REFERENCES [21]C.Sun.V.Le,and Z.Su,"Finding and analyzing compiler warning de- fects,"in Proceedings of the 38th International Conference on Software [1]J.C.Miller and C.J.Maloney,"Systematic mistake analysis of digital Engineering.ser.ICSE'16.New York.NY.USA:ACM,2016.pp computer programs,"Commun.ACM,vol.6,no.2,pp.58-63,Feb 203-213. 1963. [221 "Gcc."https://gcc.gnu.org/. [2]M.Gligoric.A.Groce,C.Zhang.R.Sharma,M.A.Alipour.and [23]"Gcov."https://gcc.gnu.org/onlinedocs/gcc/Gcov.html D.Marinov,"Guidelines for coverage-based comparisons of non- [24]"Testwell ctc++,"http://www.testwell.fi/ctcdesc.html adequate test suites,"ACM Trans.Soffw.Eng.Methodol..vol.24,no.4. 25 "Covtool,"http://covtool.sourceforge.net/. pp.22:1-22:33.Sep.2015. [26 [3]G.Fraser,M.Staats,P.McMinn,A.Arcuri,and F.Padberg."Does "Jcov,"https://wiki.openjdk.java.net/display/CodeTools/jcov. [27]“Jacoco,”https:/www.jacoco.org automated white-box test generation really help software testers?"in [28]"Emma:a free java code coverage tool,"http://emma.sourceforge.net/. Proceedings of the 2013 International Symposium on Software Testing 29 "Atlassian clover,"https://www.atlassian.com/software/clover. and Analysis,ser.ISSTA 2013.New York,NY,USA:ACM.2013,pp [30 29-30 "Codecover,"http://codecover.org/ [4]S.Yoo and M.Harman,"Regression testing minimization,selection and [311 “Openclover,.”http://openclover..org/ prioritization:A survey."Sofnw.Test.Verif.Reliab..vol.22.no.2.pp. 1321 P.Ammann and J.Offutt.Introduction to software testing.Cambridge 67-120.Mar.2012. University Press.2016. [5]J.A.Jones and M.J.Harrold,"Empirical evaluation of the tarantula [33]G.J.Myers,T.Badgett.T.M.Thomas,and C.Sandler.The art of automatic fault-localization technique,"in Proceedings of the 20th sofrware testing.Wiley Online Library,2004,vol.2. IEEE/ACM Interational Conference on Automated Software Engineer- [34]J.A.Jones and M.J.Harrold,"Test-suite reduction and prioritization for ing,ser.ASE'05.New York,NY.USA:ACM.2005,pp.273-282. modified condition/decision coverage,"IEEE Trans.Softw.Eng..vol.29. [6]G.Fraser and A.Arcuri,"A large-scale evaluation of automated unit test no.3,Pp.195-209,Mar.2003. generation using evosuite."ACM Trans.Sofw.Eng.Methodol.,vol.24. [35]L.Zhang.D.Marinov,L.Zhang,and S.Khurshid,"Regression muta- no.2,Pp.8:1-8:42.Dec.2014. tion testing."in Proceedings of the 2012 International Symposium on [7]V.Le,M.Afshari,and Z.Su,"Compiler validation via equivalence Software Testing and Analysis,ser.ISSTA 2012.New York,NY.USA: modulo inputs,"in Proceedings of the 35th ACM SIGPLAN Conference ACM,2012,pp.331-341. on Programming Language Design and Implementation.ser.PLDI'14. [36]S.Artzi,J.Dolby,F.Tip,and M.Pistoia,"Directed test generation New York.NY.USA:ACM,2014,pp.216-226. for effective fault localization,"in Proceedings of the 19th international [8]M.Bohme,V.-T.Pham,and A.Roychoudhury,"Coverage-based grey symposium on Software testing and analysis. ACM,2010,pp.49-60 box fuzzing as markov chain,"in Proceedings of the 2016 ACM SIGSAC [37]G.Rothermel.R.J.Untch,and C.Chu,"Prioritizing test cases for Conference on Computer and Communications Security,set.CCS'16 regression testing,"IEEE Trans.Softw.Eng.,vol.27,no.10,pp.929- New York.NY.USA:ACM.2016.pp.1032-1043. 