1. Pruning Dynamic Slices With Confidence Xiangyu Zhang Neelam Gupta Rajiv Gupta The University of Arizona

2. 2 Dynamic Slicing Dynamic slice is the set of statements that did affect the value of a variable at a program point for a specific program execution. [Korel and Laski, 1988 ] …… 10. A = …... 20. B = …… 30. P = 31. If (P<0) {...... 35.A = A + 1 36. } 37. B=B+1 …… 40. Error(A) Dynamic Slice (A@40) = {10, 30, 31, 35, 40}

3. 3 Effectiveness of Dynamic Slicing Dynamic slicing is very effective in containing the faulty statement, however it usually produces over- sized slices -- [AADEBUG’05]. Problem: How to automatically prune dynamic slices? Approaches: Coarse-grained pruning by intersecting multiple types (backward, forward, bidirectional) of dynamic slices -- [ASE’05, ICSE’06] Fine-grained pruning of a backward slice by using confidence analysis -- this paper.

4. 4 Types of Evidence Used in Pruning Buggy Execution output_x  Classical dynamic slicing algorithms investigate bugs through the evidence of the wrong output  Critical Predicate [ICSE’06] input0 input_x input2 output_x predicate_x output0 output1 predicate_x  Other types of evidence:  Failure inducing input [ASE’05]  Partially correct output -- this paper  Benefits of more evidence Narrow the search for faulty stmt. Broaden the applicability

5. 5 Coarse-grained Pruning by Intersecting Slices failure inducing input BS FS FS(CP) BiS(CP) + CP BS^FS

6. 6 Fine-grained Pruning by Exploiting Correct Outputs …… 10. A = 1 (Correct: A=3) …... 20. B = A % 2 …… 30. C = A + 2 …… 40. Print (B) 41. Print (C)  Correct outputs produced in addition to wrong output.  BS(O wrong ) – BS (O correct ) is problematic. BS(C@41)= {10, 30, 41} BS(B@40)= {10, 20, 40} BS(C@41)-BS(B@40) = {30,41}

7. 7 Confidence Analysis  Value produced at node n can reach only wrong output nodesn There is no evidence that n is correct, so it should be in the pruned slice. Should we include n in the slice?? Confidence(n)=0 Confidence(n)=?; 0 ≤ ? ≤ 1  Value produced at node n can reach both the correct and wrong output nodes.nnn Confidence(n)=1  Value produced at n can reach only correct outputs There is no evidence of incorrectness of n. Therefore it cannot be in the slice.

8. 8 Confidence Analysisnn Range(n)={ a, b, c, d, e, f, g } Alt(n)={ a } Value(n) = a Value(n) = bValue(n) = c, c When |Alt(n)|==1, we have the highest confidence (=1) on the correctness of n; When |Alt(n)|==|Range(n)|, we have the lowest confidence (=0). |Range(n)| >= |Alt(n)|>=1 Alt(n) is a set of possible values of the variable defined by n, that when propagated through the dynamic dependence graph, produce the same values for correct outputs.

9. 9 Confidence Analysis: Example …… 10. A =... …... 20. B = A % 2 …… 30. C = A + 2 …… 40. Print (B) 41. Print (C)

10. 10 Confidence Analysis: Two Problems  How to decide the Range of values for a node n? Based on variable type (e.g., Integer). Static range analysis. Our choice:  Dynamic analysis based on value profiles.  Range of values for a statement is the set of values defined by all of the execution instances of the statement during the program run.  How to compute Alt(n)? Consider the set of correct output values as constraints. Compute Alt(n) by backward propagation of constraints through the dynamic dependence subgraph corresponding to the slice.

11. 11 Computing Alt(n) Along Data Dependence S1: T=...9 S2: X=T+110 S3: Y=T%30 (X,T)= (6,5) (9,8) (10,9) (T,...)= (1,...) (3,...) (5,...) (8,...) (9,...) (Y,T)=( 0,3) (0,9) (1,1) (2,5) (2,8) alt(T@S2)={9} alt(T@S3)={1,3,9} alt(S1) = alt(T@S2) ∩ alt (T@S3) = {9} alt(S2)={10} alt(S3)={0,1}

12. 12 Computing Alt(n) Along Control Dependence S1: if (P) …True S2: X=T+110 S3: Y=T%30 (X,T)= (6,5) (9,8) (10,9) (Y,T)=( 0,3) (0,9) (1,1) (2,5) (2,8) alt(S1) = {True} alt(S2)={10} alt(S3)={0,1}

13. 13 Characteristics of Siemens Suite Programs ProgramDescriptionLOCVersionsTests print_tokensLexical analyzer 56554072 print_tokens2Lexical analyzer 51054057 replacePattern replacement 56385542 schedulePriority scheduler 41232627 schedule2Priority scheduler 30732683 gzipUnix utility 800911217 flexUnix utility 124188525 Each faulty version has a single manually injected error. All the versions are not included:  No output is produced.  Faulty statement is not contained in the backward slice. For each version three tests were selected.

14. 14 Results of Pruning ProgramDSPDS max PDS max / DS PDS min %Missed by PDS min print_tokens 1103531.8%350% print_tokens2 1145548.2%550% replace 1316045.8%4338.1% schedule 1177059.8%5620% schedule2 905864.4%500% gzip 35712133.9%10100% flex 727273.7%250% On average, PDS max = 41.1% of DS

15. 15 Confidence Based Prioritization DD – dep. distance CV – confidence values Executed statement instances examined (%)

16. 16 The Potential of Confidence Analysis (1)  Case Study (replace v14) 88  74  23 Dynamic Slicer With Confidence Pruned Slices User Verified Statements as correct Buggy Code Input

17. 17 The Potential of Confidence Analysis (2)  Relevant slicing (gzip v3 run r1) Potential dep. Data dep.

18. 18 Conclusions  We have presented a new approach - Confidence analysis - that exploits the correct output values produced in an execution to prune the dynamic slice of an incorrect output.  We have developed a novel dynamic analysis based implementation of confidence analysis, which effectively pruned backward dynamic slices in our experiments. Pruned Slices = 41.1% Dynamic Slices, and still contain the faulty statement.  Our study shows that confidence analysis has additional applications beyond pruning – prioritization, interactive pruning & relevant slicing.

19. 19 The End