Pruning Dynamic Slices With Confidence

Transcription

1 Pruning Dynamic Slices With Cnfidence Xiangyu Zhang Neelam Gupta Rajiv Gupta he University f Arizna, Department f Cmputer Science, ucsn, Arizna 8572 {xyzhang,ngupta,gupta}@cs.arizna.edu Abstract Given an incrrect value prduced during a failed prgram run (e.g., a wrng utput value r a value that causes the prgram t crash), the backward dynamic slice f the value very frequently captures the faulty cde respnsible fr prducing the incrrect value. Althugh the dynamic slice ften cntains nly a small percentage f the statements executed during the failed prgram run, the dynamic slice can still be large and thus cnsiderable effrt may be required by the prgrammer t lcate the faulty cde. In this paper we develp a strategy fr pruning the dynamic slice t identify a subset f statements in the dynamic slice that are likely respnsible fr prducing the incrrect value. We bserve that sme f the statements used in cmputing the incrrect value may als have been invlved in cmputing crrect values (e.g., a value prduced by a statement in the dynamic slice f the incrrect value may als have been used in cmputing a crrect utput value prir t the incrrect value). Fr each such executed statement in the dynamic slice, using the value prfiles f the executed statements, we cmpute a cnfidence value ranging frm t a higher cnfidence value crrespnds t greater likelihd that the executin f the statement prduced a crrect value. Given a failed run invlving executin f a single errr, we demnstrate that the pruning f a dynamic slice by excluding nly the statements with the cnfidence value f is highly effective in reducing the size f the dynamic slice while retaining the faulty cde in the slice. Our experiments shw that the number f distinct statements in a pruned dynamic slice are.79 t 9.57 times less than the full dynamic slice. Cnfidence values als priritize the statements in the dynamic slice accrding t the likelihd f them being faulty. We shw that examining the statements in the rder f increasing cnfidence values is an effective strategy fr reducing the effrt f fault lcatin. Categries and Subject Descriptrs D.2.5 [Sftware Engineering]: esting and Debugging Debugging aids, esting tls, racing; D.3.4 [Prgramming Languages]: Prcessrs Debuggers Algrithms, Measurement, Reliability, Verifica- General erms tin debugging, dynamic slicing, data and cntrl depen- Keywrds dences Permissin t make digital r hard cpies f all r part f this wrk fr persnal r classrm use is granted withut fee prvided that cpies are nt made r distributed fr prfit r cmmercial advantage and that cpies bear this ntice and the full citatin n the first page. cpy therwise, t republish, t pst n servers r t redistribute t lists, requires prir specific permissin and/r a fee. PLDI 6 June 4, 26, Ottawa, Ontari, Canada. Cpyright c 26 ACM /6/6... $5... Intrductin Dynamic slicing was first prpsed by Krel and Laski [3] t guide sftware develpers in the debugging prcess. he dynamic slice f a value cmputed at a prgram pint in the executin trace includes all thse executed statements which were directly r indirectly invlved in the cmputatin f the value. A significant amunt f research n algrithms fr cmputing dynamic slices has been carried ut [, 23, 24, 25]. Cmputatin f dynamic slices nrmally cnsists f tw steps: building the dynamic dependence graph fr a prgram executin (where dependences include bth data and cntrl dependences); and then traversing the dynamic dependence graph t cmpute the dynamic slice f a cmputed value that is bserved t be incrrect by the prgrammer (incrrect value may crrespnd t an incrrect utput r a value that causes the prgram t crash). Due t the size f the dynamic dependence graph, which keeps grwing as prgram executes, ne challenge f dynamic slicing is the cst f cmputing it [23]. Our prir wrk n dynamic slicing has already addressed this prblem [25, 24]. he effectiveness f dynamic slicing in fault lcatin is determined by tw factrs: Hw ften is the faulty statement present in the slice? and Hw big is the slice, i.e. hw many statements are included in the slice? In ur previus wrk [27] we evaluated the effectiveness f backward dynamic slicing in fault lcatin. We bserved that dynamic slices are able t cntain the faulty statement in mst f the cases and in general dynamic slices are quite small cmpared t the number f executed statements. Hwever, we als bserved that the abslute number f statements in the slice culd still be large and in additin many f the statements are apparently unlikely t be faulty even thugh they are present in the slice. Given an bserved incrrect value, in this paper, we develp an apprach fr cmputing a Pruned Dynamic Slice f, PDS( ), which cntains a subset f statements frm the Dynamic Slice f, DS( ), that are highly likely t include faulty statements. We bserve that althugh DS( ) cntains all executed statements that are invlved in cmputing, nt all f these statements are equally likely t be invlved in causing the errneus behavir. In particular, let us cnsider a cmmn situatin in which the prgram prduces sme crrect utputs ( s) befre prducing the incrrect value. Frm the perspective f the s and, it is pssible t divide the executed statements in DS( ) int tw sets: May Set, DS may( ), cntaining executed statements frm DS( ) that are als invlved in cmputing ne r mre f the values; and Must Set, DSmust( ), cntaining executed statements frm DS( ) that were invlved in cmputing nne f the values. In ther wrds: DS( ) = DS must( ) DS may( ) DS must( ) = DS( ) [ DS( ) DS may( ) = DS( ) DS must( )

