System Dependence Graph Research Articles

Test coverage analysis based on an object‐oriented program model

AbstractWe propose a novel test coverage analysis technique for object‐oriented (OO) programs. An important novelty of our technique is the use of a single coherent model, Call‐based Object‐Oriented System Dependence Graph (COSDG), which helps in presenting a unified test coverage analysis framework for OO programs. COSDG represents both procedural and OO features. Our technique not only uses the model to identify the different program features that are to be exercised by a test suite, but also captures the executed program features in the model for subsequent coverage evaluation and reporting. During test executions, the model elements corresponding to the executed features are marked. This helps in determining coverage on‐the‐fly, without the need to store the execution traces in a file. We describe the computation of various coverage measures, both procedural and OO, from the model elements. We have implemented our model‐based technique in a prototype tool, named KANZ. The experimental results obtained by using the tool demonstrate the efficacy and efficiency of our technique in determining OO coverage measures. Copyright © 2010 John Wiley & Sons, Ltd.

Research on Algorithm for Object-Oriented Program Slicing

Program slicing is a viable method to restrict the focus of a task to specific sub-components of a program. In this paper, the method based on ripple effect is proposed to compute coarse-grained program slicing. The method perfects object-oriented program semantics and reduces the computation complexity through expanding the signification of coarse-grained and analyzing ripple effect. The algorithms for analyzing ripple effects, constructing system dependence graph and computing object-oriented program slicing are designed.

GammaPolarSlicer

In software development, it is often desirable to reuse existing software components. This has been recognized since 1968, when Douglas Mcllroy of Bell Laboratories proposed basing the software industry on reuse. Despite the failures in practice, many efforts have been made to make this idea successful. In this context, we address the problem of reusing annotated components as a rigorous way of assuring the quality of the application under construction. We introduce the concept of caller-based slicing as a way to certify that the integration of an annotated component with a contract into a legacy system will preserve the behavior of the former. To complement the efforts done and the benefits of the slicing techniques, there is also a need to find an efficient way to visualize the annotated components and their slices. To take full profit of visualization, it is crucial to combine the visualization of the control/data flow with the textual representation of source code. To attain this objective, we extend the notion of System Dependence Graph and slicing criterion.

WYSINWYX

Over the last seven years, we have developed static-analysis methods to recover a good approximation to the variables and dynamically allocated memory objects of a stripped executable, and to track the flow of values through them. The article presents the algorithms that we developed, explains how they are used to recover Intermediate Representations (IRs) from executables that are similar to the IRs that would be available if one started from source code, and describes their application in the context of program understanding and automated bug hunting. Unlike algorithms for analyzing executables that existed prior to our work, the ones presented in this article provide useful information about memory accesses, even in the absence of debugging information. The ideas described in the article are incorporated in a tool for analyzing Intel x86 executables, called CodeSurfer/x86. CodeSurfer/x86 builds a system dependence graph for the program, and provides a GUI for exploring the graph by (i) navigating its edges, and (ii) invoking operations, such as forward slicing, backward slicing, and chopping, to discover how parts of the program can impact other parts. To assess the usefulness of the IRs recovered by CodeSurfer/x86 in the context of automated bug hunting, we built a tool on top of CodeSurfer/x86, called Device-Driver Analyzer for x86 (DDA/x86), which analyzes device-driver executables for bugs. Without the benefit of either source code or symbol-table/debugging information, DDA/x86 was able to find known bugs (that had been discovered previously by source-code analysis tools), along with useful error traces, while having a low false-positive rate. DDA/x86 is the first known application of program analysis/verification techniques to industrial executables.

The Analyzing Technique of Program Based on Program Slicing

Program analysis plays an important role in software development and maintenance. With this method, characteristics of every variable in program can be analyzed. During the period of program analyzing, computing the program slicing by the method of constructing system dependence graph is an efficient way but the work of constructing the system dependence graph is very complicated which often leads to many wrong results. So the algorithm of hierarchy slice is used in this paper. Using the precise results, the whole program can be analyzed and the dependence relation in the program can be discovered quickly.

