Transcript Slicing Method : Using Static and Dynamic Information

Slicing Methods Using Static
and Dynamic Information
Yoshiyuki Ashida , Fumiaki Ohata† ,
†‡
Katsuro Inoue
†
‡
† Osaka University
Nara Institute of Science and Technology
Contents
Program slice
static slice, dynamic slice, their problems
Proposal of methods using both static and
dynamic information
Partial analysis
Dynamic data dependence analysis
Background
Software systems are becoming large and
complex.
Developers are spending a large amount
of time to test their systems.
Various techniques for improving the
efficiency of debugging
Localization
Detecting faults in large source programs are
difficult.
If we could...
select specific portions in a source code, and
concentrate out attention only to those potions,
performance of the activities would increase.
Program slice is proposed to localize faults.
Program slice
Definition: a set of statements that affects
the value of a variable v in a statement s
(v, s ): slicing criterion
If we specify a concerned variable, all the
affecting statements are extracted.
effective for debugging
Kinds of program slicing
Static slicing
using static information(a source program)
Dynamic slicing
using dynamic information(an execution
trace)
Data dependence
DD(s, v, t ):
Variable v is defined in a statement s.
 v is referred in a statement t, and
at least one execution path without re-definition
between s and t exists. a 1: a:=5; a
2: b:=a+a; b
b
3: if b>0 then
4: c:=a
5: else
DD
6: d:=b;
Control dependence
CD(s, t ):
 s is a conditional predicate, and
the result of s determines whether statement t
is executed or not.
1: a:=5;
2: b:=a+a;
3: if b>0 then
4: c:=a
5: else
6: d:=b;
CD
Process of static slicing
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
a:=3;
b:=2;
readln(c);
if c=0 then
d:=a
else
d:=a+1;
e:=b+a;
writeln(d);
writeln(e);
S1
a
S2
b
a
S3
a
c
e
S4
S5
S7
d
S9
slicing criterion(9, d)
S8
S10
d
DD
CD
Process of dynamic slicing
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
a:=3;
b:=2;
readln(c);
if c=0 then
d:=a
else
d:=a+1;
e:=b+a;
writeln(d);
writeln(e);
Execution trace with input c=0
b
a
e
e1:
e2:
e3:
e4:
e5:
e6:
e7:
e8:
a
a:=3;
b:=2;
readln(c); c
if c=0 then
d:=a
a
e:=b+a;
writeln(d);
writeln(e);
Comparison
Slice size: static > dynamic
Static slicing considers all possible paths.
Dynamic slicing only considers a specified
executed path.
Slicing cost: static ≪ dynamic
Recording an execution trace needs much
cost.
Motivation
Small slice size
Effective localization
Expensive slicing cost
Slicing methods mixing both static and
dynamic information
Contents
Program slice
static slice, dynamic slice, their problems
Proposal of methods using both static and
dynamic information
Partial analysis
Dynamic data dependence analysis
Features of partial analysis
Cut down non-executed statements
reduce a slice size
Analyze only necessary(executed)
statements
reduce the cost of constructing PDG
Use simple dynamic information
prevent the execution time from rising
Process of partial analysis
a source
program
execution
dynamic
information
cutting down
a reduced
source program
analysis
PDG
Evaluation of partial
analysis(1)
We implemented this method
within our Osaka Slicing System
(target language: Pascal).
Methods
static slice
dynamic slice
partial analysis
Measurement
slice size
execution time
analysis time
Evaluation of partial
analysis(2)
slice size(LOC)
static
pa
dynamic
P1
27
22
14
P2
175
156
139
P3
324
166
50
program size(LOC)
P1: 88
P2: 387
P3: 941
analysis time(ms)
execution time(ms)
static
pa
dynamic
P1
38
47
87
P2
48
53
903
P3
4,046
4,104 3,1635
static
pa
dynamic
P1
21
13
N/A
P2
1,602
1,142
N/A
P3
8,125
3,957
N/A
Discussion
Slice size:
static > pa > dynamic
in between static and dynamic slice
Execution time:
static ≦ pa ≪ dynamic
almost the same as static slicing
Analysis time:
static > pa
50-70% of static slicing
reasonable slicing results and good analysis time
with a slight additional execution time
Contents
Program slice
static slice, dynamic slice, their problems
Proposal of methods using both static and
dynamic information
Partial analysis
Dynamic data dependence analysis
Array and pointer analysis
Limits of static analyses
a
array variables
1: a[0]:=0;
2: a[1]:=3; a
b 3: readln(b);
a 4: a[b]:=2;
5: c:=a[0]+4;
a
6: writeln(c);
pointer variables
1: a:=0;
2: b:=2;
3: c:=&a;
4: d:=&b;
5: *c:=4;
6: writeln(a);
Dynamic data dependence
analysis
Static analyses of array and pointer
variables needs much cost, and the
produced result is low precision.
Dynamic data dependence analysis
Data dependence analysis: dynamic
Control dependence analysis: static
Nodes in dependence graph: statements in a
source program
Process of dynamic data
dependence analysis
a source
program
analysis
execution
& analysis
data
dependence
control
dependence
mixing
PDG
How to analyze data
dependence
Execution with input b=0
b
a[0]
c
1:
2:
3:
4:
5:
6:
a[0]:=0;
a[1]:=3;
readln(b);
a[b]:=2;
c:=a[0]+4;
writeln(c);
where variables are defined
e1
e2
e3
e4
e5
e6
a[0] a[1] b
s1 s2
s4
s3
-
c
s5
--
Evaluation of dynamic data
dependence analysis
Execution time of merge sort(ms)
# of input data to sample program
100
1,000
10,000
normal
356
1,955
22,241
array & pointer
643
7,185 100,410
1,159
14,661 202,808
all DD
Discussion
Need some additional execution time to
extract DDRs
The execution time of dynamic data
dependence analysis is 3-9 times slower than
normal execution time.
If we only analyze array & pointer variables,
the execution time is 2-5 times slower.
Analyze array & pointer variables precisely
Conclusions and Future
Works
Propose and evaluate two slicing methods
Partial analysis
Dynamic data dependence analysis
Promising approaches to get effective
program localization
Implement our methods within our Java
Slicing System(under construction)