Dr. DD 1-Minimal Isolation of Failure Causes via Deferred Restarts

ISSRE'26

Transcript

1. Dr. DD 1-Minimal Isolation of Failure Causes via Deferred Restarts Aarush Kumbhakern Feiyang Chen Danushka Liyanage Xi Wu Mohammad Amin Alipour https://rahul.gopinath.org Rahul Gopinath @rahul@gopinath.org rahul@gopinath.org
2. Dr. DD 1-Minimal Isolation of Failure Causes via Deferred Restarts Aarush Kumbhakern Feiyang Chen Danushka Liyanage Xi Wu Mohammad Amin Alipour https://rahul.gopinath.org Rahul Gopinath @rahul@gopinath.org rahul@gopinath.org
3. Input reduction Failing input Reduced input ((8+3)*(5-2) + (11e0+0/0) + 9*4 - 7) 0/0 ✓ ✓ Both inputs fail with division by zero
4. The failure oracle 0/0 eval(...) ✓ Division by zero 0/1+2*4 eval(...) ✗ Other result 1+2/0/ eval(...) ✗ Other result Only accepted deletions preserve the target failure
5. ddmin: on the failing input input ((8+3)*(5-2) + (11e0+0/0) + 9*4 - 7) ✓ division by zero
6. ddmin: on the failing input input ((8+3)*(5-2) + (11e0+0/0) + 9*4 - 7) ✓ division by zero 2 blocks ((8+3)*(5-2) + (11 e0+0/0) + 9*4 - 7) ✗ each half alone: no failure
7. ddmin: on the failing input input ((8+3)*(5-2) + (11e0+0/0) + 9*4 - 7) ✓ division by zero 2 blocks ((8+3)*(5-2) + (11 e0+0/0) + 9*4 - 7) ✗ each half alone: no failure Δ₁ 4 blocks Δ₂ Δ₃ ((8+3)*(5 -2) + (11 e0+0/0) + Δ₄ 9*4 - 7) ✗ each quarter alone: no failure
8. ddmin: on the failing input input ((8+3)*(5-2) + (11e0+0/0) + 9*4 - 7) ✓ division by zero 2 blocks ((8+3)*(5-2) + (11 e0+0/0) + 9*4 - 7) ✗ each half alone: no failure Δ₁ Δ₂ Δ₃ Δ₄ 4 blocks ((8+3)*(5 -2) + (11 e0+0/0) + 9*4 - 7) ✗ each quarter alone: no failure Remove Δ₁ ((8+3)*(5 -2) + (11 e0+0/0) + 9*4 - 7) ✗ syntax error
9. ddmin: on the failing input input ((8+3)*(5-2) + (11e0+0/0) + 9*4 - 7) ✓ division by zero 2 blocks ((8+3)*(5-2) + (11 e0+0/0) + 9*4 - 7) ✗ each half alone: no failure Δ₁ Δ₂ Δ₃ Δ₄ 4 blocks ((8+3)*(5 -2) + (11 e0+0/0) + 9*4 - 7) ✗ each quarter alone: no failure Remove Δ₁ ((8+3)*(5 -2) + (11 e0+0/0) + 9*4 - 7) ✗ syntax error Remove Δ₂ ((8+3)*(5 -2) + (11 e0+0/0) + 9*4 - 7) ✓ division by zero No half reproduces the failure, but removing one quarter does
10. ddmin: on the failing input input ((8+3)*(5-2) + (11e0+0/0) + 9*4 - 7) ✓ division by zero 2 blocks ((8+3)*(5-2) + (11 e0+0/0) + 9*4 - 7) ✗ each half alone: no failure Δ₁ Δ₂ Δ₃ Δ₄ 4 blocks ((8+3)*(5 -2) + (11 e0+0/0) + 9*4 - 7) ✗ each quarter alone: no failure Remove Δ₁ ((8+3)*(5 -2) + (11 e0+0/0) + 9*4 - 7) ✗ syntax error Remove Δ₂ ((8+3)*(5 -2) + (11 e0+0/0) + 9*4 - 7) ✓ division by zero Remove Δ₂ ((8+3)*(5 -2) + (11 e0+0/0) + 9*4 - 7) ✗ syntax error When a delta can be removed, ddmin restarts from the beginning.
11. 1-minimality Final input 0 / 0 ✓ Failure remains Delete first 0 0 / 0 ✗ Delete / 0 / 0 ✗ Delete last 0 0 / 0 ✗ Every single-byte deletion is rejected
12. Dependency in the failing input 1e0+0/0 1 e0+ 0/0 Deleting e0+ makes the earlier 1 removable
13. First scan: 1 stays First scan 1 e0+ 0/0 e0+0/0 gives NameError The oracle rejects this deletion ✗
14. First scan: e0+ goes First scan 1 0/0 10/0 still divides by zero The earlier 1 was already tested ✓
15. Next scan: 1 goes Next scan 1 0/0 0/0 still divides by zero An unchanged scan then confirms 1-minimality ✓
16. ddmin Runtime O(log n) best and most common case 2 O(n ) worst case 1-minimality Guarantee (n is the size of the input)
