Dissertation Taming Android App Crashes
Total Page：16
File Type：pdf, Size：1020Kb
PhD-FSTM-2021-018 The Faculty of Science, Technology and Medicine Dissertation Presented on the 01/04/2021 in Luxembourg to obtain the degree of Docteur de l’Université du Luxembourg en Informatique by Pingfan KONG Born on 5th March 1991 in Hefei, China Taming Android App Crashes Dissertation Defense Committee Dr. Jacques Klein, Dissertation Supervisor Associate Professor, Université du Luxembourg, Luxembourg Dr. Tegawendé Bissyandé, Chairman Associate Professor, Université du Luxembourg, Luxembourg Dr. Li Li, Vice Chairman Assistant Professor, Monash University, Australia Dr. Leonardo Mariani Professor, University of Milano–Bicocca, Italy Dr. Ting Su Professor, East China Normal University, China Abstract App crashes constitute an important deterrence for app adoption in the android ecosystem. Yet, Android app developers are challenged by the limitation of test automation tools to ensure that released apps are free from crashes. In recent years, researchers have proposed various automation approaches in the literature. Unfortunately, the practical value of these approaches have not yet been confirmed by practitioner adoption. Furthermore, existing approaches target a variety of test needs which are relevant to different sets of problems, without being specific to app crashes. Resolving app crashes implies a chain of actions starting with their reproduction, followed by the associated fault localization, before any repair can be attempted. Each action however, is challenged by the specificity of Android. In particular, some specific mechanisms (e.g., callback methods, multiple entry points, etc.) of Android apps require Android-tailored crash-inducing bug locators. Therefore, to tame Android app crashes, practitioners are in need of automation tools that are adapted to the challenges that they pose. In this respect, a number of building blocks must be designed to deliver a comprehensive toolbox. First, the community lacks well-defined, large-scale datasets of real-world app crashes that are reproducible to enable the inference of valuable insights, and facilitate experimental validations of literature approaches. Second, although bug localization from crash information is relatively mature in the realm of Java, state-of-the-art techniques are generally ineffective for Android apps due to the specificity of the Android system. Third, given the recurrence of crashes and the substantial burden that they incur for practitioners to resolve them, there is a need for methods and techniques to accelerate fixing, for example, towards implementing Automated Program Repair (APR). Finally, the above chain of actions is for curative purposes. Indeed, this "reproduction, localization, and repair" chain aims at correcting bugs in released apps. Preventive approaches, i.e., approaches that help developers to reduce the likelihood of releasing crashing apps, are still absent. In the Android ecosystem, developers are challenged by the lack of detailed documentation about the complex Android framework API they use to develop their apps. For example, developers need support for precisely identifying which exceptions may be triggered by APIs. Such support can further alleviate the challenge related to the fact that the condition under which APIs are triggered are often not documented. In this context, the present dissertation aims to tame Android crashes by contributing to the following four building blocks: • Systematic Literature Review on automated app testing approaches: We aim at providing a clear overview of the state-of-the-art works around the topic of Android app testing, in an attempt to highlight the main trends, pinpoint the main methodologies applied and enumerate the challenges faced by the Android testing approaches as well as the directions where the community effort is still needed. To this end, we conduct a Systematic Literature Review (SLR) during which we eventually identified 103 relevant research papers published in leading conferences and journals until 2016. Our thorough examination of the relevant literature has led to several findings and highlighted the challenges that Android testing researchers should strive to address in the future. After that, we further propose a few concrete research directions where i testing approaches are needed to solve recurrent issues in app updates, continuous increases of app sizes, as well as the Android ecosystem fragmentation. • Locating Android app crash-inducing bugs: We perform an empirical study on 500 framework- specific crashes from an open benchmark. This study reveals that 37 percent of the crash types are related to bugs that are outside the crash stack traces. Moreover, Android programs are a mixture of code and extra-code artifacts such as the Manifest