Pruning Dynamic Slices With Confidence

Pruning Dynamic Slices With Confidence Xiangyu Zhang Neelam Gupta Rajiv Gupta The University of Arizona

Dynamic Slicing …… 10. A = …... 20. B = …… 30. P = 31. If (P<0) { ...... 35. A = A + 1 36. } 37. B=B+1 …… 40. Error(A) Dynamic slice is the set of statements that did affect the value of a variable at a program point for aspecific program execution. [Korel and Laski, 1988] Dynamic Slice (A@40) = {10, 30, 31, 35, 40}

Effectiveness of Dynamic Slicing Dynamic slicing is very effective in containing the faulty statement, however it usually produces over-sized slices -- [AADEBUG’05]. Problem: How to automatically prune dynamic slices? Approaches: • Coarse-grained pruning by intersecting multiple types (backward, forward, bidirectional) of dynamic slices --[ASE’05, ICSE’06] • Fine-grained pruning of a backward slice by using confidence analysis -- this paper.

input0 input_x input2 predicate_x output0 output1 output_x output_x predicate_x Types of Evidence Used in Pruning Buggy Execution • Classical dynamic slicing algorithms investigate bugs through the evidence of thewrong output • Other types of evidence: • Failure inducing input [ASE’05] • Critical Predicate [ICSE’06] • Partially correct output -- this paper • Benefits of more evidence • Narrow the search for faulty stmt. • Broaden the applicability

BiS(CP) FS(CP) BS^FS BS + CP Coarse-grained Pruning by Intersecting Slices failure inducing input FS

Fine-grained Pruning by Exploiting Correct Outputs • Correct outputs produced in addition to wrong output. • BS(Owrong) – BS (Ocorrect) is problematic. …… 10. A = 1 (Correct: A=3) …... 20. B = A % 2 …… 30. C = A + 2 …… 40. Print (B) 41. Print (C) BS(C@41)= {10, 30, 41} BS(B@40)= {10, 20, 40} BS(C@41)-BS(B@40) = {30,41}

n • Value produced at node n can reach only wrong output nodes ? n n • Value produced at node n can reach both the correct and wrong output nodes. Should we include n in the slice? Confidence Analysis n • Value produced at n can reach only correct outputs There is no evidence of incorrectness of n. Therefore it cannot be in the slice. Confidence(n)=1 There is no evidence that n is correct, so it should be in the pruned slice. Confidence(n)=0 Confidence(n)=?; 0 ≤ ? ≤ 1

Value(n) = b Value(n) = c n n Confidence Analysis Range(n)={ a, b, c, d, e, f, g } Value(n) = a • Alt(n) is a set of possible values of the variable defined by n, that when propagated through the • dynamic dependence graph, produce the same values for correct outputs. Alt(n)={ a } , c • When |Alt(n)|==1, we have the highest confidence (=1) on the correctness of n; • When |Alt(n)|==|Range(n)|, we have the lowest confidence (=0). • |Range(n)|>= |Alt(n)|>=1

Confidence Analysis: Example …… 10. A = ... …... 20. B = A % 2 …… 30. C = A + 2 …… 40. Print (B) 41. Print (C)

Confidence Analysis: Two Problems • How to decide the Range of values for a node n? • Based on variable type (e.g., Integer). • Static range analysis. • Our choice: • Dynamic analysis based on value profiles. • Range of values for a statement is the set of values defined by all of the execution instances of the statement during the program run. • How to compute Alt(n)? • Consider the set of correct output values as constraints. • Compute Alt(n) by backward propagation of constraints through the dynamic dependence subgraph corresponding to the slice.

(T,...)= (1,...)(3,...)(5,...)(8,...) (9,...) (Y,T)=(0,3) (0,9)(1,1) (2,5) (2,8) (X,T)= (6,5) (9,8) (10,9) Computing Alt(n) Along Data Dependence alt(S1) = alt(T@S2) ∩ alt (T@S3) = {9} S1: T=... 9 alt(T@S2)={9} alt(T@S3)={1,3,9} S2: X=T+1 10 S3: Y=T%3 0 alt(S2)={10} alt(S3)={0,1}

Computing Alt(n) Along Control Dependence alt(S1) = {True} S1: if (P) … True S2: X=T+1 10 S3: Y=T%3 0 alt(S2)={10} alt(S3)={0,1} (Y,T)=(0,3) (0,9)(1,1) (2,5) (2,8) (X,T)= (6,5) (9,8) (10,9)

Characteristics of Siemens Suite Programs • Each faulty version has a single manually injected error. • All the versions are not included: • No output is produced. • Faulty statement is not contained in the backward slice. • For each version three tests were selected.

On average, PDSmax = 41.1% of DS Results of Pruning

Confidence Based Prioritization DD – dep. distance CV – confidence values Executed statement instances examined (%)

The Potential of Confidence Analysis (1) • Case Study (replace v14) • 88  74  23 Buggy Code Pruned Slices Dynamic Slicer With Confidence Input User Verified Statements as correct

The Potential of Confidence Analysis (2) • Relevant slicing (gzip v3 run r1) Potential dep. Data dep.

Conclusions • We have presented a new approach - Confidence analysis - that exploits the correct output values produced in an execution to prune the dynamic slice of an incorrect output. • We have developed a novel dynamic analysis based implementation of confidence analysis, which effectively pruned backward dynamic slices in our experiments. • Pruned Slices = 41.1% Dynamic Slices, and still contain the faulty statement. • Our study shows that confidence analysis has additional applications beyond pruning – prioritization, interactive pruning & relevant slicing.

The End

Pruning Dynamic Slices With Confidence