Error Invariants for Fault Localization via Abstract Interpretation
summary
Presents a concrete technique that computes error invariants by iterating backward and forward abstract-interpretation analyses to shrink an error slice and explain assertion failures. Uses a BDD refinement when if‑guards cause precision loss, calls the Z3 SMT solver to find minimal supporting conjuncts, and ships as an OCaml prototype using Apron and BDD Apron domains. Evaluated on C benchmarks: precision improves over single backward analysis, results are comparable to BugAssist but multiple iterations and large BDD abstract domain sizes increase runtime.
AI-written summary · about
chapters (13)
- 0:00Error invariants for fault localization
- 1:26Error invariants with abstract interpretation
- 3:39Computing error invariants: assignment example
- 5:29If statements and precision loss
- 7:16Refining analysis with BDD domains
- 8:20While loops and irrelevant variables
- 9:01Formalizing error invariants
- 13:41Abstract semantics and refinement
- 16:22Loop for precise error invariants
- 18:15Implementation and experiments
- 20:23Comparing with fault localization tools
- 21:47Contributions and conclusions
- 22:34Q&A