948.0ct.2001 [9]D.Hao,L.Zhang.L.Zang.Y.Wang.X.Wu,and T.Xie,"To be optimal [38]W.E.Wong,J.R.Horgan,S.London,and H.A.Bellcore, “A or not in test-case prioritization,"IEEE Trans.Sofrw.Eng.,vol.42,no.5, study of effective regression testing in practice,"in Proceedings of the Pp.490-505,May2016. Eighth International Symposium on Software Reliability Engineering, [10]D.Hao.L.Zhang.L.Zhang,G.Rothermel,and H.Mei."A unified ser.ISSRE'97.Washington,DC,USA:IEEE Computer Society,1997, test case prioritization approach,"ACM Trans.Softw.Eng.Methodol. pp.264274. vol.24.no.2.pp.10:1-10:31,Dec.2014 [39]K.Jamrozik,G.Fraser.N.Tillmann,and J.De Halleux. "Augmented [1I]Z.Zuo,S.-C.Khoo,and C.Sun,"Efficient predicated bug signature dynamic symbolic execution,"in Proceedings of the 27th IEEE/ACM mining via hierarchical instrumentation,"in Proceedings of the 2014 International Conference on Automated Software Engineering,ser.ASE International Symposium on Software Testing and Analysis,set.ISSTA 2012.New York,NY.USA:ACM.2012,pp.254-257 2014. New York.NY.USA:ACM,2014,pp.215-224. [40]C.Lidbury.A.Lascu,N.Chong,and A.F.Donaldson,"Many-core com- [12]Z.Zuo.L.Fang.S.-C.Khoo.G.Xu,and S.Lu."Low-overhead and piler fuzzing,"in Proceedings of the 36th ACM SIGPLAN Conference fully automated statistical debugging with abstraction refinement,"in nguage Design and Implementarion,ser.PLDI15. Proceedings of the 2016 ACM SIGPLAN International Conference on New York,NY,USA:ACM.2015.pp.65-76. Object-Oriented Programming.Systems,Languages,and Applications, [41]Q.Zhang.C.Sun,and Z.Su,"Skeletal program enumeration for rigorous ser.OOPSLA 2016.New York.NY.USA:ACM,2016.pp.881-896. compiler testing."in Proceedings of the 38th ACM SIGPLAN Conference [13]Z.Zuo and S.-C.Khoo."Mining dataflow sensitive specifications,"in on Programming Language Design and Implementation,ser.PLDI 2017. Formal Methods and Soffware Engineering,L.Groves and J.Sun.Eds New York,NY,USA:ACM.2017.pp.347-361 Berlin,Heidelberg:Springer Berlin Heidelberg.2013.pp.36-52. [42]C.Lemieux and K.Sen,"Fairfuzz:A targeted mutation strategy for [14]Y.Li.Z.Su,L.Wang.and X.Li,"Steering symbolic execution to less increasing greybox fuzz testing coverage,"in Proceedings of the 33rd traveled paths."in Proceedings of the 2013 ACM SIGPLAN International ACM/IEEE International Conference on Automated Software Engineer- Conference on Object Oriented Programming Systems Languages &#38. ing.ser.ASE 2018.New York,NY,USA:ACM.2018.pp.475-485. Applications.ser.OOPSLA '13. New York.NY.USA:ACM.2013. [43]X.Xie,T.Y.Chen,F.-C.Kuo,and B.Xu,"A theoretical analysis of pp.19-32. the risk evaluation formulas for spectrum-based fault localization,"ACM [15]Z.Li,M.Harman,and R.M.Hierons,"Search algorithms for regression Trans.Softw.Eng.Methodol.,vol.22,no.4,pp.31:1-31:40,Oct.2013. test case prioritization,"IEEE Trans.Softw.Eng.,vol.33,no.4,pp.225- [44]T.Wang and A.Roychoudhury,"Automated path generation for software 237.Apr.2007 fault localization,"in Proceedings of the 20th IEEE/ACM International [16]"llvm-cov,"https://llvm.org/docs/CommandGuide/llvm-cov.html. Conference on Automated Software Engineering,ser.ASE '05. New 【17]“Clang,”http://clang.vm.org/. York,NY,USA:ACM,2005,pp.347-351. [18]J.Regehr.Y.Chen,P.Cuoq.E.Eide,C.Ellison,and X.Yang, [45]S.Yoo,M.Harman,and D.Clark,"Fault localization prioritization: "Test-case reduction for c compiler bugs,"in Proceedings of the 33rd Comparing information-theoretic and coverage-based