A formal semantics for program debugging

Abstract

This work aims to build a semantic framework for automated debugging. A debugging process consists of tracing, locating, and fixing processes consecutively. The first two processes are accomplished by a tracing procedure and a locating procedure, respectively. The tracing procedure reproduces the execution of the failed test case with well-designed data structures and saves necessary information for locating bugs. The locating procedure will use the information obtained from the tracing procedure to locate ill-designed statements and to generate a system of fix-equations, whose solution will be used to fix the bugs. A structural operational semantics is given to define the functions of the tracing and locating procedures. Both of them are proved to terminate. The main task of fixing process is to solve the fix-equations. It turns out that for a given failed test case, there exist four types of fix-equations and three different solutions: 1) The bug is solvable, i.e., there exists a solution of the system of fix-equations, and the program can be repaired. 2) There exists a structural design error in the program, i.e., the system of fix-equations generated at each round of the locating procedure is solvable, but a new bug will arise when the old bug is being fixed. 3) There exists a logical design error, and the system of fix-equations is not solvable.