1 Program Slicing Amir Saeidi PhD Student UTRECHT UNIVERSITY

Agenda Introduction History What is program slicing Classifications Applications Slicing Tools Demo

Introduction The size and complexity of a software today gets harder to understand, maintain and test You might have had questions like ◦ If I change this statement, what pieces of the program are going to be affected? ◦ Where are the values that flow into this statement coming from? ◦ How can I limit the functionality to only what I need?

Introduction Goals ◦ Debug your thousands lines of code easily by reducing the complexity of the program ◦ Write a robust program before testing your code ◦ Save your regression testing time by limiting the tests to only those that exercise the changed code How? ◦ “Break larger code into smaller pieces”

History Program Slicing was introduced by Mark Weiser as his PhD thesis at the University of Michigan. Mark Weiser (July 23, 1952 – April 27, 1999) was a chief scientist at Xerox PARC in the United States. He is widely considered to be the father of ubiquitous computing, a term he coined in 1988 He argued that a programmer intuitively tries to slice a program to debug it.

What is Program Slicing? Program slicing is a well-known program analysis and transformation technique to decompose programs by analyzing their data and control flow Program slicing describes a mechanism which allows the automatic generation of a slice A program slice consists of those program statements which are (potentially) related to the values computed at some program point and/or variable, referred to as a slicing criterion ◦ Slices may or may not be executable

Slicing Criterion ◦ s specifies a location (statement s) ◦ v specifies a variable (v) All statements affecting or affected by the variables mentioned in the slicing criterion becomes a part of the slice Variables V at statements S can be affected by statements S’ because: ◦ S’ define whether S is executed at all (Control Dependence) ◦ S’ define a variable that is used by S (Data Dependence)

Program Slicing Slicing Criterion is provided by the user

Slicing Example Slicing Criterion:

Principle of Dependences Data dependence ◦ Definition of variable v at statement s 1 reaches a use of v at statement s 2 Control dependence ◦ Conditional statement controls whether or not the current statement is executed Synchronization dependence ◦ Dependencies related to threading and locking 10

Control Flow Graph Control flow graph is a data structure Each node is associated with a program statement A directed edge will connect between any 2 nodes that represent statements with a possible control flow between them Special nodes: start, stop

Program Dependence Graph  Program Dependence Graph: CFG annotated with data flow information  Using PDG, slices may be built in linear time on the number of nodes of the PDG.  A PDG is an oriented graph  Each vertex represents a statement (like CFG)  Control dependence (solid lines) – between a predicate and the statements it controls  Data dependence (dotted lines) – between statements modifying a variable and those that may reference it  Special “start” node is connected to all nodes that are not control dependant

PDG – cont'd

Program Slicing Classification  Techniques of Slicing  Static vs. Dynamic vs. Conditioned Slicing  Direction of Slicing  Forward vs. Backward vs. Chopping Slicing  Levels of Slicing  Intraprocedural vs. Interprocedural Slicing  Executability of Slices  Executable vs. Closure

Static Slicing Static Slicing: No particular input for the program being sliced is considered May lead to relatively big slices Contains all statements that may affect a variable for every possible execution Current static methods can only compute approximations

Dynamic Slicing Uses information derived from a particular execution of a program to produce a slice Execution is monitored and slices are computed with respect to program history Relatively small slices Contains all the statements of the program that affect the slicing criterion for a particular execution in contrast to any execution in static slicing

Dynamic Slicing – cont'd A dynamic slicing criterion:, where i is the position of statement s in the execution history; v is the set of variables we are interested in; {a 1,...,a n } is the initial values of the program's input. Deterministic instead of probabilistic Allow an easier localization of the bugs

Dynamic Slicing Example Program Input: {text = “hello world!\eof”, n = 4} Execution History: (1, 2, 3, 4, 5, 6, 7, (8, 11, 12, 13, 14, 15, 7) 12, 16, 17, 18) Slicing Criterion:

Conditioned Slicing Conditioned slicing can be viewed as a generalization of both static and dynamic slicing Conditioned slicing computes slices w.r.t. a set of initial states that satisfy a boolean condition Condition is specified as a universally quantified formula of first-order predicate logic A conditioned slicing criterion where ◦ i is a subset of the input variables of the program ◦ F is a logic formula on i ◦ s is a statement of the program ◦ v is a subset of the variables in the program

Conditioned Slicing – cont’d Slicing Criterion: Condition: F = (  c  text, c ≠ ‘\n’. n > 0)

Backward Slicing A program can be traversed forwards or backwards from the slicing criterion. Backward Slicing: we are interested in all those statements that could influence the slicing criterion. Answer the question “what program components might effect a selected computation?” Main Application: Debugging Original method by Weiser: static backward slicing

Forward Slicing Forward Slicing: we are interested in all those statements that could be influenced by the slicing criterion. Answers the question “what program components might be effected by a selected computation?” Useful in determining which statements in a program can be effected by a change in the value of v at statement s i Main Application: Dead Code Removal

Forward Slicing – con’t Slicing Criterion:

Chopping Slicing Criterion: source and sink Chopping computes all the statements in the program that being affected by source, they affect sink Chopping is useful to detect those statements that “transmit effects" from one part of the program (source) to another (sink) Chopping is a generalization of both forward and backward slicing where either source or sink is empty Main applications: Program Analysis and Debugging

Chopping – cont’d Slicing Criterion:

Intraprocedural Slicing Original definition of program slicing: Intraprocedural Slicing Computes slice within one procedure Assumes worse case for function calls Loses Precision

Intraprocedural Slicing – cont’d Slicing criterion:

Interprocedural Slicing System Dependence Graph: A new dependence graph incorporating collections of procedures with procedure calls SDG = PDG + Call Graph Compute slices from multi-procedural programs

System Dependence Graph

Interprocedural Slicing Slicing criterion: 30

Interprocedural vs. Intraprocedural Slicing Slicing criterion:

Executability An executable slice is an executable program that behaves identically to the original program with respect to the slicing criterion A closure slice includes all the components that might affect a given computation, but is not necessarily an executable program ◦ Useful in understanding code behavior 32

Applications Debugging ◦ Finding set of statements that changes a variable of concern Dead Code Removal ◦ Removing code which does not affect the program results Program Segmentation ◦ Comprehending the design by abstracting the design decisions out of the source code Software Quality Assurance ◦ Validate interactions between safety-critical components

Applications – cont'd Program Differencing ◦ To capture semantic differences between two programs Software Maintenance ◦ Slicing helps in understanding of existing software and making changes without having a negative impact. Testing ◦ Reduce cost of regression testing after modifications (only run those tests that needed) Program Parallelization, Partial Evaluation, Program Integration, etc.

Some Slicing Tools Wisconsin Program Slicer (CodeSurfer) It can perform forwards and backwards slicing and chopping of C programs Commercial product by GammaTech Inc. Unravel It perform static backward slicing of C programs. Limitations are in the treatment of Unions, Forks and pointers to functions Indus/Kaveri It performs static forward and backward slicing and chopping of Java programs.

Tool Overview – Indus / Kaveri Indus provides a rich collection of program analyses and transformations for Java programs ◦ Platform for static analyses such as points-to analysis, escape analysis and dependence analyses. ◦ Transformations such as program slicing and program specialization via partial evaluation Kaveri provides a featureful Eclipse-based UI front- end for Indus integrated with Eclipse Java development environment ◦ Configuring, invoking and visualizing results of Indus slicing ◦ Scripting framework for flexible querying of underlying analysis APIs

37