1. Static Slicing
Static slice is the set of statements that COULD influence the value of a variable for ANY input.
Construct static dependence graph
Control dependences
Data dependences
Traverse dependence graph to compute slice
Transitive closure over control and data dependences

2. Dynamic Slicing
Dynamic slice is the set of statements that DID affect the value of a variable at a program point for ONE specific execution. [Korel and Laski, 1988]
Execution trace
control flow trace -- dynamic control dependences
memory reference trace -- dynamic data dependences
Construct a dynamic dependence graph
Traverse dynamic dependence graph to compute slices
Smaller, more precise, slices are more helpful

3. Slice Sizes: Static vs. Dynamic
Program
Statements
Avg. of 25 slices
Static /
Dynamic
Static
126.gcc
099.go
134.perl
130.li
008.espresso
585,491
95,459
116,182
31,829
74,039
51,098
16,941
5,242
2,450
2,353
6,614
5,382
765
206
350
7.72
3.14
6.85
11.89
6.72
Static slice can be much
larger than the dynamic slice

4. Applications of Dynamic Slicing
Debugging [Korel & Laski ]
Detecting Spyware [Jha ]
Installed without users’ knowledge
Software Testing [Duesterwald, Gupta, & Soffa ]
Dependence based structural testing - output slices.
Module Cohesion [N.Gupta & Rao ]
Guide program structuring
Performance Enhancing Transformations
Instruction criticality [Ziles & Sohi ]
Instruction isomorphism [Sazeides ]
Others…

5. Dynamic Slicing Example -background
For input N=2,
11: b= [b=0]
21: a=2
31: for i = 1 to N do [i=1]
41: if ( (i++) %2 == 1) then [i=1]
51: a=a [a=3]
32: for i=1 to N do [i=2]
42: if ( i%2 == 1) then [i=2]
61: b=a* [b=6]
71: z=a+b [z=9]
81: print(z) [z=9]
1: b=0
2: a=2
3: for i= 1 to N do
4: if ((i++)%2==1) then
5: a = a+1
else
6: b = a*2
endif
done
7: z = a+b
8: print(z)

6. Issues about Dynamic Slicing
Precision – perfect
Running history – very big ( GB )
Algorithm to compute dynamic slice slow and very high space requirement.

7. Efficiency How are dynamic slices computed? Execution traces
control flow trace -- dynamic control dependences
memory reference trace -- dynamic data dependences
Construct a dynamic dependence graph
Traverse dynamic dependence graph to compute slices

8. Statements Executed (Millions) Dynamic Dependence Graph Size(MB)
The Graph Size Problem
Program
Statements Executed (Millions)
Dynamic Dependence Graph Size(MB)
300.twolf
256.bzip2
255.vortex
197.parser
181.mcf
164.gzip
134.perl
130.li
126.gcc
099.go
140 67
108
123
118 71
220
124
131
138
1,568
1,296
1,442
1,816
1,535
835
1,954
1,745
1,534
1,707
Graphs of realistic program runs do not fit in memory.

9. Conventional Approaches
[Agrawal &Horgan, 1990] presented three algorithms to trade-off the cost with precision.
Algo.I
Algo.II
Algo.III
Precise dynamic analysis
Static Analysis
high
Cost: low
Precision: low
high

10. Algorithm One
This algorithm uses a static dependence graph in which all executed nodes are marked dynamically so that during slicing when the graph is traversed, nodes that are not marked are avoided as they cannot be a part of the dynamic slice.
Limited dynamic information - fast, imprecise (but more precise than static slicing)

11. Algorithm I Example 11 1: b=0 For input N=1, the trace is: 2: a=2 2131 T
4: if ((i++)%2= =1) 41 F T F
5: a=a+1 51
6: b=a*2 32 71
7: z=a+b 81
8: print(z)

12. DS={1,2,5,7,8} Algorithm I Example 1: b=0 2: a=2 3: 1 <=i <=N
Precise!
4: if ((i++)%2= =1)
5: a=a+1
6: b=a*2
7: z=a+b
8: print(z)

13. Imprecision introduced by Algorithm I
Input N=2:
for (a=1; a<N; a++) { …
if (a % 2== 1) {
b=1; }
if (a % 3 ==1) {
b= 2* b;
} else {
c=2*b+1; 4 1 2 3 4 5 6 7 8 9 7 9
Killed definition counted as reaching!

