A static analyzer for finding dynamic programming errors

Current processors employ aggressive prediction mechanisms to improve performance and reduce power. It is increasingly important to understand and quantify a program's dynamic behavior to effectively design next-generation prediction mechanisms. In this paper, we develop algorithms and mechanisms inspired by DNA discovery tools to analyze and quantify program dynamic behavior in terms of regularities and patterns. We describe our PatternFinder tool and analyze its results to summarize most important branch and data address pattern behaviors for a set of program traces and SPEC CPU 2006 benchmarks. M aking the common case fast is a design principle that has been used in microprocessor design for decades. This principle applies when determining how to spend resources, since the performance impact on making some occurrence faster is higher if the occurrence is frequent. Although quantifying frequent behavior in an application's dynamic execution behavior is trivial in cases such as observing the frequency of each type of instruction, it is very challenging to summarize dynamic data reference behavior (1). As a finding overlapping or approximate patterns. In this paper, inspired by DNA discovery tools (5, 6), we adopt and revise the methods motivated by suffix trees (5) in order to develop comprehensive pattern discovery tools targeted for computer architecture. Suffix trees have several advantages over SEQUITUR in designing such a tool, which we discuss in Section 3. In this paper, we present a novel pattern analysis tool, the PatternFinder, which is designed to discover and quantify patterns, and the results produced by the tool that quantify data address and branch patterns in dynamic program behavior. PatternFinder is an offline analysis tool that can summarize input sequences using patterns, quantify spatial and temporal regularities in input sequences and enumerate hot patterns based on specified scoring criteria (e.g., coverage). It allows user customizable search with a number of input parameters. PatternFinder can be used to gain insights into hardware and software optimization opportunities as well as perform pattern-centric

Supporting source-level performance analysis of programs written in data-parallel languages requires a unique degree of integration between compilers and performance analysis tools. Compilers for languages such as High Performance Fortran infer parallelism and communication from data distribution directives, thus, performance tools cannot meaningfully relate measurements about these key aspects of execution performance to source-level constructs without substantial compiler support. This paper describes an integrated system for performance analysis of data-parallel programs based on the Rice Fortran 77D compiler and the Illinois Pablo performance analysis toolkit. During code generation, the Fortran D compiler records mapping information and semantic analysis results describing the relationship between performance instrumentation and the original source program. An integrated performance analysis system based on the Pablo toolkit uses this information to correlate the program's dynamic behavior with the data parallel source code. The integrated system provides detailed source-level performance feedback to programmers via a pair of graphical interfaces. Our strategy serves as a model for integration of data-parallel compilers and performance tools.

Parameter mining of traces identifies formal properties that describe a program's dynamic behaviour. These properties are useful for developers to understand programs, to identify defects, and, in general, to reason about them. The dynamic behavior of programs typically follows a distinct pattern of calls and returns. Prior work uses general logic to identify properties from a given set of templates. Consequently, either the properties are inadequate since the logic is not expressive enough, or the approach fails to scale due to the generality of the logic. This paper uses nested words and nested word automata that are especially well suited for describing the dynamic behaviour of a program. Specifically, these nested words can describe pre/post conditions and inter-procedural data-flow and have constant memory requirements. We propose a framework for mining properties that are in the form of nested words from system traces. As a part of the framework, we propose a novel scalable algorithm optimized for mining nested words. The framework is evaluated on traces from real world applications.

In May, 1965, System Development Corporation (SDC) proposed to do some research to study program organization with respect to dynamic program behavior. Further, the proposal suggested that simulation techniques might be used to study the problem of resource allocation in a multiprocessor time-sharing system. Some of the reasons for the proposal related to the prospective utilization of the time-sharing hardware features of the GE and IBM time-sharing computers. At the time, there was considerable interest in investigating the concepts of program segmentation and page turning, both at SDC and in the time-sharing community at large. The concept of fixed-size paging on demand particularly, raised some questions of practicality. One of the early papers on the subject by Dennis and Glaser1 states that the concept of page-turning can be either useful or disastrous, depending on the class of information to which it is applied. However, the theory appeared to be both advantageous and elegant, so that the future of time-sharing seemed to be committed to the concept.

