1. Slicing Methods Using Static and Dynamic Information Yoshiyuki Ashida, Fumiaki Ohata, † † † ‡ †‡ Katsuro Inoue Osaka University Nara Institute of Science and Technology

2. Contents zProgram slice ystatic slice, dynamic slice, their problems zProposal of methods using both static and dynamic information yPartial analysis yDynamic data dependence analysis

3. Background zSoftware systems are becoming large and complex. zDevelopers are spending a large amount of time to test their systems. Various techniques for improving the efficiency of debugging

4. Localization zDetecting faults in large source programs are difficult. zIf we could... yselect specific portions in a source code, and yconcentrate out attention only to those potions, performance of the activities would increase. Program slice is proposed to localize faults.

5. Program slice Definition: a set of statements that affects the value of a variable v in a statement s (v, s ): slicing criterion If we specify a concerned variable, all the affecting statements are extracted. effective for debugging

6. Kinds of program slicing zStatic slicing yusing static information(a source program) zDynamic slicing yusing dynamic information(an execution trace)

7. DD(s, v, t ): zVariable v is defined in a statement s. zv is referred in a statement t, and zat least one execution path without re-definition between s and t exists. Data dependence 1: a:=5; 2: b:=a+a; 3: if b>0 then 4: c:=a 5: else 6: d:=b; DD a b b a

8. Control dependence CD(s, t ): zs is a conditional predicate, and zthe result of s determines whether statement t is executed or not. 1: a:=5; 2: b:=a+a; 3: if b>0 then 4: c:=a 5: else 6: d:=b; CD

9. 1: a:=3; 2: b:=2; 3: readln(c); 4: if c=0 then 5: d:=a 6:else 7: d:=a+1; 8: e:=b+a; 9: writeln(d); 10: writeln(e); 1: a:=3; 2: b:=2; 3: readln(c); 4: if c=0 then 5: d:=a 6:else 7: d:=a+1; 8: e:=b+a; 10: writeln(e); slicing criterion(9, d) S5S7 S4 S1 S3 S9 S2 S8 S10 CD DD a dd c a a b e Process of static slicing S5S7 S1 S3 S4 S9 9: writeln(d);

10. 1: a:=3; 2: b:=2; 3: readln(c); 4: if c=0 then 5: d:=a 6:else 7: d:=a+1; 8: e:=b+a; 9: writeln(d); 10: writeln(e); 1: a:=3; 2: b:=2; 3: readln(c); 4: if c=0 then 5: d:=a 6:else 7: d:=a+1; 8: e:=b+a; 9: writeln(d); 10: writeln(e); e8: writeln(e); e6: e:=b+a; e4: if c=0 then e2: b:=2; e1: a:=3; e3: readln(c); e5: d:=a e7: writeln(d); Execution trace with input c=0 Process of dynamic slicing 9: writeln(d); e7: writeln(d); e5: d:=a e4: if c=0 then e3: readln(c); e1: a:=3; a b a e a c

11. Comparison zSlice size: static > dynamic yStatic slicing considers all possible paths. yDynamic slicing only considers a specified executed path. zSlicing cost: static ≪ dynamic yRecording an execution trace needs much cost.

12. Motivation Small slice size Effective localization Expensive slicing cost Slicing methods mixing both static and dynamic information

13. Contents zProgram slice ystatic slice, dynamic slice, their problems zProposal of methods using both static and dynamic information yPartial analysis yDynamic data dependence analysis

14. Features of partial analysis zCut down non-executed statements yreduce a slice size zAnalyze only necessary(executed) statements yreduce the cost of constructing PDG zUse simple dynamic information yprevent the execution time from rising

15. Process of partial analysis a source program a reduced source program dynamic information execution PDG cutting down analysis

16. Evaluation of partial analysis(1) z Measurement yslice size yexecution time yanalysis time We implemented this method within our Osaka Slicing System (target language: Pascal). zMethods ystatic slice ydynamic slice ypartial analysis

17. Evaluation of partial analysis(2) slice size(LOC) static pa dynamic P1 27 22 14 P2 175 156 139 P3 324 166 50 execution time(ms) static pa dynamic P1 38 47 87 P2 48 53 903 P3 4,046 4,104 3,1635 analysis time(ms) static pa dynamic P1 21 13 N/A P2 1,602 1,142 N/A P3 8,125 3,957 N/A program size(LOC) P1: 88 P2: 387 P3: 941

18. Discussion zSlice size:static > pa > dynamic yin between static and dynamic slice zExecution time:static ≦ pa ≪ dynamic yalmost the same as static slicing zAnalysis time:static > pa y50-70% of static slicing zreasonable slicing results and good analysis time with a slight additional execution time

19. Contents zProgram slice ystatic slice, dynamic slice, their problems zProposal of methods using both static and dynamic information yPartial analysis yDynamic data dependence analysis

20. Array and pointer analysis Limits of static analyses zarray variables 1: a[0]:=0; 2: a[1]:=3; 3: readln(b); 4: a[b]:=2; 5: c:=a[0]+4; 6: writeln(c); zpointer variables 1: a:=0; 2: b:=2; 3: c:=&a; 4: d:=&b; 5: *c:=4; 6: writeln(a); b a a a a

21. Static analyses of array and pointer variables needs much cost, and the produced result is low precision. zDynamic data dependence analysis yData dependence analysis: dynamic yControl dependence analysis: static yNodes in dependence graph: statements in a source program Dynamic data dependence analysis

22. a source program data dependence execution & analysis PDG analysis control dependence mixing Process of dynamic data dependence analysis

23. How to analyze data dependence 1: a[0]:=0; 2: a[1]:=3; 3: readln(b); 4: a[b]:=2; 5: c:=a[0]+4; 6: writeln(c); 2: a[1]:=3; 3: readln(b); 4: a[b]:=2; 5: c:=a[0]+4; 6: writeln(c); 1: a[0]:=0; Execution with input b=0 where variables are defined a[0] a[1] b c e1 s1 - - - e2 s1 s2 - - e3 s1 s2 s3 - e4 s4 s2 s3 - e5 s4 s2 s3 s5 e6 s4 s2 s3 s5 b a[0] c

24. Evaluation of dynamic data dependence analysis normal 356 1,955 22,241 all DD 1,159 14,661 202,808 array & pointer 643 7,185 100,410 1,000 100 Execution time of merge sort(ms) 10,000 # of input data to sample program

25. Discussion zNeed some additional execution time to extract DDRs yThe execution time of dynamic data dependence analysis is 3-9 times slower than normal execution time. yIf we only analyze array & pointer variables, the execution time is 2-5 times slower. zAnalyze array & pointer variables precisely

26. Conclusions and Future Works zPropose and evaluate two slicing methods yPartial analysis yDynamic data dependence analysis zPromising approaches to get effective program localization zImplement our methods within our Java Slicing System(under construction)