Similar code fragment A code fragment that has similar part to it in source code introduced in source code because of various reasons. e.g. “copy-and-paste” makes software maintenance difficult. It is necessary to It is necessary to check a2. check CF 2 and CF 3 Source file Source file Similar code If CF 1 is fragment defective… CF 2 CF 1 CF 3 1 Department of Computer Science, Graduate School of Information Science & Technology, Osaka University
Similar defects in Linux 2.6.6 for(iter=0; iter<num_regs; iter++) { prom_prom_taken[iter].start_adr = prom_reg_memlist[iter].phys_addr; prom_prom_taken[iter].num_bytes = prom_reg_memlist[iter].reg_size; prom_prom_taken[iter].theres_more = &prom_phys_total[iter+1]; // should be:&prom_prom_taken[iter+1]; } for(iter=0; iter<num_regs; iter++) { prom_prom_taken[iter].start_adr = (char *) prom_reg_memlist[iter].phys_addr; prom_prom_taken[iter].num_bytes = (unsigned long) prom_reg_memlist[iter].reg_size; prom_prom_taken[iter].theres_more = &prom_phys_total[iter+1]; // should be:&prom_prom_taken[iter+1]; } 2 Department of Computer Science, Graduate School of Information Science & Technology, Osaka University
Similar defects in Linux 2.6.6 for(iter=0; iter<num_regs; iter++) { prom_prom_taken[iter].start_adr = prom_reg_memlist[iter].phys_addr; prom_prom_taken[iter].num_bytes = prom_reg_memlist[iter].reg_size; prom_prom_taken[iter].theres_more = &prom_phys_total[iter+1]; // should be:&prom_prom_taken[iter+1]; Type cast operations } are inserted. for(iter=0; iter<num_regs; iter++) { prom_prom_taken[iter].start_adr = (char *) prom_reg_memlist[iter].phys_addr; prom_prom_taken[iter].num_bytes = (unsigned long) prom_reg_memlist[iter].reg_size; prom_prom_taken[iter].theres_more = &prom_phys_total[iter+1]; // should be:&prom_prom_taken[iter+1]; Clone detection tools cannot treat } the code fragments as a clone pair. 3 Department of Computer Science, Graduate School of Information Science & Technology, Osaka University
An overview of proposed method Input code fragment (Query) Input identifier list Lexical I i [0] I i [n i ] Analysis Similar sublists I s1 [0] I s1 [n s1 ] Comparison I s2 [0] I s2 [n s2 ] Target source files Target identifier lists I sn [0] I sn [n sn ] I t1 [0] I t1 [n t1 ] Lexical I t2 [0] I t2 [n t2 ] Analysis Ranking I tn [0] I tn [n tn ] Similarity Ranking The method retrieves code Rank Start line # End line # Similarity fragments similar to an input 1 Line s1 Line e1 Sim 1 2 Line s2 Line e2 Sim 2 code fragment. 4 Department of Computer Science, Graduate School of Information Science & Technology, Osaka University
Comparison Scan a target identifier list with a sliding window We compare identifiers in the sliding window with the input identifier list. Extract a code fragment corresponding to the sliding window if the window involves one or more identifiers in the input list Input identifier list Ii[0] Ii[1] Ii[2] Target identifier list It[n-1] It[n] It[0] It[1] It[2] It[3] Sliding Window （ fixed length ） The direction of movement of the sliding window 5 Department of Computer Science, Graduate School of Information Science & Technology, Osaka University
Similarity-based ranking The extracted code fragments are sorted according to the following similarity. S i : a set of elements in an input identifier list S w : a set of elements in a sliding window Developers investigate the resultant similarity-based ranking . 6 Department of Computer Science, Graduate School of Information Science & Technology, Osaka University
Case Study Target open source software systems arch/ directory in Linux 2.6.6 Architecture-specific implementations in OS 2 incorrect pointer accesses server/ directory in Canna 3.6 Japanese input system 19 buffer overflow errors Procedure 1. extract code fragments sharing similar defects 2. enter each code fragment into the tool implementing our method 3. inspect if the similarity ranking ranks highly code fragments involving defects 7 Department of Computer Science, Graduate School of Information Science & Technology, Osaka University
Result Linux 2.6.6 We used 2 code fragments as queries. Each code fragment involves an incorrect pointer access. In both of those queries, the 2 code fragments are the top 2 . Canna 3.6 We used 19 code fragments as queries. Each code fragment involves a buffer overflow error. In all of those queries, 18 or 19 code fragments are the top 30 . In our case studies, we could detect most of similar defects. 8 Department of Computer Science, Graduate School of Information Science & Technology, Osaka University
Summary & Future work We proposed a method to retrieve similar code fragments based on identifier similarity. Sliding window comparison Similarity-based ranking We need further case studies. Application to similar defects in other software systems Effects from changing “similarity” definition 9 Department of Computer Science, Graduate School of Information Science & Technology, Osaka University
Recommend
More recommend