A Dependence Representation for Coverage Testing of Object-Oriented Programs.

We propose a dependence-based representation for object-or- iented programs, named Call-based Object-Oriented System Dependence Graph (COSDG). Apart from structural features, COSDG captures im- portant object-oriented features such as class, inheritance, and polymor- phism. Novel features of COSDG include details of method visibility in a derived class, and dierent types of method call edges to distinguish be- tween various calling contexts—simple, inherited, and polymorphic. We also propose an algorithm for the construction of COSDG, and subse- quently explain its working with an example. COSDG has been devel- oped primarily to aid test coverage analysis. However, it can be used in a variety of other software engineering applications such as program slicing, software re-engineering, and debugging.

Contradictory graph colouring algorithm to compute slice of concurrent object-oriented programs

In this paper, we propose a dynamic program slicing technique for concurrent object-oriented programs. Our technique uses the graph colouring algorithm. But in order to compute the slices, we have contradicted some facts of the traditional graph colouring algorithm. We have used the concurrent system dependence graph as the intermediate representation for the program under consideration. The advantage of our algorithm is that it eliminates the use of trace file. Since we are incorporating graph colouring scheme, we efficiently compute the slices from a graph compared to the other existing algorithms.

Slicing Java generic programs using generic system dependence graph

The existing slicing algorithms do not consider parameterized types in generic programs, so they are not suitable for generic programs. To solve this problem, this paper presents a generic system dependence graph for Java generic programs based on the traditional system dependence graph to express dependences for parameterized type information. A novel slicing criterion and slicing algorithm for generic programs is proposed. The slices computed by the algorithm can help to understand relations between concepts and types for generic programs and can express the features of generic programs better.

A dependence graph-based representation for test coverage analysis of object-oriented programs

Test coverage analysis is used to determine the extent to which different features of interest are exercised by a given test suite. For object-oriented programs, it involves determining the extent to which features such as inheritance, polymorphism, dynamic binding, etc. are exercised. As object-oriented coverage analysis using only source code or object code is difficult and inefficient, the source code is converted to a suitable intermediate representation for subsequent analysis. We propose a dependence graph-based representation for object-oriented programs, named Call-based Object-Oriented System Dependence Graph (COSDG). COSDG captures the important object-oriented features, provides details of method visibility in a derived class, and differentiates various calling contexts with different type of method call edges: simple, inherited, and polymorphic. We also propose an algorithm to construct COSDG incrementally. Though COSDG has been developed primarily to aid test coverage analysis, it can be used in a variety of other software engineering applications also.

Dependence Graph Based Verification and Synthesis of Hardware/Software Co-Designs with SAT Related Formulation

Program slicing is a software-analysis technique that generates System Dependence Graphs (SDGs) by which dependencies among program statements can be identified through their traversal. We have developed a program slicing tool for SpecC, a C-based system level design language for hardware/software co-designs, on top of a program slicer for C/C++. This program slicing tool can generate SDGs from any combined descriptions in C, C++, and SpecC, and can be used to analyze design descriptions for hardware/software co-designs uniformly and smoothly in all the combined descriptions. In this paper, after reviewing our program slicer that generates SDGs, we present verification and synthesis techniques for hardware/software co-designs through various analyses on SDGs and generations of SAT/ILP problems from them. For analysis and verification of the combined descriptions, we examine SDGs statically by traversing them with SAT/ILP solvers as verification engines. With this method, many static checks can be efficiently realized even if the target design descriptions are fairly large. We first present techniques for checking synchronization among concurrent processes described in SpecC through symbolic analysis on SDGs. The techniques could verify the synchronization of MPEG4 descriptions with about 48,000 lines within 10 seconds. The techniques can be applied to automatic conversions between sequential and parallel computations. One such application to automatic program serialization is presented. By using the technique for automatic program serialization, we could serialize Vocoder descriptions with about 10,000 lines in around 1 minute. As for synthesis from the combined descriptions, we present an optimal code generation method based on SAT formulation. It can generate codes for reconfigurable processors with minimum code lengths. The sizes of problems as SAT formulation range from 10,000 to 100,000 variables and 100,000 to 500,000 clauses for the largest configurations. With appropriate uses of the state-of-the-art SAT solvers and related tools, we show that fairly practical sizes of verification and synthesis problems can be solved by analyzing SDGs generated from the combined descriptions.

