Upload
others
View
9
Download
0
Embed Size (px)
Citation preview
CS510 Software EngineeringProgram Slicing
Asst. Prof. Mathias Payer
Department of Computer SciencePurdue University
TA: Scott A. CarrSlides inspired by Xiangyu Zhang
http://nebelwelt.net/teaching/15-CS510-SE
Spring 2015
What is slicing?
Table of Contents
1 What is slicing?
2 Using Slicing
3 Slice Construction
4 Offline Slicing Algorithms
5 Online Slicing Algorithms
6 Forward Dynamic Slice Computation
7 Slicing Outlook
8 Summary
Mathias Payer (Purdue University) CS510 Software Engineering 2015 2 / 39
What is slicing?
What is slicing?
Program slicing1 is a method used by experienced computerprogrammers for abstracting from programs. Starting from a subsetof a program’s behavior, slicing reduces that program to a minimalform which still produces that behavior. The reduced program, calleda slice, is an independent program guaranteed to faithfully representthe original program within the domain of the specified subset ofbehavior.
Slicing
The slice of variable v at statement S is the set of statementsinvolved in computing v’s value at S.
1Mark Weiser, Program slicing, ICSE’81Mathias Payer (Purdue University) CS510 Software Engineering 2015 3 / 39
What is slicing?
Slicing Example
1 #d e f i n e N 2562
3 v o i d main ( ) {4 i n t i = 0 ;5 i n t sum = 0 ;6 w h i l e ( i < N) {7 sum = sum + i ;8 i = i + 1 ;9 }
10 p r i n t f ( ”Sum = %d\n” , sum ) ;11 p r i n t f ( ” i = %d\n” , i ) ;12 }
Mathias Payer (Purdue University) CS510 Software Engineering 2015 4 / 39
Using Slicing
Table of Contents
1 What is slicing?
2 Using Slicing
3 Slice Construction
4 Offline Slicing Algorithms
5 Online Slicing Algorithms
6 Forward Dynamic Slice Computation
7 Slicing Outlook
8 Summary
Mathias Payer (Purdue University) CS510 Software Engineering 2015 5 / 39
Using Slicing
Use-cases for slicing
Debugging minimize program to capture essentials.
Data-Flow Testing reduce cost of regression testing after changes.
Code Reuse extract modules for reuse.
Version Integration safely integrate non-interfering extensions.
Partial Execution Replay repeat only failure-relevant part.
Partial Roll Back partially roll back a transaction.
Information Flow prevent confidential data from interacting withuntrusted data.
Others...
Mathias Payer (Purdue University) CS510 Software Engineering 2015 6 / 39
Slice Construction
Table of Contents
1 What is slicing?
2 Using Slicing
3 Slice Construction
4 Offline Slicing Algorithms
5 Online Slicing Algorithms
6 Forward Dynamic Slice Computation
7 Slicing Outlook
8 Summary
Mathias Payer (Purdue University) CS510 Software Engineering 2015 7 / 39
Slice Construction
Slice Construction
1 #d e f i n e N 2562
3 v o i d main ( ) {4 i n t i = 0 ;5 i n t sum = 0 ;6 w h i l e ( i < N) {7 sum = sum + i ;8 i = i + 1 ;9 }
10 p r i n t f ( ”Sum = %d\n” , sum ) ;11 p r i n t f ( ” i = %d\n” , i ) ;12 }
How can we construct aslice for # 11?
Use PDG: DataDependence.
Use PGD: ControlDependence.
Recursively enumerateall dependentstatements.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 8 / 39
Slice Construction
Static vs. Dynamic Slicing
Static slicing has lower overhead while dynamic slicing may useruntime information.
Static runs into (code/data pointer) aliasing problems whiledynamic runs into coverage problems.
Static slicing may run into state explosion.
Static slices are usually larger than dynamic slices.
Combined static/dynamic approach allows best coverage andbest results.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 9 / 39
Slice Construction
Dynamic Slicing
A dynamic program slice2 is an executable subset of the originalprogram that produces the same computations on a subset of selectedvariables and inputs. It differs from the static slice (Weiser, 1982,1984) in that it is entirely defined on the basis of a computation.The two main advantages are the following: Arrays and dynamic datastructures can be handled more precisely and the size of slice can besignificantly reduced, leading to a finer localization of the fault.
