Citation Context

...context insensitive and one context sensitive, applying wellunderstood concepts from slicing. In both thin slice approaches, we first compute a subset of the System Dependence Graph of Horwitz et al. =-=[12]-=-. We exclude control dependence edges, and include a subset of the standard SDG edges for heap accesses. Graph construction relies on a precomputed points-to analysis, to determine def-use information...

Citation Context

...based on the program as discovered by an on-the-fly call graph construction, including library methods. We used a pointer analysis based on Andersen’s analysis with on-the-fly call graph construction =-=[4, 27]-=-, but with fully object-sensitive cloning for objects of key collections classes, as described in [9]. The precise handling of containers was key forsprecision for all slicing variants, as the experim...

Citation Context

...rise in practice. In our programming experience, we have found that when such bugs arise, they can be tricky to debug, as values can be mutated in unexpected places. Analyses that find typestate bugs =-=[6, 9]-=-, e.g., reading from a file after closing it, could benefit from using thin slices to explain bugs that involve aliasing. Such tools sometimes hide error reports that involve aliasing, since there is ...

Citation Context

... (2) to compare the number of inspected statements for thin and traditional slices. We investigated several injected bugs in the Java programs in the Software-Artifact Infrastructure Repository (SIR) =-=[8]-=-. SIR provides both several injected bugs for each program and test suites that can be used to expose the bugs. For each injected bug, we ran the corresponding test suite to discover a failure. Then, ...

Citation Context

...e purposes of thin slicing, most other Java language features can be suitably translated into this language, and the language is similar to representations commonly used for Java flow analysis (e.g., =-=[16]-=-). The grammar rules are as follows: locname ::= x | x.f expr ::= new C | locname s ::= locname := expr | s1 ; s2 Note that in the following discussion, we use meta-variables m and m ′ to range over l...

Citation Context

... libraries already contain more code than a programmer can hope to master, and frameworks further compound the complexity. 1 In many frameworks, programmers spend hours learning simple usage patterns =-=[20]-=- and even more time debugging, which requires deeper understanding. 1 According to [20], the J2SE 1.4 standard library includes at least 21,000 methods and Eclipse [2] includes more than 100,000. Thin...

Citation Context

...itional slices: (1) control dependences are excluded, and (2) dependences of base pointers are excluded. Our handling of base pointers makes value-flow relevance narrower than classic flow dependence =-=[11]-=-, the notion used by traditional slicing for handling data dependence. A statement s is flow dependent on statement s ′ if s ′ updates any memory location read by s. So, a statement x := y.f in store ...

Citation Context

...pointer analysis. This work targets C, and so had to deal with difficulties arising from issues such as stackdirected pointers and unsafe memory access, which do not arise in Java. Larsen and Harrold =-=[15]-=- presented one of the first slicing approaches for object-oriented software, adding pseudo-parameters for fields to track dependencies through the heap. Our context- sensitive slicer implementation us...

Citation Context

...rise in practice. In our programming experience, we have found that when such bugs arise, they can be tricky to debug, as values can be mutated in unexpected places. Analyses that find typestate bugs =-=[6, 9]-=-, e.g., reading from a file after closing it, could benefit from using thin slices to explain bugs that involve aliasing. Such tools sometimes hide error reports that involve aliasing, since there is ...

Citation Context

...undness can be essential for some applications. For example, when performing an audit to see if untrusted inputs can flow to a sensitive statement s (e.g., web form inputs flowing to a database query =-=[19]-=-), a thin slice will show all statements that incoming values passed though, soundly indicating whether the values have passed through some “cleansing” function before reaching s. We have also develop...

Citation Context

...ndle all fields that may be accessed transitively by callees. In recent years, several papers have improved precision by integrating more precise static alias analysis into slicing. Liang and Harrold =-=[18]-=- present a novel approach to represent formal parameter objects with trees. Hammer and Snelting [10] present an enhancement to this approach, including a criterion for sound limiting of tree sizes for...

Citation Context

...e add = (AddNode) n; 16 ... 17 } 18 } Figure 4. An example illustrating a tough cast. Expressions in the thin slice used to understand the safety of the cast are underlined. scalable pointer analysis =-=[17]-=-; we used the same pointer analysis used to construct our call graph. Checking these tough casts with thin slicing represents a useful exercise for understanding a code base, and can be useful for ref...

Citation Context

... using thin slices to explain bugs that involve aliasing. Such tools sometimes hide error reports that involve aliasing, since there is no mechanism in the tool for explaining the aliasing succinctly =-=[21]-=-. Three additional technical points about explaining aliasing merit mention. First, thin slices that explain aliasing should be restricted to only show the flow of objects that can flow to both base p...

Citation Context

...s-to analysis indicates x may-alias w. We handle interprocedural heap flow the same way as the standard SDG, with heap reads and writes modeled as extra parameters and return values to each procedure =-=[5, 13]-=-. Our implementation introduces such parameters using the same heap partitions as used by the preliminary pointer analysis. Discovering the appropriate set of parameters for each procedure requires an...

Citation Context

... thin slice expansion technique is similar in spirit, but goes in a different direction by expanding slices to include statements that indirectly give rise to the primary alias relations. Mock et al. =-=[22]-=- showed that for C programs with heavy pointer use, using dynamic points-to data significantly improved slice precision over a conservative flow-insensitive pointer analysis. We suspect Java programs ...

Citation Context

...n 1979 [30], slicing has inspired a large body of work on computing slices and on applications to a variety of software engineering tasks. We refer the reader to Tip’s survey [29] and Krinke’s thesis =-=[14]-=- for broad overviews of slicing technology and challenges. Here, we focus on the work most relevant to our own. Our thin slicing algorithm is a straightforward adaptation of the SDG-based approach fir...

Citation Context

...For clarity, we refer to relevant expressions as being in the slice, which actually includes the corresponding statements.s1 class Vector { 2 Object[] elems; int count; 3 Vector() { elems = new Object=-=[10]-=-; } 4 void add(Object p) { 5 this.elems[count++] = p; 6 } 7 Object get(int ind) { 8 return this.elems[ind]; 9 } ... 10 } 11 Vector readNames(InputStream input) { 12 Vector firstNames = new Vector(); 1...

Citation Context

...-sensitive traditional slicer [13] to our larger benchmarks. 5.1 Configuration and Methodology We implemented the thin and traditional data slicers using the T.J. Watson Libraries for Analysis (WALA) =-=[3]-=-. We utilized the call graph construction and pointer analysis algorithms provided by WALA, along with its tabulation solver for context-sensitive analysis [25]. We analyzed the Sun JDK 1.4.2_09 stand...