Large-scale Open Source Projects Research Articles

Why and how bug blocking relations are breakable: An empirical study on breakable blocking bugs

Context:Blocking bugs prevents other bugs from being fixed, which is difficult to repair and negatively impacts software quality. During software maintenance, developers usually try to break the blocking relationship between blocking and blocked bugs, e.g., propose a temporary fix. Object:However, to our knowledge, no studies have investigated why and how blocking relations between bugs are breakable. In this study, we aim to construct an empirical analysis to explore breakable blocking bugs (BBBs). Method:Specifically, we employ quantitative and qualitative analysis to study these BBBs from two aspects. One is to investigate the characteristics of these bugs, and the other is to explore why and how developers break the blocking relationship between bugs during software maintenance. We build a dataset on five large-scale open-source projects and classify bugs into three types (BBBs, normal blocking bugs, and other bugs) to compare the differences between BBBs and other types of bugs. Results:We observe that BBBs have higher levels of involvement, take longer to fix, and involve more complex source code than other bugs. Moreover, we summarize four reasons blocking relationships between bugs are broken, i.e., partial association (41.87%), serious influence (26.40%), time pressure (19.73%), and flawed blocking (12.21%), and three measures developers adopt to break these blocking relationships, i.e., quick patch for blocking bugs (41.33%), quick patch for blocked bugs (38.67%), and ignore the blocking relation and fix blocked bugs directly (20.00%). Conclusion:Through these analyses, it is meaningful for software maintainers to have a deeper understanding of the characteristics and repair practices of BBBs, which will help solve these BBBs effectively in the future.

SeTransformer: A Transformer-Based Code Semantic Parser for Code Comment Generation

Automated code comment generation technologies can help developers understand code intent, which can significantly reduce the cost of software maintenance and revision. The latest studies in this field mainly depend on deep neural networks, such as convolutional neural networks and recurrent neural network. However, these methods may not generate high-quality and readable code comments due to the long-term dependence problem, which means that the code blocks used to summarize information are far from each other. Owing to the long-term dependence problem, these methods forget the previous input data’s feature information during the training process. In this article, to solve the long-term dependence problem and extract both the text and structure information from the program code, we propose a novel improved-Transformer-based comment generation method, named SeTransformer. Specifically, the SeTransformer utilizes the code tokens and an abstract syntax tree (AST) of programs to extract information as the inputs, and then, it leverages the self-attention mechanism to analyze the text and structural features of code simultaneously. Experimental results based on public corpus gathered from large-scale open-source projects show that our method can significantly outperform five state-of-the-art baselines (such as Hybrid-DeepCom and AST-attendgru). Furthermore, we also conduct a questionnaire survey for developers, and the results show that the SeTransformer can generate higher quality comments than those of other baselines.

Multi-Dimension Convolutional Neural Network for Bug Localization

Software bugs remain frequent in the life cycle of software development and maintenance. Automatic localization of buggy source code files is critical for timely bug fixing and improving the efficiency of software quality assurance. Various bug localization techniques have been proposed using different dimensions of features. Recent studies have shown that different dimensions of features may play different roles in bug localization. Unfortunately, how to effectively merge these dimensions of features for improving bug localization has rarely been investigated. This article presents a Multi-Dimension Convolutional Neural Network (MD-CNN) model for bug localization automatically based on a bug report. Our approach has dual-novelty. First, we identify and extract five statistical dimensions of features. Second, we design a Convolutional Neural Network (CNN) model that takes our five statistical dimensions of features as the input and iteratively learns the complex and non-linear relationship between the features and the bug locations. The MD-CNN bug localization model is verified using six large-scale open source projects. The experimental results show that our MD-CNN outperforms the existing representative bug localization techniques in terms of the Mean Average Precision (MAP) and the number of bugs successfully localized in the top 1, 5, and 10 matched source code files.

