Isolating Failure-Inducing Changes¶

"Yesterday, my program worked. Today, it does not. Why?" In debugging, as elsewhere in software development, code keeps on changing. Thus, it can happen that a piece of code that yesterday was working perfectly, today no longer runs – because we (or others) have made some changes to it that cause it to fail. The good news is that for debugging, we can actually exploit this version history to narrow down the changes that caused the failure – be it by us or by others.

Prerequisites

• You should have read the Chapter on Delta Debugging.
• Knowledge on version control systems (notably git) will be useful.

Changes and Bugs¶

When you develop software, it is unlikely that you will be able to produce a fully working piece of software right from the beginning – hence the need for debugging. It is just as unlikely, though, that your software will stay unchanged forever. Evolving requirements, the introduction of new technology, changes in the environment all induce software changes – and every such change brings the risk of introducing new bugs.

To detect such bugs introduced by changes, systematic (and best automatic) testing, notably regression testing, can be a big help; in fact, the more comprehensive and the more automated your testing strategy is, the more it actually enables evolving your software, because every new test lowers the risk of a change introducing a bug. Extensive testing is what enables agile development – and we're happy to point to our sibling book on test generation to give you some inspiration on how to do this.

However, a test can only detect failures, not fix them. The more you change, the more you may need to fix, too. The good news is that there are a number of debugging techniques, manual and automated, that can actually exploit the presence of older, working software versions to effectively narrow down the causes of failure in a new, failing software.

Leveraging Version Histories¶

The fundamental prerequisite for exploiting older, working software versions is to have such older, working versions in the first place. If your software always failed, then you will have to resort to conventional debugging. But if there is an older working version, you can make use of it.

We assume that you do have a version repository such as git or SVN, which you use to organize software development and keep older software versions. (If you do not use version control for your project, you are in debugging hell. Go and set it up now, and come back once you're done.)

If you have a version history, an older working version, and a new failing version, your situation is roughly as depicted in this diagram:

Somewhere between the old version "v1" ("yesterday") and the current version "v8" ("today"), the software stopped working. But when exactly? And which change was it that caused the failure?

You may think that this is an easy task: We simply manually test one version after another, thus determining the exact version that first failed. However,

• this can take a long time (notably in the presence of dozens or even hundreds of versions);
• this may still leave you with dozens of changes applied from one version to another; and
• this is actually a task that can be fully automated.

And these "automated" debugging techniques are what we explore in this chapter.

An Example Version History¶

As our ongoing example, we start with creating a little version history, using the git version management system. We follow the evolution of the remove_html_markup() versions from the introduction to debugging and the chapter on assertions.

Create a Working Directory¶

We start with creating a working folder (aptly named my_project) in which we will do our work. (Note: should you have a folder of that name, it will be deleted and re-initialized).

We choose the project folder as our working directory. Any file we create will be created in that folder.

Initialize Git¶

We set up a local Git repository in our local project folder.

We are now ready to commit our first version. Here's the initial definition of remove_html_markup() from the introduction to debugging.

The function write_source() takes a function fun and writes its source code into a file of the same name – in our case, remove_html_markup.py:

Here is write_source() in action:

With git add and git commit, we add the file to our version repository. The -m option defines a message for the commit; this is how we (and potential co-workers) can later retrieve information on what has changed, and why. (The messages we use here are deliberately kept short.)

Let us now take the second (buggy) version of remove_html_markup() and again write this into our file, thus simulating changing the source code from the first version to the new version:

We can inspect the differences between the previously committed version and the current one. Lines prefixed with + are added; lines prefixed with - are deleted.

We can now commit this second version, adding it to our repository.

We create a few more revisions.

Here comes the last version of remove_html_markup(), this one from the chapter on assertions.

We finally reached the "today" state with the latest version – and find that the latest version has an error. This should come to you as no surprise if you have read the earlier chapters. But if you haven't, you will find that when the argument s contains double quotes, these are stripped from the output:

Consequently, this test assertion fails:

Note that the failure does not occur in the very first version, as introduced above. So the simple question is:

• What is the change that caused the failure?

Accessing Versions¶

To find out the failure-inducing change, we first need to be able to access older versions. The command

git log

gives us a listing of all commits:

Using the subprocess module, we can run git log and access its output.