2 While the statements in the DS must( ) are always included in the pruned slice PDS( ), the nes in DS may( ) may r may nt be included in PDS( ). We develp an analysis that cmputes fr value v cmputed by each statement executin s DS may( ) a cnfidence value C(v@s) between and. High cnfidence value fr a statement executin indicates that we have a high cnfidence that the statement prduced a crrect value. he cnfidence values are cmputed using the value prfiles f the executed statements. A threshld cnfidence τ may be set such that nly statement executins in DS may( ) that have a cnfidence f less than τ are included in the pruned dynamic slice PDS τ( ). In ther wrds: PDS τ( ) = DS must( ) DS τ may( ) where, DS τ may( ) = {s s.t. s DS may C(v@s) < τ} As we will shw later, ur analysis may yield cnfidence values f fr many statement executins and thus they are pruned frm the dynamic slice irrespective f the chice f τ, i.e. they are never included in PDS τ( ) fr all τ. errr crrect input input? incrrect Always included in PDS Never included in PDS? May be included in PDS Figure. Pruning dynamic slice.? input? DS IDS crrect PDSmax PDS min Figure illustrates pruning f dynamic slices visually. It shws a dynamic dependence graph f a cmputatin that prduces tw values befre prducing the incrrect value. DS is the Dynamic Slice f. A subset f ndes in DS that frm the Ideal Dynamic Slice (IDS) is shwn IDS riginates at the pint f prgram errr. he ndes in DS that are nt present in IDS have been divided int three categries. he ndes labeled in DS belng t DS must, as they are nt invlved in cmputing the values, and thus they are always included in PDS, the Pruned Dynamic Slice f. he remaining ndes in DS are labeled with either r?. he ndes have cnfidence value f and thus they are never included in P DS. he ndes labeled? have a cnfidence value f less than and thus the value f threshld τ determines whether r nt they are included in PDS. he identificatin f ndes is made pssible by recgnizing that any change in the values prduced by such ndes wuld alter the utput values that were knwn t be crrect. herefre it is assumed that these ndes must have prduced crrect values. As the figure shws, the smallest (largest) pruned dynamic slice that is prduced by ur algrithm crrespnds t PDS min (PDS max). he key pint t nte here is that even if τ is set t, we btain a pruned dynamic slice PDS max which is smaller than the dynamic slice DS. We wuld als like t pint ut that PDS min is actually what is knwn as a dynamic dice [3] as ur experiments later in the paper shw, ften when faulty cde is nt captured by the dynamic dice it is captured by PDS max. Next we present a mtivating example which shws hw analysis f cde and runtime infrmatin can be used such that the cnfidence values f sme statement executins in DS may is determined t be. Figure 2(a) shws an executin f a prgram that fllws the path crrespnding t the true evaluatin f the predicate at nde 4. he value shwn t the right f each statement is the value cmputed by the statement during the executin. he dynamic dependence graph f this executin is shwn in Figure 2(b) the slid edges are data dependence edges while dtted edges are cntrl dependence edges. he ndes in the dynamic slice f the incrrect utput value prduced by statement include {,,2, 3,4, 7,}. Nw let us see hw the crrect utputs prduced by statements 8 and 9 are used t mark the ndes in DS may as r?. Frm the crrect utput value f X written by statement 8 we infer that the values prduced by statements, 3 and 5 are als crrect. he reasning n which this inference is based is as fllws. he statements 3 and 5 represent ne-t-ne mappings between the used perand values and generated result values f X. herefre any change in the values prduced by, 3 r 5 will cause the value utput at statement 8 t change. Hwever, the value utput at statement 8 is knwn t be crrect. hus, we mark statements, 3 and 5 with indicating that they prduce crrect values. We further cnclude that the true evaluatin f predicate X > Y is als crrect. his is because if X > Y wuld have evaluated t false, it wuld have prduced a different utput value fr X at statement 8. Nw let us cnsider the ther crrect utput value written by statement 9. Since statement 6 des nt represent a ne-t-ne mapping between its perand and result, even thugh the value f that is prduced by statement 6 is crrect, we d nt assume that the value f