1. Chapter 11: Dynamic Analysis Omar Meqdadi SE 3860 Lecture 11 Department of Computer Science and Software Engineering University of Wisconsin-Platteville

2. 2 Topic Covered Why Dynamic Analysis Control Flow Trace Dynamic Dependence Graph Dynamic Backward Slicing

3. 3 Dynamic Analysis Dynamic analysis : dynamic representations of the code  determine a flow through a software system given a particular set of inputs or a user scenario(s). Part of the impact analysis of required change Why  Help maintainer gain initial understanding of a software system  Diagnose and/or localize problems.  Static analysis is very imprecise Example: Debugger

4. Dynamic Analysis Dynamic program representations  Control Flow Trace  Dynamic Dependence Graph

5. Control Flow Trace List of all the execution points (execution paths) given a particular program point (input) Flow chart when executing a given input Format : , where x i is an execution point Steps:  Draw the flow chart  Find the execution given a particular input

6. Control Flow Trace: Example 3: while ( i<N) do 1: sum=0 2: i=1 4: i=i+1 5: sum=sum+i 6: print (sum) 1 1 : sum=0 3 1 : while ( i<N) do 5 1 : sum=sum+i 3 2 : while ( i<N) do 4 2 : i=i+1 3 3 : while ( i<N) do 6 1 : print (sum) N=3: 2 1 : i=1 4 1 : i=i+1 5 2 : sum=sum+i Flow Chart Control Flow Trace at N=3 N = 3 :

7. Dynamic Dependence Graph Dynamic Dependency Graph (DDG) :  A PDG ( see Chapter 10) assuming fixed input for the program Reconsider the following code from Chapter 10 and assume X( from statement S1) = -1:

8. DDG Example PDG DDG at X = -1

9. Dynamic Backward Slicing Recall that program slice is a subset of a program that contains the relevant code to the computation of interest, see Chapter 10. Dynamic Slicing assumes fixed input for a program A dynamic backward slice query is S  The set of statements involved in computing variable V’s value at statement N assuming that I is the input for the program Advantages :  Smaller  More precise  More helpful to the user

10. Dynamic Backward Slicing Two Approaches: Considering only the data dependency (Minimal Slicing)  Using Dynamic Data Dependency Graph Considering both data and control dependencies  Using Dynamic Dependency Graph

11. 1: b=0 2: a=2 3: for i= 1 to N do 4: if ((i++)%2==1) then 5: a = a+1 else 6: b = a*2 endif done 7: z = a+b 8: print(z) S 1 1 : b=0 [b=0] 2 1 : a=2 3 1 : for i = 1 to N do [i=1] 4 1 : if ( (i++) %2 == 1) then [i=1] 5 1 : a=a+1 [a=3] 3 2 : for i=1 to N do [i=2] 4 2 : if ( i%2 == 1) then [i=2] 6 1 : b=a*2 [b=6] 7 1 : z=a+b [z=9] 8 1 : print(z) [z=9] Dynamic Backward Slicing Approch1:

12. Dynamic Backward Slicing Approach2 Using DDG:  A dynamic program slice is identified from a DDG as follows: for a variable V at node N, identify all reaching definitions of V. find all nodes in the DDG which are reachable from those nodes. The visited nodes in the traversal process constitute the desired slice.  Consider the program in the slide 7 and variable Y at S10. Therefore, with respect to variable Y at S10, the dynamic slice will contain only {S1, S2 and S3}. So: For −1 as the values of X, if the value of Y is incorrect at S10, one can infer that either erroneous at S3 or the “if” condition at S2 is incorrect.