file. The fact that any artifact can lead to failures in the app execution creates the need to position the localization target beyond the code realm. We propose ANCHOR, a two-phase suspicious bug location suggestion tool. ANCHOR specializes in finding crash-inducing bugs outside the stack trace. ANCHOR is lightweight and source code independent since it only requires the crash message and the apk file to locate the fault. Experimental results, collected via cross-validation and in-the-wild dataset evaluation, show that ANCHOR is effective in locating Android framework-specific crashing faults. • Mining Android app crash fix templates: We propose a scalable approach, CraftDroid, to mine crash fixes by leveraging a set of 28 thousand carefully reconstructed app lineages from app markets, without the need for the app source code or issue reports. We develop a replicative testing approach that locates fixes among app versions which output different runtime logs with the exact same test inputs. Overall, we have mined 104 relevant crash fixes, further abstracted 17 fine-grained fix templates that are demonstrated to be effective for patching crashed apks. Finally, we release ReCBench, a benchmark consisting of 200 crashed apks and the crash replication scripts, which the community can explore for evaluating generated crash-inducing bug patches. • Documenting framework APIs’ unchecked exceptions: We propose Afuera, an automated tool that profiles Android framework APIs and provides information on when they can potentially trigger unchecked exceptions. Afuera relies on a static-analysis approach and a dedicated algorithm to examine the entire Android framework. With Afuera, we confirmed that 26 739 unique unchecked exception instances may be triggered by invoking 5 467 (24%) Android framework APIs. Afuera further analyzes the Android framework to inform about which parameter(s) of an API method can potentially be the cause of the triggering of an unchecked exception. To that end, Afuera relies on fully automated instrumentation and taint analysis techniques. Afuera is run to analyze 50 randomly sampled APIs to demonstrate its effectiveness. Evaluation results suggest that Afuera has perfect true positive rate. However, Afuera is affected by false negatives due to the limitation of state-of-the-art taint analysis techniques. ii Have a greater perspective of things that are greater than myself. Acknowledgements This dissertation would not have been possible without the support of many people who in one way or another have contributed and extended their precious knowledge and experience in my PhD studies. It is my pleasure to express my gratitude to them. First of all, I would like to express my deepest thanks to my supervisor, Assoc. Prof. Jacques Klein, who has given me this great opportunity to come across continents to pursue my doctoral degree. He has always trusted and supported me with his great kindness throughout my whole PhD journey. Second, I am equally grateful to my daily advisers, Assoc. Prof. Tegawendé Bissyandé and Asst. Prof. Li Li, who have introduced me into the world of Android. Since then, working in this field is just joyful for me. They have taught me how to perform research, how to write technical papers, and how to conduct fascinating presentations. Their dedicated guidance has made my PhD journey a fruitful and fulfilling experience. I am very happy for the friendship we have built up during the years. Third, I would like to extend my thanks to all my co-authors including Prof. Yves Le Traon, Dr. Jun Gao, Dr. Kui Liu, Dr. Kevin Allix, Dr. Médéric Hurier, Dr. Alexander Bartel, Mr. Timothée Riom, Ms. Yanjie Zhao, and Mr. Jordan Samhi for their valuable discussions and collaborations. I would like to thank all the members of my PhD defense committee, including Prof. Leonardo Mariani, Prof. Ting SU, my supervisor Assoc. Prof. Jacques Klein, and my daily advisers Assoc. Prof. Tegawendé Bissyandé and Asst. Prof. Li Li. It is my great honor to have them in my defense committee and I appreciate very much their efforts to examine my dissertation and evaluate my PhD work. I would like to also express my great thanks to all the friends that I have made in the Grand Duchy of Luxembourg for the memorable moments that we have had. More specifically, I would like to thank all the team members of TRuX and SerVal at SnT for the great coffee breaks and interesting discussions. I would also like to thank the team under Asst. Prof. Li Li in Monash University for the insightful discussions. Finally, I would like to thank my wife and my daughter for bringing the everlasting joy and happiness to my everyday life. Pingfan Kong University of Luxembourg April 2021 v Contents List of figures xi List of tables xiii Contents xiii 1 Introduction 1 1.1 Motivation.........................................2