2Bogdan Korel and Janusz Laski, Dynamic Program Slicing, 1988Mathias Payer (Purdue University) CS510 Software Engineering 2015 10 / 39
Slice Construction
Dynamic Slicing (2)
The set of executed statements instances that contributed to thevalue of the criterion.
Dynamic slicing leverages all information about a particularexecution of a program.
Computation through Dynamic Program Dependence Graph(DPDG): (i) each node is an executed statement; (ii) edgesrepresent control/data dependences; dynamic slice criterion is atriplet {var, exec point, input}; (iii) the reachable set from acriterion constitutes a slice.
Dynamic slices are smaller, more precise, and more helpful.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 11 / 39
Slice Construction
Static vs. Dynamic Slicing
Static slicing has lower overhead while dynamic slicing may useruntime information.
Static runs into (code/data pointer) aliasing problems whiledynamic runs into coverage problems.
Combined static/dynamic approach allows best coverage andbest results.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 12 / 39
Slice Construction
Dynamic Slicing Example
1 #d e f i n e N 2562
3 v o i d main ( ) {4 i n t i = 0 ;5 i n t sum = 0 ;6 w h i l e ( i < N) {7 sum = sum + i ;8 i = i + 1 ;9 }
10 p r i n t f ( ”Sum = %d\n” , sum ) ;11 p r i n t f ( ” i = %d\n” , i ) ;12 }
slice(I@11) ={4, 6, 8, 11}dslice(I@11,N = 0) ={4, 11}(11 DD 4, 11 !CD 6)
dslice(I@11,N = 1) ={4, 6, 8, 11}10’: i = 5;
dslice(I@11,N = 1) ={10′, 11}
Control Dependence3
3B is control dependent on A iff there is a path in the CFG from A to B thatdoes not contain the immediate dominator of A.Mathias Payer (Purdue University) CS510 Software Engineering 2015 13 / 39
Slice Construction
Dynamic Slicing Summary
Do we still care about aliasing?
No, a backward linear scan through the trace recovers all datadependences.
What about control dependences?
Still tricky. We cannot just traverse backwards to detect if astatement X is control dependent on an earlier statement, moredata-structures are needed.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 14 / 39
Offline Slicing Algorithms
Table of Contents
1 What is slicing?
2 Using Slicing
3 Slice Construction
4 Offline Slicing Algorithms
5 Online Slicing Algorithms
6 Forward Dynamic Slice Computation
7 Slicing Outlook
8 Summary
Mathias Payer (Purdue University) CS510 Software Engineering 2015 15 / 39
Offline Slicing Algorithms
Offline Slicing
Idea: instrument the program to generate the control-flow andmemory access trace, recover control dependences and datadependences offline, after trace collection.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 16 / 39
Offline Slicing Algorithms
Trace example
1 v o i d main ( ) {2 i n t i = 0 ; t r a c e ( 2 , wr , &i , 0) ;3 i n t sum = 0 ; t r a c e ( 3 , wr , &sum , 0) ;4 w h i l e ( i<N, t r a c e ( 4 , rd , &i , rd &N) ) {5 sum = sum + i ; t r a c e ( 5 , rd , &sum , rd , &i , wr , &sum ) ;6 i = i + 1 ; t r a c e ( 6 , rd , &i , wr , &i ) ;7 }8 p r i n t f ( ”sum = %d\n” , sum ) ; t r a c e ( 8 , rd , &sum ) ;9 p r i n t f ( ” i = %d\n” , i ) ; t r a c e ( 9 , rd , &i ) ;
10 }
Mathias Payer (Purdue University) CS510 Software Engineering 2015 17 / 39
Offline Slicing Algorithms
Offline Slicing: Data Dependence
For each “{R, addr}”, traverse trace backwards to find the closest“{W, addr}”, introduce a data-dependency edge. Then traversefurther to find the corresponding writes of the reads on the identifiedwrite.{9, rd ,&i} → {6,wr ,&i}{6, rd ,&i} → {2,wr ,&i}
Mathias Payer (Purdue University) CS510 Software Engineering 2015 18 / 39
Offline Slicing Algorithms
Offline Slicing: Control Dependence
Assume that there are no recursive functions and CD(i) is the set ofstatic control dependence of i. Traverse backward in the trace andfind the closest x so that x is in CD(i) then introduce a dynamiccontrol dependence from i to x.This does not work (well) with recursion.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 19 / 39