The output of git log contains the ID of the version (the so-called commit hash) as well as the message provided during the commit.

Each hash uniquely identifies a version, and is required to access it. Let us create a list versions, where versions[0] contains the hash (the id) of the first version, versions[1] the second version, and so on.

We can now check out the first version:

If we read in this definition of remove_html_markup() from the first version, we will find that the failure was not yet present:

However, if we check out the last version of that file ...

... we find that this is the version that no longer works.

Manual Bisecting¶

As stated above, we could now go and try out one version after another to see with which version the bug was introduced. But again, proceeding in such a linear fashion would be very inefficient. It is much better to proceed by binary search: If you know that version $v_n$ passed, and version $v_m$ failed (with $m >n$), then test a version $v' = v_{n + (m - n)/2}$ that is right in the middle between the two.

• If $v'$ passes, then repeat the process with $v'$ and $v_m$.
• If $v'$ fails, then repeat the process with $v_n$ and $v'$.

Such bisecting quickly progresses towards the failure-inducing version, as it requires you to take only a logarithmic number of tests. In contrast, progressing linearly through the version history requires a test for each version, which is far more effort.

If you use the git version control system, such bisecting is actually a built-in feature, coming to you through the git bisect command. Let us illustrate how git bisect quickly identifies the version that introduced the error.

A bisecting section with git starts with the command bisect start.

Then, you use git bisect good to identify the version that worked, and git bisect bad to identify the version that was bad – in our case, the hashes of the first and last version.

We find that git bisect automatically has checked out the middle version between the passing and the failing one – in our case, version 4 – and now asks us to assess this version.

The version is already in our working folder:

We now need to test this version, and let git bisect know the outcome – with

git bisect good

if the test passes, and with

git bisect bad

if the test fails.

It turns out that this version fails:

So we enter git bisect bad:

git bisect has chosen version 3 to assess – again in the middle between a passing and a failing version:

So let us test this version and find that it fails, too:

We mark the version as bad. git bisect then checks out version 2 as the last version to assess.

When we test version 2, we find that it fails as well:

Hence, version 2 is the version that introduced the error.

When we let git bisect know that this version fails, it tells us that this version is indeed the "first bad commit":

By comparing this version against the older one, we can see the lines it introduced – namely (buggy) handling of double quotes:

Now that we have identified the failure-inducing change ("something is wrong in remove_html_markup(), and it has to do with quote handling"), we can end our git bisect session. git bisect reset gets us back to the start, such that we can fix the most recent version.

Automatic Bisecting¶

Even though manual bisecting can be quick, we can speed things up by writing a script that does the testing for us. With such a script, we can have git bisect run fully automatically.

A test script to automate bisecting does the following:

• It (re)builds the program under test for the given version
• It tests whether the failure is present.

Its exit code indicates the test outcome:

• 0 means "good" (the failure did not occur)
• 1 means "bad" (the failure did occur)
• 125 means "undetermined" (we cannot decide if the failure is present or not)

The latter ("undetermined") case may occur if the program fails to build, or shows some other behavior.

We use a Python script test.py that reads in remove_html_markup.py and then tests for the presence or absence of the failure. (Since this is Python, we don't have to rebuild things.)

Right now, we are with version 8 and thus in the "failing" state – our script exits with a code of 1:

Let us use our test script to bisect automatically. As with manual bisecting, we first have to tell git bisect which the good (passing) and bad (failing) versions are:

Now, we can make use of our script. git bisect run <script> automatically determines the failing version. In our case, <script> is python test.py, and it produces the failing version in less than a second:

Again, we are at version 2, and can investigate the failure-inducing change:

With git bisect run as well, we have to end our bisecting session:

Computing and Applying Patches¶

Even if a version control system allows us to identify the change that introduced the failure, a single change between versions can still affect multiple locations. The change between version 1 and version 2 of remove_html_markup(), above, for instance, affects four separate locations in a single function. In the real world, changes between versions may affect dozens or even hundreds of locations. The question is:

• Can we break down changes further down to individual locations?

The answer is yes! But for this, we first need a means to break down changes into smaller parts. These parts are called patches – differences in individual code locations that can be determined and applied individually.

