ReRe歐空局Ariane 波音737Max墜 海灣戰爭中愛國者飛 當我們說軟件是正確的：程序的行為符合

intfoo(inta,intb)returna+

輸入 →

Formal(a>=0&&b<=0)||(a<=0&&b>=0)(a>=0&&b>=0&&a+b>=0)(a<=0&&b<=0&&a+b<=

foo(0,1)=1;foo(INT_MAX,1)=ERROR;foo(INT_MAX-1,1)=INT_MAX;foo(INT_MAX,INT_MIN)=-1;我們樸素的愿望：希望測試能變異算子(mutationExecuteExecutetestExecutetest變異算子(mutation變異算子(mutation 1971DeMilloHamlet面向中間表示：Javabytecode,LLVM-Android、MPI基于變異的缺陷自動定位（mutation-basedfaultlocalization）傳統定位方法：基于測試覆蓋信息對語句排序（spectrum-basedfault基于變異的方法：通過觀察變異對測試結果CProteum(108mutationWinMut(IR-JavaMajor[ByReneJavaLanch(IR-based)[ByPITest(CommercialSoftware-artifactInfrastructureRepository(somehowDefects4JManyBugs挑戰1：BugDeepMutationICSME-19]、LEAM[ASE-挑戰2：挑戰2：阻礙變異分析走向工業實踐的是可擴展性（Scalability）M個變異，N變異分析的計算復雜度：O(M)+????????????=∑??∈????????????,??+ ????????????????,??+ ∑??∈??在實際規模的程序中，M挑戰3：ii!=

for(inti=0;i<10;

for(inti=

面向挑戰1：buggy->面向挑戰2：4包括開源模型和商用閉源模型（實驗還在擴展中GPT-3.5-TurboGPT-4-TurboAPI23090Java（JavaBaselineDefects4Jv1.20395ConDefects45JavaLEAM[ASE-muBert[ICST- 實缺陷作為Few-shot時間代價（秒平均生成1k等價變異率（按95%置信度和5%誤差幅度采樣AST節點類型(例如，aba–babfoo(ab)ASTBLEUASTOchiai（語義相似度指標P2：P1few-shotP3：P2P4：P1基于大模型的變異生成：不同的Few-shot我們將所有工具生成的變異數限制為最少的一個analyzebytesttestqualityanalyzebytesttestqualityassessment→mutationfaultlocalization→passorvoidtest_foo(){assert(foo(a,b,c)==RES);EachmutanthasasyntacticTestfoo(inta,intb,Testfoo(inta,intb,intc){intd=a+b;inte=(++d)+c;returne;foo(inta,intb,intc){intd=(++a)+b;inte=d+c;returne;foo(inta,intb,intc){intd=a+b;inte=d+c;returne;foo(inta,intb,intc){intd=(a+1)+b;inte=d+c;returne;returnreturnreturnCyclesrepresentstates,thenumbersinsideareidArrowsrepresentstatetransitionsbyexecutingthelabelstatementintd=a+b;inte=d+c;returne;intd=(a+1)+b;inte=d+c;returnintdintd=(++a)+b;inte=d+c;returnintd=a+inte=(++d)+return

return

Therearealotofredundantcomputation.Forexample,theexecutionfromthebeginningtothestate0 Theinterpreterforkschild-processeswhenencountersamutatedstatement.returnStartwithaprocesscarryingallreturnreturnReplacemutatedstatementswithSSEd=a+b;inte=d+c;returne;intd=interpret(a,b,ADD);inte=Theinterpreterforkschild-processeswhenencountersamutatedstatement.returnStartwithaprocesscarryingallreturnreturnReplacemutatedstatementswithSSEd=a+b;inte=d+c;returne;intd=interpret(a,b,ADD);inte=interpret(d,c,ADD);returne;intd=(a+1)+b;inte=d+c;intd=(++a)+b;inte=d+c;intd=a+inte=(++d)+returnreturnreturnreturnTheredundancyafterthefirstlineisstillalivebeforethestate0Wangetal.,ThelabelbelowistheexecutedexpressioninsideinterpreterWangetal.,ThelabelbelowistheexecutedexpressioninsideinterpreterTheinterpreterTheinterpreteralsocarriesallmutantsItclustersthemutantsofonestatementbyEMS,andforksnewprocessforeach

returnintintd=interpret(a,b,ADD);inte=interpret(d,c,ADD);returne;M1,Instrumentasreturn return

return

2.AccMutinvolves2.AccMutinvolvesalotof AccMutisunabletomergemorereturnM3isSplitcauseitisinareturnTheinterpreterinvocationsinachildprocessisuselessM1andM2aresplitbythevalueofthevariablea,however,whichhasnoeffectonthefinalresult

1 returnreturn

return return Fewer ContinuouslyinterpretabasicblockreturnFewer ContinuouslyinterpretabasicblockreturnreturnDirectlyexecutetheoriginreturnInthechildprocessofaformerOnlycomparethevariableeMergeallthemutantsinasingleAvoidinvokingtheM1,M2,2.Onlycomparethevariablesthatmayaffectthefinal1.Enlargeanalysisscopefromastatementtoabasic3.Avoidunnecessarily3.AvoidunnecessarilyinterpretingmutatedSmallerLLVM-IR中