Slicing of Java Programs using the Soot Framework

Slicing of Java Programs using the Soot FrameworkD.ArvindPriti Shankararvind@csa.iisc.ernet.in,priti@csa.iisc.ernet.inDepartment of Computer Science and AutomationIndian Institute of ScienceSeptember6,2006AbstractSlicing is a technique used to identify the program subset that could affect a particular statement of interest called the slicing criterion.Slicing has applications in program understanding,testing,model checkingand functionality extraction.For computing a slice,we need to compute dependence information amongstatements.In object oriented languages,finding dependence information becomes non-trivial because oflanguage features like inheritance,objects,polymorphism,dynamic binding and so forth.We develop amethod for computing slices in object oriented programs for application in regression testing.In particularwe propose a new method for intraprocedural alias analysis for Java and implement an interprocedural slicingtechnique using the system dependence graph of Horwitz et al.1IntroductionProgram slicing is a technique that has many applications,for example regression testing,program understanding etc.A program slice is an executable subset of program statements that might affect the value of a variable v at program point p.The pair(p,v)is called the slicing criterion.For interprocedural slices Horwitz et al.defined the System Dependence Graph and a two phase reachability algorithm that ensured that only valid execution paths through procedure calls and returns are tracked by the analysis.Special properties of object oriented languages like classes,objects,inheritance polymorphism and dynamic binding present challenges that are not taken care of by slicing techniques for imperative languages.The Class Dependence Graph was defined by Larsen and Harrold [10].This can represent a class hierarchy,polymorphism and so forth.Having constructed such a graph the technique of Horwitz et al.can be used for slicing.Their technique however cannot distinguish different data members instantiated from the same class leading to imprecise slices.Tonella et al.[33]propose an extension of the linear time points to analysis of Steensgard[32]to handle object oriented constructs,but is bothflow and context insensitive.Liang and Harrold[9]propose a technique to augment the analysis of Larsen and Harrold [10]to more fully represent features of object-oriented programs.This technique is able to distinguish between data members for different objects,and address polymorphism.Regression testing is a major component in the maintenance phase where a software system may be corrected, adapted to new environment,or enhanced to improve its performance.When a program is modified,it is necessary to validate modified parts of the program as well as to ensure that other parts of the program affected by changes work correctly.The challenge is in identifying the parts of the program affected by the changes in an efficientmanner.Although the exact identification of the components affected by the changes is in general undecidable, one can design techniques that provide safe approximations.There are two important problems in data-flow regression testing:1.Identifying those existing tests that must be rerun since they may exhibit different behavior in the changedprogram,and2.Identifying those def-use associations in the program that must be re-tested to satisfy some coverage criteria.We focus on the second problem and implement a slicing based technique which identifies the subset of a program affected by a change.Incremental regression testing attempts to exploit this information in two ways First if a new component is tested by an existing test case then the costly construction of a new test case can be avoided. Second if it may be asserted that for a subset of tests,the modified program will produce the same output as the original program then the potentially costly execution of the modified program on this subset can be avoided. This occurs for example if no changed program components are executed by a test.Incremental regression testing has the following steps.1.Identify a set of affected program components of the modified program.2.Identify a subset of T the original test set that tests the affected components3.Identify untested components of the modified program that must be covered by new tests.4.Create new tests for the uncovered