Subhajit Roy

Program synthesis using natural language

Interacting with computers is a ubiquitous activity for millions of people. Repetitive or specialized tasks often require creation of small, often one-off, programs. End-users struggle with learning and using the myriad of domain-specific languages (DSLs) to effectively accomplish these tasks. We present a general framework for constructing program synthesizers that take natural language (NL) inputs and produce expressions in a target DSL. The framework takes as input a DSL definition and training data consisting of NL/DSL pairs. From these it constructs a synthesizer by learning optimal weights and classifiers (using NLP features) that rank the outputs of a keyword-programming based translation. We applied our framework to three domains: repetitive text editing, an intelligent tutoring system, and flight information queries. On 1200+ English descriptions, the respective synthesizers rank the desired program as the top-1 and top-3 for 80% and 90% descriptions respectively.

Profiling k-Iteration Paths: A Generalization of the Ball-Larus Profiling Algorithm

The Ball-Larus path-profiling algorithm is an efficient technique to collect acyclic path frequencies of a program. However, longer paths — those extending across loop iterations — describe the runtime behaviour of programs better. We generalize the Ball-Larus profiling algorithm for profiling k-iteration paths — paths that can span up to to k iterations of a loop. We show that it is possible to number such k-iteration paths perfectly, thus allowing for an efficient profiling algorithm for such longer paths. We also describe a scheme for mixed-mode profiling: profiling different parts of a procedure with different path lengths. Experimental results show that k-iteration profiling is realistic.

The hot path SSA form: extending the static single assignment form for speculative optimizations

The Static Single Assignment (SSA) form has been an eminent contribution towards analyzing programs for compiler optimizations. It has been affable to the design of simpler algorithms for existing optimizations, and has facilitated the development of new ones. However, speculative optimizations — optimizations targeted towards speeding-up the “common cases” of a program — have not been fortunate enough to savor an SSA-like intermediate form. We extend the SSA form for speculative analyses and optimizations by allowing only hot reaching definitions — definitions along frequent acyclic paths in the program profile — to reach its respective uses; we call this representation the Hot Path SSA form. We propose an algorithm for constructing such a form, and demonstrate its effectiveness by designing the analysis phase of a novel optimization — Speculative Sparse Conditional Constant Propagation: an almost obvious extension of Wegman and Zadecks Sparse Conditional Constant Propagation algorithm. Our experiments on some SPEC2000 programs proves the potency of such an optimization.

Exploring program phases for statistical bug localization

Statistical bug isolation techniques attempt to capture a correlation of various program features (like predicates and profiled paths) for debugging. These techniques collect profile data for multiple executions, both with successful and faulty runs, and propose using various statistical tests to capture this correlation. In this paper, we explore the utility of program phases, a concept which is primarily used by computer architects to speed up architectural simulations, for statistical bug isolation. Program phases represent sets of execution intervals in a programs execution where the rates of architectural statistics like branch mispredictions, CPU/Memory usage and cache misses remain almost the same. We found multiple scenarios where coupling program phases with predicates achieves higher accuracy to bug localization than when predicates are used alone. We demonstrate the use of program phases for bug isolation by presenting experimental results and concrete case studies on medium-size programs, showing an improved ranking of the program points that are critical to debugging over when program phases are not used.

Pertinent path profiling: Tracking interactions among relevant statements

Acyclic path profiles are an indispensable tool geared towards multiple ends, with applications spanning from compiler optimizations to software engineering. Though such profiles provide an usable approximation to the program trace, many a times programmers are more interested in uncovering high-level interactions among a set of pertinent statements - not so much in the overall control-flow profile of the program. We propose a new profiling technique, Pertinent Path Profiling, which attempts to unveil such high-level interactions efficiently: given a control-flow graph and a set of pertinent basic-blocks (containing the relevant statements, Pertinent Path Profiling uniquely and efficiently identifies these high-level interactions, revealing execution demeanors that are otherwise difficult to discover via current control-flow profiling schemes. Additionally, if the number of pertinent basic-blocks is small, most of the time our algorithm yields much smaller path-frequency tables than those obtained by acyclic path profilers: if we are interested in a pertinent path profile with about 30% of the basic-blocks marked pertinent, most functions shrink their path-tables to about 15% of that of the acyclic path profiler. We illustrate a couple of possible applications of this new technology and provide experimental results on a set of benchmark programs to testify the utility of this new profiling technique.

