Merge conflicts often occur when developers concurrently change the same code artifacts. While state-of-practice unstructured merge tools (e.g git merge) try to automatically resolve merge conflicts based on textual similarity, semistructured and structured merge tools try to go further by exploiting the syntactic structure and semantics of the involved artifacts. Although there is evidence that semistructured merge has significant advantages over unstructured merge, and that structured merge reports significantly less conflicts than unstructured merge, it is unknown how semistructured merge compares with structured merge. To help developers decide which kind of tool to use, we compare semistructured and structured merge in an empirical study by reproducing more than 40,000 merge scenarios from more than 500 projects. In particular, we assess how often the two merge strategies report different results, we identify conflicts incorrectly reported by one but not by the other (false positives), and conflicts correctly reported by one but missed by the other (false negatives). Our results show that semistructured and structured merge differ on 24% of the scenarios with conflicts. Semistructured merge reports more false positives, whereas structured merge has more false negatives. Finally, we observe that adapting a semistructured merge tool to resolve a particular kind of conflict makes semistructured and structured merge even closer.

Guilherme Cavalcanti

Federal University of Pernambuco, Brazil

Brazil

Paulo Borba

Federal University of Pernambuco, Brazil

Brazil

Georg Seibt

University of Passau

Sven Apel

Saarland University

Germany

Industry widely uses unstructured merge tools that rely on textual analysis to detect and resolve conflicts between code contributions. Semistructured merge tools go further by partially exploring the syntactic structure of code artifacts, and, as a consequence, obtaining significant merge accuracy gains for Java-like languages. To understand whether semistructured merge and the observed gains generalize to other kinds of languages, we implement two semistructured merge tools for JavaScript, and compare them to an unstructured tool. We find that current semistructured merge algorithms and frameworks are not directly applicable for scripting languages like JavaScript. By adapting the algorithms, and studying 10,345 merge scenarios from 50 JavaScript projects on GitHub, we find evidence that our JavaScript tools report fewer spurious conflicts than unstructured merge, without compromising the correctness of the merging process. The gains, however, are much smaller than the ones observed for Java-like languages, suggesting that semistructured merge advantages might be limited for languages that allow both commutative and non-commutative declarations at the same syntactic level.

Alberto Trindade Tavares

Federal University of Pernambuco

Paulo Borba

Federal University of Pernambuco, Brazil

Brazil

Guilherme Cavalcanti

Federal University of Pernambuco, Brazil

Brazil

Sergio Soares

Federal University of Pernambuco

Code clones are already proven as harmful for maintenance and evaluation of software systems such as development and modification of source code, propagation of potential bugs throughout software system and so on. Now a days, a single software system is developing in various programming languages for greater adaptability. In these systems a single functionality is replicated among their varieties; often implemented in different programming languages (cross language clones(CLC)). Consequences of these clones are more severe as they are hard to detect and hard to track their modifications. However, while there are a great many studies for finding clones in the same programming language, there is a marked lack of studies in detecting CLCs. To fill this gap, in this paper, we are going to propose CLCDSA, a CLC detector which can detect CLCs despite any prerequisites or intermediate states. This model analyses different syntactical features of source codes across different programming languages to detect CLC. To support large scale clone data, this model comprises an action filter based on cross language API calls similarity to discard non-potential clones before proceed to the main model. The design methodologies of CLCDSA is two-folded: a. it can detect CLC On the Fly by calculating features’ value similarity; b. it poses a deep neural network based feature vector learning model to learn the features and detect CLC. An early evaluation of this model observed an average precision, recall and F-measure score of 0.55, 0.86 and 0.64 respectively for the On the Fly phase and 0.61, 0.93 and 0.71 for the neural net phase which indicate that CLCDSA has outperformed all the available models in detecting cross language clones.

Kawser Nafi

University of Saskatchewan

Tonny Shekha Kar

University of Saskatchewan, Canada

Banani Roy

University of Saskatchewan

Chanchal K. Roy

University of Saskatchewan

Canada

Kevin Schneider

University of Saskatchewan

COTS software products are widely developed on top of one or more OSS projects, which might lead to OSS reuse vulnerabilities. To discover such vulnerabilities, detecting OSS reuses for COTS software is a necessary step. Existing binary-to-source matching approaches are scalable to tens of thousands of OSS projects. However, when applying to COTS software products, they are suffering from precision problem severely due to their limited code features, imprecise matching score computation and the neglect of code structure of OSS projects. In this paper, we propose a novel binary-to-source matching approach B2SFinder to address these issues. It fully analyzes and selects seven kinds of code features that are presented in both binary file and source code and are not susceptible to compilation. In order to precisely calculate matching scores, it employs a weighted feature matching algorithm that combines three matching methods with two importance-weight computing algorithms. The matching methods are applied to different features according to the representation form of the features. The weighting algorithms compute the weight of a feature instance considering its specificity and occurrence frequency. B2SFinder further identifies the reuse type based on matching scores and code structures of OSS projects. We have implemented a prototype of B2SFinder with optimized data structure. We evaluated it on 21991 binaries of 1000 popular COTS software products. The results showed that it is not only precise but also scalable. It identified up to 2.15 times as many reuse cases as the state-of-the-art approach while only took 53.85 seconds on average for a binary file. It also plays a major role in discovering OSS reuse vulnerabilities.

Muyue Feng

Institute of Information Engineering, Chinese Academy of Sciences

Zimu Yuan

Institute of Information Engineering, Chinese Academy of Sciences

Feng Li

Institute of Computing Technology at Chinese Academy of Sciences, China

Gu Ban

Institute of Information Engineering, Chinese Academy of Sciences

Yang Xiao

Institute of Information Engineering, Chinese Academy of Sciences & School of Cyber Security, University of Chinese Academy of Sciences

Shiyang Wang

Institute of Information Engineering, Chinese Academy of Sciences

Qian Tang

Institute of Information Engineering, Chinese Academy of Sciences

He Su

Institute of Information Engineering, Chinese Academy of Sciences

Chendong Yu

University of Chinese Academy of Sciences

Jiahuan Xu

Institute of Information Engineering, Chinese Academy of Sciences

Aihua Piao

Institute of Information Engineering, Chinese Academy of Sciences

Jingling Xue

UNSW Sydney

Australia

Wei Huo

Institute of Information Engineering, Chinese Academy of Sciences

Code review is an important mechanism for code quality assurance both in open source software and industrial software. Reviewers usually suffer from numerous, tangled and loosely related code changes are bundled in a single commit, which makes code review very difficult. In this paper, we propose CoRA (Code Review Assistant), an automatic approach to decompose a tangled commit into different parts and generate concise descriptions for reviewers. More specifically, CoRA can decompose a commit into independent parts (e.g., bug fixing, new feature adding, or refactoring) by code dependency analysis and tree-based similar-code detection, then identify the most important code changes in each part based on PageRank algorithm and heuristic rules. As a result, CoRA can generate a concise description for each part of the commit. We evaluate our approach in 7 open source software projects and 50 code commits. The results indicate that CoRA can improve the accuracy of decomposing code changes by 6.3% over the state-of-art practice. At the same time, CoRA can identify the important part from the fine-grained code changes with a mean average precision (MAP) of 87.7%. We also conduct a human study with 8 participants to evaluate the performance and usefulness of CoRA, the user feedback indicates that CoRA can effectively help reviewers

Min Wang

Peking University

China

Zeqi Lin

Microsoft Research, China

Yanzhen Zou

Peking University

Bing Xie

Peking University