perand Z used in statement 6 is crrect. As a result we cnclude that values prduced by statements and 2 may r may nt be crrect and therefre we mark them with a?. Nte that the value f Y generated by statement has anther use in the predicate X > Y. Even thugh we have determined that the predicate crrectly evaluated t true, we cannt determine frm this fact that the value f Y used by the predicate is crrect because many different values f Y wuld have prduced the crrect true evaluatin f the predicate. hus, frm bth uses f Y we cnclude the same thing, i.e. the value f Y prduced by statement may r may nt be crrect. Given the abve bservatins, the pruned dynamic slice f incrrect value utput at statement will always include statements 7 and. Mre imprtantly it will never include statements, 3, 4 and 5. Hwever, it may r may nt include statements and 2. he cnfidence values fr statements and 2 will be cmpared with the threshld τ t make this determinatin. In ther wrds: DS = {,, 2,3, 4,7, }; IDS = {2, 7, } PDS max = {, 2, 7,}; PDS min = {7, }

3 errr Z = Y+2 Y =.. 9 X = Z = Y+ 3 4 X = X+ 2 if X > Y 5 X = X+ 22 X = X 2 6 = Z%2 = Z% Z = Z+ Z = Z Write Write X 22 Write Z F (a) Prgram Executin. dynamic data dependences 5 Y =.. 9 X = Z = Y+ 3 4 X = X = Z%2 7 Z = Z+ 8 9 X = X+ 2 if X > Y Write Write X 22 Write Z crrect value crrect value incrrect value?? dynamic cntrl dependences (b) Dynamic Dependence Graph. Figure 2. Pruning dynamic slice. In the remainder f this paper we will present a cnfidence estimatin methd that will prduce the fllwing results. First fr the abve example it will prduce a cnfidence value f fr values prduced by statements, 3, 4, and 5. herefre ur pruning algrithm will crrectly remve statements, 3 and 4 frm the dynamic slice f the incrrect utput value prduced by statement. Secnd it will prduce cnfidence values f less than fr statements and 2 such that the cnfidence value f statement is mre than cnfidence value f 2. hus, depending upn the value f τ, three pssible pruned slices will result: {, 2, 7,}, {2, 7,} and {7, }. he cmputatin f cnfidence values will be perfrmed using the value prfiles f the executed statements (i.e., the perand values used and result values prduced during statement executins). Given a failed run invlving the executin f a single errr, ur experiments shw that the pruning f a dynamic slice by excluding nly the statements with the cnfidence value f is highly effective in reducing the size f the dynamic slice while retaining the faulty cde in the slice. We bserve that the number f distinct statements in a pruned dynamic slice PDS max are.79 t 9.57 times less than the cnventinal dynamic slice. Cnfidence values als priritize the statements in the dynamic slice accrding t the likelihd f them being faulty. We als shw that lcating a fault by examining the statements in the rder f increasing cnfidence values is an effective strategy. he rest f the paper is rganized as fllws. In sectin 2 we frmally define cnfidence values and shw hw value prfiles are used fr estimating cnfidence values. In sectin 3 we present results f experiments t demnstrate the effectiveness f pruning dynamic slices using estimates f cnfidence values. Related wrk is discussed in sectin 4 and we cnclude in sectin Cnfidence Analysis In this sectin we develp an analysis that will serve as the basis fr pruning a cnventinal dynamic slice. In this wrk we assume that fr the failed prgram run being analyzed, the failure was caused due t the executin f a single errr in the prgram (i.e., even thugh the prgram may cntain many bugs, the failure was caused by encuntering ne f thse bugs). Our gal is t develp a heuristic fr pruning a dynamic slice such that the size f the dynamic slice is significantly reduced and very rarely is the errneus statement pruned frm the dynamic slice. In ther wrds we wuld like t significantly reduce the size f the slice with minimal lss in fault lcatin effectiveness. Befre we describe ur analysis, we present sme basic definitins. DEFINIION. he Dynamic Dependence Graph f a prgram run, DDG(N, E), cnsists f a set f ndes N and a set f directed edges E where: each nde n i N crrespnds t i th executin instance f statement n in the prgram; and each edge m j n i E crrespnds t a dynamic data dependence r dynamic cntrl dependence f i th executin instance f statement n n the j th executin instance f statement m. In ther wrds, with the executin f each statement during a prgram run, a new nde is added t the dynamic data dependence graph and the incming edges t the nde frm ther ndes n which the new nde is data and cntrl dependent are intrduced. he executin f every statement during a prgram run results in the cmputatin f a result value. Fr an assignment statement this is the value assigned t the left hand side variable during the executin while fr a predicate statement the value is either true r false crrespnding t the result f the predicate s evaluatin. he dynamic slice f a value cmputed by a statement is defined as fllws.

