Chapter-5-Data Flow Models - Testing

8/3/2019 Chapter-5-Data Flow Models - Testing

1/52

Chapter 5DEPENDENCE, DATA FLOW MODELS, AND DATAFLOW TESTING:

Definition-Use pairs; Data flow analysis; Classic analyses; From

1Collections by: Dr. U.P.Kulkarni

arrays and pointers; Inter-procedural analysis; Overview of

data flow testing; Definition- Use associations; Data flow testing

criteria; Data flow coverage with complex structures; The

infeasibility problem. 7 Hrs

10/11/2011


2/52

Why Data Flow Models?

Other Models emphasized control

Control flow graph, call graph, finite state machines We also need to reason about dependence

Where does this value of x come from?

What would be affected by changing this? ...

Many program analyses and test design techniques

use data flow information Often in combination with control flow

2Collections by: Dr. U.P.Kulkarni10/11/2011


3/52

Def-Use Pairs (1)

A def-use (du) pair associates a point in a program wherea value is produced with a point where it is used

Definition: where a variable gets a value

Variable declaration (often the special value uninitialized)

Variable initialization

Assignment Values received by a parameter

Use: extraction of a value from a variable

Expressions

Conditional statements

Parameter passing

Returns



4/52

Def-Use Pairs

...

if (...) {

x = ... ;

...x = ...

if (...) {

...

Definition: x gets a

value

y = ... + x + ... ;...

y = ... + x + ...

...

Use: the

value of x is

extractedDef-Use

path



5/52

Def-Use Pairs (3)/** Euclid's algorithm */public class GCD{public int gcd(int x, int y) {

int tmp; // A: def x, y,tmpwhile (y != 0) { // B: use y

use x, yx = y; // D: def x; use

yy = tmp; // E: def y; use

tmp}return x; // F: use x}

Collections by: Dr. U.P.Kulkarni Ch 6, slide 5


6/52

Def-Use Pairs (3)

A definition-clear path is a path along the CFG

from a definition to a use of the same variablewithout another definition of the variable between

If, instead, another definition is present on the path, then

A def-use pair is formed if and only if there is adefinition-clear path between the definition and theuse



7/52

Definition-Clear or Killing

x = ... // A: def x

q = ...

x = y; // B: kill x,def x

z = ...

y = f(x); // C: use x

x = ...

...

... Definition: x

gets a valueA

Definition: x

Use: the

value of x is

extracted

x = ygets a newvalue, old

value is killed

...

y = f(x)

B

C

Path B..C is

definition-clear

Path A..C is

not definition-clear



8/52

Data Flow Analysis

information



9/52

DATA FLOW ANALYSIS

Flow Graph is directed graph which shows all possible

path of program execution.

Collections by: Dr. U.P.Kulkarni 910/11/2011


10/52

DATA FLOW ANALYSIS



11/52

DATA FLOW ANALYSIS



12/52

DATA FLOW ANALYSIS

USE:

Yields the information useful to both programmers

and optimizing compilers

Collections by: Dr. U.P.Kulkarni 12

Unreachable code/ Dead code,

Unused parameters to procedure,

variables which are used before being given

initial value

10/11/2011


13/52

DATA FLOW ANALYSIS

Reaching Definition Analysis

Live Variable Analysis

-

Definition-use chains(du chains)

..



14/52

DATA FLOW ANALYSIS



15/52

DATA FLOW ANALYSIS



16/52

DATA FLOW ANALYSIS



17/52

DATA FLOW ANALYSIS



18/52

DATA FLOW ANALYSIS



19/52

DATA FLOW ANALYSIS



20/52

DATA FLOW ANALYSIS



21/52

DATA FLOW ANALYSIS



22/52

DATA FLOW ANALYSIS



23/52

DATA FLOW ANALYSIS



24/52

DATA FLOW ANALYSIS



25/52

DATA FLOW ANALYSIS



26/52

DATA FLOW ANALYSIS



27/52

DATA FLOW ANALYSIS



28/52

DATA FLOW ANALYSIS



29/52

DATA FLOW ANALYSIS

NODE IN USE OUT In[s] Def[n]

1 - - - - a

2 a a - - b

3 bc bc - - c


4 b b - - a

5 a a a - a a

6 c c - - -


30/52

DATA FLOW ANALYSIS

NODE IN USE OUT In[s] Def[n]

1 - - a a a

2 ac a bc bc b

3 bc bc b b c


4 b b a a a

5 ac a ac ac -

6 c c - - -


31/52

DATA FLOW ANALYSIS



32/52

Data flow analysis with arrays and pointers

Arrays and pointers introduce uncertainty:Do different expressions access the same storage?

a[i] same as a[k] when i = k

a[i] same as b[i] when a = b (aliasing)

e uncer a n y s accomo a e epen ng o ekind of analysis

Any-path: gen sets should include all potential aliases andkill set should include only what is definitely modified

All-path: vice versa



33/52

Scope of Data Flow Analysis

Intraprocedural

Within a single method or procedure

as described so far

Interprocedural

Across several methods (and classes) or procedures

Cost/Precision trade-offs for interprocedural analysis

are critical, and difficult context sensitivity

flow-sensitivity



34/52

Context Sensitivity

sub() sub()

bar() {sub()

{

foo() {(call) (call)

}

}

}

(return) (return)

A context-sensitive (intrarprocedural) analysis

distinguishes sub() called from foo()from sub() called from bar();

A context-insensitive (interprocedural) analysis

does not separate them, as if foo() could call sub()

and sub() could then return to bar()



35/52

Data flow testing



36/52

Data flow concept

x = ....

if ....

