Slicing Methods Using Static and Dynamic Information Yoshiyuki Ashida, Fumiaki Ohata, † † † ‡ †‡ Katsuro Inoue Osaka University Nara Institute of Science and Technology

Contents zProgram slice ystatic slice, dynamic slice, their problems zProposal of methods using both static and dynamic information yPartial analysis yDynamic data dependence analysis

Background zSoftware systems are becoming large and complex. zDevelopers are spending a large amount of time to test their systems. Various techniques for improving the efficiency of debugging

Localization zDetecting faults in large source programs are difficult. zIf we could... yselect specific portions in a source code, and yconcentrate out attention only to those potions, performance of the activities would increase. Program slice is proposed to localize faults.

Program slice Definition: a set of statements that affects the value of a variable v in a statement s (v, s ): slicing criterion If we specify a concerned variable, all the affecting statements are extracted. effective for debugging

Kinds of program slicing zStatic slicing yusing static information(a source program) zDynamic slicing yusing dynamic information(an execution trace)

DD(s, v, t ): zVariable v is defined in a statement s. zv is referred in a statement t, and zat least one execution path without re-definition between s and t exists. Data dependence 1: a:=5; 2: b:=a+a; 3: if b>0 then 4: c:=a 5: else 6: d:=b; DD a b b a

Control dependence CD(s, t ): zs is a conditional predicate, and zthe result of s determines whether statement t is executed or not. 1: a:=5; 2: b:=a+a; 3: if b>0 then 4: c:=a 5: else 6: d:=b; CD

1: a:=3; 2: b:=2; 3: readln(c); 4: if c=0 then 5: d:=a 6:else 7: d:=a+1; 8: e:=b+a; 9: writeln(d); 10: writeln(e); 1: a:=3; 2: b:=2; 3: readln(c); 4: if c=0 then 5: d:=a 6:else 7: d:=a+1; 8: e:=b+a; 10: writeln(e); slicing criterion(9, d) S5S7 S4 S1 S3 S9 S2 S8 S10 CD DD a dd c a a b e Process of static slicing S5S7 S1 S3 S4 S9 9: writeln(d);

1: a:=3; 2: b:=2; 3: readln(c); 4: if c=0 then 5: d:=a 6:else 7: d:=a+1; 8: e:=b+a; 9: writeln(d); 10: writeln(e); 1: a:=3; 2: b:=2; 3: readln(c); 4: if c=0 then 5: d:=a 6:else 7: d:=a+1; 8: e:=b+a; 9: writeln(d); 10: writeln(e); e8: writeln(e); e6: e:=b+a; e4: if c=0 then e2: b:=2; e1: a:=3; e3: readln(c); e5: d:=a e7: writeln(d); Execution trace with input c=0 Process of dynamic slicing 9: writeln(d); e7: writeln(d); e5: d:=a e4: if c=0 then e3: readln(c); e1: a:=3; a b a e a c

Comparison zSlice size: static > dynamic yStatic slicing considers all possible paths. yDynamic slicing only considers a specified executed path. zSlicing cost: static ≪ dynamic yRecording an execution trace needs much cost.

Motivation Small slice size Effective localization Expensive slicing cost Slicing methods mixing both static and dynamic information

Contents zProgram slice ystatic slice, dynamic slice, their problems zProposal of methods using both static and dynamic information yPartial analysis yDynamic data dependence analysis

Features of partial analysis zCut down non-executed statements yreduce a slice size zAnalyze only necessary(executed) statements yreduce the cost of constructing PDG zUse simple dynamic information yprevent the execution time from rising

Process of partial analysis a source program a reduced source program dynamic information execution PDG cutting down analysis

Evaluation of partial analysis(1) z Measurement yslice size yexecution time yanalysis time We implemented this method within our Osaka Slicing System (target language: Pascal). zMethods ystatic slice ydynamic slice ypartial analysis

Evaluation of partial analysis(2) slice size(LOC) static pa dynamic P P P execution time(ms) static pa dynamic P P P3 4,046 4,104 3,1635 analysis time(ms) static pa dynamic P N/A P2 1,602 1,142 N/A P3 8,125 3,957 N/A program size(LOC) P1: 88 P2: 387 P3: 941

Discussion zSlice size:static > pa > dynamic yin between static and dynamic slice zExecution time:static ≦ pa ≪ dynamic yalmost the same as static slicing zAnalysis time:static > pa y50-70% of static slicing zreasonable slicing results and good analysis time with a slight additional execution time

Contents zProgram slice ystatic slice, dynamic slice, their problems zProposal of methods using both static and dynamic information yPartial analysis yDynamic data dependence analysis

Array and pointer analysis Limits of static analyses zarray variables 1: a[0]:=0; 2: a[1]:=3; 3: readln(b); 4: a[b]:=2; 5: c:=a[0]+4; 6: writeln(c); zpointer variables 1: a:=0; 2: b:=2; 3: c:=&a; 4: d:=&b; 5: *c:=4; 6: writeln(a); b a a a a

Static analyses of array and pointer variables needs much cost, and the produced result is low precision. zDynamic data dependence analysis yData dependence analysis: dynamic yControl dependence analysis: static yNodes in dependence graph: statements in a source program Dynamic data dependence analysis

a source program data dependence execution & analysis PDG analysis control dependence mixing Process of dynamic data dependence analysis

How to analyze data dependence 1: a[0]:=0; 2: a[1]:=3; 3: readln(b); 4: a[b]:=2; 5: c:=a[0]+4; 6: writeln(c); 2: a[1]:=3; 3: readln(b); 4: a[b]:=2; 5: c:=a[0]+4; 6: writeln(c); 1: a[0]:=0; Execution with input b=0 where variables are defined a[0] a[1] b c e1 s e2 s1 s2 - - e3 s1 s2 s3 - e4 s4 s2 s3 - e5 s4 s2 s3 s5 e6 s4 s2 s3 s5 b a[0] c

Evaluation of dynamic data dependence analysis normal 356 1,955 22,241 all DD 1,159 14, ,808 array & pointer 643 7, ,410 1, Execution time of merge sort(ms) 10,000 # of input data to sample program

Discussion zNeed some additional execution time to extract DDRs yThe execution time of dynamic data dependence analysis is 3-9 times slower than normal execution time. yIf we only analyze array & pointer variables, the execution time is 2-5 times slower. zAnalyze array & pointer variables precisely

Conclusions and Future Works zPropose and evaluate two slicing methods yPartial analysis yDynamic data dependence analysis zPromising approaches to get effective program localization zImplement our methods within our Java Slicing System(under construction)