4 DEFINIION 2. Given DDG(N, E), a dynamic dependence graph, the Dynamic Slice f n i N dented by DS(n i) is the subgraph f DDG(N, E) which includes n i as well as all ther ndes and edges frm which n i is reachable, i.e. DS(n i) = ({n i}, {e e = m j n i E}) [ m j n i DS(m j) Cnsider a failed prgram run frm which tw kinds f evidence are cllected: negative evidence in frm f the first incrrect value bserved by the prgrammer during the prgram run; and psitive evidence in frm f sme crrect utput values ( s) generated during the prgram run befre the incrrect value was generated. We classify each relevant value, i.e. value that was invlved directly r indirectly in cmputing and/r values, int three distinct categries as defined belw. DEFINIION 3. A relevant value v generated by nde n is classified as: r crrect if it is used in cmputing at least ne f the values but it is nt used in cmputing the incrrect value. herefre S values cmputed by all ndes in DS( ) DS( ) are classified as ; r incrrect if it is used in cmputing the incrrect value but it is nt used in cmputing any f the values. herefre values cmputed by all ndes in DS( ) S DS( ) are classified as ; and? r unknwn if it is used in cmputing the incrrect value and at least ne f the values. herefre values cmputed by all ndes in DS( ) S DS( ) are classified as?. In [27] it has been shwn that dynamic slice DS( ) typically cntains the errneus cde respnsible fr prducing the incrrect value ; hwever, it als includes many statement executins that are nt respnsible fr generating the incrrect value. Accrding t the abve definitins, statement executins in DS( ) will be initially classified int tw categries sme will be classified as while thers will be classified as?. he nes that are classified as are always included in the dynamic slice. Hwever, we perfrm analysis t determine what subset f statement executins classified as? shuld be included in the pruned dynamic slice. he decisin as t whether the statement executins in the dynamic slice that are classified as? shuld be included in the pruned dynamic slice is based upn cnfidence analysis. Fr every value v cmputed by statement executin n, cnfidence analysis prduces a cnfidence value C(v@n) that measures the likelihd f the value being crrect. he cnfidence estimate C(v@n) ranges frm t where C(v@n) = indicates that we have n cnfidence at all in the crrectness f value v while C(v@n) = indicates that we have the highest pssible cnfidence in the crrectness f value v@n. his estimate is defined as shwn belw. DEFINIION 4. Cnfidence estimate f value v cmputed by a relevant nde n is defined as fllws: if v is classified as (i.e., crrect) then C(v@n) = elseif v is classified as (i.e., incrrect) then C(v@n) = elseif v is classified as? (i.e., unknwn) then C(v@n) = lg Range(v@n) Alt(v@n) where Range(v@n) represents all legal values f v and Alt(v@n) Range(v@n) is a set f alternate values f v such that if any value in Alt(v@n) was prduced by n, the same crrect values wuld have resulted. Let us discuss the reasning behind the C(v@n) cmputatin when v is classified as?. If any change whatsever in the value cmputed by n wuld cause at least ne f the values t change and hence becme incrrect, then we cnclude that the value v cmputed by n during the prgram run must have been crrect. In this case the set Alt(v@n) cntains nly ne value. herefre as desired, the cnfidence estimate C(v@n) = lg Range(v@n) =. On the ther hand, if changing v t ther values can still yield the same values, then we have less cnfidence in the crrectness f value v. As the set Alt(v@n) increases in size, the cnfidence estimate C(v@n) reduces and when Alt(v@n) is equal t Range(v@n), then C(v@n) = lg Range(v@n) Alt(v@n) =. Befre settling n the abve definitin f cnfidence, we cnsidered ther simpler definitins f cnfidence but we fund them nt t be nearly as effective. Fr example, we cnsidered a definitin in which each value s cnfidence was prprtinal t the number f crrect utputs whse cmputatin depended upn that the value. Hwever, we bserved that in many cases different utputs were derived frm different values and thus many values were assigned the same cnfidence. In additin, this simpler methd fails t explit the knwledge that smetimes even thugh a value may be invlved in cmputing a single crrect utput, by lking at the statements invlved we may be able t definitely determine that the value is crrect. Fr example, in Figure 2(b), since the value f X utput by statement 8 is crrect, we can determine that the value f X cmputed by statement must be crrect. his is because the statements alng the data dependence chain (4 and 5) perfrm ne-t-ne mapping between ld and new values f X. Next we develp an algrithm fr cmputing cnfidence estimates. While ur definitin f cnfidence estimates is quite simple, the cmputatin f cnfidence estimates is made challenging by the need fr deriving the Range(v@n) and Alt(v@n) sets fr all ndes n that are classified as?. here are tw key prblems that must be addressed. First, given a variable x referenced by a prgram statement s, we first define the set Range(v@n), i.e. the set f legal values that x may be allwed t take during its reference by an executin f s. Once such a legal set f values is determined fr all variable references, the Alt() sets will be cmputed with respect t these legal values. Secnd, we must develp an algrithm fr prpagatin f values. Starting frm the values classified as, we traverse the dynamic dependence graph in a bttm up fashin t cmpute the Alt() sets f values classified as?. he Alt() set f a value classified as is initialized t empty while the Alt() set f a value classified as? is cmputed by examining the Alt() sets f its child ndes in the dynamic dependence graph. Let us first discuss hw the set f legal values is determined fr each variable reference. A simple apprach wuld be t use all pssible values a variable can take based upn its type (integer, char, blean) r cmpute a mre accurate set using static analysis (e.g., range prpagatin [2]). Hwever, such an verestimate is nt very desirable fr debugging because during debugging we are interested in analyzing a single prgram executin (i.e. the failed run) crrespnding t a specific prgram input. herefre we use the value prfile fr the failed run t supply the set f legal values Range(). DEFINIION 5. Given a reference (definitin r use) t a variable v in a prgram statement s, the value prfile V P(v@s) prvides an rdered list f values taken by variable v during the multiple executins f s in the failed run.

