1 / 65

Program Slicing

Program Slicing. Xiangyu Zhang. What is a slice?. S: …. = f (v) Slice of v at S is the set of statements involved in computing v’s value at S. [Mark Weiser, 1982] Data dependence Control dependence. Void main ( ) { int I=0; int sum=0; while (I<N) {

kyoko
Download Presentation

Program Slicing

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Program Slicing Xiangyu Zhang

  2. What is a slice? S: …. = f (v) • Slice of v at S is the set of statements involved in computing v’s value at S. [Mark Weiser, 1982] • Data dependence • Control dependence Void main ( ) { int I=0; int sum=0; while (I<N) { sum=add(sum,I); I=add(I,1); } printf (“sum=%d\n”,sum); printf(“I=%d\n”,I);

  3. Why Slicing • Debugging • Testing • Differencing • Program understanding • Software maintenance • Complexity measurement / Functional Cohesion • Program integration • Reverse engineering • Software Quality Assurance Old!

  4. What Now • Security • Malware detection; • Software piracy • … • Software Transactional Memory • Architecture • Value speculation • Program optimization • PRE • Data Lineage • More to come A program implement multiple semantic functions. All are not relevant!

  5. Outline • Slicing ABC • Dynamic slicing • Efficiency • Effectiveness • Challenges

  6. Slicing Classification • Static vs. Dynamic • Backward vs. Forward • Executable vs. Non-Executable • More

  7. b=0 a=2 1 <=i <=N T if ((i++)%2= =1) F T F a=a+1 b=a*2 z=a+b print(z) How to do slicing? • Static analysis • Input insensitive • May analysis • Dependence Graph • Characteristics • Very fast • Very imprecise

  8. Why is a static slice imprecise? • All possible program paths S1:x=… S2:x=… L1:…=x • Use of Pointers – static alias analysis is very imprecise S1:a=… S2:b=… L1:…=*p • Use of function pointers – hard to know which function is called, conservative expectation results in imprecision

  9. Dynamic Slicing • Korel and Laski, 1988 • Dynamic slicing makes use of all information about a particular execution of a program and computes the slice based on an execution history (trace) • Trace consists control flow trace and memory reference trace • A dynamic slice query is a triple • <Var, Input , Execution Point> • Smaller, more precise, more helpful to the user

  10. Dynamic Slicing Example -background For input N=2, 11: b=0 [b=0] 21: a=2 31: for i = 1 to N do [i=1] 41: if ( (i++) %2 == 1) then [i=1] 51: a=a+1 [a=3] 32: for i=1 to N do [i=2] 42: if ( i%2 == 1) then [i=2] 61: b=a*2 [b=6] 71: z=a+b [z=9] 81: print(z) [z=9] 1: b=0 2: a=2 3: for i= 1 to N do 4: if ((i++)%2==1) then 5: a = a+1 else 6: b = a*2 endif done 7: z = a+b 8: print(z)

  11. Issues about Dynamic Slicing • Precision – perfect • Running history – very big ( GB ) • Algorithm to compute dynamic slice - slow and very high space requirement.

  12. Backward vs. Forward 1 main( ) 2 { 3 int i, sum; 4 sum = 0; 5 i = 1; 6 while(i <= 10) 7 { 8 sum = sum + 1; 9 ++ i; 10 } 11 Cout<< sum; 12 Cout<< i; 13 } An Example Program & its forward slice w.r.t. <3, sum>

  13. Executable vs. Non-Executable

  14. Comments • Want to know more? • Frank Tip’s survey paper (1995) • Static slicing is very useful for static analysis • Code transformation, program understanding, etc. • Points-to analysis is the key challenge • Not as useful in reliability as dynamic slicing • We will focus on dynamic slicing • Precise • good for reliability. • Solution space is much larger. • There exist hybrid techniques.

  15. Outline • Slicing ABC • Dynamic slicing • Efficiency • Effectiveness • Challenges

  16. Efficiency • How are dynamic slices computed? • Execution traces • control flow trace -- dynamic control dependences • memory reference trace -- dynamic data dependences • Construct a dynamic dependence graph • Traverse dynamic dependence graph to compute slices

  17. [r2] How to Detect Dynamic Dependence • Dynamic Data Dependence • Shadow space (SS) • Addr  Abstract State Virtual Space Shadow Space s1x [r1] s1x: ST r1, [r2] SS(r2)=s1x s2y SS(r1)=s1x s2y: LD [r1], r2 Dynamic control dependence is more tricky!