To illustrate how to compute and apply patches, let us have an example. We access the source code of the first and second version of remove_html_markup(), respectively:

Patches are what a tool like diff produces when comparing two files (or git diff when comparing two versions). Here, we see that the difference between the two files consists of four patches, each one affecting a different line in the program.

We'd like to compute and apply such patches without the help of an external program. To this end, we use Google's diff-match-patch library.

By default, the diff-match-patch library is set up for comparing character strings, not lines; so we have to use a special workaround. Our diff() function computes a set of line patches between the two texts s1 and s2:

We can use our diff() function to compare the two versions of remove_html_markup(). We obtain four patch_obj patch objects:

To inspect these patches, one can simply print() them; however, their string representation uses URL encoding for special characters. We introduce a patch_string() function that decodes them again, and then print out the four patches:

Each patch comes with a location (the part between @@ characters as a character offset into the string) and a change (prefixed by + for added lines or - for deleted lines) in a particular context (notably, the preceding and following line).

This context allows us to apply patches even if the location no longer exactly matches – the last patch, for instance, introducing elif c == '"'..., for instance, is applied between the lines tag = False and the next elif.

We define a patch() function that applies a list of patches to a string, again wrapping around the function provided by the diff-match-patch library.

Here's how to use patch(). First, if we apply all patches between version 1 and version 2 on version 1, we get version 2:

Applying no patch leaves the content unchanged.

However, one can also apply partial sets of patches. For instance, if we only apply the first patch...

... we find that the result includes the added line quote = False, but nothing else:

Likewise, we can also apply the second patch individually:

Delta Debugging on Patches¶

With the ability to apply arbitrary sets of patches, we can now go and apply Delta Debugging to identify failure-inducing patches. The idea is simple: If applying no patch makes the test pass, and applying all patches makes the test fail, then we can use Delta Debugging to identify a minimal set of failure-inducing patches.

Let us write a testing function that checks for the presence of the failure. test_remove_html_markup_patches()

• takes a list of patches,
• applies them on version 1,
• reads in the definition of remove_html_markup()
• and then invokes it to check if the error is present.

If no patches are applied, we are at version 1, and the error is not present.

If all patches are applied, we are at version 2, and the error is present.

A Minimal Set of Patches¶

We can now apply delta debugging on the list of patches, simply by invoking a DeltaDebugger:

This is the minimal set of failure-inducing patches:

This is the resulting code. We see that the changes to the conditions (if c == '<' and if c == '>') are not necessary to produce the failure – our test string has no HTML tags.

Hence, we have now narrowed down our failure-inducing changes from four patches down to two.

A Minimal Difference¶

Can we narrow this down even further? Yes, we can! The idea is to not only search for the minimal set of patches to be applied on the passing version, but to actually seek a minimal difference between two patch sets. That is, we obtain

• one set of passing patches that, when applied, still passes;
• one set of failing patches that, when applied, fails;

with a minimal difference between the two. This minimal difference is what causes the failure.

We obtain such two sets (as well as their difference) by using the min_arg_diff() method of the DeltaDebugger.

This is remove_html_markup[) with the passing set applied. We see that the variable quote is defined at the beginning. This definition is actually a precondition for other patches to result in an executable program; otherwise, the program will fail when the variable quote does not exist.

Here's remove_html_markup() with the failing set applied. We see that now we also have the check for double quotes:

The difference is just this one patch:

And one more time, we are pointed to the buggy line that introduced the error.

A ChangeDebugger class¶

Let us put all these steps together in a single class. The ChangeDebugger is a derivative of CallCollector which takes two source files (one passing, one failing).

From CallCollector, it inherits the ability to inspect a single function call...

... and to repeat it at will.

We can access the passing source, the failing source, and the list of patches:

For testing, we do not apply Delta Debugging on the function under test – that would reduce the function's arguments. (It would still be neat, but that's not what we're aiming for here.)

Instead, we introduce a method test_patches() that gets a set of patches, applies them, reads in the resulting source, and (re-)calls the function.

For completeness, we ensure that at the beginning of the with block, we assume the failing source:

Here's test_patches() in action. As before, if we apply no patches, the test passes; if we apply all patches, it fails.