5 S: Y =.. if (..) C : X=Y+ fi if (..) C 2 : X=Y%2 fi if (..) C 3 : X=Y+Z fi Reference Value Prfile {,2,3,4,5,6,7,8,9} {7,8,9} X@C {8,9,} 2 {,2,3,9} X@C 2 {,,,} Z@C 3 {9,9,5,5} 3 {4,5,6,9} X@C 3 {3,4,,4} Figure 3. Value prfiles. A prgram run generates a large number f values and exercises a large number f dynamic dependences. Capturing this histry t perfrm dynamic slicing is a challenge that is already addressed in ur prir wrk [25, 26]. We develped a highly cmpressed frm, whle executin traces [26], that enables us t hld the executin trace f t 2 billin instructins in GB f memry. Nw let us cnsider the rules f prpagatin alng data and cntrl dependence edges in the dynamic dependence graph. Intuitively, given an executin instance f a statement, the values in the Alt() set f the result cmputed by the statement are cnstrained by each f its children in the dynamic data dependence graph. Only thse values can be put int the Alt() set that d nt adversely impact any f the values alng any chain f dependence edges frm the executed statement t any f the values. herefre, we als assciate Alt() sets with dynamic dependence edges and then the Alt() set fr the result value f an executed statement is simply cmputed by intersecting the Alt() sets f edges leaving the statement. here are tw key peratins invlved in prpagatin. First frm the Alt() set f a result cmputed by an executed statement, we cmpute the subset f legal values that the perands can take such that these perand values prduce the result values cntained in the Alt() set. Secnd the Alt() set f a result is cmputed by examining the subset f legal values already determined at each f the uses f the result value. C 3 X = Y + (Write X) {9} C 2 4 Alt(Y@S 9 ) = {9} S 9 Y =... 9 {,3,9} X = Y % 2 (Write X) {5,9} 3 C 4 X = Y + Z (Write X) 4 Figure 4. Dependences amng assignment statements. Let us cnsider prpagatin alng dynamic data dependence edges that cnnect assignment statements (we will als cnsider predicate statements shrtly). We illustrate prpagatin by analyzing the result value cmputed by 9 th executin instance f statement S in the example frm Figure 3. he value f Y cmputed by S 9 is 9 and this value is used later by 3 rd, 4 th, and 4 th executin instances f statements C, C 2 and C 3 respectively. he dynamic dependence will therefre include three data dependence edges S 9 C 3, S 9 C 2 4, S 9 C 3 4. We further assume that the values f X cmputed by C 3, C 2 4 and C 3 4 are utput and determined t be crrect. Figure 4 first shws hw the ptential 4 values in 9) set are identified by cnsidering each dynamic data dependence individually. Given that C represents a ne-t-ne mapping between the value perand Y and result X, the 9 C3) set btained is empty. In cntrast, since statements C 2 and C 3 d nt represent ne-t-ne mappings between the value f perand Y and the value f result X, the sets 9 C4) 2 and 9 C4) 3 crrespnding t dynamic data dependence edges S 9 C4 2 and S 9 C4 3 cntain mre than ne value. Hwever, the 9) is cmputed by intersecting the three sets fr the three dynamic data dependences yielding a set with nly ne element. herefre the cnfidence estimate 9) = and therefre we mark the value cmputed by S 9 as, i.e. crrect. Frm the abve analysis we bserve tw things. First, the presence f ne-t-ne mappings are greatly beneficial in pruning a dynamic slice since they prevent Alt() sets frm expanding as prpagatin prceeds. Secnd, we bserve that as lng as there is ne data dependence edge alng which a cmputed value can be verified (i.e., its Alt() set cntains ne value), the value is cnsidered verified. As we will shw later, ur apprach is very effective because prgrams ften cntain many statement executins that crrespnd t ne-t-ne mappings (e.g., cpy peratins, expressins with tw perands ne f which is a cnstant etc.). In the abve example we cnsidered prpagatin alng dynamic data dependence edges and these edges were present between assignment statement executins. Next we see hw t handle the situatin in which predicate evaluatins are present and hence dynamic cntrl dependence edges are als present. here are tw pints t be made here. First we classify the value f a predicate as being crrect ( ) if the value f ne f its direct r indirect cntrl dependent assignment statements has been determined t be. his is because if the predicate wuld have evaluated differently the variable assigned by the cntrl dependent assignment wuld have had a different value and hence it wuld have adversely affected ne f the values thrugh its further uses. Secnd it shuld be nted that when the result value f a predicate is classified as crrect, it nly means that the utcme f the predicate evaluatin (true r false) is crrect. Hwever, since a predicate usually represents a many-t-ne mapping between its perand values and true/false result, we cannt infer that the perand values are necessarily crrect. he nly thing we can say is that the perand values are the subset f legal values fr which the predicate prduces the same desired result, i.e. true/false. illustrate the abve pints we use a fragment f the previus example as shwn in Figure 5. he S: Y =.. P : if (Y>6) C : X=Y+ fi C 3 S 9 Alt(Y@S ) = {9} 9 Y =... 9 {9} {7,8,9} P 9 (Write X) if Y > 6 X = Y + Figure 5. Dependences invlving predicates. dynamic dependence graph and the results f analysis are shwn in the figure. Nte that the predicate evaluatin P 9 is marked as

