automated debugging for arbitrarily long executions
play

Automated Debugging for Arbitrarily Long Executions Cristian - PowerPoint PPT Presentation

Automated Debugging for Arbitrarily Long Executions Cristian Zamfir, Baris Kasikci, Johannes Kinder, Edouard Bugnion, George Candea Debugging is Hard Debugging = diagnose + fix the root cause May take days-months to diagnose bugs in the


  1. Automated Debugging for Arbitrarily Long Executions Cristian Zamfir, Baris Kasikci, Johannes Kinder, Edouard Bugnion, George Candea

  2. Debugging is Hard • Debugging = diagnose + fix the root cause • May take days-months to diagnose bugs in the real world 1 1 Concurrency at Microsoft – An Exploratory Survey , CAV workshop 2008

  3. Real World Debugging Debugging during development

  4. Real World Debugging Debugging during development $ gdb ./program

  5. Real World Debugging Debugging during development $ gdb ./program (gdb) record

  6. Real World Debugging Debugging during development $ gdb ./program (gdb) record (gdb) run

  7. Real World Debugging Debugging during development $ gdb ./program (gdb) record (gdb) run Segmentation fault

  8. Real World Debugging Debugging during development $ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

  9. Real World Debugging Debugging during development $ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

  10. Real World Debugging Debugging during development Debugging in the real world $ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

  11. Real World Debugging Debugging during development Debugging in the real world $ ./program $ gdb ./program (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

  12. Real World Debugging Debugging during development Debugging in the real world $ ./program $ gdb ./program Segmentation fault (gdb) record (gdb) run Segmentation fault (gdb) reverse-step

  13. Real World Debugging Debugging during development Debugging in the real world $ ./program $ gdb ./program Segmentation fault (gdb) record (core dumped) (gdb) run Segmentation fault $ gdb ./program core (gdb) reverse-step

  14. Real World Debugging Debugging during development Debugging in the real world $ ./program $ gdb ./program Segmentation fault (gdb) record (core dumped) (gdb) run Segmentation fault $ gdb ./program core (gdb) reverse-step (gdb) reverse-step

  15. Real World Debugging Debugging during development Debugging in the real world $ ./program $ gdb ./program Segmentation fault (gdb) record (core dumped) (gdb) run Segmentation fault $ gdb ./program core (gdb) reverse-step (gdb) reverse-step Target core command unsupported

  16. Debug Without Recording

  17. Debug Without Recording What are the classes of information necessary for debugging?

  18. Debug Without Recording What are the classes of information Coredump Program necessary for debugging? 10101010 11101011 + 10101011 10001001

  19. Debug Without Recording What are the classes of information Coredump Program necessary for debugging? 10101010 11101011 + 10101011 10001001 Synthesize program inputs thread schedule

  20. Debug Without Recording What are the classes of information Coredump Program necessary for debugging? 10101010 11101011 + 10101011 10001001 Synthesize Original Program Binary Debugger program inputs Replay Library thread schedule

  21. Debug Without Recording Synthesize program inputs thread schedule

  22. Debug Without Recording Synthesize program inputs thread schedule

  23. Debug Without Recording Synthesize program inputs thread schedule

  24. Debug Without Recording Synthesize program inputs thread schedule

  25. Debug Without Recording Synthesize program inputs thread schedule

  26. Debug Without Recording Synthesize program inputs thread schedule

  27. Debug Without Recording Synthesize program inputs thread schedule Exact same execution is not necessary 
 ODR, PRES (SOSP’09) and ESD (EuroSys’10)

  28. Debug Without Recording Synthesize program inputs thread schedule Exact same execution is not necessary 
 ODR, PRES (SOSP’09) and ESD (EuroSys’10) Reproduce the root cause and the failure 
 Debug Determinism (HotOS’11)

  29. Debug Without Recording Synthesize program inputs thread schedule Exact same execution is not necessary 
 ODR, PRES (SOSP’09) and ESD (EuroSys’10) Reproduce the root cause and the failure 
 Debug Determinism (HotOS’11)

  30. Reverse Execution Synthesis Synthesize program inputs thread schedule

  31. Reverse Execution Synthesis Synthesize program inputs thread schedule The root cause is close to the failure 
 85% of the time (Conseq, ASPLOS’11)

  32. Reverse Execution Synthesis Synthesize program inputs thread schedule The root cause is close to the failure 
 85% of the time (Conseq, ASPLOS’11)

  33. Reverse Execution Synthesis Synthesize program inputs thread schedule The root cause is close to the failure 
 85% of the time (Conseq, ASPLOS’11)

  34. Reverse Execution Synthesis Synthesize program inputs thread schedule The root cause is close to the failure 
 85% of the time (Conseq, ASPLOS’11)

  35. Reverse Execution Synthesis

  36. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1

  37. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1 Coredump: x 1 y 10

  38. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); next: buffer[y] = 1 buffer[y] = 1; Coredump: (buffer overflow) x 1 y 10

  39. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); x = 1; next: if (f(x) == y) buffer[y] = 1 True buffer[y] = 1; Coredump: (buffer overflow) x 1 y 10

  40. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); x = 2; x = 1; next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 True True buffer[y] = 1; Coredump: (buffer overflow) x 1 y 10

  41. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; if (g(x) == y) { goto next; } exit(); x = 2; x = 1; next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 y 10

  42. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x if (g(x) == y) { goto next; y y } exit(); x = 2; x = 1; next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 y 10

  43. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x x if (g(x) == y) { goto next; y y y } exit(); x = 2; x = 1; next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 y 10

  44. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x if (g(x) == y) { goto next; y y } x exit(); x = 2; x = 1; y next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 y 10

  45. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x if (g(x) == y) { goto next; y y } x 2 exit(); x = 2; x = 1; y next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 y 10

  46. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x if (g(x) == y) { goto next; y y } exit(); x = 2; x = 1; x 2 next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 y 10 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 y 10

  47. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x if (g(x) == y) { goto next; y y } exit(); x = 2; x = 1; next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 x 2 y 10 y 10 g(2) != 10

  48. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x x ? if (g(x) == y) { goto next; y y y 10 } exit(); x = 2; x = 1; next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 x 2 y 10 y 10 g(2) != 10

  49. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x x ? if (g(x) == y) { goto next; y y y 10 } exit(); x = 2; x = 1; next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 x 2 y 10 y 10 g(2) != 10 no match

  50. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x x ? if (g(x) == y) { goto next; y y y 10 } exit(); x = 2; x = 1; next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 x 2 y 10 y 10 g(2) != 10

  51. Reverse Execution Synthesis x = 1; if (f(x) == y) { goto next; } ... x = 2; x x x x ? if (g(x) == y) { goto next; y y y y 10 } exit(); x = 2; x = 1; next: if (g(x) == y) if (f(x) == y) buffer[y] = 1 False True True False buffer[y] = 1; Coredump: (buffer overflow) x 1 x 2 y 10 y 10 g(2) != 10

Recommend


More recommend