Online Slicing Algorithms
Table of Contents
1 What is slicing?
2 Using Slicing
3 Slice Construction
4 Offline Slicing Algorithms
5 Online Slicing Algorithms
6 Forward Dynamic Slice Computation
7 Slicing Outlook
8 Summary
Mathias Payer (Purdue University) CS510 Software Engineering 2015 20 / 39
Online Slicing Algorithms
Online Slicing Algorithms
Offline trace traversal has huge performance implications due tofrequent trace scans.
Detect control dependence and data dependence online duringexecution (instead of just recording the trace).
Mathias Payer (Purdue University) CS510 Software Engineering 2015 21 / 39
Online Slicing Algorithms
Efficient Data Dependence Detection
Idea: Use data structure to store last writer.
Store last instruction that writes an address in a hashmap.
For reads, lookup address in hashmap and add data-dependencyedge.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 22 / 39
Online Slicing Algorithms
Efficient Control Dependence Detection
Dynamic Control Dependence
yj is dynamic control dependent (DCD) on xi iff there exists a pathfrom xi to Exit that does not pass yj and no such paths for nodes inthe executed path from xi to yj .
We also note that all executed statements between a predicateinstance and its immediate post-dominator form a region.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 23 / 39
Online Slicing Algorithms
Region example
1 f o r ( i =0; i<N; I ++) {2 i f ( i %2==0)3 p = &a [ i ] ;4 f o o ( p ) ;5 }6 a=a +1;
|- |- 1_1
| | |- 2_1
| | |- 3_1
| | 4_1
| | ...
| | |- 1_2
| | | |-2_2
| | | |-3_2
| | | 4_2
| | | ...
| |- |- 1_3
|- 6_1
Mathias Payer (Purdue University) CS510 Software Engineering 2015 24 / 39
Online Slicing Algorithms
Dynamic Control Dependence: Properties
1 A statement instance xi is DCD on the predicate instanceleading xi ’s enclosing region.
2 Regions are disjoint or nested, they never overlap.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 25 / 39
Online Slicing Algorithms
DCD: Property 1
A statement instance xi is DCD on the predicate instance leading xi ’senclosing region.Proof:let the predicate instance be pj and assume xi does not DCD pj .Therefore either (i) there is not a path from pj to exit that does notpass xi , which indicates xi is a post-dominator of pj , contradictingthe condition that xi is in the region delimited by pj and itsimmediate post-dominator or (ii) there is a yk in between pj and xi sothat yk has a path to Exit that does not pass xi . Since pj ’simmediate post-dominator is also a post-dominator of yk , yk and pj ’spost-dominator form a smaller region that includes xi , contradictingthat pj leads the enclosing region of xi .
Mathias Payer (Purdue University) CS510 Software Engineering 2015 26 / 39
Online Slicing Algorithms
DCD: Property 2
Regions are disjoint or nested, they never overlap.Proof: Assume there are two regions (x , y) and (m, n) that overlap.Let m reside in (x , y), thus y resides in (m, n),which implies thatthere is a path from m to Exit without passing y .Let the path be P .Therefore, the path from x to m and P constitute a path from x toExit without passing y , contradicting the condition that y is apost-dominator of x .
Mathias Payer (Purdue University) CS510 Software Engineering 2015 27 / 39
Online Slicing Algorithms
Efficient DCD Detection
Observation: regions have LIFO property (otherwise regionswould overlap).
Implication: the sequence of nested active regions can bemaintained by a stack, called Control Dependence Stack.
A region is nested in the region right below it on the stack.
The enclosing region for the current execution point is alwaysthe top entry in the stack, therefore the execution point iscontrol dependent on the predicate that leads the top region.
An entry is pushed onto CDS if a branching point (predicates,switch statements, etc.) executes.
Top is popped if the immediate post-dominator of the branchingpoint executes, denoting the end of the current region.
