Pruning Dynamic Slices

1
Pruning Dynamic Slices With Confidence
Xiangyu Zhang Neelam Gupta Rajiv Gupta The
University of Arizona
2
Dynamic Slicing
10. A ... 20. B 30. P 31. If (P ...... 35. A A 1 36. 37. BB1 40.
Error(A)

• Dynamic slice is the set of statements that
  did affect the value of a variable at a program
  point for a specific program execution. Korel
  and Laski, 1988

Dynamic Slice (A_at_40) 10, 30, 31, 35, 40
3
Effectiveness of Dynamic Slicing

• Dynamic slicing is very effective in
  containing the faulty statement, however it
  usually produces over-sized slices --
  AADEBUG05.
• Problem
• How to automatically prune dynamic slices?
• Approaches
• Coarse-grained pruning by intersecting multiple
  types (backward, forward, bidirectional) of
  dynamic slices -- ASE05, ICSE06
• Fine-grained pruning of a backward slice by using
  confidence analysis -- this paper.

4
Types of Evidence Used in Pruning
Buggy Execution

• Classical dynamic slicing algorithms investigate
  bugs through the evidence of the wrong output

• Other types of evidence
• Failure inducing input ASE05

• Critical Predicate ICSE06

• Partially correct output -- this paper

• Benefits of more evidence
• Narrow the search for faulty stmt.
• Broaden the applicability

5
Coarse-grained Pruning by Intersecting Slices
failure inducing input
FS
6
Fine-grained Pruning by Exploiting Correct Outputs

• Correct outputs produced in addition to wrong
  output.
• BS(Owrong) BS (Ocorrect) is problematic.

10. A 1 (Correct A3) ... 20. B A
2 30. C A 2 40. Print (B) 41. Print (C)
BS(C_at_41) 10, 30, 41 BS(B_at_40) 10, 20,
40 BS(C_at_41)-BS(B_at_40) 30,41
7
Confidence Analysis
n

• Value produced at n can reach only correct
  outputs

There is no evidence of
incorrectness of n. Therefore it cannot be in
the slice.
Confidence(n)1
There is no evidence that n is correct, so it
should be in the pruned slice.
Confidence(n)0
Confidence(n)? 0 ? 1
8
Confidence Analysis
Range(n) a, b, c, d, e, f, g
Value(n) a
Alt(n) is a set of possible values of the
variable defined by n, that when propagated
through the dynamic dependence graph, produce
the same values for correct outputs.
Alt(n) a
, c

• When Alt(n)1, we have the highest
  confidence (1) on the correctness of n
• When Alt(n)Range(n), we have the
  lowest confidence (0).
• Range(n) Alt(n)1

9
Confidence Analysis Example
10. A ... ... 20. B A 2 30. C A
2 40. Print (B) 41. Print (C)
10
Confidence Analysis Two Problems

• How to decide the Range of values for a node n?
• Based on variable type (e.g., Integer).
• Static range analysis.
• Our choice
• Dynamic analysis based on value profiles.
• Range of values for a statement is the set of
  values defined by all of the execution instances
  of the statement during the program run.
• How to compute Alt(n)?
• Consider the set of correct output values as
  constraints.
• Compute Alt(n) by backward propagation of
  constraints through the dynamic dependence
  subgraph corresponding to the slice.

11
Computing Alt(n) Along Data Dependence
alt(S1) alt(T_at_S2) n alt (T_at_S3) 9
S1 T...
9
alt(T_at_S2)9
alt(T_at_S3)1,3,9
S2 XT1
10
S3 YT3
0
alt(S2)10
alt(S3)0,1
12
Computing Alt(n) Along Control Dependence
alt(S1) True
S1 if (P)
True
S2 XT1
10
S3 YT3
0
alt(S2)10
alt(S3)0,1
(Y,T)(0,3) (0,9) (1,1) (2,5) (2,8)
(X,T) (6,5) (9,8) (10,9)
13
Characteristics of Siemens Suite Programs

• Each faulty version has a single manually
  injected error.
• All the versions are not included
• No output is produced.
• Faulty statement is not contained in the backward
  slice.
• For each version three tests were selected.

14
Results of Pruning
15
Confidence Based Prioritization
DD dep. distance
CV confidence values
Executed statement instances examined ()
16
The Potential of Confidence Analysis (1)
Buggy Code
Pruned Slices
Dynamic Slicer With Confidence
Input
User Verified Statements as correct

• Case Study (replace v14)
• 88 ? 74 ? 23

17
The Potential of Confidence Analysis (2)

• Relevant slicing (gzip v3 run r1)

Potential dep. Data dep.
18
Conclusions

• We have presented a new approach - Confidence
  analysis - that exploits the correct output
  values produced in an execution to prune the
  dynamic slice of an incorrect output.
• We have developed a novel dynamic analysis based
  implementation of confidence analysis, which
  effectively pruned backward dynamic slices in our
  experiments.
• Pruned Slices 41.1 Dynamic Slices, and still
  contain the faulty statement.
• Our study shows that confidence analysis has
  additional applications beyond pruning
  prioritization, interactive pruning relevant
  slicing.

19
The End