Could I Have a Stack Trace to Examine the Dependency Conflict Issue?

• Published in: Proceedings / International Conference on Software Engineering pp. 572 - 583
• Main Authors: Wang, Ying, Wen, Ming, Wu, Rongxin, Liu, Zhenwei, Tan, Shin Hwei, Zhu, Zhiliang, Yu, Hai, Cheung, Shing-Chi
• Format: Conference Proceeding
• Language: English
• Published: IEEE 01.05.2019
• Subjects: Computer crashes; Java; Libraries; mutation; Runtime; Static analysis; test generation; Test pattern generators; third party-library
• DOI: 10.1109/ICSE.2019.00068

Intensive use of libraries in Java projects brings potential risk of dependency conflicts, which occur when a project directly or indirectly depends on multiple versions of the same library or class. When this happens, JVM loads one version and shadows the others. Runtime exceptions can occur when methods in the shadowed versions are referenced. Although project management tools such as Maven are able to give warnings of potential dependency conflicts when a project is built, developers often ask for crashing stack traces before examining these warnings. It motivates us to develop Riddle, an automated approach that generates tests and collects crashing stack traces for projects subject to risk of dependency conflicts. Riddle, built on top of Asm and Evosuite, combines condition mutation, search strategies and condition restoration. We applied Riddle on 19 real-world Java projects with duplicate libraries or classes. We reported 20 identified dependency conflicts including their induced crashing stack traces and the details of generated tests. Among them, 15 conflicts were confirmed by developers as real issues, and 10 were readily fixed. The evaluation results demonstrate the effectiveness and usefulness of Riddle.