the slice file produced by this tool.

This is TreeAdd, from Olden's benchmark. If you run this program with "-l 2", and slice on line 53 (TreeAdd:53) the slice is: TreeAdd:36 TreeAdd:40 TreeAdd:53 TreeNode:49 TreeNode:101 TreeNode:106

int addTree()
{
    int total = value; /* line 101 */
    if (left != null)
    total += left.addTree();
    if (right != null) 
    total += right.addTree();
    return total; /* line 106 */
}

The problem is between lines 101 and 106. As you can see in the log, lines from 101 to 106 are executed and they are used to compute the variable total returned in 106 (of TreeNode), which is used to print the criterion in line 53 of TreeAdd. In Javaslicer they are part of the slice (I checked this and it's okay).

It's important to run this with "-l 2" (or a greater number) as arguments for replying this behaviour. Thanks in advance for everything.

TreeAdd.zip

khaled-e-a commented 2 years ago

Thank you Alexis for your interest in Slicer4J and for trying it out!

There was an issue in the graph construction phase not connecting control flow edges properly in recursive calls. Thank you for bringing my attention to it.

This now fixed in commit https://github.com/resess/Slicer4J/commit/06db36b8924928dd38b13064ed95da003a21b442 in Slicer4J and commit https://github.com/resess/DynamicSlicingCore/commit/8b1363199c4b014e1fc392d829eab81ea9a8f8e3. I added the TreeAdd program as the test case: https://github.com/resess/Slicer4J/blob/06db36b8924928dd38b13064ed95da003a21b442/Slicer4J/src/test/java/ca/ubc/ece/resess/slicer/dynamic/slicer4j/ProgramTests.java#L310

Please pull and build both repos.

asoifer commented 2 years ago

Thank you so much, for the fix and the explanation, It works! Good luck on ESEC/FSE :)