1. 1 Software Testing & Quality Assurance Lecture 13 Created by: Paulo Alencar Modified by: Frank Xu

2. 2 Overview  Structural Testing  Introduction – General Concepts  Flow Graph Testing  Data Flow Testing  Definitions  Some Basic Data Flow Analysis Algorithms  Define/use Testing  Slice Based Testing  Guidelines and Observations  Hybrid Methods  Retrospective on Structural Testing

3. 3 Slicing The notion of a program slice is useful in software testing, program debugging, automatic parallelization, and program integration A slice of a program is taken with respect to a program point P and a variable x. The slice consists of all program statements that may affect the value x at program point P. The tuple is called a slicing criterion A Forward Slice of a program with respect to a program point P and variable x consists of all statements of the program that may be affected by the value of x at point P One way to compute a slice is by constructing a Program Dependence Graph (PDG) and then appropriately traverse this graph [Ref: S. Horowitz, T. Reps, and D. Binkley. Interprocedural slicing using depen- dence graphs. In Proceedings of the SIGPLAN '88 Conference on Programming Language Design and Implementation, Atlanta, GA, June 1988].

4. 4 Motivation Static Slicing Program reduction technique Useful for program comprehension, debugging, maintenance, reuse, etc. Based on control and flow graph dependencies

5. 5 Motivation >

6. 6 Motivation >

7. 7 Program Dependency Graphs (1) Directed graphs with three types of vertices: –Entry vertex –Initial-State(x) for every variable x such that, there exists a path in the CFG on which x is used before it is defined. It represents an assignment to x from the initial state –Final-Use(x) for every variable x named in P’s end statement. It represents an access to the final value of x computed by P

8. 8 Program Dependence Graphs (2) Two main types of edges: –Control Dependence edges labeled as True or False. The source is either a predicate or the entry vertex. A control dependence means that during program execution, if the label of the edge matches the execution result of the source vertex predicate then, the target vertex will be eventually executed. –Data Dependence edges between two nodes iff one is defining a variable and the other is using the variable. Two types of data dependence edges: Flow dependence –Loop carried –Loop independent Def-order dependence

9. 9 Control Dependence Edges A Program Dependence Graph of a program P contains a Control Dependence edge from vertex v 1 to vertex v 2 (v 1  c v 2 iff one of the following holds: –Vertex v 1 is the entry vertex and v 2 represents a component of program P that is not nested within a loop or conditional; these edges are labeled True –Vertex v 1 represents a control dependence and v 2 represents a component of P immediately nested within a loop or a conditional statement whose predicate is represented by v 1. If v 1 is a test predicate of a loop structure the edge is labeled True. If it is a test predicate in a conditional statement the edge is labeled according to the boolean result of the predicate.

10. 10 Data Dependence Edges A Program Dependence Graph of a program P contains a Data Dependence edge from vertex v 1 to vertex v 2 (v 1  f v 2 iff all of the following holds: –Vertex v 1 is a vertex that defines variable x –Vertex v 2 is a vertex that uses variable y –Variables x and y are either the same variable or aliases –Control can reach v 2 after v 1, via an execution path along which there is no other intervening definition of x or y. That is there is a path in the program’s CFG by which definition of x at v 1 reaches the use of x at v 2. Data flow dependence edges can be further classified as loop carried and loop independent

11. 11 Loop Carried Data Dependence Loop carried dependencies between vertex v 1 and vertex v 2 denoted as v 1  lc(L) v 2 occur when in addition to the other criteria for data dependence we have: –There is an execution path that includes a back edge to the predicate of the loop L –Both vertex v 1 and vertex v 2 are enclosed in the loop L If there is no back edge to the predicate the data dependence is called loop independent

12. 12 Def-Order Dependence A PDG contains a def-order dependence edge from vertex v1 to vertex v2 with witness vertex v3 denoted as v 1  do(v3) v 2 iff all of the following hold: –Vertex v 1 and v 2 define variables x 1 and x 2 respectively –Variables x 1 and x 2 are either aliases or the same variable –Vertex v 1 and v 2 and in the same branch of any conditional statement that encloses both of them –There exists a program component v 3 that v 1  f v 2 and v 2  f v 3 –Vertex v 1 occurs to the left of v 2 in the program’s AST (i.e., the statement related to v 1 executes before the statement related to vertex v 2 )

