8/3/2019 Chapter-5-Data Flow Models - Testing
1/52
Chapter 5DEPENDENCE, DATA FLOW MODELS, AND DATAFLOW TESTING:
Definition-Use pairs; Data flow analysis; Classic analyses; From
1Collections by: Dr. U.P.Kulkarni
arrays and pointers; Inter-procedural analysis; Overview of
data flow testing; Definition- Use associations; Data flow testing
criteria; Data flow coverage with complex structures; The
infeasibility problem. 7 Hrs
10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
2/52
Why Data Flow Models?
Other Models emphasized control
Control flow graph, call graph, finite state machines We also need to reason about dependence
Where does this value of x come from?
What would be affected by changing this? ...
Many program analyses and test design techniques
use data flow information Often in combination with control flow
2Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
3/52
Def-Use Pairs (1)
A def-use (du) pair associates a point in a program wherea value is produced with a point where it is used
Definition: where a variable gets a value
Variable declaration (often the special value uninitialized)
Variable initialization
Assignment Values received by a parameter
Use: extraction of a value from a variable
Expressions
Conditional statements
Parameter passing
Returns
3Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
4/52
Def-Use Pairs
...
if (...) {
x = ... ;
...x = ...
if (...) {
...
Definition: x gets a
value
y = ... + x + ... ;...
y = ... + x + ...
...
Use: the
value of x is
extractedDef-Use
path
4Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
5/52
Def-Use Pairs (3)/** Euclid's algorithm */public class GCD{public int gcd(int x, int y) {
int tmp; // A: def x, y,tmpwhile (y != 0) { // B: use y
use x, yx = y; // D: def x; use
yy = tmp; // E: def y; use
tmp}return x; // F: use x}
Collections by: Dr. U.P.Kulkarni Ch 6, slide 5
8/3/2019 Chapter-5-Data Flow Models - Testing
6/52
Def-Use Pairs (3)
A definition-clear path is a path along the CFG
from a definition to a use of the same variablewithout another definition of the variable between
If, instead, another definition is present on the path, then
A def-use pair is formed if and only if there is adefinition-clear path between the definition and theuse
6Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
7/52
Definition-Clear or Killing
x = ... // A: def x
q = ...
x = y; // B: kill x,def x
z = ...
y = f(x); // C: use x
x = ...
...
... Definition: x
gets a valueA
Definition: x
Use: the
value of x is
extracted
x = ygets a newvalue, old
value is killed
...
y = f(x)
B
C
Path B..C is
definition-clear
Path A..C is
not definition-clear
7Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
8/52
Data Flow Analysis
information
8Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
9/52
DATA FLOW ANALYSIS
Flow Graph is directed graph which shows all possible
path of program execution.
Collections by: Dr. U.P.Kulkarni 910/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
10/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 1010/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
11/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 1110/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
12/52
DATA FLOW ANALYSIS
USE:
Yields the information useful to both programmers
and optimizing compilers
Collections by: Dr. U.P.Kulkarni 12
Unreachable code/ Dead code,
Unused parameters to procedure,
variables which are used before being given
initial value
10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
13/52
DATA FLOW ANALYSIS
Reaching Definition Analysis
Live Variable Analysis
-
Definition-use chains(du chains)
..
13Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
14/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 1410/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
15/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 1510/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
16/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 1610/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
17/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 1710/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
18/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 1810/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
19/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 1910/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
20/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 2010/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
21/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 2110/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
22/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 2210/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
23/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 2310/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
24/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 2410/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
25/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 2510/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
26/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 2610/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
27/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 2710/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
28/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 2810/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
29/52
DATA FLOW ANALYSIS
NODE IN USE OUT In[s] Def[n]
1 - - - - a
2 a a - - b
3 bc bc - - c
Collections by: Dr. U.P.Kulkarni 2910/11/2011
4 b b - - a
5 a a a - a a
6 c c - - -
8/3/2019 Chapter-5-Data Flow Models - Testing
30/52
DATA FLOW ANALYSIS
NODE IN USE OUT In[s] Def[n]
1 - - a a a
2 ac a bc bc b
3 bc bc b b c
Collections by: Dr. U.P.Kulkarni 3010/11/2011
4 b b a a a
5 ac a ac ac -
6 c c - - -
8/3/2019 Chapter-5-Data Flow Models - Testing
31/52
DATA FLOW ANALYSIS
Collections by: Dr. U.P.Kulkarni 3110/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
32/52
Data flow analysis with arrays and pointers
Arrays and pointers introduce uncertainty:Do different expressions access the same storage?