approaches,"ACM ACM SIGPLAN Conference on Programming Language Design and Trans.Sofw.Eng.Methodol,vol.22.no.3.pp.19:1-19:29.Jul.2013. Implementation,ser.PLDI '12. New York,NY,USA:ACM,2012. [46]R.Santelices.J.A.Jones,Y.Yu,and M.J.Harrold,"Lightweight 19Ya.Chen.E.Eide.and J.Regehr."Finding and understanding fault-localization using multiple coverage types,"in Proceedings of the 31st International Conference on Software Engineering,ser.ICSE'09 bugs in c compilers,"in Proceedings of the 32Nd ACM SIGPLAN Washington,DC,USA:IEEE Computer Society,2009.pp.56-66. Conference on Programming Language Design and Implementation,ser. [47]J.Xuan and M.Monperrus,"Test case purification for improving fault PLDI '11.New York,NY,USA:ACM,2011,pp.283-294. localization,"in Proceedings of the 22Nd ACM SIGSOFT International [20]Y.Chen,A.Groce.C.Zhang.W.-K.Wong.X.Fern,E.Eide,and Symposium on Foundations of Software Engineering,ser.FSE 2014. J.Regehr,"Taming compiler fuzzers,"in Proceedings of the 34th New York,NY,USA:ACM,2014,pp.52-63. ACM SIGPLAN Conference on Programming Language Design and [48]X.Wang.N.Zeldovich,M.F.Kaashoek.and A.Solar-Lezama,"To Implementation,ser.PLDI '13.New York,NY.USA:ACM.2013 wards optimization-safe systems:Analyzing the impact of undefined Pp.197-208. behavior,"in Proceedings of the Twenty-Fourth ACM Symposium on 498REFERENCES [1] J. C. Miller and C. J. Maloney, “Systematic mistake analysis of digital computer programs,” Commun. ACM, vol. 6, no. 2, pp. 58–63, Feb. 1963. [2] M. Gligoric, A. Groce, C. Zhang, R. Sharma, M. A. Alipour, and D. Marinov, “Guidelines for coverage-based comparisons of non￾adequate test suites,” ACM Trans. Softw. Eng. Methodol., vol. 24, no. 4, pp. 22:1–22:33, Sep. 2015. [3] G. Fraser, M. Staats, P. McMinn, A. Arcuri, and F. Padberg, “Does automated white-box test generation really help software testers?” in Proceedings of the 2013 International Symposium on Software Testing and Analysis, ser. ISSTA 2013. New York, NY, USA: ACM, 2013, pp. 291–301. [4] S. Yoo and M. Harman, “Regression testing minimization, selection and prioritization: A survey,” Softw. Test. Verif. Reliab., vol. 22, no. 2, pp. 67–120, Mar. 2012. [5] J. A. Jones and M. J. Harrold, “Empirical evaluation of the tarantula automatic fault-localization technique,” in Proceedings of the 20th IEEE/ACM International Conference on Automated Software Engineer￾ing, ser. ASE ’05. New York, NY, USA: ACM, 2005, pp. 273–282. [6] G. Fraser and A. Arcuri, “A large-scale evaluation of automated unit test generation using evosuite,” ACM Trans. Softw. Eng. Methodol., vol. 24, no. 2, pp. 8:1–8:42, Dec. 2014. [7] V. Le, M. Afshari, and Z. Su, “Compiler validation via equivalence modulo inputs,” in Proceedings of the 35th ACM SIGPLAN Conference on Programming Language Design and Implementation, ser. PLDI ’14. New York, NY, USA: ACM, 2014, pp. 216–226. [8] M. Bohme, V.-T. Pham, and A. Roychoudhury, “Coverage-based grey- ¨ box fuzzing as markov chain,” in Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, ser. CCS ’16. New York, NY, USA: ACM, 2016, pp. 1032–1043. [9] D. Hao, L. Zhang, L. Zang, Y. Wang, X. Wu, and T. Xie, “To be optimal or not in test-case prioritization,” IEEE Trans. Softw. Eng., vol. 42, no. 5, pp. 490–505, May 2016. [10] D. Hao, L. Zhang, L. Zhang, G. Rothermel, and H. Mei, “A unified test case prioritization approach,” ACM Trans. Softw. Eng. Methodol., vol. 24, no. 2, pp. 10:1–10:31, Dec. 2014. [11] Z. Zuo, S.