components5.Run the modified program on the union of the tests produced in Steps(2)and(4)We concentrate on thefirst problem in this work.2Background on Slicing2.1Intra-procedural slicing using the Program Dependence GraphThe concept of slicing was introduced by Weiser[5]who described it in terms of dataflow equations.Ottenstein [6]introduced the Program Dependence Graph and slicing was redefined as a graph reachability problem over the PDG.In a PDG,each node represents a statement or predicate expression.Edges represents data or control dependencies.A node is said to be control dependent on a predicate if the execution of the node is dependent on the value of the predicate.Control dependencies between statements can be computed using the dominance frontier information[17]Node y is said to be data dependent on node x,if x defines a variable and y uses that variable.Data dependencies(in absence of aliasing)can be calculated using standard reaching definition analysis[1].Aliasing is discussed in a separate section.2.2Handling Arbitrary controlflowIn presence of unstructured controlflow statements like goto,return,break,continue the conventional slicing algorithms produce incorrect results.Modification to the slicing algorithm to handle these statements correctly is discussed in[11],[13]and[14]2.3Interprocedural slicing using System Dependence graphHorwitz[7]extended the PDG to the interprocedural case terming the graph a System Dependence Draph.Slicing can be no longer be defined as simple graph reachability problem because procedure calls and returns should be matched.To overcome this problem,they introduced the concept of summary edges.Summary edges describe the cummulative effect of the entire procedure.This approach is a variation of the functional approach given by Sharir and Pnueli[16].An efficient method to compute the summary edges is given in[15]A system-dependence graph(SDG)is a collection of program-dependence graphs(PDG)one for each procedure. Figure1shows an example SDG.Figure1:An Example of a system Dependence GraphEach PDG contains an entry node that represents entry to the procedure.To model procedure calls parameter passing,an SDG introduces additional nodes and edges.Accesses to global variables are modeled via additional parameters of the procedure.They assume parameters are passed by value-result.They introduce additional nodes in the interprocedural case.1.Call-site nodes represent the call sites.2.Actual-in and actual-out nodes represent the input and output parameters at the call sites.They are controldependent on the call-site node.3.Formal-in and formal-out nodes represent the input and output parameters at the called procedure.Theyare control dependent on the procedure’s entry node.They also introduce additional edges to link the program dependence graphs together:1.Call edges link the call-site nodes with the procedure entry nodes.2.Parameter-in edges link the actual-in nodes with the formal-in nodes.3.Parameter-out edges link the formal-out nodes with the actual-out nodesTo create these additional nodes and edges,we need information about the variables that are accessed or modified by a function.We use GMOD and GREF information to compute this information[20].The interprocedural backward slicing algorithm consists of two phases.Thefirst phase traverses back-wards from the node in the SDG that represents the slicing criterion along all edges except parameter-out edges,and marks those nodes that are reached.The second phase traverses backwards from all nodes marked during the first phase along all edges except call and parameter-in edges,and marks reached nodes.The slice is the union of the marked nodes.We implemented a variation of the two phase slicing algorithm and summary computation algorithm as discussed in[3]2.4Call Graph ConstructionThis subsection describes call graph construction for Java programs.The call graph construction algorithm proceeds as follows.Start with initial set(S)of reachable methods.Trace through these methods and look for call statements.If a static call statement is found,then there is only one target we add that to set S.If a virtual call statement is found,then we need to estimate the possible types of the receiver(using an algorithm like Class Hierarchy Analysis(CHA)or Rapid Type analysis(RTA))and add each potential target method to the set S.An call edge exists from the current call statement to