4

1

Value of x at 6 could becomputed at 1 or at 4

Bad com utation at 1 or 4

2

3

Collections by: Dr. U.P.Kulkarni

....

...

....

y = x + ...6

could be revealed only ifthey are used at 6

(1,6) and (4,6) aredef-use (DU) pairs

defs at 1,4

use at 6

5


37/52

Terms

DU pair: a pair of definition and use for somevariable, such that at least one DU path exists fromthe definition to the use

x = ... is a definitionof x

= ... ...

DU path: a definition-clear path on the CFG startingfrom a definition to a use of a same variable

Definition clear: Value is not replaced on path

Note loops could create infinite DU paths between a defand a use



38/52

Definition-clear path

1,2,3,5,6 is a definition-clearpath from 1 to 6

x is not re-assigned between 1and 6

1,2,4,5,6 is not a definition-

x = ....

if ....

1

2


c ear pat rom to

the value of x is killed(reassigned) at node 4

(1,6) is a DU pair because

1,2,3,5,6 is a definition-clearpath

x = ....

...

....

y = x + ...

6

5


39/52

A program written in a procedural language, such as C and Java,

contains variables. Variables are defined by assigning values tothem and are used in expressions.

Statement x= +z defines variable x and uses variables and z.

Definitions and uses

Declaration int x, y, A[10]; defines three variables.

Statement scanf(``%d %d", &x, &y) defines variables x and y.

Statement printf(``Output: %d \n", x+y) uses variables x and y.


40/52

Uses of a variable that occurs within an expression

as part of an assignment statement, in an outputstatement, as a parameter within a function call,

C-use

, - ,

where the c in c-use stands for computational.


41/52

The occurrence of a variable in an expression used

as a condition in a branch statement such as an ifand a while, is considered as a p-use. The p in p-

p-use

use s an s or pre ca e.


42/52

Data flow graph: Example

Unreachable node

For a given

test case

Identify

possible def-use pairs

covered

Example: Test enhancement using


43/52

Here is an MC/DC adequate test set that

does not reveal the error.

Example: Test enhancement using

data flow


44/52

Neither of the two tests force the use of z

defined on line 6, at line 9. To do so onerequires a test that causes conditions at lines 5

and 8 to be true.

Example (contd.)

An MC/DC adequate test does not force

the execution of this path and hence thedivide by zero error is not revealed.


45/52

Verify that the following test set covers all def-use pairs of z andreveals the error.

Example (contd.)


46/52

Adequacy criteria

All DU pairs: Each DU pair is exercised by at leastone test case

All DU paths: Each simple(non looping) DU path isexercised by at least one test case

All definitions: For each definition, there is at leastone test case which exercises a DU pair containingit

(Every computed value is used somewhere)

Corresponding coverage fractions can also bedefined



47/52

Difficult cases

x[i] = ... ; ... ; y = x[j]

DU pair (only) if i==j

p = &x ; ... ; *p = 99 ; ... ; q = x

*p is an alias of x

m.putFoo(...); ... ; y=n.getFoo(...); Are m and n the same object?

Do m and n share a foo field?

Problem of aliases: Which references are (always orsometimes) the same?



48/52

Data flow coverage with complex structures

Arrays and pointers are critical for data flow analysis

Under-estimation of aliases may fail to include some DU pairs

Over-estimation, on the other hand, may introduce unfeasible testobligations

For testing, it may be preferrable to accept under-estimationo a as set rat er t an over-est mat on or expens ve ana ys s

Controversial: In other applications (e.g., compilers), a conservative

over-estimation of aliases is usually required

Alias analysis may rely on external guidance or other global analysisto calculate good estimates

Undisciplined use of dynamic storage, pointer arithmetic, etc. maymake the whole analysis infeasible



49/52

Infeasibility

Consider the c-use at node 4 of z defined at node 5.

For this c-use to be covered, control must arrive at node 5 (

X>0) and then move to node 4 through 6 , 2 and 3. This isnot possible because edge (2,3) can be taken only if x


50/52

Infeasibility

Suppose condhas notchanged between 1 and 5

Or the conditions could bedifferent, but the first implies

the second

if (cond)

x = ........ 3

1

2

,

DU pair But it is difficult or impossible

to determine which pairs areinfeasible

Infeasible test obligationsare a problem

No test case can cover them

...

y = x + ...

if (cond)

....6

5

7



51/52

Infeasibility

The path-oriented nature of data flow analysismakes the infeasibility problem especially relevant

Combinations of elements matter! Impossible to (infallibly) distinguish feasible from infeasible

paths. More paths = more work to check manually.

In practice, reasonable coverage is (often, notalways) achievable Number of paths is exponential in worst case, but often

linear

All DU pathsis more often impractical

5110/11/2011 Collections by: Dr. U.P.Kulkarni

S


52/52

Summary

Data flow testing attempts to distinguish important paths:Interactions between statements

Intermediate between simple statement and branch coverage andmore expensive path-based structural testing

Cover Def-Use (DU) pairs: From computation of value to itsuse

Intuition: Bad computed value is revealed only when it is used

Levels: All DU pairs, all DU paths, all defs (some use)

Limits: Aliases, infeasible paths Worst case is bad (undecidable properties, exponential blowup of

paths), so pragmatic compromises are required

5210/11/2011 Collections by: Dr. U.P.Kulkarni

Documents

Chapter-5-Data Flow Models - Testing