Automating Object Transformations for Dynamic Software Updating Stephen Magill ∗ IDA Center for Computing Sciences sbmagil@super.org Michael Hicks University of Maryland, College Park mwh@cs.umd.edu Suriya Subramanian Intel Corporation suriya@alumni.cs.utexas.edu Kathryn S. McKinley Microsoft Research & The University of Texas at Austin mckinley@cs.utexas.edu Abstract Dynamic software updating (DSU) systems eliminate costly downtime by dynamically fixing bugs and adding features to executing programs. Given a static code patch, most DSU systems construct runtime code changes automati- cally. However, a dynamic update must also specify how to change the running program’s execution state, e.g., the stack and heap, to make it compatible with the new code. Constructing such state transformations correctly and auto- matically remains an open problem. This paper presents a solution called Targeted Object Synthesis (TOS). TOS first executes the same tests on the old and new program ver- sions separately, observing the program heap state at a few corresponding points. Given two corresponding heap states, TOS matches objects in the two versions using key fields that uniquely identify objects and correlate old and new-version objects. Given example object pairs, TOS then synthesizes the simplest-possible function that transforms an old-version object to its new-version counterpart. We show that TOS is effective on updates to four open-source server programs for which it generates non-trivial transformation functions that use conditionals, operate on collections, and fix memory leaks. These transformations help programmers understand their changes and apply dynamic software updates. ∗ Most of the work was completed while this author was at the University of Maryland, College Park. Permission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. To copy otherwise, to republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. OOPSLA’12, October 19–26, 2012, Tucson, Arizona, USA. Copyright c  2012 ACM 978-1-4503-1561-6/12/10. . . $10.00 Categories and Subject Descriptors D.1.2 [Programming Techniques]: Automatic Programming; I.2.2 [Artificial In- telligence]: Program Synthesis General Terms Algorithms, Languages, Theory Keywords Dynamic Software Update, DSU, Hot-Swapping, Program Synthesis, State Transformation, Object Correla- tion, Object Matching 1. Introduction Suppose you are running an on-line service and a memory leak in your server software causes it to regularly run out of memory and crash. Eventually you discover the one-line fix: the Connection class’s close method should unlink some metadata when a connection closes. To apply this fix in a standard deployment, you stop your server and restart the patched version, but this disrupts active users. With dynamic software updating (DSU) support in an extended Virtual Ma- chine such as LiveRebel [16] you can do better. You apply a dynamic patch to the Connection class of your running sys- tem to prevent further leaks without disrupting current users. In some DSU-enhanced VMs, such as Jvolve [14], you can do better still. You include state transformation code in the dynamic patch that traverses the heap and unlinks the useless metadata left reachable by the bug. An important goal toward furthering the adoption of DSU systems is to make them easy to use, i.e., to minimize the effort required to produce a correct dynamic patch from two versions of a system. As a step in this direction, many DSU systems employ simple syntactic, type-based tool support for constructing a dynamic patch from the old and new program versions [1, 8, 13, 14]. For example, if the bytecode for method m of class C changes, Jvolve will include C.m in the dynamic patch. If C’s field definitions change, in type or number, Jvolve creates a default object transformation function that it applies to all C objects when it applies the