Phoenix Based Dynamic Slicing Debugging Tool Eric Cheng Lin Xu Matt Gruskin Ravi Ramaseshan Microsoft Phoenix Intern Team (Summer '06)

What is Phoenix ? Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● Software optimization and analysis framework. ● Read and write binaries and MSIL assemblies. ● Represent the input files in an IR. ● Analyze and manipulate the IR by using the Phoenix API.

v What is Slicing ? Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● What program statements potentially affect the computation of variable v at statement s. void foo () { int i = 0; int j = 0; i = i + 1; j = j + 1; j = i + j; } void foo() { int i = 0; int j = 0; i = i + 1; j = j + 1; j = i + j; } s

Static & Dynamic Slicing Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● Static Slicing – A static program slice is an executable subset of a program whose behavior is identical, for all program input, to that of the original program with respect to set of variables of interest at some execution point. ● Dynamic Slicing – Use values from the execution context to present a smaller subset of the program.

Program Slicing and Debugging Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● One very unpredictable cost of software development is the time we spend debugging code. ● Problems when debugging – Contorted control flow – Function calls – Aliasing. ● Present a subset of the program being debugged to the user.

Program Dependence Graph Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments int test (int x, int y) { int total = 0; int sum = 0; if (x <= 1) { sum = y; } else { total = x + y; } return total + sum; } ● Nodes – statements and predicate expressions (or operators and operands). ● Edges – data values on which the node’s operations depend and the control conditions on which the execution of the operations depends.

Static Slicing Example Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● Map source code and variable to IR instruction and operand. ● Graph problem of finding the connected component in a PDG seeded at a node on which the operand is dependent on. int test (int x, int y) { int total = 0; int sum = 0; if (x <= 1) { sum = y; } else { total = x + y; } return total + sum; }

Problems with Static Slicing Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments int test (int x, int y) { int total = 0; int sum = 0; if (x <= 1) { sum = y; } else { total = x + y; } return total + sum; } ● Slices are large. ● Does not use runtime information about values of program variables.

Dynamic Slicing Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments int test (int x, int y) { int total = 0; int sum = 0; if (x <= 1) { sum = y; } else { total = x + y; } return total + sum; } ● While debugging we have a snapshot of the entire state of the program. ● Use values of program variables to reduce the slice. x = 0

Dynamic Slicing Overview Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● Use Phoenix's data-flow analysis and optimization framework. ● Extract values for program variables from the debugger. ● Annotate constants onto operands of instructions. ● Run a constant propagation pass to find unreachable code. ● Prune the static slice by removing unreachable code.

Phoenix's Global Optimizer Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● Operates on IR in SSA form. ● Standard data-flow analysis using lattices. ● Lattices specify flow functions for data-flow. ● Lattice elements – cells – encode program facts. ● Propagates cells forward and backward through the SSA.

Phoenix's Global Optimizer – Constant Propagation Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments void foo () { int a, b, c; a = 5; b = 7; c = b + a; } ● Constant operands get annotated with const-cells. ● The simulator transfers values over assignment and arithmetic statements. ● Predicates are evaluated and unreachable code detected.

Annotating Operands Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments int foo (int x) { if (x != 1) { } x = bar (); return x; } ● Find definitions reaching the current point in the program. ● Annotate operands that use the found definitions. 1

Dynamic Slicing with Unreachable Code Elimination Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments int test (int x, int y) { int total = 0; int sum = 0; if (x <= 1) { sum = y; } else { total = x + y; } return total + sum; } ● Extract values for program variables from the debugger. ● Annotate the SSA IR. ● Run the global optimizer's constant propagation to find unreachable code. ● Prune static slice by removing unreachable code. x = 0 true

Dynamic Slicing with Dead Code Elimination Too Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments int test (int x, int y) { int total = 0; int sum = 0; if (x <= 1) { sum = y; } else { total = x + y; } return total + sum; } ● Phoenix provides a dead code elimination lattice too. ● Provides more opportunities to prune the slice. x = 0

Dynamic Slicing Tool Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● Sample for the Phoenix RDK ● Add-in to Visual Studio ● Intra-procedural ● Debug time ● Dynamic Slicing ● Source code and assembly instruction slicing

Visual Studio Dynamic Slicing Tool Architectural Overview Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments Build PDG Static Slicing Dynami c Slicing User Interface Debugger Function Slice VariableLineValues

Source Screen-shot Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments

Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments Assembly Slicing

Limitations Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● Aliasing support limited to that provided by Phoenix – very conservative. ● Flow functions in the constant propagation lattice only implemented for a few instructions. ● Only integer constants are propagated. ● Dead code elimination lattice not implemented for LIR.

Acknowledgments Introduction Static Slicing Dynamic Slicing Architecture Screen Shots Limitations Acknowledgments ● Our mentors: – Russell Hadley, John Lin, Jim Hogg and Curt Carpenter ● Andy Ayers ● And other members of the Phoenix team, specially: – Chris McKinsey, Marko Radmilac and Andrew Cox.