Efficient Points-to Analysis for Whole-Program Analysis

Alias analysis is a fundamental compiler analysis that powers numerous optimizations. While research has focused on deriving more precise alias information assuming that the compiler will optimize better, recent work shows a negligible, or even negative, performance impact of alias information. In this work, we shift the perspective from refining to relaxing alias information, i.e. , removing information, to complement existing work and challenge that assumption systematically. Our study on a state-of-the-art compiler, LLVM, running the SPEC CPU 2017 benchmark suite, shows (1) a small overall impact —removing alias analysis entirely has little impact on the final binaries, (2) few influential queries —only a small fraction, namely ∼3%, of the alias information leads to changes in the final binary, and (3) lost potential —random relaxations can reduce execution time by 21% and binary size by 39% for certain cases, suggesting that compilers could better utilize alias information. Through this work, we advocate that it is beneficial for future research to avoid simply refining the general precision of alias analysis, but also to explore how to find and refine the most relevant queries, and how to more effectively utilize alias information.

In this paper, we present an accurate, instruction-level, probabilistic alias analysis algorithm for ARM executable code, which reveals the probability of two registers holding the same value. The concept of memory regions (i.e., global, local, and heap variables) is borrowed from high-level programming languages and used to enhance the analytical accuracy. A memory information table (MIT) is proposed as a means of linking determinable stored values with the corresponding memory addresses in order to exploit unknown alias relationships. We also propose a simplified representation of probabilistic information, in order to enhance the efficiency of the proposed algorithm. The alias analysis algorithm was implemented using a post-link optimizer, Diablo. The experimental results show that the entire analytical procedure can be completed within a reasonable amount of time and memory. The proposed algorithm can provide alias information for about 80%-98% of memory reference relationships, and can estimate the probability that two registers refer to the same memory address in the 96.10% of the tested memory-disambiguation pairs, with an overall average accuracy of about 90%-100%.Keywordsalias analysisprobabilityassembly instruction

Certain software defects require corrective changes repeatedly in a few components of the system. One type of such defects spans multiple components of the system, and we call such defects pervasive multiple-component defects (PMCDs). In this paper, we describe an empirical study of six releases of a large legacy software system (of approx. size 20 million physical lines of code) to analyze PMCDs with respect to: (1) the complexity of fixing such defects and (2) the persistence of defect-prone components across phases and releases. The overall hypothesis in this study is that PMCDs inflict a greater negative impact than do other defects on defect-correction efficacy. Our findings show that the average number of changes required for fixing PMCDs is 20-30 times as much as the average for all defects. Also, over 80% of PMCD-contained defect-prone components still remain defect-prone in successive phases or releases. These findings support the overall hypothesis strongly. We compare our results, where possible, to those of other researchers and discuss the implications on maintenance processes and tools.

Reverse engineering aims at obtaining high-level representations of software systems from existing low-level artifacts, such as binaries, source code, execution traces or historical information. Reverse engineering methods and technologies play an important role in many software engineering tasks and quite often are the only way to get an understanding of large and complex software systems. Given for example the task to understand certain aspects of the test code in large software systems, such as Eclipse. How would you figure out the answers to the following questions:

The state explosion problem faced by concolic execution is significantly serious when detecting program bugs especially in large scale software systems. To mitigate the issue, we propose a practical concolic execution approach to detect vulnerabilities in this paper. First, we identify the correlation between symbolic memory and control flow by statically analyzing the software under test, and distinguish the critical symbolic memory and ordinary symbolic memory according to the above correlation. Then, we design different strategies for two kinds of symbolic memory in order to generate state when performing concolic execution of the target software. We present these ideas in a prototype system, Pracolic, and evaluate it with four file systems in Linux, i.e., ext4, XFS, Btrfs, and ReiserFS. Experimental results show that Pracolic can effectively mitigate the problem of state explosion in concolic execution, and outperform S2E, a state-of-the-art analysis system, on state reduction and code coverage for large scale software systems.

Testing consumes significant human and machine resources, especially for large, complex systems such as database servers. While a variety of testing approaches have been proposed to improve the efficiency of the testing process, it is difficult to evaluate these approaches. Mutation testing has been proposed as a way to assess the adequacy of a test suite, assigning a score that can be used to compare testing approaches. While promising, serious obstacles appear to prevent mutation testing with large software systems. Recent advances in mutation testing have scaled to medium-sized programs of around 100,000 lines of code but to our knowledge there are no reported studies working with large systems with millions of lines of code and other features of database systems that complicate testing. In this paper we explore using mutation testing on a database server to evaluate its suitability for comparing test suites or testing approaches.

Large software systems are expensive to develop and maintain. A significant amount of programmer activity in understanding, changing, and debugging these systems is information management. To support these activities more directly, we have designed a programming environment, called OMEGA, that provides powerful mechanisms for accessing and displaying the information in a large software system. OMEGA uses successful ideas from existing programming environments while trying to correct deficiencies. The major deficiency in these systems is that programmers can only view and manipulate a single logical representation of programs. To support multiple representations, OMEGA uses a relational database system to manage all program information. Using a database system provides a powerful mechanism for efficient access to a variety of cross-sections of program information, as well as providing traditional database facilities such as concurrency control, data integrity, and crash recovery. The user interface to OMEGA separates input specification from output display, relies on pointing rather than typing, and exploits interaction in semantic analysis to detect many errors as soon as they are made. By eliminating the traditional textual interface to programs, OMEGA also allows the unification of the different abstraction mechanisms present in traditional programming environments. We have experimented with the ideas in OMEGA by designing a relational schema for software written in a particular programming language, and by implementing a program that transfers existing programs, stored as text, into a database managed by an off-the-shelf database system. A prototype visual interface to the program database has also been implemented. The results of this thesis are new models of program representation and user interaction for software development systems. The model of program representation can be expressed in the relational data model, and software can therefore be manipulated easily and powerfully using relational calculus. Our experimental implementation demonstrates the feasibility of using a relational database system, and provides insights into potential problems and how they might be solved.

