Finding Resume And Restart Errors In Android . - IBM

Finding Resume and RestartErrors in Android Applications[OOPSLA’16]Iulian NeamtiuNew Jersey Institute of Technologyjoint work with Zhiyong Shan (Univ. of Central Missouri), Tanzirul Azim (MSR)IBM PL Day5/12/16

Smartphone apps have a fundamentally differentlifecycle, compared to desktop/server programsDesktop/serverprograms never killedby the system duringproper operationIBM PL Day5/12/16Android apps are stopped when Pressing Home button Pressing Back button Changing phone’s orientation Receiving phone call Receiving text message etc.Rationale: energy, security, etc.iOS has similar behavior2

Earlier version of Alarm Clock Plus app,more than 5 million installsChange phone orientation, alarm is reset !Or send app to background, then bring to foregroundalarm is reset!Instance data that has to persist across runs - KR dataKR data lost upon restart/resume - KR errorIBM PL Day5/12/163

Example: KR error in DateSlider appBefore restart?After restartIBM PL Day5/12/16mTime is modifiedWhen pressing theBack button,onSaveInstanceState() is not called bythe system thesave operationputLong() is notcalled4

Platform support and save protocolAndroid saves GUI state, invokes user-defined callbacksDevelopers must do the rest, e.g., fill out callbacksConfusing and error-proneonCreate()Android Activity LifecycleNew processCreatedKilled/exit edPausedonResume()onStop()Not guaranteedStoppedonDestroy()Not guaranteedDestroyedonSaveInstanceState()Not guaranteedonRestart()IBM PL Day5/12/165

Define Kill & Restart (KR) hierarchyLevel 1: Pause activityCauses: Display dialogShow drop-down menuCallbacks: onPause()/onResume()onCreate()New processCreatedKilled/exit Resume()onRestart()IBM PL stroy()DestroyedAndroid ActivityLifecycle6

Level 2: Stop activityCauses: Press Home buttonSwitch to another appStart a new activityReceive a phone callCallbacks: onStop()/onRestart()onCreate()New processCreatedKilled/exit Resume()onRestart()IBM PL stroy()DestroyedAndroid ActivityLifecycle7

Level 3: Destroy activityCauses: Press Back buttonKilled by userCallbacks: onDestroy()/onCreate()onCreate()New processCreatedKilled/exit Resume()onRestart()IBM PL stroy()DestroyedAndroid ActivityLifecycle8

Our approach: a complete toolchain to find andreproduce KR errorsKREfinderKREreproducerKR dataChangedKR dataData-flowanalysisAPKControl-flowanalysisKR saveKRrestoreFlowsummaryErrorlocation RedexerGator DirectedtransitionsExit! Find KR data, KR changes, KR saves,KR restores and exits! Track data and control flow fromchanged KR data to KR saves, exits! Track data and control flow betweenKR changes and KR restoresIBM PL Day5/12/16! Report potentialbugs and theirlocation! Generate a list oftargeted methodshttp://spruce.cs.ucr.edu/kre/! Construct input ! Usersequence toverifiesreach errorerrorlocation9

KREfinder: data flow analysis pointsKR dataFields that are mutable and modifiedKR restoreAPI calls that restore data, e.g.,Android.OS.Bundle.get*()KR data changeAssignment statement where a KRdata (or alias thereof) is written toKR saveAPI calls that save data, e.g.,Android.OS.Bundle.put*()The end of onDestroy() or onStop(),java.lang.system.exit() callIBM PL Day5/12/16Exit10

Killed/exit KR writeonPause() {.}Resumedkrfield .onStop() {.}onDestroy() {.save (krfield)}Not calledKREfinder: Four error typesType 1: save operation in a callback not guaranteed to executeResumedkrfield .onPause() {.if (pred).elsesave(krfield)Not calledKR writeKilled/exit onStop() {.}onDestroy() {.}}Type 2: save operation in a callback guaranteed to execute, but not on the path to exitType 3: no save or restore of KR dataType 4: restore KR data but no save operationIBM PL Day5/12/1611

KREreproducer Given an error point method, instruction generate adirected transition to reach that point Undecidable in general, but works well on Android Use Redexer to generate a method transitionlist that ends at method Identify GUI callbacks Use Gator to build the UI-event mapping that leads to method, instruction Flow summaryError location method, instruction IBM PL Day5/12/16RedexerGatorDirectedtransitions 12

EvaluationDataset! 324 apps from Google Play, AppsApk, GitHub! CategoriesUtilities, Email & SMS, Games, Health & Fitness! Size3KB—23MB, on average 377KB! Popularity (installs)11 apps with more than 1 million installs, e.g., Facebook, YahooWeather, NPR News!Effectiveness49 confirmed bugs in 37 apps (1.4 bugs per app)210 potential bugs in 287 appsEfficiencyTime (seconds)MinMaxAverageMedian12,1846122IBM PL Day5/12/1613

Error examples and categoriesAppError DescriptionAppError DescriptionNorton snap QR!User turns on the flashlight,then stops the app; afterresuming, flashlight is offDr.Web Anti-virus Light!The custom scan check boxsetting is lost after restartOpenSudoku!Game state lostMotorola Camera!The user switches from imagemode to video mode, thenrestarts. The camera returns toimage mode again! Losing GUI state! Losing user’s progress! Losing device settings(see paper for more examples)IBM PL Day5/12/1614

Conclusions! Smartphone apps are restarted frequentlyo When restarts not handled properly KR errors! Our approach finds and reproduces KR errorso Effective: 324 apps, found 49 reproducible bugs, 210other potential bugso Efficient: 61 seconds per app! Wanna know more?o See our OOPSLA’16 papero Try the open source toolchain, available athttp://spruce.cs.ucr.edu/kre/IBM PL Day5/12/1615

Finding Resume and Restart Errors in Android Applications [OOPSLA’16] Iulian Neamtiu New Jersey Institute of Technology joint work with Zhiyong Shan (Univ. of Central Missouri), Tanzirul Azim (MSR) IBM PL Day 5/12/16 . Smartphone apps have a fundamentally different lifecycle, compared to desktop/server programs Desktop/server .