Toward an Effective Bug Triage System Using Transformers to Add New Developers

As defects become more widespread in software development and advancement, bug triaging has become imperative for software testing and maintenance. The bug triage process assigns an appropriate developer to a bug report. Many automated and semiautomated systems have been proposed in the last decade, and some recent techniques have provided direction for developing an effective triage system. However, these techniques still require improvement. Another open challenge related to this problem is adding new developers to the existing triage system, which is challenging because the developers have no listed triage history. This paper proposes a transformer-based bug triage system that uses bidirectional encoder representation from transformers (BERT) for word representation. The proposed model can add a new developer to the existing system without building a training model from scratch. To add new developers, we assumed that new developers had a triage history created by a manual triager or human triage manager after learning their skills from the existing developer history. Then, the existing model was fine-tuned to add new developers using the manual triage history. Experiments were conducted using datasets from well-known large-scale open-source projects, such as Eclipse and Mozilla, and top-k accuracy was used as a criterion for assessment. The experimental outcome suggests that the proposed triage system is better than other word-embedding-based triage methods for the bug triage problem. Additionally, the proposed method performs the best for adding new developers to an existing bug triage system without requiring retraining using a whole dataset.

A Graph Convolution Network-Based Bug Triage System to Learn Heterogeneous Graph Representation of Bug Reports

Many bugs and defects occur during software testing and maintenance. These bugs should be resolved as soon as possible, to improve software quality. However, bug triage aims to solve these bugs by assigning the reported bugs to an appropriate developer or list of developers. It is an arduous task for a human triager to assign an appropriate developer to a bug report, when there are several developers with different skills, and several automated and semi-automated triage systems have been proposed in the last decade. Some recent techniques have suggested possibilities for the development of an effective triage system. However, these techniques require improvement. In previous work, we proposed a heterogeneous graph representation for bug triage, using word–word edges and word-bug document co-occurrences to build a heterogeneous graph of bug data. Cosine similarity is used to weight the word–word edges. Then, a graph convolution network is used to learn a heterogeneous graph representation. This paper extends our previous work by adopting different similarity metrics and correlation metrics for weighting word–word edges. The method was validated using different small and large datasets obtained from large-scale open-source projects. The top-k accuracy metric was used to evaluate the performance of the bug triage system. The experimental results showed that the point-wise mutual information of the proposed model was better than that of other word–word weighting methods, and our method had better accuracy for large datasets than other recent state-of-the-art methods. The proposed method with point-wise mutual information showed 3% to 6% higher top-1 accuracy than state-of-the-art methods for large datasets.

On the fulfillment of coordination requirements in open-source software projects: An exploratory study

In large-scale open-source software projects, where developers are often distributed across the entire planet, coordination among developers is crucial. To estimate whether a state of socio-technical congruence is achieved, which is associated with software quality and project success, we assess the alignment of collaboration and communication in such software projects in terms of coordination requirements. By means of an empirical study on a substantial set of large-scale open-source software projects—the development histories of all projects sum up to over 180 years—we aim at shedding light on this issue. To this end, to take a more semantic view on this phenomenon in comparison to previous work, we do not only identify coordination requirements arising from files and functions only, but also those arising from features. We found that open-source developers fulfill coordination requirements intentionally, but mostly those coordination requirements that arise from coupled source-code artifacts, while they resolve simpler ones independently. Furthermore, neither of the considered abstraction levels of source-code artifacts (files, functions, features) is more suitable to construct coordination requirements with respect to their fulfillment. This finding strongly indicates that features do not play an as important role in the development process as expected and commonly believed by the research community in the area of feature-oriented and feature-driven development. Finally, we identified notable evolutionary trends in the fulfillment of coordination requirements and showed that far-reaching social events (such as organizational issues) have a huge impact on their fulfillment, both negatively and positively. The key findings of our empirical study are that socio-technical relations are important to understand open-source development communities and that the incorporation of different abstraction levels for developer collaboration does yield important insights to further improve the evolution in open-source software projects.