17. ddmin Competition ProbDD Same reduction as ddmin in 27% less time, and O(n) oracle calls in the worst case 2 compared to O(n ) for ddmin CDD Same reduction as ddmin in 29% less time, and O(n) oracle calls in the worst case 2 compared to O(n ) for ddmin
18. ddmin: restart after success ✓ commit deletion and restart at the same level ((8+3)*(5e0+0/0) + 9*4 - 7) -2) + (11 Test block deletion Begin scan ((8+3)*(5-2) + (11e0+0/0) + 9*4 - 7) ✗ ((8+3)*(5 Success revisits the start of the scan Next block
19. ddmin Restarts at every level n/2 n/4 … 1 Coarse levels repeat work. Unnecessary for 1-minimality guarantee
20. ddmin: restart after success Always restart on reduction
21. ddmin Competition ProbDD: O(n) oracle calls worst case No restarts and No 1-minimality guarantee Same reduction as ddmin in 27% less time, and O(n) oracle calls in the worst case compared to O(n2) for ddmin CDD: O(n) oracle calls worst case No restarts and No 1-minimality guarantee
22. Dr. DD: deferred restarts Restart only at element 1
23. Dr. DD Restarts only at the end n/2 n/4 … 1 X X Coarse levels repeat work Single elements certify minimality
24. Why the guarantee holds ✓ Failure invariant ✓ Termination ✓ 1-minimality certificate Every accepted deletion preserves the failure Every productive scan removes at least one byte The unchanged scan rejects every byte deletion
25. But: The quadratic worst case remains δ₁ δ₂ δ₃ … One deletion can unlock an earlier byte O(n) scans × O(n) tests = O(n²) δₖ
26. Restarts and 1-minimality Method Revisiting 1-Minimality? Worst Case ddminʸ After successful deletion ✓ 2 O(n ) Dr. DD At single-byte granularity ✓ 2 O(n ) ProbDD / CDD No fixed-point check ✗ O(n) drdd needs no prior estimate of input reducibility
27. Evaluation ffmpeg 14 52 inputs across four families binutils 12 XML 15 CrashJS 11 Oracle calls, runtime, output size
28. Oracle calls across four algorithms Oracle calls (log scale) Smaller is better
29. Mean minutes (log scale) Wall-clock time across four algorithms Smaller is better
30. Mean output size across four algorithms Mean output size (bytes) Smaller is better
35. ddmin
36. ProbDD
37. CDD
38. DrDD
39. Output size stays close to ddminʸ Family ddminʸ (bytes) DrDD (bytes) ffmpeg 1310 1272 XML 1025 1058 binutils 4704 4704 CrashJS 476 477
40. ProbDD and CDD can use fewer calls On binutils and CrashJS: Fewer oracle calls than drdd Larger mean outputs The guarantee has a measurable trade-off
41. Checking the competitors’ outputs 15 selected inputs per competitor ProbDD 8 / 15 CDD 8 / 15 ✓ 1-minimal ✗ more bytes removable
42. Deletion boundaries matter Delete one tag <div> … </div> ✗ Malformed XML Delete the pair <div> … X </div> Coordinated deletion A different search path can reach a smaller fixed point X ✓
43. The restart budget R Maximum number of single-byte scans 1 2 3 … n R=1 R = n (default) Linear worst case No 1-minimality guarantee 1-minimality guarantee Stop early after an unchanged scan
44. Restart budget on 15 inputs Oracle calls 3,000 2,000 2,546 1-minimal outputs 2,833 2,833 2,833 75% 1,829 93% 100% 100% 100% 100% 60% 50% 1,000 25% 0% 0 1 2 4 8 Restart budget R |I| 1 2 4 8 Restart budget R Four scans sufficed here. This is not a universal bound. |I|
45. Scope and limits Four input families One reported ProbDD run per input Competitor priors use observed family reducibility Oracle stability matters for every reducer
46. Deferred restarts preserve 1-minimality Coarse scans once Repeat single-byte scans Up to about 19× faster in this evaluation Thank you