Detecting ErrorHandling Bugs without Error Specification Input Most software systems frequently encounter errors when interacting with their environments. When errors occur, errorhandling code must execute flawlessly to facilitate system recovery. Implementing correct error handling is repetitive but nontrivial, and developers often inadvertently introduce bugs into errorhandling code. Existing tools require correct error specifications to detect errorhandling bugs. Manually generating error specifications is errorprone and tedious, while automatically mining error specifications is hard to achieve a satisfying accuracy. In this paper, we propose EHMiner, a novel and practical tool that can automatically detect errorhandling bugs without the need for error specifications. Given a function, EHMiner mines its errorhandling rules when the function is frequently checked by an equivalent condition, and handled by the same action. We applied EHMiner to 117 applications across 15 software domains. EHMiner mined errorhandling rules with the precision of 91.1% and the recall of 46.9%. We reported 142 bugs to developers, and 106 bugs had been confirmed and fixed at the time of writing. We further applied EHMiner to Linux kernel, and reported 68 bugs for kernel4.17, of which 42 had been confirmed or fixed.

SCMiner: Localizing SystemLevel Concurrency Faults from Large System Call Traces Localizing concurrency faults that occur in production is hard because, (1) detailed field data, such as user input, file content and interleaving schedule, may not be available to developers to reproduce the failure; (2) it is often impractical to assume the availability of multiple failing executions to localize the faults using existing techniques; (3) it is challenging to search for buggy locations in an application given limited runtime data; and, (4) concurrency failures at the system level often involve multiple processes or event handlers (e.g., software signals), which can not be handled by existing tools for diagnosing intraprocess(threadlevel) failures. To address these problems, we present SCMiner, a practical online bug diagnosis tool to help developers understand how a systemlevel concurrency fault happens based on the logs collected by the default system audit tools. SCMiner achieves online bug diagnosis to obviate the need for offline bug reproduction. SCMiner does not require code instrumentation on the production system or rely on the assumption of the availability of multiple failing executions. Specifically, after the system call traces are collected, SCMiner uses data mining and statistical anomaly detection techniques to identify the failureinducing system call sequences. It then maps each abnormal sequence to specific application functions. We have conducted an empirical study on 19 realworld benchmarks. The results show that SCMiner is both effective and efficient at localizing systemlevel concurrency faults.