Stability Assessment Method Considering Fault Fixing Time in Open Source Project

Recently, open source software (OSS) are adopted various situations because of quick delivery, cost reduction and standardization of systems. Many OSS are developed under the peculiar development style known as bazaar method. According to this method, faults are detected and fixed by users and developers around the world, and the fixed result will be reflected in the next release. Also, the fix time of faults tends to be shorter as the development of OSS progresses. However, several large-scale open source projects have a problem that faults fixing takes a lot of time because faults corrector cannot handle many faults reports quickly. Furthermore, imperfect fault fixing sometimes occurs because the fault fixing is performed by various people and environments. Therefore, OSS users and project managers need to know the stability degree of open source projects by grasping the fault fixing time. In this paper, for assessment stability of large-scale open source project, we derive the imperfect fault fixing probability and the transition probability distribution. For derivation, we use the software reliability growth model based on the Wiener process considering that the fault fixing time in open source projects changes depending on various factors such as the fault reporting time and the assignees for fixing faults. In addition, we applied the proposed model to actual open source project data and examined the validity of the model.

Applying Convolutional Neural Networks With Different Word Representation Techniques to Recommend Bug Fixers

Bug triage processes are intended to assign bug reports to appropriate developers effectively, but they typically become bottlenecks in the development process—especially for large-scale software projects. Recently, several machine learning approaches, including deep learning-based approaches, have been proposed to recommend an appropriate developer automatically by learning past assignment patterns. In this paper, we propose a deep learning-based bug triage technique using a convolutional neural network (CNN) with three different word representation techniques: Word to Vector (Word2Vec), Global Vector (GloVe), and Embeddings from Language Models (ELMo). Experiments were performed on datasets from well-known large-scale open-source projects, such as Eclipse and Mozilla, and top-k accuracy was measured as an evaluation metric. The experimental results suggest that the ELMo-based CNN approach performs best for the bug triage problem. GloVe-based CNN slightly outperforms Word2Vec-based CNN in many cases. Word2Vec-based CNN outperforms GloVe-based CNN when the number of samples per class in the dataset is high enough.

ALTRA: Cross-Project Software Defect Prediction via Active Learning and Tradaboost

Cross-project defect prediction (CPDP) methods can be used when the target project is a new project or lacks enough labeled program modules. In these new target projects, we can easily extract and then measure these modules with software measurement tools. However, labeling these program modules is time-consuming, error-prone and requires professional domain knowledge. Moreover, directly using labeled modules in the other projects (i.e., the source projects) can not achieve satisfactory performance due to the large data distribution difference in most cases. In this article, to our best knowledge, we are the first to propose a novel method ALTRA, which can utilize both active learning and TrAdaBoost to alleviate this issue. In particular, we firstly use Burak filter to select similar labeled modules from the source project after analyzing the unlabeled modules in the target project. Then we use active learning to choose representative unlabeled modules from the target project and ask experts to label the type (i.e., defective or non-defective) of these modules. Later, we use TrAdaBoost to determine the weights of labeled modules in the source project and the target project, and then construct the model via weighted support vector machine. After selecting a small number of modules (i.e., only 5% modules) in the target project, we terminate the method ALTRA and return the final constructed model. To show the effectiveness of our proposed method ALTRA, we choose 10 large-scale open-source projects from different application domains. In terms of both F1 and AUC performance indicators, we find ALTRA can perform significantly better than seven state-of-the-art CPDP baselines. Moreover, we also show that the usage of Burak filter, the uncertainty active learning strategy, the class imbalanced learning method and TrAdaBoost are competitive in our proposed method ALTRA.

A Method of Fault Fix Priority Identification for Open Source Project

Open source software are adopted as embedded systems, server usage because of quick delivery, cost reduction and standardization of systems. Many open source software are developed under the peculiar development style known as bazaar method. According to this method, faults are detected and fixed by developers around the world, and the fixed result will be reflected in the next release. Also, the fix time of faults tends to be shorter as the development of open source software progresses. However, several large-scale open source projects have a problem that faults fixing takes a lot of time because the faults corrector cannot handle many faults reports quickly. In this paper, we aim to identify the fix priority of newly registered faults in the bug tracking system by using random forest, and we make an index to detect the faults that require high fix priority and long fault fixing time when faults are reported in specific version of open source project. The index is derived and identified by using open source project data obtained from bug tracking system. In addition, we try to improve the detection accuracy of the proposed index by learning not only the specific version but also the fault report data of the past version by using random forest considering the characteristic similarities of faults fix among different versions. As a result, the detection accuracy has highly improved comparing with using only specific version data and using logistic regression.