-C. Khoo, and C. Sun, “Efficient predicated bug signature mining via hierarchical instrumentation,” in Proceedings of the 2014 International Symposium on Software Testing and Analysis, ser. ISSTA 2014. New York, NY, USA: ACM, 2014, pp. 215–224. [12] Z. Zuo, L. Fang, S.-C. Khoo, G. Xu, and S. Lu, “Low-overhead and fully automated statistical debugging with abstraction refinement,” in Proceedings of the 2016 ACM SIGPLAN International Conference on Object-Oriented Programming, Systems, Languages, and Applications, ser. OOPSLA 2016. New York, NY, USA: ACM, 2016, pp. 881–896. [13] Z. Zuo and S.-C. Khoo, “Mining dataflow sensitive specifications,” in Formal Methods and Software Engineering, L. Groves and J. Sun, Eds. Berlin, Heidelberg: Springer Berlin Heidelberg, 2013, pp. 36–52. [14] Y. Li, Z. Su, L. Wang, and X. Li, “Steering symbolic execution to less traveled paths,” in Proceedings of the 2013 ACM SIGPLAN International Conference on Object Oriented Programming Systems Languages & Applications, ser. OOPSLA ’13. New York, NY, USA: ACM, 2013, pp. 19–32. [15] Z. Li, M. Harman, and R. M. Hierons, “Search algorithms for regression test case prioritization,” IEEE Trans. Softw. Eng., vol. 33, no. 4, pp. 225– 237, Apr. 2007. [16] “llvm-cov,” https://llvm.org/docs/CommandGuide/llvm-cov.html. [17] “Clang,” http://clang.llvm.org/. [18] J. Regehr, Y. Chen, P. Cuoq, E. Eide, C. Ellison, and X. Yang, “Test-case reduction for c compiler bugs,” in Proceedings of the 33rd ACM SIGPLAN Conference on Programming Language Design and Implementation, ser. PLDI ’12. New York, NY, USA: ACM, 2012, pp. 335–346. [19] X. Yang, Y. Chen, E. Eide, and J. Regehr, “Finding and understanding bugs in c compilers,” in Proceedings of the 32Nd ACM SIGPLAN Conference on Programming Language Design and Implementation, ser. PLDI ’11. New York, NY, USA: ACM, 2011, pp. 283–294. [20] Y. Chen, A. Groce, C. Zhang, W.-K. Wong, X. Fern, E. Eide, and J. Regehr, “Taming compiler fuzzers,” in Proceedings of the 34th ACM SIGPLAN Conference on Programming Language Design and Implementation, ser. PLDI ’13. New York, NY, USA: ACM, 2013, pp. 197–208. [21] C. Sun, V. Le, and Z. Su, “Finding and analyzing compiler warning de￾fects,” in Proceedings of the 38th International Conference on Software Engineering, ser. ICSE ’16. New York, NY, USA: ACM, 2016, pp. 203–213. [22] “Gcc,” https://gcc.gnu.org/. [23] “Gcov,” https://gcc.gnu.org/onlinedocs/gcc/Gcov.html. [24] “Testwell ctc++,” http://www.testwell.fi/ctcdesc.html. [25] “Covtool,” http://covtool.sourceforge.net/. [26] “Jcov,” https://wiki.openjdk.java.net/display/CodeTools/jcov. [27] “Jacoco,” https://www.jacoco.org/. [28] “Emma: a free java code coverage tool,” http://emma.sourceforge.net/. [29] “Atlassian clover,” https://www.atlassian.com/software/clover. [30] “Codecover,” http://codecover.org/. [31] “Openclover,” http://openclover.org/. [32] P. Ammann and J. Offutt, Introduction to software testing. Cambridge University Press, 2016. [33] G. J. Myers, T. Badgett, T. M. Thomas, and C. Sandler, The art of software testing. Wiley Online Library, 2004, vol. 2. [34] J. A. Jones and M. J. Harrold, “Test-suite reduction and prioritization for modified condition/decision coverage,” IEEE Trans. Softw. Eng., vol. 29, no. 