Reading assignment: Bin Xin, Xiangyu Zhang, Efficient Online Detection of
Dynamic Control Dependence, ISSTA’07.Mathias Payer (Purdue University) CS510 Software Engineering 2015 28 / 39
Forward Dynamic Slice Computation
Table of Contents
1 What is slicing?
2 Using Slicing
3 Slice Construction
4 Offline Slicing Algorithms
5 Online Slicing Algorithms
6 Forward Dynamic Slice Computation
7 Slicing Outlook
8 Summary
Mathias Payer (Purdue University) CS510 Software Engineering 2015 29 / 39
Forward Dynamic Slice Computation
Forward Dynamic Slice Computation
Prior mechanisms use backward slicing: dependence graphs aretraversed backwards from slicing criterion with space complexityO(execution length).
Forward computation: a slice is represented as a set ofstatements that are involved in computing the value of theslicing criterion, maintain slices per variable.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 30 / 39
Forward Dynamic Slice Computation
Forward Dynamic Slicing
An assignment statement execution is formulated as:si : x = pj?op(src1, src2, ...)
The statement execution instance si is control dependent on pjand operates on variables of src1, src2, etc.
Upon execution of si , the slice of x is updated toslice(x) = si ∪ slice(src1) ∪ slice(src2) ∪ ... ∪ slice(pj)
The slice of variable x is the union of the current statement, theslices of all variables that are used and the slice of the predicateinstance that si is control dependent on. Because they arecontributing to the value of x .
Such slices are equivalent to slices computed by backwardsalgorithms.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 31 / 39
Forward Dynamic Slice Computation
Forward Dynamic Slicing (2)
A predicate is formulated as si : pj?op(src1, src2, ...). Thepredicate itself is control dependent on another predicateinstance pj and the branch outcome is computed from variablesof src1, src2, and so on.
When executing si a triple of< si , IPD(s), s ∪ slice(src1) ∪ slice(src2) ∪ ... ∪ slice(pj) > ispushed to the CDS. The entry is popped at its immediatepost-dominator.
slice(pj) can be retried from the top element of the CDS.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 32 / 39
Forward Dynamic Slice Computation
Forward Dynamic Slicing Example
a = 1 11 : a = 1 slice(a) = {1}b = 2 21 : b = 2 slice(b) = {2}c = a+b 31 : c = a + b slice(c) = {1, 2, 3}if a < b then 41 : if a < b then push(< 41, 6, 1, 2, 4 >)d = b*c 51 : d = b ∗ c slice(d) = {1, 2, 3, 4, 5}
Mathias Payer (Purdue University) CS510 Software Engineering 2015 33 / 39
Forward Dynamic Slice Computation
Forward Dynamic Slicing (3)
Slices are equivalent to those computed by backward slicing.
Space complexity is bounded byO((nr(variables) + MAX CDS DEPTH) ∗ nr(statements)).
Efficiency relies on hashmap implementation and set operations.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 34 / 39
Slicing Outlook
Table of Contents
1 What is slicing?
2 Using Slicing
3 Slice Construction
4 Offline Slicing Algorithms
5 Online Slicing Algorithms
6 Forward Dynamic Slice Computation
7 Slicing Outlook
8 Summary
Mathias Payer (Purdue University) CS510 Software Engineering 2015 35 / 39
Slicing Outlook
Slicing Outlook
Slicing is an approach to isolate part of the program (orexecution) given a certain criterion.
Event slicing: intrusion detection, execution fast forwarding,understanding network protocols, malware replayer.
Forward slicing.
Chopping.
Probabilistic slicing.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 36 / 39
Summary
Table of Contents
1 What is slicing?
2 Using Slicing
3 Slice Construction
4 Offline Slicing Algorithms
5 Online Slicing Algorithms
6 Forward Dynamic Slice Computation
7 Slicing Outlook
8 Summary
Mathias Payer (Purdue University) CS510 Software Engineering 2015 37 / 39
Summary
Summary
Static and dynamic slicing concepts and mechanisms.
Offline dynamic slicing algorithms based on backwards traversalof traces are inefficient.
Online algorithms that detect data dependences and controldependences allow efficient implementation.
Mathias Payer (Purdue University) CS510 Software Engineering 2015 38 / 39
Summary
Questions?
?
Mathias Payer (Purdue University) CS510 Software Engineering 2015 39 / 39