Kinect Uygulamaları için Veri Transfer Platformu Tasarımı

In recent years, software, hardware, and algorithms have come to fruition. These developments in technology have also affected sensor technologies. The Kinect sensor, initially marketed as a gaming device, has been met with great interest by both researchers and developers. The Kinect sensor has been used in different areas in the literature for different purposes. All data from the Kinect sensor is transmitted to developers through the Software Development Kit ( SDK ) developed by Microsoft. The Kinect sensor produces between 240 and 270 thousand points per second in normal conditions, depending on scene complexity. The purpose of this work is to design a data transfer platform for Kinect applications. The developed platform works on client server architecture. The platform, which has different scenarios for online and offline communication situations, also offers several filtering and encryption algorithms. The platform uses the Point Cloud Library (PCL), a large-scale open source project for 2D / 3D image and point cloud processing. VoxelGrid (VG) Filter, Outlier Filter, Histogram Based Conditional Filter, Octree-based Compression and PGP Encryption methods are also available on request. In addition, a special data structure has been developed for Kinect applications. WebRTC middleware software is used for online communication. Thanks to all these steps, unnecessary data points have been cleaned, compressed, secured and data packages suitable for the developed data structure have been obtained. Because of the filtering, a compression ratio of 19.96% has been obtained. Application-based or client-based filtering is provided through custom design. A file compression result of 10.38% has been obtained with the file compression approach applied after filtering. The presented platform will provide performance for Kinect applications used by researchers and developers.

Prediction of Fault Fix Time Transition in Large-Scale Open Source Project Data

Open source software (OSS) programs are adopted as embedded systems regarding their server usage, due to their quick delivery, cost reduction, and standardization of systems. Many OSS programs are developed using the peculiar style known as the bazaar method, in which faults are detected and fixed by developers around the world, and the result is then reflected in the next release. Furthermore, the fix time of faults tends to be shorter as the development of the OSS progresses. However, several large-scale open source projects encounter the problem that fault fixing takes much time because the fault corrector cannot handle many fault reports. Therefore, OSS users and project managers need to know the stability degree of open source projects by determining the fault fix time. In this paper, we predict the transition of the fix time in large-scale open source projects. To make the prediction, we use the software reliability growth model based on the Wiener process considering that the fault fix time in open source projects changes depending on various factors such as the fault reporting time and the assignees to fix the faults. In addition, we discuss the assumption that fault fix time data depend on the prediction of the transition in fault fixing time.

Managing to release early, often and on time in the OpenStack software ecosystem

The dictum of “Release early, release often.” by Eric Raymond as the Linux modus operandi highlights the importance of release management in open source software development. However, there are very few empirical studies addressing release management in this context. It is already known that most open source software communities adopt either a feature-based or time-based release strategy. Both have their own advantages and disadvantages that are also context-specific. Recent research reports that many prominent open source software projects have overcome a number of recurrent problems by moving from feature-based to time-based release strategies. In this longitudinal case study, we address the release management practices of OpenStack, a large scale open source project developing cloud computing technologies. We discuss how the release management practices of OpenStack have evolved in terms of chosen strategy and timeframes with close attention to processes and tools. We discuss the number of practical and managerial issues related to release management within the context of large and complex software ecosystems. Our findings also reveal that multiple release management cycles can co-exist in large and complex software ecosystems such as OpenStack.

