Before releasing updated software, developers typically run regression test suites to verify that the code changes behave as intended and do not introduce unintended behaviors. Regression test suites, however, are often incomplete and can miss relevant software behaviors. To mitigate this issue, we introduce a technique for detecting potentially unintended behavioral changes. Given two versions of the software, our technique first finds functions that reach modified code in either version. It then performs underconstrained symbolic execution on both the original and revised programs, starting from the identified functions. If the execution reaches changed code, the technique compares corresponding program states across versions and logs differences. Because the so-generated raw log can contain a large number of redundant entries and a mixture of both intended and unintended differences, our technique clusters, orders, and ranks the logged differences to help developers identify feasible, unintended differences. We evaluated our technique by (1) applying it to a large set of known regressions, (2) comparing our results with those of a state-of-the-art approach, and (3) applying it to a popular program, Redis. Our results are promising: for the known regressions, our technique automatically identified more than half of the regressions, generated a low number of false positives, ranked the true positives above the false positives in most cases, and reported more regressions than the state-of-the-art technique we used as a baseline; for the refactored Redis versions, our technique reported no regressions.

In previous work, we introduced zero-overhead profiling (ZOP), a technique that leverages the electromagnetic emissions generated by the computer hardware to profile a program without instrumenting it. Although effective, ZOP has several shortcomings: it requires test inputs that achieve extensive code coverage for its training phase; it predicts path profiles instead of complete execution traces; and its predictions can suffer unrecoverable accuracy losses. In this paper, we present zero-overhead path prediction (ZOP-2), an approach that extends ZOP and addresses its limitations. First, ZOP-2 achieves high coverage during training through progressive symbolic execution (PSE)-symbolic execution of increasingly small program fragments. Second, ZOP-2 predicts complete execution traces, rather than path profiles. Finally, ZOP-2 mitigates the problem of path mispredictions by using a stateless approach that can recover from prediction errors. We evaluated our approach on a set of benchmarks with promising results; for the cases considered, (1) ZOP-2 achieved over 90% path prediction accuracy, and (2) PSE covered feasible paths missed by traditional symbolic execution, thus boosting ZOP-2's accuracy.

Software engineers build software systems in increasingly regulated environments, and must therefore ensure that software requirements accurately represent obligations described in laws and regulations. Prior research has shown that graduate-level software engineering students are not able to reliably determine whether software requirements meet or exceed their legal obligations and that professional software engineers are unable to accurately classify cross-references in legal texts. However, no research has determined whether software engineers are able to identify and classify important ambiguities in laws and regulations. Ambiguities in legal texts can make the difference between requirements compliance and non-compliance. Herein, we develop a ambiguity taxonomy based on software engineering, legal, and linguistic understandings of ambiguity. We examine how 17 technologists and policy analysts in a graduate-level course use this taxonomy to identify ambiguity in a legal text. We also examine the types of ambiguities they found and whether they believe those ambiguities should prevent software engineers from implementing software that complies with the legal text. Our research suggests that ambiguity is prevalent in legal texts. In 50 minutes of examination, participants in our case study identified on average 33.47 ambiguities in 104 lines of legal text using our ambiguity taxonomy as a guideline. Our analysis suggests (a) that participants used the taxonomy as intended: as a guide and (b) that the taxonomy provides adequate coverage (97.5%) of the ambiguities found in the legal text.