Calling context--the set of active methods on the stack--is critical for understanding the dynamic behavior of large programs. Dynamic program analysis tools, however, are almost exclusively context insensitive because of the prohibitive cost of representing calling contexts at run time. Deployable dynamic analyses, in particular, have been limited to reporting only static program locations. This paper presents Breadcrumbs, an efficient technique for recording and reporting dynamic calling contexts. It builds on an existing technique for computing a compact (one word) encoding of each calling context that client analyses can use in place of a program location. The key feature of our system is a search algorithm that can reconstruct a calling context from its encoding using only a static call graph and a small amount of dynamic information collected at cold (infrequently executed) callsites. Breadcrumbs requires no offline training or program modifications, and handles all language features, including dynamic class loading. We use Breadcrumbs to add context sensitivity to two dynamic analyses: a data-race detector and an analysis for diagnosing null pointer exceptions. On average, it adds 10% to 20% runtime overhead, depending on a tunable parameter that controls how much dynamic information is collected. Collecting less information lowers the overhead, but can result in a search space explosion. In some cases this causes reconstruction to fail, but in most cases Breadcrumbs >produces non-trivial calling contexts that have the potential to significantly improve both the precision of the analyses and the quality of the bug reports.

The goal of the JAVAVIS system is to help students understand what is happening in a Java program during execution. The primary focus of the first release is on sequential Java programs, although there is some support for visualizing concurrent threads. The system uses the Java Debug Interface (JDI), so there are no modifications needed in the Java source code for the extraction of information. The system shows the dynamic behavior of a running program by displaying several object diagrams and a single sequence diagram. There is one object diagram for each active method on the call stack. All modifications in the diagrams are done by smooth transitions.

In today's rapidly changing field of Management Information Systems (MIS) one problem faced by organizations is the consumption of storage capacity due to the growing base of software assets. Research has shown that very few firms effectively monitor program usage. Storage management issues arise due to the fact that many of the programs occupying valuable storage space are used infrequently. In this dissertation, we apply Simon's model of information usage in order to model the dynamic behavior of program usage. This methodology enables organizations to identify the changing usage frequencies of software assets. We propose a classification scheme which MIS personnel can use in order to effectively monitor their program usage tendencies. This classification scheme may then serve as a basis for storage allocation decision-making. Through a study of the dynamic behavior of programs, we have formulated a minimum cost model for hierarchical storage allocation. We will show the value of incorporating dynamic usage frequencies into algorithms which have traditionally considered only a static view.

Static and dynamic program analysis tools mostly focus on the detection of a priori defined defect patterns and security vulnerabilities. Automated detection of logical errors, due to a faulty implementation of applications’ functionality is a relatively uncharted territory. Automation can be based on profiling the intended behavior behind the source code. In this paper, we present a new code profiling method that combines the crosschecking of dynamic program invariants with symbolic execution, an information flow analysis, and the use of fuzzy logic. Our goal is to detect logical errors and exploitable vulnerabilities. The theoretical underpinnings and the practical implementation of our approach are discussed. We test the APP_LogGIC tool that implements the proposed analysis on two real-world applications. The results show that profiling the intended program behavior is feasible in diverse applications. We discuss the heuristics used to overcome the problem of state space explosion and of the large data sets. Code metrics and test results are provided to demonstrate the effectiveness of the approach.

Software Defect Prediction (SDP) plays an active area in many research domain of Software Quality of Assurance (SQA). Many existing research studies are based on software traditional metric sets and defect prediction models are built in machine language to detect the bug for limited source code line. Inspired by the above existing system. In this paper, defect prediction is focused on predicting defects in source code. The objective of this thesis is to improve the software quality for accurate defect prediction is source code for file level. So, that it helps the developer to find the bug and fix the issue, to make better use of a resource which reduces the test effort, minimize the cost and improve the quality of software. A new approach is introduced to improve the prediction performance of Bidirectional RNNLM in Deep Neural Network. To build the defect prediction model a defect learner framework is proposed and first it need to build a Neural Language Model. Using this Language Model it helps to learn to deep semantic features in source code and it train & test the model. Based on language model it combined with software traditional metric sets to measure the code and find the defect. The probability of language model and metric set Cross-Entropy with Abstract Syntax Tree (CE-AST) metric is used to evaluate the defect proneness and set as a metric label. For classification the metric label K-NN classifier is used. BPTT algorithm for learning RNN will provide additional improvement, it improves the predictions performance to find the dynamic error.