13. 13 Example program Sum sum = 0; i=1; while i < 10) do sum = sum +i; i = i+1; enddo end T T T T T T T Legend: Control dependence Loop independent data dependence Loop carried data dependence Def-order dependence ENTRY sum = 0i = 1; while i < 10; FinalUse(i); FinalUse(sum); sum=sum+1; i = i +1;

14. 14 Computing a Slice Using a PDG (1) For vertex S of the Program Dependence Graphs G of a program P, the slice of G with respect to S is a graph (denoted as G/S) containing all vertices of which S has a transitive flow or control dependence (i.e. all vertices that can reach S via flow or control edges) The edges in the slice graph G/S are data dependence (loop independent), control dependence, and def-order edges of the original graph G that have source and targets in vertices in G/S

15. 15 Computing a Slice Using a PDG (2) Therefore the vertices of a slice G/S are: V(G/S) = {w | w in V(G) and w  * S} We can extend the definition to a slice with respect to a set of vertices S = U i S i V(G/S) = V(G/ U i S i ) = U i (V(G/S i )) The edges in a slice are: E(G/S) = {u  f w | u  w in E(G) and u, w in V(G/S)} U {u  c w | u  w in E(G) and u, w in V(G/S)} U {u  do w | u  w in E(G) and u, w in V(G/S)} c,f

16. 16 Algorithm for Intra-Procedural Slice Using a PDG Program ComputeSlice(G, S) G: a program dependence graph S: a set of vertices in G WorkList: a set of vertices in G v, w: vertices in G Begin WorkList = S; while Worklist ≠ 0 do begin Select and remove vertex v from WorkList; Mark v For each unmarked vertex w such that w  f v or w  c v or w  do v do begin Insert w in WorkList end End

17. 17 Example (1) T T T T T T T ENTRY sum = 0 i = 1; while i < 10; FinalUse(i); FinalUse(sum); sum=sum+1; i = i +1; Slice based of the criterion FinalUse(i)

18. 18 Example (2) T T T T ENTRY i = 1; while i < 10; FinalUse(i); i = i +1; program Sum sum = 0; i=1; while i < 10) do sum = sum +i; i = i+1; enddo end program SumSlice i=1; while i < 10) do i = i+1; enddo end Slice on FinalUse(i)

19. 19 Example: Ada Program 1.function P return INTEGER is 2.begin 3. X, Y: INTEGER 4. READ(X); READ(Y); 5. while (X>10) loop 6. X:= X – 10; 7. exit when X=10; 8. end loop; 9. if (Y < 20 and then X mod 2 = 0) then 10. Y:= Y – 20; 11. else 12. Y:= Y – 20; 13. end if; 14. return 2 * X + Y; 15.end P;

20. 20 Slicing using Control Flow Graphs Given a program P, and a program graph G(P) in which statements and statement fragments are numbered, and a set V of variables in P, the slice of the set of variables V at statement fragment n, written as S(V, n), is the set node numbers of all statement fragments W in P prior to n that contribute to the values of variables in V at point n Contribute means that a statement in S(V, n) will affect the c-use or a p-use of a variable v in V at statement n. Actually, we refine here the concepts of c-use and p-use. More specifically, –P-use: used in a predicate (e.g., decision) –C-use: used in a computation (e.g., assignment) –O-use: used for output (e.g., write/print) –L-use: used for location (e.g., pointers, array indices) –I-use: iteration (loop counters, internal counters) Also we can distinguish two definition nodes: –I-def: defined by input (e.g., read) –A-def: defined by assignment (e.g., a:=x+y)

21. 21 Slices We can consider that in a slice S(V, n), V has only one element say variable v. If n is a defining node for v then is included the slice. If n is a usage node for v it is not included in the slice p-uses, and c-uses of other variables not in V are included as long their execution affects the value of variable v at point n We chose to exclude O-uses, L-uses, and I-uses from the slice

22. 22 Slices – Points of Interest Do not make slices with a criterion (V, n) where variables of V do not appear in n Consider making slices with respect of one variable not a set of variables Consider making slices for all A-def nodes (focus is on the variables in the right hand side of an assignment) Consider making slices for p-use nodes Consider making slices compilable

23. 23 Uses of Slices in Testing If a slice is compilable one could use the testing techniques we have examine so far On the other hand, in general slices do not map nicely to test cases. We can use slices: –to identify and eliminate unwanted dependencies between variables –to identify problems in mutually exclusive parts of the code by considering set complements or localizing potential problems in segments