For large software systems, refactoring activities can be a challenging task, since for keeping component complexity under control the overall architecture as well as many details of each component have to be considered. Product metrics are therefore often used to quantify several parameters related to the modularity of a software system. This paper devises an approach for automatically suggesting refactoring opportunities on large software systems. We show that by assessing metrics for all components, move methods refactoring an be suggested in such a way to improve modularity of several components at once, without hindering any other. However, computing metrics for large software systems, comprising thousands of classes or more, can be a time consuming task when performed on a single CPU. For this, we propose a solution that computes metrics by resorting to GPU, hence greatly shortening computation time. Thanks to our approach precise knowledge on several properties of the system can be continuously gathered while the system evolves, hence assisting developers to quickly assess several solutions for reducing modularity issues.

Tao is a system that optimizes the execution of unit tests in large software programs and reduces the programmer wait time from minutes to seconds. Tao is based on two key ideas: First, Tao focuses on efficiency, unlike past work that focused on avoiding false negatives. Tao implements simple and fast function-level dependency tracking that identifies tests to run on a code change; any false negatives missed by this dependency tracking are caught by running the entire test suite on a test server once the code change is committed. Second, to make it easy for programmers to adopt Tao, it incorporates the dependency information into the source code repository. This paper describes an early prototype of Tao and demonstrates that Tao can reduce unit test execution time in two large Python software projects by over 96% while incurring few false negatives.

The detection of early-warning signals of performance deterioration can help technical support teams in taking swift remedial actions, thus ensuring rigor in production support operations of large scale software systems. Performance anomalies or deterioration, if left unattended, often result in system slowness and unavailability. In this paper, we presents a simple, intuitive and low-overhead technique for recognizing the early warning signs in near real time before they impact the system The technique is based on the inverse relationship which exists between throughput and average response time in a closed system. Because of this relationship, a significant increase in the average system response time causes an abrupt fall in system throughput. To identify such occurrences automatically, Individuals and Moving Range (XmR) control charts are used. We also provide a case study from a real-world production system, in which the technique has been successfully used. The use of this technique has reduced the occurrence of performance related incidents significantly in our daily operations. The technique is tool agnostic and can also be easily implemented in popular system monitoring tools by building custom extensions.

This paper characterizes the testing environment for large commercial software systems, matches reliability model assumptions with the application environment, examines alternative test workload me...

The software maintenance research community has developed a large number of approaches that can help maintainers understand large software systems accurately and efficiently. However, tools that can facilitate research in program comprehension are rarely publicly available. In this paper, we introduce two approaches that generate artifacts, such as fact bases and decompositions, that can be used to study the behaviour of existing software clustering approaches for the comprehension of large software systems. We also present three distinct applications of these approaches: the development of a simple evaluation method for clustering algorithms, the study of the behaviour of the objective function of the Bunch tool, and the calculation of a congruity measure for clustering evaluation measures. Implementations of the two approaches are available online.

Program slicing is a useful reduction technique in many areas such as debugging and testing, and thus, there has also been some research to try and apply slicing techniques to flat state-based models at the design level, for their maintenance and quality improvement. However, such state-based models have difficulties in specifying large and complex software systems, and so the benefit obtained from slicing such models, is very limited. In contrast, UML state machine diagrams can properly describe the behavior of large software systems; but it is difficult to apply a slicing algorithm to automatically reduce the diagram with respect to a point of interest, because of the unique properties (such as hierarchy and orthogonality) of these diagrams. In this paper, we identify important issues relevant to the slicing of UML state machine diagrams with regards to data and control dependence. We also show why the unique properties of these diagrams are important to consider when retrieving data and control dependence information, by virtue of an illustrative example.

The detection of function clones in software systems is valuable for the code adaptation and error checking maintenance activities. This paper presents an efficient metrics-based data mining clone detection approach. First, metrics are collected for all functions in the software system. A data mining algorithm, fractal clustering, is then utilized to partition the software system into a relatively small number of clusters. Each of the resulting clusters encapsulates functions that are within a specific proximity of each other in the metrics space. Finally, clone classes, rather than pairs, are easily extracted from the resulting clusters. For large software systems, the approach is very space efficient and linear in the size of the data set. Evaluation is performed using medium and large open source software systems. In this evaluation, the effect of the chosen metrics on the detection precision is investigated.

Software management consultants have something in common with physicians: both are much more likely to be called in when there are serious problems rather than when everything is fine. Examining large software systems-those in excess of 5000 function points (which is roughly 500000 source code statements in a procedural programming language such as Cobol or Fortran)-that are in trouble is very common for management consultants. Unfortunately, the systems are usually already late, over budget, and showing other signs of acute distress before the study begins. The consultant engagements, therefore, serve to correct the problems and salvage the system-if, indeed, salvaging is possible. The failure or cancellation rate of large software systems is over 20 percent. Of those that are completed, about two thirds experience schedule delays and cost overruns that may approach 100 percent. Roughly the same number are plagued by low reliability and quality problems in the first year of deployment. Yet some large systems finish early, meet their budgets, and have few, if any, quality problems. How do these projects succeed, when so many fail?.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>