6 Initialize: Alt( ) φ; fr each relevant nde S i marked? in bttm-up rder d if S i is an assignment X =.. then CmputeAlt(Alt(X@S i )); if Alt(X@S i ) = then C(X@S i ) = ; mark S i as ; else C(X@S i ) = lg Range(X@Si ) Alt(X@S i ) endif elseif S i is a predicate then if S j st S j dynamically cntrl dependent upn S i and S j is marked then mark S i as endif endif endfr CmputeAlt(Alt(X@S i )) Let the fllwing dynamic dependence edges lead frm S i t ndes marked r?: t assignments: S i C i, S i C 2 2i,... S i C n ni ; t predicates: S i P i, S i P 2 2i,... S i P m mi. fr each C j : Y = f(x) st S i C j ji d Alt(X@S i C j ji ) = {v : v V P(X@C j ) C j (X = v) j ji )} endfr fr each P j : f(x) st S i P j ji d Alt(X@S i P j ji ) = {v : v V P(X@P j ) P j (X = v) = P j ji } endfr Alt(X@S i ) = Alt(X@S i C j ji ) endcmputealt j,s i C j ji j,s i P j ji Alt(X@S i P j ji ) Figure 6. Cnfidence cmputatin algrithm. because its dynamic cntrl dependent child C 3 is marked. 9 P 9 ) als includes values 7 and 8 in additin t 9 as fr these legal values f Y, the predicate Y > 6 evaluates t true just as it evaluates t true fr the value 9 prduced by S 9. he prcess we have described is summarized fully in the algrithm presented in Figure 6. All ndes in the dynamic dependence graph that have been marked as? are the nes that are prcessed t cmpute their cnfidence estimates. he Alt() sets fr all ndes are initialized t the empty set. he ndes marked? are then prcessed in a bttm-up rder ne by ne. If a nde being prcessed is an assignment statement then the Alt() set fr its result value is cmputed, frm which then its cnfidence estimate is derived. Predicate ndes are prcessed by cnsidering the markings n their dynamically cntrl dependent assignment statements. In Figure 6, the functin CmputeAlt() presents the details f the Alt() set cmputatins which were described intuitively earlier. 3. Experimental Results 3. Implementatin and Benchmarks We have develped a dynamic slicing framewrk which was used t cnduct experiments. Our tl executes gcc cmpiler generated binaries fr Intel x86 and captures dynamic infrmatin including dependence, value, and cntrl flw traces [26]. Even thugh ur tl wrks at binary level, the dynamic infrmatin is easily mapped back t surce cde level using the debugging infrmatin generated by gcc. Figure 7 shws the main cmpnents f ur tl. he static analysis cmpnent f ur tl cmputes static cntrl dependence (CD) required fr frward/backward slice cmputatins frm the binary. he static analysis was implemented using the Diabl [32] retargetable link-time binary rewriting framewrk as this framewrk already has the capability f cnstructing the cntrl flw graph frm an Intel x86 binary. he dynamic prfiling cmpnent f ur system which is based upn the Valgrind memry debugger and prfiler [33] accepts the same gcc generated binary, instruments it by calling the slicing instrumenter, and executes the instrumented cde with the supprt f the slicing runtime. he slicing instrumenter and the slicing runtime were develped by us t enable the cllectin f dynamic infrmatin. Valgrind s kernel is a dynamic instrumenter which takes the binary and befre executing any new (never instrumented) basic blcks it calls the instrumentatin functin, which is prvided by the slicing instrumenter. he instrumentatin functin instruments the prvided basic blck and returns the new basic blck t the Valgrind kernel. he kernel executes the instrumented basic blck instead f the riginal ne. he instrumented basic blck is cpied t a new cde space and thus it can be reused withut calling the instrumenter again. he slicing runtime essentially cnsists f a set f call back functins fr certain events (e.g., entering functins, accessing memry, binary peratins, predicates etc.). It als manages the shadw memry which is used t capture dynamic dependences. Mre details n the wrking and use f shadw memry can be fund in [27]. We intercept the utput system call ( WRIE etc.) and then augment the riginal utput with its crrespnding psitin in the DDG. he cnfidence cmpnent implements the analysis in