Now for the actual debugging. We introduce a method min_patches() in which we invoke a DeltaDebugger on the test_patches() method we just defined. Using min_arg.diff(), it then computes a minimal failure-inducing difference between the patches.

The __repr__() method, turning a ChangeDebugger into a readable string, computes min_patches() and returns a user-readable representation of the patches:

Here's how to use these methods. First, we invoke ChangeDebugger with the given old and new source code versions on our test function.

These are the patches we determined:

We invoke min_patches to obtain a minimal set of patches:

We can inspect the failure-inducing patches right away:

Or – even simpler – we can simply print out the ChangeDebugger to obtain a readable representation.

Success!

Does this also work for longer change histories? Let's take the very first and the very last version.

We start with 5 patches:

Printing out the debugger again reveals a single failure-inducing change – it's actually still the same.

We close with a bit of housekeeping, ensuring that the preconditions are properly met.

With this, we're done. Enjoy debugging changes!

Lessons Learned¶

• If one has a version history available, one can use it to determine failure-inducing changes.
• Bisecting with git effectively isolates failure-inducing commits, both manually and automatically.
• Delta debugging on changes allows further isolating minimal sets of failure-inducing changes.

Next Steps¶

This concludes our applications of Delta Debugging. In the next chapters, we will analyze how to abstract failure-inducing inputs into failure-inducing input sets.

Background¶

The concept of "bisecting" as traversing a version history to identify failure-inducing changes was first described by Brian Ness and Viet Ngo from Cray Research as "Source change isolation" [Ness et al, 1997]. The abstract of their paper summarizes the goals and benefits:

Effective regression containment is an important factor in the design of development and testing processes for large software projects, especially when many developers are doing concurrent work on a common set of sources. Source change isolation provides an inexpensive, mechanical alternative to analytical methods for identifying the cause of software regressions. It also provides the advantage of enabling regressions to be eliminated by reversing the effect of source changes that introduced errant behavior, without the need to write new code, and without halting other development work on the same software. Deliverability is also improved.

Delta Debugging on changes (and also Delta Debugging) was introduced in "Yesterday, my program worked. Today, it does not. Why?" [Zeller et al, 1999], a paper which would win an ACM SIGSOFT Impact Paper Award ten years later. This paper generalized over [Ness et al, 1997] by identifying failure-inducing differences in arbitrary sets of changes. [Zeller et al, 2002] generalized the algorithm to work on inputs and other collections (including changes); the chapter on delta debugging, which we use in this chapter, uses the [Zeller et al, 2002] formulation of the dd algorithm.

We're done, so we clean up a bit:

Exercises¶

Exercise 1: Fine-Grained Changes¶

Instead of computing patches on lines (as we and most diff programs do), one can also compute fine-grained diffs, using our diff() function with mode='chars'. Would this make sense?

Exercise 2: Failure-Inducing Changes in the Large¶

Our ChangeDebugger class works on two versions of one class, function, or module, but not on versions of an entire project. Extend ChangeDebugger to a class DiffDebugger that can actually take two directories (including differences in subdirectories with added and deleted files) and determine failure-inducing differences between them. This would allow checking out two versions of a project and determine failure-inducing differences.

Note that applying delte debugging on large sets of differences is a time-consuming task, since

• Every test requires a rebuild and rerun of the code; and
• There are many ways to cause inconsistencies by applying random changes.

Refer to [Zeller et al, 1999] for some hints on how to make this efficient.

Exercise 3: Hierarchical Change Debugging¶

Rather than running Delta Debugging on all changes between two projects (as with DiffDebugger, above), it can be wise to first progress along the change history (as with git bisect) and only then run Delta Debugging on the remaining changes.

Building on DiffDebugger, implement a class GitDebugger that takes two version identifiers (= the "good" and "bad" hashes in git bisect) and a test (like ChangeDebugger) and then

1. runs git bisect to narrow down the failure-inducing commit
2. runs ChangeDebugger to further narrow down the failure-inducing change within the failure-inducing commit.

This gives you the best of two worlds: The failure-inducing commit is quickly identified; and the additional ChangeDebugger run provides even more fine-grained details, albeit at the expense of (potentially several) additional tests.