a[i] same as a[k] when i = k
a[i] same as b[i] when a = b (aliasing)
e uncer a n y s accomo a e epen ng o ekind of analysis
Any-path: gen sets should include all potential aliases andkill set should include only what is definitely modified
All-path: vice versa
32Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
33/52
Scope of Data Flow Analysis
Intraprocedural
Within a single method or procedure
as described so far
Interprocedural
Across several methods (and classes) or procedures
Cost/Precision trade-offs for interprocedural analysis
are critical, and difficult context sensitivity
flow-sensitivity
33Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
34/52
Context Sensitivity
sub() sub()
bar() {sub()
{
foo() {(call) (call)
}
}
}
(return) (return)
A context-sensitive (intrarprocedural) analysis
distinguishes sub() called from foo()from sub() called from bar();
A context-insensitive (interprocedural) analysis
does not separate them, as if foo() could call sub()
and sub() could then return to bar()
34Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
35/52
Data flow testing
35Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
36/52
Data flow concept
x = ....
if ....
4
1
Value of x at 6 could becomputed at 1 or at 4
Bad com utation at 1 or 4
2
3
Collections by: Dr. U.P.Kulkarni
....
...
....
y = x + ...6
could be revealed only ifthey are used at 6
(1,6) and (4,6) aredef-use (DU) pairs
defs at 1,4
use at 6
5
8/3/2019 Chapter-5-Data Flow Models - Testing
37/52
Terms
DU pair: a pair of definition and use for somevariable, such that at least one DU path exists fromthe definition to the use
x = ... is a definitionof x
= ... ...
DU path: a definition-clear path on the CFG startingfrom a definition to a use of a same variable
Definition clear: Value is not replaced on path
Note loops could create infinite DU paths between a defand a use
37Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
38/52
Definition-clear path
1,2,3,5,6 is a definition-clearpath from 1 to 6
x is not re-assigned between 1and 6
1,2,4,5,6 is not a definition-
x = ....
if ....
1
2
Collections by: Dr. U.P.Kulkarni
c ear pat rom to
the value of x is killed(reassigned) at node 4
(1,6) is a DU pair because
1,2,3,5,6 is a definition-clearpath
x = ....
...
....
y = x + ...
6
5
8/3/2019 Chapter-5-Data Flow Models - Testing
39/52
A program written in a procedural language, such as C and Java,
contains variables. Variables are defined by assigning values tothem and are used in expressions.
Statement x= +z defines variable x and uses variables and z.
Definitions and uses
Declaration int x, y, A[10]; defines three variables.
Statement scanf(``%d %d", &x, &y) defines variables x and y.
Statement printf(``Output: %d \n", x+y) uses variables x and y.
8/3/2019 Chapter-5-Data Flow Models - Testing
40/52
Uses of a variable that occurs within an expression
as part of an assignment statement, in an outputstatement, as a parameter within a function call,
C-use
, - ,
where the c in c-use stands for computational.
8/3/2019 Chapter-5-Data Flow Models - Testing
41/52
The occurrence of a variable in an expression used
as a condition in a branch statement such as an ifand a while, is considered as a p-use. The p in p-
p-use
use s an s or pre ca e.
8/3/2019 Chapter-5-Data Flow Models - Testing
42/52
Data flow graph: Example
Unreachable node
For a given
test case
Identify
possible def-use pairs
covered
Example: Test enhancement using
8/3/2019 Chapter-5-Data Flow Models - Testing
43/52
Here is an MC/DC adequate test set that
does not reveal the error.