14. Algorithm II
A dependence edge is introduced from a load to a store if during execution, at least once, the value stored by the store is indeed read by the load (mark dependence edge)
No static analysis is needed.

15. Algorithm II Example 11 1: b=0 71 For input N=1, the trace is: 2: a=221 51
3: 1 <=i <=N 31 T 41
4: if ((i++)%2= =1) F T F
5: a=a+1
6: b=a*2
7: z=a+b 81
8: print(z)

16. Algorithm II – Compare to Algorithm I
More precise
Algo. II
Algo. I
x=…
x=…
…=x
…=x
…=x
…=x

17. Efficiency: Summary For an execution of 130M instructions:
space requirement: reduced from 1.5GB to 94MB (I further reduced the size by a factor of 5 by designing a generic compression technique [MICRO’05]).
time requirement: reduced from >10 Mins to <30 seconds.

18. Algorithm III
First preprocess the execution trace and introduces labeled dependence edges in the dependence graph. During slicing the instance labels are used to traverse only relevant edges.

19. Dynamic Dep. Graph Representation
1: sum=0
2: i=1
1: sum=0
2: i=1
3: while ( i<N) do
3: while ( i<N) do
4: i=i+1
5: sum=sum+i
4: i=i+1
5: sum=sum+i
3: while ( i<N) do
4: i=i+1
5: sum=sum+i
6: print (sum)
3: while ( i<N) do
6: print (sum)

20. Dynamic Dep. Graph Representation
Timestamps
N=2:
1: sum=0
2: i=1
1: sum=0
2: i=1 1 1
3: while ( i<N) do
3: while ( i<N) do
4: i=i+1
5: sum=sum+i 2 2
4: i=i+1
5: sum=sum+i
(2,2)
(4,4) 3 3
3: while ( i<N) do
4: i=i+1
5: sum=sum+i
(4,6) 4 4
6: print (sum) 5 5
3: while ( i<N) do 6 6
6: print (sum)
A dynamic dep. edge is represented as by an edge annotated with a pair of timestamps <definition timestamp, use timestamp>

21. Infer: Local Dependence Labels: Full Elimination
(...,20)
...
X =
Y= X
X =
Y= X
(10,10)
(20,20)
(30,30)
X =
Y= X =Y 21
(20,21)
...
10,20,30

22. Transform: Local Dependence Labels: Elimination In Presence of Aliasing
X =
*P =
Y= X
X =
*P =
Y= X
(10,10)
(20,20)
X =
*P =
Y= X =Y
11,21
(20,21) ...
10,20

23. Transform: Local Dependence Labels: Elimination In Presence of Aliasing
X =
*P =
Y= X
X =
*P =
Y= X
(10,10)
(20,20)
X =
*P =
Y= X
X =
*P =
Y= X
11,21
(10,11) (20,21) =Y
11,21 =Y
(20,21)
(10,11)
10,20 10 20

24. Transform: Coalescing Multiple Nodes into One2 1 10 3 4 6 7 9 5 8 2 1 10 3 4 6 7 9 5 8 1 2 3 4 5 6 7 1 2 3 4 5 6 7 8 9 10

25. Group: Labels Across Non-Local Dependence Edges
X =
Y =
= Y
= X
X =
Y =
= Y
= X
(10,21)
(20,11)
X =
Y =
= Y
= X
(20,11)
(10,21) 10 20
11,21