Survey of program slicing techniques

1. Survey of program slicing techniques Presenter’s Name: Keyur Malaviya

2. Purpose of this paper • It’s a survey that presents an overview of program slicing • Various general approaches used to compute slices • Specific techniques used to address procedures, unstructured control flow, composite data types and pointers, and concurrency. • Static and dynamic slicing methods for each of these features • Comparison and classification in terms of their accuracy and efficiency

3. Topics Covered • Definitions • Static slicing vs Dynamic slicing • Basic slicing algorithm for single procedure and multiprocedure • Weiser Algorithm • Hausler • Bergeretti and Carr´e • Horwitz, Reps, and Binkley Algo • Applications

4. Definitions (Basics) • Slicing? • Slicing Criteria? • Static and Dynamic slicing? • Program slicing? • Program dependence graph (PDG) or Control flow graph (CFG) or System dependency grapy (SDG) (1) read(n); (2) i := 1; (3) sum := 0; (4) product := 1; (5) while i <= n do begin (6) sum := sum + i; (7) product := product * i; (8) i := i + 1 end; (9) write(sum); (10) write(product)

5. Definitions (CFG \ PDG) PDG: Directed graph; Vertices = statements and control predicates Edges = data and control dependences CFG

6. Definitions • Program slice: consists of the parts of a program that affect the values computed at some point of interest. • Slicing criterion: is this point of interest specified by a pair (program point, set of variables) • Original concept by Weiser: Its a mental abstractions that people make when they are debugging a program • Static slicing: Computed without making assumptions regarding a program’s input • Dynamic slicing: Relies on some specific test case

7. Definitions (criteria and slicing ) Slice of this program w.r.t criterion (10, product) (1) read(n); (2) i := 1; (3) sum := 0; (4) product := 1; (5) while i <= n do begin (6) sum := sum + i; (7) product := product * i; (8) i := i + 1 end; (9) write(sum); (10) write(product) (1) read(n); (2) i := 1; (3) sum := 0; (4) product := 1; (5) while i <= n do begin (6) sum := sum + i; (7) product := product * i; (8) i := i + 1 end; (9) write(sum); (10) write(product) (1) read(n); (2) i := 1; (3) (4) product := 1; (5) while i <= n do begin (6) (7) product := product * i; (8) i := i + 1 end; (9) (10) write(product) • Single-procedure programs(PDG); Shading in the PDG shown before  vertices in the slice w.r.t. write(product)

8. Static slicing vs Dynamic slicing • Dynamic Slicing: First introduced by Korel and Laski Non-interactive variation of Balzer’s flowback analysis • Flowback analysis: Interactively traverse a graph (data and control dependences between statements in the program); For e.g.: S(V) depends on T(V), S and T are statements; T  S is in CFG, then trace back from vertex for S to vertex for T • Only the dependences that occur in a specific execution of the program are taken into account • Dynamic slicing criterion is a triple (input, occurrence of a statement, variable) – it specifies the input, and distinguishes between different occurrences of a statement in the execution history • Dynamic slicing assumes fixed input for a program • Static slicing does not make assumptions regarding the input.

9. 1 2 3 4 5 6 7 8 read(n); i := 1; while (i <= n) do begin if (i mod 2 = 0) then x := 17 else x := 18; i := i + 1 end; write(x) Static slicing vs Dynamic slicingcriterion SS: (8, x) and DS: (n=2, 81, x) Example program: Static slice w.r.t. criterion (8, x) Dynamic slice w.r.t. criterion (n=2, 81, x) read(n); i := 1; while (i <= n) do begin if (i mod 2 = 0) then x := 17 else x := 18; i := i + 1 end; write(x) read(n); i := 1; while (i <= n) do begin if (i mod 2 = 0) then x := 17 else ; i := i + 1 end; write(x)

10. Slicing Algorithm Approaches • Achieved through one of three algorithmic approaches: 1) data-flow equations 2) system dependency graph 3) parallel algorithm • All based on control and data dependencies and defined in terms of a graph representation of a program (as seen before)

11. Approaches: • Statements and control predicates are gathered by way of a backward traversal of the program’s control flow graph (CFG) or PDG, starting at the slicing criterion • Weiser’s approach: compute slices from consecutive sets of transitively relevant statements ( data flow and control flow dependences ) • Ottenstein approach: in terms of a reachability problem in a PDG. Slicing criterion  A vertex in the PDG; A Slice corresponds to all PDG vertices from which the vertex under consideration can be reached • Other approaches: Based on modified and extended versions of PDGs