  18. Dynamic Dependence Graph Sizes • On average, given an execution of 130M instructions, the constructed dependence graph requires 1.5GB space.

  19. Conventional Approaches • [Agrawal &Horgan, 1990] presented three algorithms to trade-off the cost with precision. Algo.I Algo.II Algo.III Precise dynamic analysis Static Analysis high Cost: low Precision: low high

  20. Algorithm One • This algorithm uses a static dependence graph in which all executed nodes are marked dynamically so that during slicing when the graph is traversed, nodes that are not marked are avoided as they cannot be a part of the dynamic slice. • Limited dynamic information - fast, imprecise (but more precise than static slicing)

  21. 11 21 31 41 51 71 81 Algorithm I Example 1: b=0 For input N=1, the trace is: 2: a=2 3: 1 <=i <=N T 4: if ((i++)%2= =1) F T F 5: a=a+1 6: b=a*2 32 7: z=a+b 8: print(z)

  22. Algorithm I Example 1: b=0 2: a=2 DS={1,2,5,7,8} 3: 1 <=i <=N Precise! 4: if ((i++)%2= =1) 5: a=a+1 6: b=a*2 7: z=a+b 8: print(z)

  23. Imprecision introduced by Algorithm I Input N=2: for (a=1; a<N; a++) { … if (a % 2== 1) { b=1; } if (a % 3 ==1) { b= 2* b; } else { c=2*b+1; } } 4 1 2 3 4 5 6 7 8 9 7 9 Killed definition counted as reaching! Aliasing!

  24. Algorithm II • A dependence edge is introduced from a load to a store if during execution, at least once, the value stored by the store is indeed read by the load (mark dependence edge) • No static analysis is needed.

  25. 11 21 31 41 51 71 81 Algorithm II Example 1: b=0 For input N=1, the trace is: 2: a=2 3: 1 <=i <=N T 4: if ((i++)%2= =1) F T F 5: a=a+1 6: b=a*2 7: z=a+b 8: print(z)

  26. Algorithm II – Compare to Algorithm I • More precise Algo. II Algo. I x=… x=… …=x …=x …=x …=x

  27. Imprecision introduced by Algorithm II • A statically distinct load/store may be executed several times during program execution. Different instances of a load may be dependent on different store instructions or different instances of a store instructions. S1:x=… S2:x=… < 2, 1 > < 1 , 1 > L1:…=x • Algo. 2 uses unlabeled edges. Therefore, upon inclusion of the load in the slice it will always include both the stores.

  28. Algorithm III • First preprocess the execution trace and introduces labeled dependence edges in the dependence graph. During slicing the instance labels are used to traverse only relevant edges.

  29. Dynamic Dependence Graph Sizes (revisit) • On average, given an execution of 130M instructions, the constructed dependence graph requires 1.5GB space.

  30. Dynamic Dep. Graph Representation N=2: 1: sum=0 2: i=1 1: sum=0 2: i=1 3: while ( i<N) do 3: while ( i<N) do 4: i=i+1 5: sum=sum+i 4: i=i+1 5: sum=sum+i 3: while ( i<N) do 4: i=i+1 5: sum=sum+i 6: print (sum) 3: while ( i<N) do 6: print (sum)

  31. Dynamic Dep. Graph Representation Timestamps N=2: 1: sum=0 2: i=1 1: sum=0 2: i=1 0 0 1 1 3: while ( i<N) do 3: while ( i<N) do 4: i=i+1 5: sum=sum+i 2 2 4: i=i+1 5: sum=sum+i (2,2) (4,4) 3 3 3: while ( i<N) do 4: i=i+1 5: sum=sum+i (4,6) 4 4 6: print (sum) 5 5 3: while ( i<N) do 6 6 6: print (sum) • A dynamic dep. edge is represented as by an edge annotated with a pair of timestamps <definition timestamp, use timestamp>

  32. (...,20) ... X = X = X = (10,10) (20,20) (30,30) Y= X Y= X Y= X (20,21) ... =Y 21 Infer: Local Dependence Labels: Full Elimination 10,20,30