This paper describes a methodology for estimating the numerical errors in real-time simulation based on comparing two real-time simulations, one with the nominal integration step size and the second with an augmented step size. Accurate interpolation formulas are then used to convert the outputs from the second simulation to outputs at the discrete times for the first simulation. This permits a direct computation of the difference between the two simulations at common discrete times. Assuming that the dynamic errors vary as hk, where h is the integration step size and k is known, a simple formula can then be used to calculate the deviation of either simulation from the solution for zero step size. While only approximate, this procedure results in dynamic error estimates that are surprisingly accurate, as demonstrated in the paper in example simulations that use both single and multi-rate integrations. It turns out that three simulations, each with a different integration step size, can be used to estimate the exponent k in the dependence of dynamic errors on hk. This in turn allows programming errors, such as the inadvertent introduction of a one-frame delay within the simulation code, to be identified. The author feels that the methodology described in the paper can play a major role in optimizing as well as verifying the dynamic fidelity of real-time, hardware-in-the-loop simulations.

High-performance superscalar processors are designed with the help of complex simulation environment. The simulation infrastructure permits to validate the processor instruction set and contributes as well to the performance evaluation of the selected microarchitecture. Unfortunately, new architectures like the EPIC are not properly supported in the research community. Due to its specificity, the EPIC architecture requires a new framework that gives the researcher an opportunity to explore the EPIC paradigm by characterizing the static and dynamic behavior of binary programs. In particular, this task is made difficult by the fact that the EPIC architecture defines a fully predicated ISA. This paper presents a novel simulation infrastructure, called IATO that permits to analyze, emulate and simulate the EPIC microarchitecture by using the IA64 ISA as the reference architecture. The novelty of the environment is to provide an in-order and an out-of-order cycle accurate execution-driven simulators. In particular, the out-of-order simulator provides an innovative solution for the out-of-order execution of a fully predicated ISA.

The approach presented concentrates on integrating intelligent and unintelligent approaches to come up with an environment that helps novices develop not only problem-solving skills, but also an accurate conceptual and mental model of the programming process. DISCOVER, an intelligent discovery program system supports novices in an initial unintelligent free discovery programming phase and in a subsequent intelligent guided discovery programming phase. In the initial phase, novices explore, observe, and discover the dynamic behavior of individual programming concepts and whole programs as well as of the national machine to build the underlying conceptual programming knowledge. In the subsequent phase, novices compose together programming concepts and language constructs, observed and discovered in the initial phase, to solve given problems under explicit intelligent guidance of system domain expert to transform their programming knowledge into programming skill. Several design issues and decisions that have influenced the development of DISCOVER are discussed. >

Random testing can be a powerful and scalable method for finding faults in software. However, sophisticated random testers usually test a whole program, not individual components. Writing random testers for individual components of complex programs may require unreasonable effort. In this paper we present a novel method, directed swarm testing, that uses statistics and a variation of random testing to produce random tests that focus on only part of a program, increasing the frequency with which tests cover the targeted code. We demonstrate the effectiveness of this technique using real-world programs and test systems (the YAFFS2 file system, GCC, and Mozilla's SpiderMonkey JavaScript engine), and discuss various strategies for directed swarm testing. The best strategies can improve coverage frequency for targeted code by a factor ranging from 1.1-4.5x on average, and from nearly 3x to nearly 9x in the best case. For YAFFS2, directed swarm testing never decreased coverage, and for GCC and SpiderMonkey coverage increased for over 99% and 73% of targets, respectively, using the best strategies. Directed swarm testing improves detection rates for real SpiderMonkey faults, when the code in the introducing commit is targeted. This lightweight technique is applicable to existing industrial-strength random testers.

In this article we describe a memory tracing and profiling tool called Gleipnir. Gleipnir is a plug-in tool for a widely used binary instrumentation framework, Valgrind. Gleipnir's ability to collect fine grained memory traces and associate each access to source level data structures and elements of these structures, makes it a good candidate tool for advanced memory analysis and studying complex memory access patterns. The data provided by Gleipnir may be used by cache simulators to analyze accesses to data structure elements and understand the dynamic memory behavior of programs. The goal of Gleipnir is to give the programmer aid in refactoring data and code. In addition to Gleipnir we introduce a cache simulation tool, Gl cSim. Gl cSim is an extension to DineroIV (a uni-processor simulator) that tracks Gleipnir provided trace and debug-information.

The paper presents an analytical description of a state‐dependent assignment policy, where different assignments of attributes to objects are employed under different states. Various considerations, other than optimizing an objective function, present themselves for such cases—for example, the existence of groups of assignees with certain levels of intragroup assignment uniformity, the stability of the policy over states, the presence of a revealed preference ordering of the assignments, and others. An approach towards a quantitative treatment of such features of a state‐dependent assignment policy is discussed, and in particular a uniformity measure is defined and its properties are investigated. Potential uses of the model are suggested for urban emergency services, questionnaire analysis, task allocation, medical diagnosis, and dynamic computer program behavior. Three implementations for questionnaire analysis are reported.