12. Weiser Algorithm (single procedure) • Two levels of iteration: 1. Transitive data dependences in the presence of loops in the program 2. Control dependences, initiating the inclusion of control predicates for which each, step 1 is repeated to include the statements it is dependent upon • Determine directly relevant variables and then indirectly relevant variables; From these compute the sets of relevant statements

13. Parameters and equations • Defined and Referenced Variables • DEF(i) and REF(i) • Say at node ‘i’ consider a statement a = b + c • Then DEF(i) = {a} and REF(i) = {b, c} • Directly Relevant Variable • : set of directly relevant variables, where slice criterion = (V, n) • Set DRV (i) Set DRV (all nodesj) that have a direct edge to i,

14. Parameters and equations • Directly Relevant Statements • : set of all nodes i that define a variable vthat is relevant at the successor node of I • Indirectly Relevant Variables • referenced variables in control predicate are indirectly relevant when at least oneof the statements in its body is relevant, denoted: • b is known as a range of influence INFL (b),

15. Example program

16. Applying the Weiser algo Slicing criterion (10, product) & our example program R0 {product}

17. Applying the Weiser algo Slicing criterion (10, product) & our example program R0 {product} {product} {product}

18. Applying the Weiser algo Slicing criterion (10, product) & our example program R0 {product, i} {product} {product} {product}

19. Applying the Weiser algo Slicing criterion (10, product) & our example program Slicing criterion (5, {i, n}) & repeat the same procedure 0 {n} {i, n} {i, n} {product, i, n} {product, i, n} {product, i, n} {product, i, n} {product} {product}

20. Applying the Weiser algo Slicing criterion (10, product) & our example program ? ? ?

21. Equations for related statements:

22. Hausler (functional style) • For each type of statement, have a function and • & express how a statement transforms the set of relevant variables & relevant statements reply. • Functions for a while statement are obtained by transforming it into an infinite sequence of if statements

23.  iff the value of v on entry to S potentially affects the value computed for e  iff the value computed for e potentially affects the value of v on exit from S,  iff the value of v on entry to S may affect the value of v on exit from S. Information-flow relations(Bergeretti and Carr´e) Statement S: variable v and an expression e ( e can be control predicate or right-hand side of assignment) • We define relations: • They possess following properties:

24. Information-flow relations(Bergeretti and Carr´e) • How to get the slice with respect to the final value of v ? • The set of all expressions e for which can be used to construct “partial statements” replace all statements in S that do not contain expressions in by empty statements. • Relations are computed in a syntax-directed, bottom-up • For S, v := e

25. Information-flow relations(Bergeretti and Carr´e) • Set of expressions that potentially affect the value of product at the end of the program are {1, 2, 4, 5, 7, 8} • Partial statement is obtained • by omitting all statements from the program that do not contain expressions in this set, i.e., both assignments to sum and both write statements • The slice is same as Weiser’s algorithm

26. Dependence graph based approaches (PDG) and Procedures • PDG variant of Ottenstein shows considerably more detail than that by Horwitz, Reps, and Binkley • Procedures • Call-return structure of interprocedural execution paths • Single pass considers infeasible execution paths – a problem called “calling-context” • Will see two approaches: • Weiser’s approach (CFG) • Horwitz, Reps, and Binkley (SDG)

27. Dependence graph based approaches (PDG) and Procedures • Weiser’s approach for interprocedural static slicing: • Interprocedural summary information is computed, using previously developed techniques  P, set MOD(P) of variables = modified by P, and set USE(P) of variables = used by P • Intraprocedural slicing algorithm: Treat ‘P()’ as a conditional assignment statement ‘if SomePredicate then MOD(P) := USE(P)’ (external procedures, source-code is unavailable?)

28. (i) procedures Q called by P: consist of all pairs • (ii) procedures R that call P: consist of all pairs Weiser’s approach • Actual inter-procedural slicing algo that generates new slicing criteria iteratively w.r.t slices computed in step (2): • (i) procedures Q called by P • (i) procedures Q called by P: • (ii) procedures R that call P • (ii) procedures R that call P:

29. Weiser’s Algo • To formalize the generation of new criteria: • UP(S) : Map (a set S of slicing criteria in a P) to (a set of criteria in procedures that call P) • DOWN(S): Map (a set S of slicing criteria in a P) to (a set of criteria in procedures called by P) • Set of all criteria: transitive and reflexive closure of the UP and DOWN relations (UP U DOWN)* • UP and DOWN sets: Requires sets of relevant variables to be known at all call sites  computation of these sets is done by slicing these procedures • When iteration stops? • When no new criteria are generated

30. Main issue: procedure P(y1, y2, … , yn); begin write(y1); write(y2); … (M) write(yn) end • program Main; • … • while ( ) do • P(x1, x2, , xn); • z := x1; • x1 := x2; • x2 := x3; • xn1 := xn • end; • (L) write(z) • end Procedure P is sliced ‘n’ times by Weiser’s algorithm for criterion (L, {z}).