eachpotential target method.2.5Class Hierarchy AnalysisClass Hierarchy Analysis is a method to conservatively estimate the types of receiver.Given a receiver o of a declared type d,hierarchy-types(o,d)for Java is defined as follows:1.If d is a class type C,hierarchy-types(o,d)includes C plus all subclasses of C.2.If d is a interface type I,hierarchy-types(o,d)includes:1)the set of all classes that implement I or implementa sub-interface of I,which we call implements(I),plus2)all subclasses of implements(I).2.6Rapid Type AnalysisThe basic idea in rapid type analysis is that some classes are never instantiated in reachable methods,and we can prune away some call edges that are computed using class hierarchy analysis3Alias Analysis3.1Problem in presence of aliasingComputation of data dependence is complicated by the presence of aliasing.The problem is illustrated by an example.In the example(Table1),the object O1could be accessed both by reference variables x and y.x.a and y.a refer to the same object.The fact that there is a dependency between line4and line5could not be inferred from the def boxes and use boxes calculated by the framework Soot[28].Table1:Def Use computation with aliasingLine Def1y2x3y4x.a5yEdges in OFG represent constraints.Denote the set of objects pointed by x as O x and the set of objects pointed by y as O y.Each statement induces some set constraints.An assignment statement such as x=y says that the sets of objects pointed by x is a superset of the set of objects pointed by y.i.e O x⊇O y.Anderson’s algorithm [18]is one method to solve a set constraint problem.Aiken[19]discusses various set constraint problems and their application to program analysis.Statements that influence the points-to information of a reference variable are as follows.1.Allocation statement(x=new Object();)The heap object allocated at this statement is abstracted by the object node O i and an edge is drawn from x to O i.2.Assignment statement(x=y)An inclusion edge is drawn from x to y.3.Load statement(x=y.f)for every inclusion edge from the named”x”to some O i,we add a new inclusion edge from the named y to O i.f4.Store statement(x.f=y)for every inclusion edge from the given x to some O i we add a new inclusion edge from O i.f to the given y.Solving the constraints using Anderson’s algorithm involves computing the transitive closure of the OFG.Tran-sitive closure gives information about reachability of one node from another and thus we can ascertain which object nodes are accessible from any reference variable nodes.The analysis does not consider the order in which the statements are executed and is therefore termedflow insensitive.We now propose a technique forflow sensitive analysis which we implement in our slicing algorithm.3.5Flow Sensitive Alias Analysis using Path Expressions3.5.1Problem withflow insensitive alias analysisConsider the program in table2.If we applyflow insensitive alias analysis,then the analysis will conclude that x and y can be aliased and thus there is a dependency between line4and5.But this dependency is spurious,since that alias relation holds only after the assignment at line6.Theflow insensitive algorithm gives rise to spurious alias relations.This is because at a particular point in the program,only a subgraph of the Object Flow Graph is valid,whereas theflow-insensitive objectflow analysis assumed that the entire graph is valid at every point. Maintaining subgraphs of the OFG at every program point is expensive in space though it would give us aflow sensitive algorithm.We propose an intermediate solution here.Table2:Problem withflow insensitive alias analysis1234563.5.2Incorporating Flow SensitivityFlow sensitive analysis also has to take the program point into account.Aflow sensitive analysis must be able to answer queries like’what objects could be accessed by a particular reference variable at a particular program point’.Aflow insensitive OFG maps Reference variable→Set of objects,whereas we need the mapping (Reference variable,Program Point)→Set of objects forflow sensitive analysis.The basic idea is to associate with every program point,the set of edges of the OFG that are valid at that point.We need to construct the mapping Program point→Valid Edges which associates each program point with the set of edges that are valid at that point.We need another mapping that gives the set of objects that are accessed by a reference variable under the condition that only some of the edges are valid.