  33. X = X = X = (20,20) *P = *P = *P = (10,10) Y= X Y= X Y= X =Y 11,21 Transform: Local Dependence Labels: Elimination In Presence of Aliasing (20,21) ... 10,20

  34. X = X = X = X = (20,20) *P = *P = *P = *P = (10,10) Y= X Y= X Y= X Y= X (10,11) (20,21) (10,11) (20,21) =Y =Y 11,21 11,21 Transform: Local Dependence Labels: Elimination In Presence of Aliasing 10 20 10,20

  35. 1 1 1 1 1 2 2 2 2 2 3 3 3 3 4 6 7 9 3 4 6 7 9 3 5 6 7 9 3 4 6 8 9 3 5 6 8 9 4 4 5 5 4 3 3 6 6 5 6 7 8 7 8 9 9 7 10 10 Transform: Coalescing Multiple Nodes into One 1 2 10

  36. X = Y = X = Y = X = Y = (10,21) X = Y = X = Y = X = Y = (10,21) (10,21) (20,11) (20,11) = Y = X = Y = X = Y = X (20,11) Group: Labels Across Non-Local Dependence Edges 10 20 11,21

  37. Space: Compacted Graph Sizes

  38. Breakdowns of Different Optimizations Infer Transform Group Others Explicit

  39. Efficiency: Summary • For an execution of 130M instructions: • space requirement: reduced from 1.5GB to 94MB (I further reduced the size by a factor of 5 by designing a generic compression technique [MICRO’05]). • time requirement: reduced from >10 Mins to <30 seconds.

  40. Generic Compression • Traversable in compressed form • Sequitur • Context-based • Using value predictors;( M. Burtsher and M. Jeeradit, PACT2003) • Bidirectional!! • Queries may require going either direction • The system should be able to answer multiple queries

  41. X Y Z A Compression using value predictors • Value predictors • Last n values; • FCM (finite context method). • Example, FCM-3 Uncompressed Left Context lookup table X Y Z A Compressed 1

  42. X Y Z X Y Z X Y Z A A B Compression using value predictors • Value predictors • Last n values; • FCM (finite context method). • Example, FCM-3 Uncompressed Left Context lookup table X Y Z B Compressed B Length(Compressed) = n/32 + n*(1- predict rate) Only forward traversable;

  43. Bidirection idea: Enable bidirectional traversal - idea Previous predictor compression: Compressed

  44. Uncompressed X Y Z X Y Z X Y Z A Uncompressed current context Compressed 1 X Y Z Y Z A Right Context lookup table X Y Z A Right Context lookup table Left Context lookup table Enable bidirectional traversal • Forward compressed, backward traversed (uncompressed) FCM • Traditional FCM is forward compressed, forward traversed Left Context lookup table A • Bidirectional FCM

  45. A X Y 1 1 1 X Y Z 1 A X Y Z A X Y Z 1 A X Y Z Bidirectional FCM - example Right Context lookup table Left Context lookup table

  46. Outline • Slicing ABC • Dynamic slicing • Dynamic slicing practices • Efficiency • Effectiveness • Challenges

  47. The Real Bugs • Nine logical bugs • Four unix utility programs • grep 2.5, grep 2.5.1, flex 2.5.31, make 3.80. • Six memory bugs [AccMon project (UIUC)] • Six unix utility programs • gzip, ncompress, polymorph, tar, bc, tidy.

  48. 2.4-47.1% EXEC Avg 30.9% Classic Dynamic Slicing in Debugging

  49. input0 input_x input2 predicate_x output0 output1 output_x output_x predicate_x Looking for Additional Evidence Buggy Execution • Classic dynamic slicing algorithms investigate bugs through negative evidence of thewrong output • Other types of evidence: • Failure inducing input • Critical Predicate • Partially correct output • Benefits of More Evidence • Narrow the search for fault • Broaden the applicability

  50. (1) (3) (2) Negative: Failure Inducing Input [ASE’05] iname[1025]: aaaaaaaaa...aaaaa strcpy.c ... 40: for (; (*to = * from)!=0; ++from; ++to); ... gzip.c ... 193: char *env; 198: CHAR ifname[1024]; ... 844: strcpy (ifname, iname); ... 1344: ... free(env), ... The rationale

More Related