this paper. It receives dynamic infrmatin frm the slicing runtime and stres it as DDG, which is a variant f ur prir WE representatin [26]. Figure 7. l infrastructure. able shws the benchmarks used in ur experimentatin. he first five are knwn as the Siemens suite prgrams []. he last tw unix utilities are als available frm the same website [3]. We use this suite f prgrams because it prvides several faulty versins f the prgrams which have exactly ne fault injected in each ne f them. he versins used in ur experiments are als indicated in able. Fr each faulty versin many test inputs are als prvided in []. Different inputs ften result in different psitins fr the first incrrect utput in the utput stream. he clumn psitin range f able gives the range f the psitins f the first bserved wrng utput. he greater the psitin number, the greater is the number f crrect utputs prduced befre the incrrect utput. We can see that it is cmmn fr a certain number f crrect utputs t be generated in a failed run. In fact these numbers can be very high fr sme failed runs. We exclude the prgram tcas and tt inf frm the Siemens suite because tcas is t small and tt inf has flating pint peratins, which are currently nt supprted by ur tl. We d have sme real wrld benchmarks. Hwever, mst f them are memry crruptin errrs fr which prgram executins terminated befre any utput was prduced. he test suite prvides mre versins than thse used in ur experiments. We excluded sme f the versins as they are nt apprpriate fr experimentatin. Sme versins prduce n utput r the very first utput prduced is wrng. herefre ur apprach is nt applicable. In tw kinds f situatins the faulty statement is nt present in the dynamic slice itself and thus we cannt study the ef-

7 Benchmark Versin Errr in Failed Psitin Cases Range print tkens switch-case 6 [4-495] (565 LOC) 2 switch-case 43 [7-77] 4 cnstant 23 [7-29] 6 cnstant 43 [3-274] 7 predicate 28 [8-27] print tkens2 4 assignment 268 [2-394] (5 LOC) 5 return 67 [2-6] 6 parameter 329 [2-87] 7 predicate 58 [27-486] 8 predicate 94 [6-928] replace predicate 24 [2-2] (563 LOC) 3 predicate 3 [2-666] 6 lp cnditin 92 [2-69] 9 predicate 92 [2-69] 4 predicate 92 [3-49] 8 predicate 9 [2-38] 2 predicate 2 [8-4] 25 predicate 2 [3-] schedule 2 assignment 2 [2-38] (42 LOC) 4 predicate 267 [2-39] 7 added cde 2 [2-4] schedule2 5 added cde 32 [5-28] (37 LOC) 6 cnstant 2 [-8] 7 predicate 2 [2-6] gzip predicate 6 [9-9] (799 LOC) flex 4 cnstant 2 [ ] (248 LOC) 5 cnstant 257 [73-956] 7 cnstant 97 [ ] array index 6 [ ] predicate 53 [ ] 5 cnstant 55 [ ] 7 cnstant 35 [ ] 9 cnstant 343 [ ] able. Characteristics f benchmarks f unique statements in them (nte that ne unique statement may get executed many times and result in many ndes in DDG). We als present the fault lcatin effectiveness in clumn Errr In. Here I, X, and D indicate the presence f errneus statement in PDS min, PDS max, and DS respectively. he results are als summarized by taking averages acrss different versins f each benchmark in able 4. Frm these tw tables, we make the fllwing bservatins: () he cnfidence analysis greatly reduces the size f dynamic slice withut sacrificing the fault lcatin effectiveness. able 4 shws the average factr by which PDS max is smaller than DS ranges frm 4.3 t (all) and.79 t 9.57 (distinct). Fr flex, the slices are s precisely reduced that they simply cntain the chain f dependences frm the errneus statement t the incrrect utput this chain includes nly a few statements. (2) Fr mst f the versins, we used three runs and studied the relatin between the pruning capability and the number f crrect utputs. he abslute sizes f the P DSs appear t be independent f the number f crrect utputs. Hwever, the reductins in the sizes f PDSs with respect t the sizes f DSs increase as the number f crrect utputs grw because f the increases in the sizes f DSs. (3) We bserve that the fault lcatin effectiveness f PDS max is very gd. Even thugh it is much smaller than DS, nly in ne case the errneus statement is remved during pruning this happened in replace versin v9 run r2. Fig. 8 explains hw this happened. In this run, statement i = i + is wrng such that D is assigned t the wrng psitin in array pat. Hwever, statement return flag is verified and thus flag=true; is verified, which means the predicate is crrect. Since the predicate represents a ne-t-ne mapping t its perand when it evaluates t true, pat[j] cntains the crrect value D. Accrding t ur analysis, the stre t pat[i] will get verified and s will the wrng index. As is illustrated in the right hand side f Fig. 8, pat[j] being crrect is the result f bth array pat and j being wrng. fectiveness f pruning in such cases. First, cde missin faults are present in sme versins. Since