1. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Dependence-Cache Slicing: A Slicing Method Using Lightweight Dynamic Information Tomonori Takada, Fumiaki Ohata, Katsuro Inoue Osaka University

2. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Background of Research Software Systems are becoming large and complex Debugging, testing, and maintaining costs are increasing To reduce development costs, techniques for improving efficiency of such activities are essential

3. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Comprehension Comprehending large source programs is difficult If we could select specific portions in the source programs and we can concentrate our attentions only to those portions, the performance of the activities would increase

4. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University A technique of extracting all program statements affecting the value of a variable Slicing: Extraction Slice: Collection of extracted statements Developers can concentrate their attentions to the extracted statements Program Slicing

5. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Kusumoto, S., Nishimatsu, A., Nishie, K. and Inoue, K. : ``Experimental Evaluation of Program Slicing for Fault Localization'', Empirical Software Engineering, Vol.7, No.1, pp. 49-76 (2002). To evaluate the validity of slice With two independent groups Measured bug detection time with slice: 122 minutes without slice: 165 minutes Experiment Using Program Slice

6. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Static Slicing Program is analysed statically (without execution) All possible input data sets are assumed. Extract all possible statements affecting the value of the focused statement. Program Dependence Graph (PDG) is used. Static slices are extracted by traversing edges in PDG.

7. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Program Dependence Graph PDG shows dependence relations between statements in a source program. nodes statements conditional predicates edges control dependence edges data dependence edges

8. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Dependences Control Dependence (CD) Statement s1 has a control dependence to statement s2 if the execution of s2 is decided by s1’s result. Data Dependence (DD) Def-Use relation. s1: if a=0 then s2: b :=1; s1s2 s3: a := 1; s4: writeln(a); s3s4 a

9. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Example of PDG program test(input, output); var a : array [0..9] of integer; var b, i, c : integer; begin writeln("input array : "); for i:=0 to 9 do a[i] := i * i; writeln("input number : "); readln(b); if b < 10 then c := a[b] else c := -1; writeln(c) end. writeln(“inp.. a[i] := i * i readln(b) writeln(“inp.. c := a[b] a[] b i if b<10 c := -1 writeln(c) c c for i:=0 to 9 CD DD b

10. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Example of static slice program test(input, output); var a : array [0..9] of integer; var b, i, c : integer; begin writeln("input array : "); for i:=0 to 9 do a[i] := i * i; writeln("input number : "); readln(b); if b < 10 then c := a[b] else c := -1; writeln(c) end. writeln(“inp.. a[i] := i * i readln(b) writeln(“inp.. c := a[b] a[]b i if b<10 c := -1 writeln(c) c c for i:=0 to 9 b Slicing Criteria writeln(c) for i:=0 to 9 do a[i] := i * i; readln(b); if b < 10 then c := a[b] else c := -1;

11. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Dynamic Slicing Program is analysed dynamically (executed with a particular input data) Extract statements actually affecting the value of a slicing criteria Execution trace is recorded Dynamic Dependence Graph(DDG) is constructed from the exection trace. Dynamic slices are extracted by traversing edges in DDG.

12. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University writeln("input array : "); for i:=0 to 9 do a[0] := 0 *0; for i:=0 to 9 do a[1] := 1 *1; for i:=0 to 9 do a[2] :=2 *2; for i:=0 to 9 do a[3] := 3 *3; for i:=0 to 9 do a[4] := 4 *4; for i:=0 to 9 do a[5] := 5 *5; for i:=0 to 9 do a[6] := 6 *6; for i:=0 to 9 do a[7] := 7 *7; for i:=0 to 9 do a[8] := 8 *8; for i:=0 to 9 do a[9] := 9 *9; writeln("input number : "); readln(b); if b < 10 then c := a[b] writeln(c) Example of dynamic slice program test(input, output); var a : array [0..9] of integer; var b, i, c : integer; begin writeln("input array : "); for i:=0 to 9 do a[i] := i * i; writeln("input number : "); readln(b); if b < 10 then c := a[b] else c := -1; writeln(c) end. for i:=0 to 9 do a[i] := i * i; readln(b); if b < 10 then c := a[b] readln(b) writeln(“inp.. c := a[5] a[] b i if b<10 writeln(c) c b b a[5] for i:=0 to 9 writeln(“inp.. a[0] := 0*0 for a[1] := 1 * 1 for a[2] := 2 * 2 for a[3] := 3 * 3 for a[4] := 4 * 4 for a[5] := 5 * 5 for a[6] := 6 * 6 for a[7] := 7 * 7 for a[8] := 8 * 8 for a[9] := 9 * 9 input b=5 writeln(c)

13. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Static and Dynamic Slicing Analysis cost: static < dynamic Recording execution trace is exhaustive Determining data dependence and cotrol dependence on execution trace is expensive Slice size: static > dynamic Static slicing considers all possible flows Dynamic slicing only considers one trace Efficient and Effective Slicing unify

14. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Unified Slicing Methods Focusing on Dynamic Control-Flow Information Hybird Slicing (Gupta, 1997) Collect all traces between break points and procedure calls Need to specify break points / Trace can be huge Call-Mark Slicing (Nishimatsu, 1999; our group) Dynamically set call-marks (flags that shows a caller statement is executed or not) Eliminate non-executed statements from PDG by using call-mark and execution dependence relations. Focusing on Dynamic Data-Flow Information Reduced DDG Method (Agrawal, 1990) The same sub-structure of DDG is shared with one structure. Run-time overhead is serious. Dependence-Cache Slicing

15. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Dependence-Cache Slicing Dependence-Cache Slicing (DC slicing) : A slicing method focused on dynamic data- flow information Control Dependence Easily obtained by syntax analysis Data Dependence static analysis is difficult Computation Step1: Pre-Execution Analysis Statically compute control dependence relations and construct PDG having control dependence edges and nodes Computation Step2: Execution-time Analysis Collect dynamic data dependence relations by using Caches and add data dependence edges to PDG

16. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University s1: a[0]:=0; s2: a[1]:=3; s3: readln(b); s4: a[b]:=2; s5: c:=a[0]+4; s6: writeln(c); a[0]a[1]bc s1 s2s1s2s3 Data Dependence Collection Input: b=0 b a[0] c Value of cache s4s2s3s4s2s3s5 Each cache holds the statement where the variable is defined

17. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Example of DC slice program test(input, output); var a : array [0..9] of integer; var b, i, c : integer; begin writeln("input array : "); for i:=0 to 9 do a[i] := i * i; writeln("input number : "); readln(b); if b < 10 then c := a[b] else c := -1; writeln(c) end. writeln(“inp.. a[i] := i * i readln(b) writeln(“inp.. c := a[b] if b<10 c := -1 writeln(c) for i:=0 to 9 input b=5 a[5] b i c b writeln(c) for i:=0 to 9 do a[i] := i * i; readln(b); if b < 10 then c := a[b]

18. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Experiment Measured some metric values on our slicing system “Osaka Slicing System (OSS)” OSS had already implemented features to extract static, call-mark and dynamic slices. Add function to compute DC slice Three sample PASCAL programs P1: calendar program (85 lines) P2 ： wholesaler program (387 lines) P3 ： wholesaler program2 (871 lines) Slicing criterion were randomly chosen

19. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Slice Size 21 182 187 17 162 166 15 16 61 55 8 0 20 40 60 80 100 120 140 160 180 200 P1P2P3 static call-mark dependence-cache dynamic lines static ＞ call-mark ＞＞ DC ＞ dynamic DC and dynamic slicing can analyze actual dependence. P2, P3 use array variables.

20. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Pre-Execution Analysis Time 11 213 710 14 215 698 5 19 48 N/A 0 100 200 300 400 500 600 700 800 P1P2P3 static call-mark dependence-cache dynamic time (ms) static ≒ call-mark ＞ DC DC slicing analyses only control dependence relations.

21. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University 4743 4700 4743 4731 51 45 174 4540 206464 4834 0 1000 2000 3000 4000 5000 6000 P1P2P3 static call-mark dependence-cache dynamic Execution time time (ms) Static ≒ CM ≒ DC ＜＜ Dynamic DC slicing can be computed with small overhead increase. Execution time for static slicing shows the execution time for “original” program.

22. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Slice Computation Time 0.4 1.9 3.0 0.6 1.8 3.0 0.3 0.7 1.2 7610124969 0 2 4 6 8 10 P1P2P3 static call-mark dependence- cache dynamic time (ms) DC ＜ static ≒ call-mark ＜＜ dynamic DC slicing uses PDG that has less DD edges than that of static slicing.

23. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Discussion Analysis cost:static  DC << dynamic Collect dynamic data dependence relatios by simple method Slice size:static  DC  dynamic only “actual” data dependence relations are added to PDG Reasonable slice results with reasonable analysis time Promising approach to get effective program localization

24. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Limit of DC slicing DC slice’s accuracy is less than dynamic slice’s. s1: a[0] := 0; s2: a[1] := 1; s3: i:= 0; s4: while i<2 do begin s5: b := a[i]; s6: i := i + 1 end; s7: writeln(b); DC slicing analyse dependence relations between statements, not between execution trace. For this program, DC slicing can’t distinct between first and second execution of s5. (Dynamic slicing can distinct it.)

25. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Applications We have applied DC slicing to several language environments. Pascal (Interpreter) OSS mentioned before. Java source code (Preprocessor) Translate program to collect dynamic data dependence relations. Java byte code (Compiler, VM) Virtual Machine collects dynamic data dependence Relations Most of Java libraries are provided by byte code

26. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Conclusions and Future Works Proposed dependence-cache slicing Practical and efficient approach to get reasonable slices Confirmed validity through an experiment Applicable to various environments Future Works Evaluation through user testing Apply to other language environments

27. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University

28. Example of DC slice(2) program test(input, output); var a : array [0..9] of integer; var b, i, c : integer; begin writeln("input array : "); for i:=0 to 9 do a[i] := i * i; writeln("input number : "); readln(b); if b < 10 then c := a[b] else c := -1; writeln(c) end. writeln(“inp.. a[i] := i * i readln(b) writeln(“inp.. c := a[b] i if b<10 c := -1 writeln(c) c for i:=0 to 9 input b=10 b

29. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University

30. Static Slicing All statements possibly affecting the value of Slice Criterion (a variable concerned) Method (1) Construct Program Dependence Graph (PDG) Nodes: statements in program Edges: Data Dependence (DD): variable definition and its reference Control Dependence (CD): predicate and statement dominated by the predicate (2) Collect all reachable nodes on PDG to a slice criterion (statement, variable)

31. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University s1begin s2a:=3; s3b:=3; s4readln(c); s5if c=0 then s6begin s7d:=functionA(a); s8e:=d s9end; s10else s11begin s12d:=functionB(b); s13e:=d s14end; s15writeln(e) s16end. Example of PDG

32. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Example of Static Slice Slicing criterion (s13, d) s1begin s2a:=3; s3b:=3; s4readln(c); s5if c=0 then s6begin s7d:=functionA(a); s8e:=d s9end; s10else s11begin s12d:=functionB(b); s13e:=d s14end; s15writeln(e) s16end.

33. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Example of Static Slice (2) Slicing criterion (s15, e) s1begin s2a:=3; s3b:=3; s4readln(c); s5if c=0 then s6begin s7d:=functionA(a); s8e:=d s9end; s10else s11begin s12d:=functionB(b); s13e:=d s14end; s15writeln(e) s16end.

34. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University s1begin s2a:=3; s3b:=3; s4readln(c); s5if c=0 then s6begin s7d:=functionA(a); s8e:=d s9end; s10else s11begin s12d:=functionB(b); s13e:=d s14end; s15writeln(e) s16end. e1begin e2a:=3; e3b:=3; e4readln(c); e5if c=0 then e6begin e7d:=functionA(a); e8e:=d e9end; e15writeln(e) e16end. Source (1) Execute Trace with Input c=0 Example of Dynamic Slicing

35. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University e1begin e2a:=3; e3b:=3; e4readln(c); e5if c=0 then e6begin e7d:=functionA(a); e8e:=d e9end; e15writeln(e) e16end. CD DD a c d e Example of Dynamic Slicing (cont.) (2) Determine DD and CD s1begin s2a:=3; s3b:=3; s4readln(c); s5if c=0 then s6begin s7d:=functionA(a); s8e:=d s9end; s10else s11begin s12d:=functionB(b); s13e:=d s14end; s15writeln(e) s16end. (3) Collect Statements Slicing Criterion (c=0, s15, e)

36. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Architecture of Osaka Slicing System Osaka Slicing System

37. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Snapshot of Osaka Slicing System

38. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Call-Mark Slicing Dependences Control Dependence Data Dependence Execution Dependence shows relation that statement A is never executed if statement B is not executed. Dynamically set call-marks (flags that shows a caller statement is executed or not). Eliminate non-executed statements from PDG by using call-mark and ED relations.

39. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Kusumoto, S., Nishimatsu, A., Nishie, K. and Inoue, K. : ``Experimental Evaluation of Program Slicing for Fault Localization'', Empirical Software Engineering, Vol.7, No.1, pp. 49-76 (2002). To evaluate the validity of slice With two independent groups Measured bug detection time Two sub-experiments were conducted. trial-1 : Group A used slice trial-2 : Group B used slice Experiment Using Program Slice trial-1 with Slicewithout Slice subjects A1A2A3B1B2B3 time 119128120154175166 average 122.3165 trial-2 without Slicewith Slice subjects A1A2A3B1B2B3 time 11812615513193118 average 133114

40. Software Engineering Laboratory, Department of Computer Science, Graduate School of Information Technology and Science, Osaka University Characteristics of DC slice Effectiveness only “actual” Data Dependence relations are added to PDG slice size would be small Efficiency no execution trace is recorded faster execution than dynamic slicing PDG size is smaller than PDG size of static slice faster slice-extraction than static slicing