(Reference Variable,Valid Edges)→Set of objects This is more precise than theflow insensitive analysis since we query only the valid subgraph at that point.3.5.3Algorithm forflow sensitive Objectflow analysisWe have seen that there are four statements that contribute to OFG(the allocation statement,assignment statement,load statement and store statement).In this section,we develop aflow sensitive alias analysis algorithm (without considering load and store statements).The next section extends them to load and store statements. Step-1:Create the Objectflow graph(OFG)Figure2:OFGEach edge has label E i that was created due to statement S i.Set GEN set of statement S i is set as E i.Figure 1shows the OFG created for the program in table-3Step-2:Associate with each point,the set of valid edges of the OFG.The valid edges form a subgraph of the OFG.We already have the GEN set computed on CFG in step1.OUT is defined as union over all predecessors.Do aflow analysis tillfixed point is reached.This associates with each program point the set of edges of the OFG (i.e the OFG subgraph)that are valid at that point.This step does the mapping Program point→Valid Edges Table-4computes this information.An example to show that advantage of aflow sensitive OFG over an insensitive one is illustrated by considering ”d.f”at line6.It is obvious from the program that d cannot access O1.This fact is captured by the OFG Subgraph (comprising of e0,e4,e5,e6).The dotted lines show the edges that are invalid at that program rmation couldflow only thro e0,e4,e5,e6.This shows that d could not access O1.Table3:GENa=new Objectif(P){b=a;c=b;d=c;}else{d=new Foo();c=a;b=c;}OUTa=new Object e0b=a;e0,e12e2d=c;e0,e1,e2,e3d=new Foo();e0,e45e5b=c;e0,e4,e5,e6}Step-3:Computing the path expressionFigure-3gives an example of associating each reference variable with a set of subgraphs.We will see how to compute this information shortly.The information1+5.6present on’b’says that O1willflow to b if either edge 1is present or edges5and6are presentThe algorithm associates with every variable a path expression.The path expression consists of a set of terms. Each term has an associated object and it consists of a set of edges.If all the edges are present,it means that the associated objectflows to the reference variable.The computation of a path expression for each variable can be considered as a dataflow problem.Initially each variable in the OFG is given empty expression.At every iteration,the path expression of a node N having predecessors P1,P2...is defined to be P1.e1+P2.e2+....where e1,e2..are edge labels present on P1→N,P2→N etc.Step-4:Finding the set of objects accessible by a reference variableTofind what objectsflow to a particular reference variable at a program point,wefirstfind the set of validFigure3:OFG(valid subgraph)Figure4:OFG(path expression)edges(step2).We substitute the set of valid edges in the path expression to compute the set of objects thatflow into the reference variable.4Work CompletedWe have implemented the data dependence subgraph without aliasing and used the control dependence graph implementation of TRDDC.Construction of the system dependence graph for interprocedural slicing has also been implemented along with summary computation.The slicing algorithm at present uses a conservative callgraph.Though rapid type analysis has been implemented as a separate module it has not yet been integrated into the slicer.We have also implemented an intraprocedural version of the new path expression based alias analyser.References[1]A.V.Aho,R.Sethi and J.D.Ullman,Compilers:Principles,Techniques and Tools,Addison Wesley,1986.[2]Frank Tip.A survey of program slicing techniques.Journal of programming languages,3(3),September1995.[3]Jens Krinke.Advanced Slicing of Sequential and Concurrent Programs Ph.D Thesis.Universitt Passau April2003[4]J.Ferrante,K.J.Ottenstein and J.D.Warren.The program dependence graph and its use in optimization,ACM TOPLAS,9(3):319-349,July1987.[5]Mark Weiser.Program slicing.IEEE Transactions on Software Engineering,10(4):352-357,July1984.[6]Karl J.Ottenstein and Linda M.Ottenstein.The program dependence graph in a software development envi-ronment.In Proceedings of the ACM SIGSOFT/SIGPLAN Software Engineering Symposium on Practical Software Development Environments,volume19(5)of ACM SIGPLAN Notices,pages177-184,1984.