31. Weiser’s Algo • Lprogram point at S = write(z) • M  program point at last statement in P • Slice w.r.t. criterion (L, { z })? • ‘n’ iterations of the body of the while loop • During the ith iteration, variables x1, …, xi will be relevant at call site • DOWN(Main): criterion (M, { y1, …, yi }) gets included • Issue is: ??? Procedure P will be sliced n times

32. What was the problem? • Weiser’s algorithm does not take into account which output parameters are dependent on which input parameters is a source of imprecision • Lets see another examples that shows this problem:

33. What was the problem? program Example; begin ; b := 18; P(a, b, c, d); write(d) end procedure P(v, w, x, y); ; y := w end program Example; begin program Example; begin (1) a := 17; (2) b := 18; (3) P(a, b, c, d); (4) write(d) end procedure P(v, w, x, y); (5) x := v; (6) y := w end a := 17; a := 17; b := 18; P(a, b, c, d); end procedure P(v, w, x, y); ; y := w end Slice with Weiser’s algo Actual Slice

34. Horwitz, Reps, and Binkley Algo • Computes precise inter-procedural static slices: • 1. SDG, a graph representation for multi-procedure programs • 2. Computation of inter-procedural summary information • precise dependence relations between i/p & o/t parameters • explicitly present in SDG as summary edges • 3. Two-pass algorithm for extracting interprocedural slices from an SDG

35. Multi-procedure program

36. Horwitz, Reps, and Binkley Algo1) Structure of SDG • SDG = PDG for main program, & a procedure dependence graph for each procedure • SDG <> PDG (Vertices and edges are different) • For each call statement, there is a call-site vertex in the SDG as well as actual-in and actual-out vertices

37. 1) Structure of SDG • Each procedure dependence graph has an entry vertex, and formal-in and formal-outvertices • interprocedural dependence edges: (i) control dependence edge (call-site vertex & entry vertex) (ii) parameter-in edge between corresponding actual-in and formal-in vertices, (iii) a parameter out edge between corresponding formal-out and actual-out vertices, and (iv) summary edges that represent transitiveinterprocedural data dependences

38. 1) Structure of SDG

39. Horwitz, Reps, and Binkley Algo2) and 3) • Second part: • Models the calling relationships between the procedures (as in a call graph) • Compute subordinate characteristic graph • For each procedure in the program, this graph contains edges that correspond to precise transitive flow dependences between its input and output parameters. • Third part: • summary edges of an SDG serve to circumvent the calling context problem • First phase: all vertices from which ‘s’ can be reached without descending into procedure calls (slicing starts at vertex s) • Second phase: remaining vertices in the slice by descending into all previously side-stepped calls

40. COMPLETE SDG NEXT: Complete SDG for the example program shown above

42. SDG style interpretation • Thin solid arrows  represent flow dependences, • Thick solid arrows correspond to control dependences, • Thin dashed arrows  Used for call, parameter-in, and parameter-out dependences, • Thick dashed arrows  Transitive inter-procedural flow dependences. • Shaded vertices Vertices in the slice w.r.t. statement write(product) • Light shading  Vertices identified in the first phase • Dark shading  Vertices identified in the second phase

43. The slice with criteria (10, product) program Example; begin (1) read(n); (2) i := 1; (3) sum := 0; (4) product := 1; (5) while i <= n do begin (6) Add(sum, i); (7) Multiply(product, i); (8) Add(i, 1) end; (9) write(sum); (10) write(product) end procedure Add(a; b); begin 11) a := a + b End procedure Multiply(c; d); begin 12) j := 1; 13) k := 0; 14) while j <= d do begin 15) Add(k, c); 16) Add(j, 1); end; 17) c := k end

44. Application of slicing • Debugging and program analysis • Program differencing and program integration • analyzing an old and a new version of a program • partitioning the components • compares slices in order to detect equivalent behaviors • Software maintenance • change at some place in a program  behavior of other parts of the program

45. QUESTIONS