Editor’s Introduction to the Special Volume on Application of Constraints to Formal Verification

Editor’s Introduction to the Special Volume on Application of Constraints to Formal Verification

Empirical study of optimization techniques for massive slicing

This article presents results from a study of techniques that improve the performance of graph-based interprocedural slicing of the System Dependence Graph (SDG). This is useful in “massive slicing” where slices are required for many or all of the possible set of slicing criteria. Several different techniques are considered, including forming strongly connected components, topological sorting, and removing transitive edges. Data collected from a test bed of just over 1,000,000 lines of code are presented. This data illustrates the impact on computation time of the techniques. Together, the best combination produces a 71% reduction in run-time (and a 64% reduction in memory usage). The complete set of techniques also illustrates the point at which faster computation is not viable due to prohibitive preprocessing costs.

A novel formal approach to program slicing

Program slicing is a well-known program analysis technique that extracts the elements of a program related to a particular computation. The current slicing methods, however, are singular (mainly based on a program or system dependence graph), and lack good reusability and flexibility. In this paper, we present a novel formal method for program slicing, modular monadic program slicing, which abstracts the computation of program slicing as a slice monad transformer, and applies it to semantic descriptions of the program analyzed in a modular way, forming the corresponding monadic slicing algorithms. The modular abstraction mechanism allows our slicing method to possess excellent modularity and language-flexibility properties. We also give the related axioms of our slice monad transformer, the proof of the correctness and the implementation of monadic slicing algorithms. We reveal the relations of our algorithms and graph-reachable slicing algorithms.

Hardware/Software Co-design and Verification Methodology from System Level Based on System Dependence Graph

System Dependence Graph (SDG) is a graph representation which shows dependencies among statements / expressions in a design. In this paper, we propose a new HW/SW co-design methodology based on SDG. In our method, any combination of C / C++ / SpecC descriptions is acceptable as input designs so that design functions can be specified flexibly. First, the input descriptions are analyzed and verified with static but partially dynamic program checking methods by traversing SDG. With those methods, large descriptions can be processed. Next, those designs are divided into HW and SW parts. In this step, SDGs are fully utilized to insert parallelism into the designs, and it enables flexible HW/SW partitioning. The HW parts are further optimized and then converted into RTL descriptions by existing behavioral synthesis tools. Finally, the generated RTL descriptions together with the SW parts are compared to the original descriptions in order to make sure that they are logically equivalent. Also, designer- specified properties may be model checked with these final design descriptions. Such formal verifications can be realized by translating those descriptions into Finite State Machine (FSM) type representations and existing formal verifiers. We show two case studies with practical examples to demonstrate the usefulness of our approach.

Slicing-based Hardware/Software Co-design Methodology From Functional Specifications

Program slicing is a software analysis technique and generates System Dependence Graphs (SDGs) by which dependences among program statements can be identified. In this paper, we propose a new hardware-software co-design methodology based on the static and partially dynamic dependence analysis with SDG. We start with any combinations of C, C++, and SpecC descriptions so that flexible functional specifications of the HW/SW systems can be made. First of all, the input descriptions are analyzed and verified with the SDG generated from the input descriptions. Actual analyses and verifications are based on static ones but partially with dynamic ones as well, and fairly large descriptions can be processed. After these analyses, we divide the system into hardware and software parts by optimizing the design descriptions and introducing parallelism if necessary. In this HW/SW partitioning, SDG generated from C / C++ / SpecC design descriptions is fully utilized to extract / convert / pack the HW parts from the entire descriptions. This flexibility of HW/SW partitioning is one of the main differences from previous HW/SW partitioning methods. The extracted HW parts are further optimized and then converted into RTL descriptions by existing behavioral synthesis tools. As the last step, the generated RTL descriptions together with SW parts are compared to the original descriptions in order to make sure that they are logically equivalent. Also, designer-specified properties may be model checked with these final design descriptions. These equivalence checking and model checking can be realized by first translating the HW/SW design descriptions into FSM type representations. The translated FSM type representations are further processed by existing formal verifiers. We present the proposed HW/SW co-design methodology with an illustrating example as well as actual application to real designs and demonstrate the usefulness of our approach.

