Slicing Methods Using Static and Dynamic Information Yoshiyuki

Slicing Methods Using Static and Dynamic Information Yoshiyuki Ashida , Fumiaki Ohata†, † Katsuro Inoue†‡ † ‡ Osaka University Nara Institute of Science and Technology

Contents z. Program slice ystatic slice, dynamic slice, their problems z. Proposal of methods using both static and dynamic information y. Partial analysis y. Dynamic data dependence analysis

Background z. Software systems are becoming large and complex. z. Developers are spending a large amount of time to test their systems. Various techniques for improving the efficiency of debugging

Localization z. Detecting faults in large source programs are difficult. z. If we could. . . yselect specific portions in a source code, and yconcentrate out attention only to those potions, performance of the activities would increase. Program slice is proposed to localize faults.

Program slice Definition: a set of statements that affects the value of a variable v in a statement s (v, s ): slicing criterion If we specify a concerned variable, all the affecting statements are extracted. effective for debugging

Kinds of program slicing z. Static slicing yusing static information(a source program) z. Dynamic slicing yusing dynamic information(an execution trace)

Data dependence DD(s, v, t ): z Variable v is defined in a statement s. z v is referred in a statement t, and z at least one execution path without re-definition between s and t exists. a 1: a: =5; a 2: b: =a+a; b b 3: if b>0 then 4: c: =a 5: else DD 6: d: =b;

Control dependence CD(s, t ): z s is a conditional predicate, and z the result of s determines whether statement t is executed or not. 1: a: =5; 2: b: =a+a; 3: if b>0 then 4: c: =a 5: else 6: d: =b; CD

Process of static slicing 1: 2: 3: 4: 5: 6: 7: 8: 9: 10: a: =3; b: =2; readln(c); if c=0 then d: =a else d: =a+1; e: =b+a; writeln(d); writeln(e); S 1 a b S 3 a a c d S 9 slicing criterion(9, d) S 8 e S 4 S 5 S 2 d S 7 S 10 DD CD

Process of dynamic slicing 1: 2: 3: 4: 5: 6: 7: 8: 9: 10: a: =3; b: =2; readln(c); if c=0 then d: =a else d: =a+1; e: =b+a; writeln(d); writeln(e); Execution trace with input c=0 b a e e 1: e 2: e 3: e 4: e 5: e 6: e 7: e 8: a: =3; a b: =2; readln(c); c if c=0 then d: =a a e: =b+a; writeln(d); writeln(e);

Comparison z. Slice size: static > dynamic y. Static slicing considers all possible paths. y. Dynamic slicing only considers a specified executed path. z. Slicing cost: static ≪ dynamic y. Recording an execution trace needs much cost.

Motivation Small slice size Effective localization Expensive slicing cost Slicing methods mixing both static and dynamic information

Contents z. Program slice ystatic slice, dynamic slice, their problems z. Proposal of methods using both static and dynamic information y. Partial analysis y. Dynamic data dependence analysis

Features of partial analysis z. Cut down non-executed statements yreduce a slice size z. Analyze only necessary(executed) statements yreduce the cost of constructing PDG z. Use simple dynamic information yprevent the execution time from rising

Process of partial analysis a source program execution dynamic information cutting down a reduced source program analysis PDG

Evaluation of partial analysis(1) We implemented this method within our Osaka Slicing System (target language: Pascal). z Methods ystatic slice ydynamic slice ypartial analysis z Measurement yslice size yexecution time yanalysis time

Evaluation of partial analysis(2) slice size(LOC) static pa dynamic P 1 27 22 14 P 2 175 156 139 P 3 324 166 50 program size(LOC) P 1: 88 P 2: 387 P 3: 941 analysis time(ms) execution time(ms) static pa dynamic P 1 38 47 87 P 2 48 53 903 P 3 4, 046 4, 104 3, 1635 static pa dynamic P 1 21 13 N/A P 2 1, 602 1, 142 N/A P 3 8, 125 3, 957 N/A

Discussion z Slice size: static > pa > dynamic yin between static and dynamic slice z Execution time: static ≦ pa ≪ dynamic yalmost the same as static slicing z Analysis time: static > pa y 50 -70% of static slicing z reasonable slicing results and good analysis time with a slight additional execution time

Contents z. Program slice ystatic slice, dynamic slice, their problems z. Proposal of methods using both static and dynamic information y. Partial analysis y. Dynamic data dependence analysis

Array and pointer analysis Limits of static analyses a z array variables 1: a[0]: =0; 2: a[1]: =3; a b 3: readln(b); a 4: a[b]: =2; 5: c: =a[0]+4; a 6: writeln(c); z pointer variables 1: a: =0; 2: b: =2; 3: c: =&a; 4: d: =&b; 5: *c: =4; 6: writeln(a);

Dynamic data dependence analysis Static analyses of array and pointer variables needs much cost, and the produced result is low precision. z. Dynamic data dependence analysis y. Data dependence analysis: dynamic y. Control dependence analysis: static y. Nodes in dependence graph: statements in a source program

Process of dynamic data dependence analysis a source program analysis execution & analysis data dependence control dependence mixing PDG

How to analyze data dependence Execution with input b=0 b a[0] c 1: 2: 3: 4: 5: 6: a[0]: =0; a[1]: =3; readln(b); a[b]: =2; c: =a[0]+4; writeln(c); where variables are defined e 2 e 3 e 4 e 1 e 5 e 6 a[0] a[1] b s 1 s 2 s 4 s 3 - c s 5 --

Evaluation of dynamic data dependence analysis Execution time of merge sort(ms) # of input data to sample program 100 1, 000 10, 000 normal 356 1, 955 22, 241 array & pointer 643 7, 185 100, 410 1, 159 14, 661 202, 808 all DD

Discussion z. Need some additional execution time to extract DDRs y. The execution time of dynamic data dependence analysis is 3 -9 times slower than normal execution time. y. If we only analyze array & pointer variables, the execution time is 2 -5 times slower. z. Analyze array & pointer variables precisely

Conclusions and Future Works z. Propose and evaluate two slicing methods y. Partial analysis y. Dynamic data dependence analysis z. Promising approaches to get effective program localization z. Implement our methods within our Java Slicing System(under construction)