An empirical study of tactical vulnerabilities

Architectural security tactics (e.g., authorization, authentication) are used to achieve stakeholders’ security requirements. Security tactics allow the system to react, resist, detect and recover from attacks. Flaws in the adoption of these tactics into the system’s architecture, an incorrect implementation of security tactics, or deterioration of tactic implementations over time can introduce severe vulnerabilities that are exploitable by attackers. Therefore, in this work, we present the Common Architectural Weakness Enumeration (CAWE), a catalog of known weaknesses rooted in the design or implementation of security tactics which can result in tactical vulnerabilities. We categorized all known software weaknesses as tactic-related and non-tactic related. This way, our CAWE catalog enumerates common weaknesses in a security architecture that can lead to tactical vulnerabilities. From our CAWE catalog, we found 223 different types of tactical vulnerabilities. In this work, we also used this catalog to study tactical vulnerabilities in three large-scale open source projects: Chromium, PHP, and Thunderbird. In a detailed analysis, we identified the most occurring vulnerability types on these projects. From this study we observed that (i) Improper Input Validation and Improper Access Control were the most occurring vulnerability types in Chromium, PHP and Thunderbird and (ii) “Validate Inputs” and “Authorize Actors” were the security tactics mostly affected by these tactical vulnerabilities. Moreover, in a qualitative analysis of 632 tactical vulnerabilities and their fixes in these systems, we characterized their root causes and investigated the way the original developers of each system fixed these vulnerabilities. From this qualitative analysis, we found 44 distinct root causes that lead to these tactical vulnerabilities. The results of this study not only show how architectural weaknesses in systems have created severe vulnerabilities, but also provide recommendations driven by empirical data for addressing such security problems.

Two-Phase Assessment Approach to Improve the Efficiency of Refactoring Identification

To automate the refactoring identification process, a large number of candidates need to be compared. Such an overhead can make the refactoring approach impractical if the software size is large and the computational load of a fitness function is substantial. In this paper, we propose a two-phase assessment approach to improving the efficiency of the process. For each iteration of the refactoring process, refactoring candidates are preliminarily assessed using a lightweight, fast delta assessment method called the Delta Table. Using multiple Delta Tables, candidates to be evaluated with a fitness function are selected. A refactoring can be selected either interactively by the developer or automatically by choosing the best refactoring, and the refactorings are applied one after another in a stepwise fashion. The Delta Table is the key concept enabling a two-phase assessment approach because of its ability to quickly calculate the varying amounts of maintainability provided by each refactoring candidate. Our approach has been evaluated for three large-scale open-source projects. The results convincingly show that the proposed approach is efficient because it saves a considerable time while still achieving the same amount of fitness improvement as the approach examining all possible candidates.

Efficiently detecting structural design pattern instances based on ordered sequences

In software engineering, a design pattern is a general reusable solution to a commonly occurring problem within a given context in software design. Design patterns reveal much about the high-level abstract designs of software systems. Accurately discovering design pattern instances in software systems helps developers and maintainers to understand the original design and implementation, and to facilitate the re-development, upgrade and maintenance. In recent years, numerous approaches have been proposed to discover design pattern instances from system source code. Among them, many transform the source code and design patterns into graphs, and then discover the isomorphic sub-graphs of design patterns from the graph of software system. However, as testing sub-graph isomorphism is an NP-complete problem, those approaches usually fail to achieve satisfactory efficiency. On the other hand, a real time response of detecting pattern instance is in fact essential. To address this problem, we propose a novel efficient approach to detect structural design pattern instances based on directed sub-graph isomorphism. In particular, we put forward a well-designed search order, or Ordered Sequences, by which the candidate pattern instances can be rapidly detected. Because the Ordered Sequences guide the search process in such an order that the most representative classes are discovered first, a large number of irrelevant classes can be filtered out at early stage, which greatly reduces the search space. We employ our approach on four well-known open-source systems. The results of extensive experiments for discovering instances of all GoF structural design patterns verify that our approach obtains 100% recall and the high precision. In addition, the experiment conducted on two other large scale open-source projects indicates that our approach runs significantly faster than the compared approach.

Preventing Defects: The Impact of Requirements Traceability Completeness on Software Quality

Requirements traceability has long been recognized as an important quality of a well-engineered system. Among stakeholders, traceability is often unpopular due to the unclear benefits. In fact, little evidence exists regarding the expected traceability benefits. There is a need for empirical work that studies the effect of traceability. In this paper, we focus on the four main requirements implementation supporting activities that utilize traceability. For each activity, we propose generalized traceability completeness measures. In a defined process, we selected 24 medium to large-scale open-source projects. For each software project, we quantified the degree to which a studied development activity was enabled by existing traceability with the proposed measures. We analyzed that data in a multi-level Poisson regression analysis. We found that the degree of traceability completeness for three of the studied activities significantly affects software quality, which we quantified as defect rate. Our results provide for the first time empirical evidence that more complete traceability decreases the expected defect rate in the developed software. The strong impact of traceability completeness on the defect rate suggests that traceability is of great practical value for any kind of software development project, even if traceability is not mandated by a standard or regulation.