A monadic program slicer

Program slicing is an important decomposition technique. It has been widely used in many software activities, such as software analyzing, understanding, debugging, testing, and maintenance. The current slicing methods and tools, however, are monolithic, and mainly based on program or system dependence graph. This paper presents a novel formal tool for program slicing. It abstracts the computation of program slicing as a language-independent slice monad transformer, which can be applied to the semantic descriptions of the program in a modular way, forming the corresponding slicing algorithms. Such algorithms allow program slices to be computed directly on abstract syntax, with no need to explicitly construct intermediate structures such as dependence graphs or to record an execution history. It has reusability and language-flexibility properties in comparison with the current program slicing methods/tools.

System dependence graph construction for aspect oriented C++

This paper proposes an extended system dependence graph called AspectSDG to represent control and data dependences for AspectC++ programs, and presents an approach for the construction of AspectSDG. This approach decomposes aspect-oriented programs into three parts: component codes, aspect codes, and weaving codes. It constructs program dependence graphs (PDGs) for each part, and then connects the PDGs at call sites to form the complete AspectSDG. The AspectSDG can deal with advice precedence correctly, and represent the additional dependences caused by aspect codes. Based on this model, we introduce how to compute a static slice of an AspectC++ program.

Computing dynamic slices of concurrent object-oriented programs

We propose a novel dynamic program slicing technique for concurrent object-oriented programs. Our technique uses a Concurrent System Dependence Graph (CSDG) as the intermediate program representation. We mark and unmark the edges in the CSDG appropriately as and when the dependencies arise and cease during run-time. We mark an edge when its associated dependence exists and unmark an edge when the dependence ceases to exist. Our approach eliminates the use of trace files. Another advantage of our approach is that when a request for a slice is made, it is already available. This appreciably reduces the response time of slicing commands.

Web Application Slicing in Presence of Dynamic Code Generation

The computation of program slices on Web applications may be useful during debugging, when the amount of code to be inspected can be reduced, and during understanding, since the search for a given functionality can be better focused. The system dependence graph is an appropriate data structure for slice computation, in that it explicitly represents all dependences that have to be taken into account in slice determination. Construction of the system dependence graph for Web applications is complicated by the presence of dynamically generated code. In fact, a Web application builds the HTML code to be transmitted to the browser at run time. Knowledge of such code is essential for slicing. In this paper an algorithm for the static approximation of the dynamically generated HTML code is proposed. The concatenations of constant strings and variables are propagated according to special purpose flow equations, allowing the estimation of the generated code and the refinement of the system dependence graph.

Displaying dependence graphs: a hierarchical approach

AbstractWe present a method to extract and handle data and control dependences of programs, which we represent as simplified system dependence graphs. Ordinary dependence graphs contain too many nodes and edges for them to be easily comprehended, even for medium sized programs. That is why we propose decomposing programs into a hierarchy of groups for which the corresponding dependence graphs are likely to be of manageable size. In order to realize this, we first implement a tool that builds this hierarchy and stores it in a database. Then a graphical interface provides means to browse the hierarchy, to visualize the dependences of each group, to possibly refine the proposed hierarchy and to annotate nodes or groups.This paper introduces our approach for dependence graph handling, it describes our tool for graph exploration and discusses the results we obtained with a set of real‐world programs. Copyright © 2004 John Wiley & Sons, Ltd.