To be precise: regression aware debugging

Bounded model checking based debugging solutions search for mutations of program expressions that produce the expected output for a currently failing test. However, the current localization tools are not regression aware: they do not use information from the passing tests in their localization formula. On the other hand, the current repair tools attempt to guarantee regression freedom: when provided with a set of passing tests, they guarantee that none of these tests can break due to the suggested repair patch, thereby constructing a large repair formula. In this paper, we propose regression awareness as a means to improve the quality of localization and to scale repair. To enable regression awareness, we summarize the proof of correctness of each passing test by computing Craig Interpolants over a symbolic encoding of the passing execution, and use these summaries as additional soft constraints while synthesizing altered executions corresponding to failing tests. Intuitively, these additional constraints act as roadblocks, thereby discouraging executions that may damage the proof of a passing test. We use a partial MAXSAT solver to relax the proofs in a systematic way, and use a ranking function that penalizes mutations that damage the existing proofs. We have implemented our algorithms into a tool, TINTIN, that enables regression aware localization and repair. For localizations, our strategy is effective in extracting a superior ranking of suspicious locations: on a set of 52 different versions across 12 different programs spanning three benchmark suites, TINTIN achieves a saving of developer effort by almost 45% (in terms of the locations that must be examined by a developer to reach the ground-truth repair) in the worst case and 27% in the average case over existing techniques. For automated repairs, on our set of benchmarks, TINTIN achieves a 2.3X speedup over existing techniques without sacrificing much on the ranking of the repair patches: the ground-truth repair appears as the topmost suggestion in more than 70% of our benchmarks.

Partial flow sensitivity

Compiler optimizations need precise and scalable analyses to discover program properties. We propose a partially flow-sensitive framework that tries to draw on the scalability of flow-insensitive algorithms while providing more precision at some specific program points. Provided with a set of critical nodes -- basic blocks at which more precise information is desired -- our partially flow-sensitive algorithm computes a reduced control-flow graph by collapsing some sets of non-critical nodes. The algorithm is more scalable than a fully flow-sensitive one as, assuming that the number of critical nodes is small, the reduced flow-graph is much smaller than the original flow-graph. At the same time, a much more precise information is obtained at certain program points than would had been obtained from a flow-insensitive algorithm.

Synthesizing Heap Manipulations via Integer Linear Programming

Writing heap manipulating programs is hard. Even though the high-level algorithms may be simple, it is often tedious to express them using low-level operations. We present a new tool — Synlip — that uses expression of intent in the form of concrete examples drawn using box-and-arrow diagrams to synthesize heap-manipulations automatically. Instead of modeling the concrete examples in a monolithic manner, Synlip attempts to extract a set of patterns of manipulation that can be applied repeatedly to construct such programs. It, then, attempts to infer these patterns as linear transformations, leveraging the power of ILP solvers for program synthesis.

Facilitating Verification in Program Loops by Identification of Static Iteration Patterns

Generating invariants for loops is often a grueling obstacle in formal program verification. Researchers have employed methods from formal techniques based on abstract interpretation to test-driven dynamic analysis to tackle this problem. Even though powerful techniques for generating conjunctive invariants (invariants that employ only conjunction of terms) have been developed, disjunctive invariants have remained a sore thumb for formal techniques. In this paper, we propose a technique to transform certain category of loops, those that have a static iteration pattern, into loops that can be handled by conjunctive invariant generators. The key idea is to identify a static iteration pattern that distributes the disjunction in an invariant in a manner that can be captured by only conjunctive invariants. To broaden the scope of our algorithm, we also propose the idea of parametric verification, while attempting to verify specialized versions of the program where a subset of the input variables is instantiated with certain test-inputs. Note that parametric verification distinguishes it from program testing as testing requires all of its variables to be instantiated with test-inputs. We discuss our ideas on loops drawn from real programs to establish real-world applicability of our algorithms.

Probabilistic dataflow analysis using path profiles on structure graphs

Speculative optimizations are increasingly becoming popular for improving program performance by allowing transformations that benefit frequently traversed program paths. Such optimizations are based on dataflow facts which are mostly true, though not always safe. Probabilistic dataflow analysis frameworks infer such facts about a program, while also providing the probability with which a fact is likely to be true. We propose a new Probabilistic Dataflow Analysis Framework which uses path profiles and information about the nesting structure of loops to obtain improved probabilities of dataflow facts.