[7]Susan B.Horwitz,Thomas W.Reps,and David Binkley.Interprocedural slicing using dependence graphs.ACM Transactions on Programming Languages and Systems,12(1):26-60,January1990.[8]R.Gupta,M.J.Harrold and M.L.Soffa.An Approach to Regression Testing using Slicing.Proceedings ofthe Conference on Software Maintenance(CSM’92),pages299–302,November1992.[9]D.Liang and M.J.Harrold,Slicing Objects Using System Dependence Graph,in Proceedings of the Interna-tional Conference on software Maintenance,ICSM98,November1998.[10]Lors Larsen and M.J.Harrold,Slicing object Oriented Software,in Proceedings of the International Confer-ence on software Engineering,ICSE1996,1996.[11]T.Ball and S.Horwitz.Slicing programs with arbitrary controlflow.In Lecture Notes in Computer Science,volume749,New York,NY,November1993.Springer-Verlag.[12]Raja Vallee-Rai et al,Soot-A Java Optimization Framework IBM Center for Advanced Studies Confer-ence(CASCON),1999.[13]J.Choi and J.Ferrante.Static slicing in the presence of goto statements.ACM Trans.on ProgrammingLanguages and Systems,16(4):10971113,July1994.[14]Sumit Kumar and Susan Horwitz.Better slicing of programs with jumps and switches.In Proceedings ofFASE2002:Fundamental Approaches to Software Engineering,volume2306of Lecture Notes in Computer Science,pages96-112.Springer,2002.[15]Thomas Reps,Susan Horwitz,Mooly Sagiv,and Genevieve Rosay.Speeding up slicing.In Proceedings ofthe ACM SIGSOFT’94Symposium on the Foundations of Software Engineering,pages11-20,1994.[16]M.Sharir and A.Pnueli.Two approaches to interprocedural dataflow analysis.In S.S.Muchnick and N.D.Jones,editors,Program Flow Analysis:Theory and Applications,chapter7,pages189234.Prentice-Hall, Englewood Cliffs,NJ,1981.Cytron,[17]Ferrante,Rosen,Wegman,Zadeck Efficiently Computing Static Single Assignment Form and the ControlDependence Graph TOPLAS13:4,p.451,October91[18]L.O.Andersen.Program Analysis and Specialization for the C Programming Language.PhD thesis,Univer-sity of Copenhagen,DIKU,1994.[19]Alexander Aiken.Introduction to set constraint-based program analysis.Science of Computer Programming,35(23):79111,1999.[20]Banning,J.P.An efficient way tofind the side effects of procedure calls and the aliases of variables.InProceedings of the6th Annual ACM Symposium on Principles of Programming Languages,ACM,New York,29-41.(Jan.1979)[21]Cooper,K.D.,and Kennedy,K.Efficient computation offlow-insensitive interprocedural summary infor-mation.In Proceedings of the SIGPLAN84Symposium on Compiler Construction;SIGPLAN Not.19,6, 247-258.(June1984)[22]Randy Allen and Ken Kennedy Optimizing Compilers for Modern Architectures Elsevier Publications[23]Mark Harman and Sebastian Danicic Using Program Slicing to Simplify Testing Journal of Software Testing,Verification and Reliability,vol5,no.3,1995,pp.143-162.[24]D.Binkley,The application of program slicing to regression testing Information and Software Technology,vol.40,no.11/12,1998,pp.583-594.[25]R Gupta,M.J.Harrold and M.L.Soffa,An approach to regression testing using slicing In Proc.Conferenceon Software Maintenance,1992,pp.299-308.[26]B.Steensgaard,Points-to Analysis in Almost Linear Time,in Proceedings of23rd ACM SIGACT-SIGPLANInternational Conference on Principles of Programming Languages,POPL96,1996.[27]P.Tonella G.antoniol,R.Fiutem,E.Merlo,Flow Insensitive C++Pointers and Polymorphism Analysisand its Application to Slicing,in Proceedings of the International Conference on software Engineering,1997.[28]Raja Vallee-Rai et al,Soot-A Java Optimization Framework IBM Center for Advanced Studies Confer-ence(CASCON),1999.[29]Mark Harman and Sebastian Danicic Using Program Slicing to Simplify Testing Journal of Software Testing,Verification and Reliability,vol5,no.3,1995,pp.143-162.[30]D.Binkley,The application of program slicing to regression testing Information and Software Technology,vol.40,no.11/12,1998,pp.583-594.[31]R Gupta,M.J.Harrold and M.L.Soffa,An approach to regression testing using slicing In Proc.Conferenceon Software Maintenance,1992,pp.299-308.[32]B.Steensgaard,Points-to Analysis in Almost Linear Time,in Proceedings of23rd ACM SIGACT-SIGPLANInternational Conference on Principles of Programming Languages,POPL96,1996.[33]P.Tonella G.Antoniol,R.Fiutem,E.Merlo,Flow Insensitive C++Pointers and Polymorphism Analysisand its Application to Slicing,in Proceedings of the International Conference in Software Engineering1997.。