3, pp. 195–209, Mar. 2003. [35] L. Zhang, D. Marinov, L. Zhang, and S. Khurshid, “Regression muta￾tion testing,” in Proceedings of the 2012 International Symposium on Software Testing and Analysis, ser. ISSTA 2012. New York, NY, USA: ACM, 2012, pp. 331–341. [36] S. Artzi, J. Dolby, F. Tip, and M. Pistoia, “Directed test generation for effective fault localization,” in Proceedings of the 19th international symposium on Software testing and analysis. ACM, 2010, pp. 49–60. [37] G. Rothermel, R. J. Untch, and C. Chu, “Prioritizing test cases for regression testing,” IEEE Trans. Softw. Eng., vol. 27, no. 10, pp. 929– 948, Oct. 2001. [38] W. E. Wong, J. R. Horgan, S. London, and H. A. Bellcore, “A study of effective regression testing in practice,” in Proceedings of the Eighth International Symposium on Software Reliability Engineering, ser. ISSRE ’97. Washington, DC, USA: IEEE Computer Society, 1997, pp. 264–274. [39] K. Jamrozik, G. Fraser, N. Tillmann, and J. De Halleux, “Augmented dynamic symbolic execution,” in Proceedings of the 27th IEEE/ACM International Conference on Automated Software Engineering, ser. ASE 2012. New York, NY, USA: ACM, 2012, pp. 254–257. [40] C. Lidbury, A. Lascu, N. Chong, and A. F. Donaldson, “Many-core com￾piler fuzzing,” in Proceedings of the 36th ACM SIGPLAN Conference on Programming Language Design and Implementation, ser. PLDI ’15. New York, NY, USA: ACM, 2015, pp. 65–76. [41] Q. Zhang, C. Sun, and Z. Su, “Skeletal program enumeration for rigorous compiler testing,” in Proceedings of the 38th ACM SIGPLAN Conference on Programming Language Design and Implementation, ser. PLDI 2017. New York, NY, USA: ACM, 2017, pp. 347–361. [42] C. Lemieux and K. Sen, “Fairfuzz: A targeted mutation strategy for increasing greybox fuzz testing coverage,” in Proceedings of the 33rd ACM/IEEE International Conference on Automated Software Engineer￾ing, ser. ASE 2018. New York, NY, USA: ACM, 2018, pp. 475–485. [43] X. Xie, T. Y. Chen, F.-C. Kuo, and B. Xu, “A theoretical analysis of the risk evaluation formulas for spectrum-based fault localization,” ACM Trans. Softw. Eng. Methodol., vol. 22, no. 4, pp. 31:1–31:40, Oct. 2013. [44] T. Wang and A. Roychoudhury, “Automated path generation for software fault localization,” in Proceedings of the 20th IEEE/ACM International Conference on Automated Software Engineering, ser. ASE ’05. New York, NY, USA: ACM, 2005, pp. 347–351. [45] S. Yoo, M. Harman, and D. Clark, “Fault localization prioritization: Comparing information-theoretic and coverage-based approaches,” ACM Trans. Softw. Eng. Methodol., vol. 22, no. 3, pp. 19:1–19:29, Jul. 2013. [46] R. Santelices, J. A. Jones, Y. Yu, and M. J. Harrold, “Lightweight fault-localization using multiple coverage types,” in Proceedings of the 31st International Conference on Software Engineering, ser. ICSE ’09. Washington, DC, USA: IEEE Computer Society, 2009, pp. 56–66. [47] J. Xuan and M. Monperrus, “Test case purification for improving fault localization,” in Proceedings of the 22Nd ACM SIGSOFT International Symposium on Foundations of Software Engineering, ser. FSE 2014. New York, NY, USA: ACM, 2014, pp. 52–63. [48] X. Wang, N. Zeldovich, M. F. Kaashoek, and A. Solar-Lezama, “To￾wards optimization-safe systems: Analyzing the impact of undefined behavior,” in Proceedings of the Twenty-Fourth ACM Symposium on 498