Augmenting Bug Localization with Part-of-Speech and Invocation

Bug localization represents one of the most expensive, as well as time-consuming, activities during software maintenance and evolution. To alleviate the workload of developers, numerous methods have been proposed to automate this process and narrow down the scope of reviewing buggy files. In this paper, we present a novel buggy source-file localization approach, using the information from both the bug reports and the source files. We leverage the part-of-speech features of bug reports and the invocation relationship among source files. We also integrate an adaptive technique to further optimize the performance of the approach. The adaptive technique discriminates Top 1 and Top N recommendations for a given bug report and consists of two modules. One module is to maximize the accuracy of the first recommended file, and the other one aims at improving the accuracy of the fixed defect file list. We evaluate our approach on six large-scale open source projects, i.e. ASpectJ, Eclipse, SWT, Zxing, Birt and Tomcat. Compared to the previous work, empirical results show that our approach can improve the overall prediction performance in all of these cases. Particularly, in terms of the Top 1 recommendation accuracy, our approach achieves an enhancement from 22.73% to 39.86% for ASpectJ, from 24.36% to 30.76% for Eclipse, from 31.63% to 46.94% for SWT, from 40% to 55% for ZXing, from 7.97% to 21.99% for Birt, and from 33.37% to 38.90% for Tomcat.

Evaluating the Effects of Architectural Documentation: A Case Study of a Large Scale Open Source Project

Sustaining large open source development efforts requires recruiting new participants; however, a lack of architectural documentation might inhibit new participants since large amounts of project knowledge are unavailable to newcomers. We present the results of a multitrait, multimethod analysis of the effects of introducing architectural documentation into a substantial open source project—the Hadoop Distributed File System (HDFS). HDFS had only minimal architectural documentation, and we wanted to discover whether the putative benefits of architectural documentation could be observed over time. To do this, we created and publicized an architecture document and then monitored its usage and effects on the project. The results were somewhat ambiguous: by some measures the architecture documentation appeared to effect the project but not by others. Perhaps of equal importance is our discovery that the project maintained, in its web-accessible JIRA archive of software issues and fixes, enough architectural discussion to support architectural thinking and reasoning. This “emergent” architecture documentation served an important purpose in recording core project members’ architectural concerns and resolutions. However, this emergent architecture documentation did not serve all project members equally well; it appears that those on the periphery of the project—newcomers and adopters—still require explicit architecture documentation, as we will show.

An efficient approach to identify multiple and independent Move Method refactoring candidates

ContextApplication of a refactoring operation creates a new set of dependency in the revised design as well as a new set of further refactoring candidates. In the studies of stepwise refactoring recommendation approaches, applying one refactoring at a time has been used, but is inefficient because the identification of the best candidate in each iteration of refactoring identification process is computation-intensive. Therefore, it is desirable to accurately identify multiple and independent candidates to enhance efficiency of refactoring process. ObjectiveWe propose an automated approach to identify multiple refactorings that can be applied simultaneously to maximize the maintainability improvement of software. Our approach can attain the same degree of maintainability enhancement as the method of the refactoring identification of the single best one, but in fewer iterations (lower computation cost). MethodThe concept of maximal independent set (MIS) enables us to identify multiple refactoring operations that can be applied simultaneously. Each MIS contains a group of refactoring candidates that neither affect (i.e., enable or disable) nor influence maintainability on each other. Refactoring effect delta table quantifies the degree of maintainability improvement each elementary candidate. For each iteration of the refactoring identification process, multiple refactorings that best improve maintainability are selected among sets of refactoring candidates (MISs). ResultsWe demonstrate the effectiveness and efficiency of the proposed approach by simulating the refactoring operations on several large-scale open source projects such as jEdit, Columba, and JGit. The results show that our proposed approach can improve maintainability by the same degree or to a better extent than the competing method, choosing one refactoring candidate at a time, in a significantly smaller number of iterations. Thus, applying multiple refactorings at a time is both effective and efficient. ConclusionOur proposed approach helps improve the maintainability as well as the productivity of refactoring identification.