Program Slicing Techniques CSE 6329 Spring 2013 Parikksit Bhisay

Flow: Abstract Overview Static slicing Dynamic slicing Data and Control Dependence

Abstract: A program slice consists of the parts of a program that (potentially) affect the values computed at some point of interest, referred to as a slicing criterion. The task of computing program slices is called program slicing.

Abstract : Procedures, arbitrary control flow, composite datatypes and pointers, and interprocess communication each require a specific solution. We classify Static & Dynamic slicing methods for each of above features and then compare their accuracy & efficiency

Overview: Original concept by Weiser, 1979.[2] Large programs must be decomposed for understanding and manipulation. However, it should be into procedures and abstract data types. Program Slicing is decomposition based on data flow and control flow analysis. A study showed, experienced programmers mentally slicing while debugging.

Overview: However, many variations exist. Because: Different applications need different properties of slices An important aspect is distinction between Static and Dynamic slicing. Static: made without assumptions of the program’s input. Dynamic: Relies on some specific case

Overview: Features of programming languages: Procedures, arbitrary control flow, composite datatypes and pointers, and interprocess communication each require a specific solution. We classify Static & Dynamic slicing methods for each of above features and then compare their accuracy & efficiency

Static Slicing: With Example 1.read(n); 2.i := 1; 3.sum := 0; 4.product := 1; 5.while i <= n do begin 6.sum := sum + i; 7.product := product * i; 8.i := i + 1; end; 9. write(sum); 10. write(product); 1.read(n); 2.i := 1; 3. 4.product := 1; 5.while i <= n do begin 6. 7.product := product * i; 8.i := i + 1; end; write(product); (A) (B) Static slicing w.r.t. the criterion (n, product)

Dynamic Slicing First introduced by Korel and Laski Dynamic Slicing is a non-interactive version of Balzer’s flowback analysis. Flowback Analysis: If a value computed at statement s depends o values computed at statement t, the user may trace back to the vertex of s and t. Dependencies occurring in specific execution are considered.

Difference: Quick View Dynamic Slicing assumes a fixed input for a program. Static Slicing does not make any assumptions regarding the input. Hybrid Approaches – make use of both!

Dynamic Slicing: Example 1.read(n); 2.i := 1; 3.while (i <= n) do begin 4.if (i mod 2 = 0) then 5.x := 17 else 6.x := 18; 7.i := i+1 end; 8.write(x) 1.read(n); 2.i := 1; 3.while (i <= n) do begin 4.if (i mod 2 = 0) then 5.x := 17 else 6. ; 7.i := i+1 end; 8.write(x) (A)(B) dynamic slicing w.r.t. the criterion (n = 2, 8¹, x)

CFG CFG = Control Flow Graph Example: Startread(n) sum:=0 prod:=1i<=n sum:= sum+1 prod:= prod+1 i:=i+1 write(sum)write(prod)Stop (1) (3)(4) (5) (2) i := 1 (6) (7) (8) (10)(9)

Contains a node for each statement Edge indicates possible flow Contains special nodes Start and Stop Startread(n) sum:=0 prod:=1i<=n sum:= sum+1 prod:= prod+1 i:=i+1 write(sum)write(prod)Stop (1) (3)(4) (5) (2) i := 1 (6) (7) (8) (10)(9) CFG

Data and Control Dependence Defined in terms of CFG Types of dependencies: Flow dependence loop-carried dependence loop independent dependence output dependence anti dependence However, for slicing, we only consider flow dependence.

Data and Control Dependence Node j is flow dependent on node j if there exists a variable x such that: x ∈ DEF(i), x ∈ REF(j) and there exists a path from i to j without intervening definitions of x

Data and Control Dependence Control dependence is usually defined in terms of post-dominance. A node i is post-dominated by j if all paths from i to STOP pass through j. A node j is control dependent on a node i if: there exists a path P from i to j...and... i is not post-dominated by j

Startread(n) sum:=0 prod:=1i<=n sum:= sum+1 prod:= prod+1 i:=i+1 write(sum)write(prod)Stop (1) (3)(4) (5) (2) i := 1 (6) (7) (8) (10)(9) Example of Post-Dominated CFG Node 3 is post-dominated by Node 2

Startread(n) sum:=0 prod:=1i<=n sum:= sum+1 prod:= prod+1 i:=i+1 write(sum)write(prod)Stop (1) (3)(4) (5) (2) i := 1 (6) (7) (8) (10)(9) Example of flow dependence Node 7 is flow dependent on node 4 because: 1.node 4 defines variable prod. 2.node 7 references variable prod...and 3.there exists a path 4->5->6->7 without intervening definitions of prod.

Startread(n) sum:=0 prod:=1i<=n sum:= sum+1 prod:= prod+1 i:=i+1 write(sum)write(prod)Stop (1) (3)(4) (5) (2) i := 1 (6) (7) (8) (10)(9) Example of control dependence Node 7 is control dependent on node 5 because... there exists a path 5->6->7 such that: 1.node 6 is post-dominated by node 7..and 2.node 5 is not post-dominated by node 7.

References: [1] F. Tip, A Survey of Program Slicing Techniques, CS-R9438, Computer Science/Department of Software Technology, 1994 [2] Weiser, M. Program slices: formal, psychological, and practical investigations of an automatic program abstraction method. PhD thesis, University of Michigan, Ann Arbor, 1979.

Questions?