Static slicing talk - homes.cs.washington.edu

Ernst Slicing 5/97 Page 1

Practical fine-grained static slicingof optimized code

Michael Ernst

University of Washington

(work done at Microsoft Research)

Simple example

Example: function calls and pointers

Applications of slicing

Closure slicing: visualize dependences

program understanding

maintenance

test coverage

debugging

Executable slicing: produce binary

specialization

parallelization

testing

integration of program versions

Dynamic slicing: execution tracing

Outline

Motivation

Basic slicing algorithm

Interprocedural

Pointers and aggregate values

Optimized code

Executable slicing

Conclusion

Simple slicing algorithm

For graph-based program representation:

Just graph reachability!

The value dependence graph (VDG)

Sparse, functional, parallel representationfor imperative programs

Insights:

Only values matter

Original names and control flow are incidental

Consequences:

All values are explicit

Select values, not control paths

Control flow represented by function calls

Components of thevalue dependence graph

xUpdate

operation nodes

selectors

closures (functions)

function calls

memory lookups (load instructions)memory assignments (store instructions)

Example VDGn I/O

sum product

product

"Sum..."

printfvoid sum_product(int n)

int sum = 0;

int product = 0;

int i = 0;

while (i++ < n)

{ sum = sum + i;

product = product * i;

printf("Sum %d, product %d",

sum, product);

Example VDG, sliced

sum product

product

"Sum..."

printf

The VDG is good for slicing

Simple, fast algorithm

Fine granularity

One graph directly links producers and consumers

All values are explicit

Slicing criteria

Expression results, not whole computations

Any expression

Any result, including unnameable ones

Unreferenced variables

Outline

Motivation

Interprocedural

Optimized code

Executable slicing

Conclusion

Interprocedural slicing

Goals:

sensitive to calling context

do not include entire procedure or all calls

efficient

omit irrelevant procedures

Obvious solution: graph reachability

call results procedure returns

formal parameters actual parameters

This does not satisfy our goals.

Interprocedural slicing (solution)

Summarize dependences of returns on formals

Separately include appropriate portions of body

When slicing criterion is within a procedure, include all calls

This meets our goals.

Procedure summary dependences

Optimistic forward dataflow problem

operation result depends on what the operands depend on

for calls, use current approximation as transfer function

reprocess calls when new approximation becomes available

iterate until fixpoint is reached

Complexity

Outline

Motivation

Interprocedural

Optimized code

Executable slicing

Conclusion

Pointers

Support arbitrary pointer manipulations

Points-to analysis gives possibly referenced locations

For lookup, slice on location and (part of) store

= Lookup

xLookup

storex

Lookup

...*x......x...

Treat store as a collection

Slice on every possibly referenced location.

Slice continues at

killing def: location, value (use pointer equality)

preserving def: location, value, store

other: store

Lookup

Update

Aggregate values

Just like the store.

Complexity

Outline

Motivation

Interprocedural

Optimized code

Executable slicing

Conclusion

Slicing optimized code

Improve:

dependences

liveness

computations

overhead

The hardware runs optimized code

Slice reflects intermediate representation’s semantics

Correspondence with source code

Need many-to-many mappings

VDG node source text

source text VDG node

Maintain a separate source graph

initially isomorphic to VDG

transformations modify VDG and source correspondences

slicing traverses both graphs in tandem

slice display defaultly highlights only appropriate sources

History mechanism

Source graphs are never side-effected or removed

Transformations add to source graph

Mappings no longer necessarily inverses

This enables

undoing transformations

explaining changes

slice according to naive interpretation

slice dead code

statement-oriented display

Outline

Motivation

Interprocedural

Optimized code

Executable slicing

Conclusion

Executable slicing

Goal: executable binary

Applications:

specialization

parallelization

testing

integration of program versions

Compilable slicing

Traditional technique for executable slicing:

subset the original program

compile using a standard compiler

Compilable slicing tradeoffs

Retains context, comments, formatting, names

Include undemanded portions of the program to satisfy syntactic constraints

multi-valued computation

function call parameters

variable assignments

control flow: goto, continue, break

Limits optimization

Hard to undo

Our executable slicing solution

Generate code directly from slice

For debugging, use original program

Outline

Motivation

Interprocedural

Optimized code

Executable slicing

Conclusion

Status

Part of a programming environment

Handles C (except longjmp)

Written in Scheme

Integrated with Emacs

Future work

Quasi-static slicing

Dynamic slicing

History mechanism

User interface alternatives

Tests on real users

Debugging optimized code

Ambiguity in program points

Update

store (a,b,c)

store (x,y,z)

z = ...;

a = b + c;

z = x * y;

Comparing the VDG and PDG

Which PDG?

no implicit quantities

better integration with programming environment

easier analysis, transformation

cleaner interprocedural representation

single graph

finer granularity

Static slicing talk - homes.cs.washington.edu

Documents

Dynamic Slicing

Genetic Linkage Analysis - homes.cs.washington.edu

srcSlice: very efficient and scalable forward static slicinghalomari/papers/srcSlice very... · srcSlice: very efﬁcient and scalable forward static slicing ... This large body of

String Slicing

personales.upv.espersonales.upv.es/josilga/papers/IC2012.pdf · Static Slicing of Explicitly Synchronized LanguagesI Michael Leuschela, Marisa Llorens b, Javier Oliver , Josep Silva

Combining Dynamic and Static Slicing for Analysing Assembler · 2009-11-27 · Combining Dynamic and Static Slicing for Analysing Assembler Martin Ward and Hussein Zedan Software

1 Program Slicing Purvi Patel. 2 Contents Introduction What is program slicing? Principle of dependences Variants of program slicing Slicing classifications

Strings - homes.cs.washington.edu

homes.cs.washington.edu - Experimental Analysis of Denial-of …homes.cs.washington.edu/~yoshi/papers/BRL_ICCPS_2015... · 2015. 6. 3. · Sunnyvale, CA and patients in Cincinnati

Class 6 - cc.gatech.eduharrold/6340/cs6340_fall2009/Slides/Ba… · 4. Interprocedural slicing (later) 4 Slicing Overview Types of slices yBackward static slice yExecutable slice

Precise Dynamic Slicing Algorithms* a great deal of research has been conducted on static slicing and an excellent survey of many of the proposed techniques and tools can be found

CSE P521: Applied Algorithms - homes.cs.washington.edu

Slicing Layers

Log Structured FS - homes.cs.washington.edu

ards - homes.cs.washington.edu

IBM Research Report - homes.cs.washington.edu

Slicing Guide

Intraprocedural Static Slicing of Binary Executables Cristina Cifuentes Antoine Fraboulet University of Queensland International Conference on Software

Program Slicing Program Testing and Analysis€¦ · 4. Dynamic Slicing Mostly based on these papers: Program Slicing, Weiser., IEEE TSE, 1984 Thin Slicing, Sridharan et al., PLDI

PiGE - homes.cs.washington.edu