Example: Test enhancement using
data flow
8/3/2019 Chapter-5-Data Flow Models - Testing
44/52
Neither of the two tests force the use of z
defined on line 6, at line 9. To do so onerequires a test that causes conditions at lines 5
and 8 to be true.
Example (contd.)
An MC/DC adequate test does not force
the execution of this path and hence thedivide by zero error is not revealed.
8/3/2019 Chapter-5-Data Flow Models - Testing
45/52
Verify that the following test set covers all def-use pairs of z andreveals the error.
Example (contd.)
8/3/2019 Chapter-5-Data Flow Models - Testing
46/52
Adequacy criteria
All DU pairs: Each DU pair is exercised by at leastone test case
All DU paths: Each simple(non looping) DU path isexercised by at least one test case
All definitions: For each definition, there is at leastone test case which exercises a DU pair containingit
(Every computed value is used somewhere)
Corresponding coverage fractions can also bedefined
46Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
47/52
Difficult cases
x[i] = ... ; ... ; y = x[j]
DU pair (only) if i==j
p = &x ; ... ; *p = 99 ; ... ; q = x
*p is an alias of x
m.putFoo(...); ... ; y=n.getFoo(...); Are m and n the same object?
Do m and n share a foo field?
Problem of aliases: Which references are (always orsometimes) the same?
47Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
48/52
Data flow coverage with complex structures
Arrays and pointers are critical for data flow analysis
Under-estimation of aliases may fail to include some DU pairs
Over-estimation, on the other hand, may introduce unfeasible testobligations
For testing, it may be preferrable to accept under-estimationo a as set rat er t an over-est mat on or expens ve ana ys s
Controversial: In other applications (e.g., compilers), a conservative
over-estimation of aliases is usually required
Alias analysis may rely on external guidance or other global analysisto calculate good estimates
Undisciplined use of dynamic storage, pointer arithmetic, etc. maymake the whole analysis infeasible
48Collections by: Dr. U.P.Kulkarni10/11/2011
8/3/2019 Chapter-5-Data Flow Models - Testing
49/52
Infeasibility
Consider the c-use at node 4 of z defined at node 5.
For this c-use to be covered, control must arrive at node 5 (
X>0) and then move to node 4 through 6 , 2 and 3. This isnot possible because edge (2,3) can be taken only if x
8/3/2019 Chapter-5-Data Flow Models - Testing
50/52
Infeasibility
Suppose condhas notchanged between 1 and 5
Or the conditions could bedifferent, but the first implies
the second
if (cond)
x = ........ 3
1
2
,
DU pair But it is difficult or impossible
to determine which pairs areinfeasible
Infeasible test obligationsare a problem
No test case can cover them
...
y = x + ...
if (cond)
....6
5
7
Collections by: Dr. U.P.Kulkarni
8/3/2019 Chapter-5-Data Flow Models - Testing
51/52
Infeasibility
The path-oriented nature of data flow analysismakes the infeasibility problem especially relevant
Combinations of elements matter! Impossible to (infallibly) distinguish feasible from infeasible
paths. More paths = more work to check manually.
In practice, reasonable coverage is (often, notalways) achievable Number of paths is exponential in worst case, but often
linear
All DU pathsis more often impractical
5110/11/2011 Collections by: Dr. U.P.Kulkarni
S
8/3/2019 Chapter-5-Data Flow Models - Testing
52/52
Summary
Data flow testing attempts to distinguish important paths:Interactions between statements
Intermediate between simple statement and branch coverage andmore expensive path-based structural testing
Cover Def-Use (DU) pairs: From computation of value to itsuse
Intuition: Bad computed value is revealed only when it is used
Levels: All DU pairs, all DU paths, all defs (some use)
Limits: Aliases, infeasible paths Worst case is bad (undecidable properties, exponential blowup of
paths), so pragmatic compromises are required
5210/11/2011 Collections by: Dr. U.P.Kulkarni