such faults are nt even captured in the static slice f the utput, they cannt be caught by any dynamic slicing algrithm. Secnd, it is knwn that the dynamic slice f the incrrect utput des nt always include the errneus statement executed. his can happen when the errneus utput is prduced due t an incrrect evaluatin f a branch predicate causing the executin f sme statements t be incrrectly bypassed. his situatin can be handled by cnstructing an expanded dynamic slice called the relevant slice [6, 27]. While in ur experiments we mit such cases, later we shw hw they can be handled by extending ur technique.! " # " $ % Figure 8. Replace versin v9 run r2 3.2 Cnfidence-based Pruning Since fr sme faulty versins there are many test inputs, and sme f these may nt differ much in their behavir, fr each faulty versin we selected three test inputs such that varying number f crrect utputs are generated befre the incrrect utput is prduced. Whenever pssible, we selected three runs such that the wrng utput was bserved at: the lwer bund f psitin range in the first run; clsest t the middle f psitin range in the secnd run; and at the upper bund f psitin range in the third run. Fr each run, we first cmputed the dynamic slice f the wrng utput and then pruned the slice using cnfidence analysis. We present six numbers abut the slice sizes in ables 2 and 3. All.PDS min, All.PDS max, and All.DS represent the number f DDG ndes in PDS min, PDS max, and DS. he crrespnding distinct numbers (D.PDS min, D.PDS max, and D.DS) dente the number (4) Let us cmpare PDS max with PDS min. Althugh PDS min wrks fr a large number f test cases, we did bserve that in several cases, such as replace v, v3, v9, v2 and schedule v7, it prunes the errneus statement while PDS max des nt d s. On the ther hand, PDS max wrks almst equally well fr the cases in which PDS min als wrks. As shwn in able 4, when the errneus statement is captured in bth PDS max and PDS min, crrespnding t the IX clumns, PDS max/pds min is rughly ne, i.e. their sizes are nearly the same (the entries marked NA are nes where there were n slices in that categry). hus, using cnfidence analysis t btain PDS max is an effective methd fr bth pruning the slice and maintaining the fault lcatin effectiveness. (5) In sme cases such as flex v5, part f the wrng utput appears t be crrect which may cause sme cnfusin. Fr example, flex v5 has the errr f printf ( YY USER ACION ) missing a

8 Benchmark Versin Wrng Output Ps. (All.PDS min -All.PDS max)/all.ds (D.PDS min -D.PDS max)/d.ds Errr In print tkens 4 (3-3)/72 (4-4)/72 IXD 3 (239-24)/4582 (4-4)/86 IXD 495 (37-37)/363 (4-4)/34 IXD 2 7 (7-7)/429 (9-9)/6 IXD 23 (68-69)/365 (8-8)/86 IXD 77 (7-7)/4458 (9-9)/49 IXD 4 7 ( )/63 (4-4)/69 IXD 9 (22-22)/965 (35-35)/92 IXD 26 ( )/2853 (43-43)/4 IXD 6 3 (457-47)/84 (44-44)/7 IXD 9 (24-24)/993 (35-35)/97 IXD 274 ( )/6665 (36-36)/45 IXD 7 8 () (399-4)/698 (4-4)/74 IXD 92 () ( )/486 (4-4)/94 IXD 27 () (39-39)/27274 (37-37)/36 IXD print tkens2 4 2 (74-74)/92 (4-4)/99 IXD 47 ( )/56 (5-5)/95 IXD 394 (77-77)/8364 (44-44)/38 IXD 5 2 ( )/85 (58-58)/97 IXD 79 ( )/3 (59-59)/9 IXD 6 ( )/2784 (56-56)/54 IXD 6 2 (28-28)/68 (6-6)/95 IXD 34 (28-28)/77 (6-6)/97 IXD 87 (28-28)/862 (6-6)/43 IXD 7 27 ( )/29 (59-6)/96 IXD 75 ( )/4 (53-53)/83 IXD 486 (5-5)/63 (67-67)/48 IXD 8 6 () ( )/29 (59-59)/ IXD 63 (377-46)/676 (48-5)/5 IXD 928 (367-43)/2738 (48-5)/5 IXD replace 2 (92-494)/222 (38-77)/47 XD 9 (24-46)/625 (53-8)/3 XD 2 (79-48)/687 (44-64)/28 XD 3 2 (6-67)/2 (32-86)/36 IXD 8 (89-89)/997 (2-2)/55 IXD 666 (7-868)/8522 (3-45)/25 XD 6 2 (37-78)/66 (45-62)/36 IXD 9 (26-648)/229 (28-5)/32 IXD 69 (325-65)/2525 (46-49)/53 IXD 9 2 (8-357)/889 (4-6)/5 XD 26 (2) (48-243)/347 (8-42)/25 D 4 3 ( )/87 (55-88)/38 IXD 9 (6-689)/255 (73-7)/6 IXD 49 (3-2)/32 (23-28)/ IXD 8 2 (6-7)/669 (26-27)/9 IXD 35 (52-52)/445 (37-37)/43 IXD 38 (94-94)/2588 (37-37)/27 IXD 2 8 (39-78)/2372 (53-86)/32 XD 4 (52-783)/35 (42-59)/2 XD 25 3 (32-53)/975 (55-78)/2 IXD (45-552)/2952 (72-84)/65 IXD schedule 2 2 ( )/46 (65-66)/93 IXD (62-623)/255 (69-69)/8 IXD 38 ( )/676 (55-55)/9 IXD 4 2 ( )/265 (88-98)/9 IXD (25-29)/255 (85-89)/7 IXD 7 2 ( )/726 (67-68)/9 IXD 6 (83-284)/24 (24-65)/5 XD 4 (84-33)/246 (24-59)/97 XD schedule2 5 5 (52-52)/823 (64-64)/83 IXD 4 (95-95)/2594 (34-34)/73 IXD 28 ( )/5639 (6-6)/79 IXD 6 (23-23)/6 (4-4)/67 IXD 8 ( )/2526 (42-42)/67 IXD 7 2 (8-45)/696 (27-36)/67 IXD 6 (3-29)/287 (25-27)/94 IXD 6 (693-79)/33 (59-6)/84 IXD (). Part f the wrng utput appeared t be crrect; (2). he rt cause was pruned. able 2. Pruning effectiveness results f faulty versins fr up t three test inputs.

9 Benchmark Versin Wrng Output Ps. (All.PDS min -All.PDS max)/all.ds (D.PDS min -D.PDS max)/d.ds Errr In gzip 9 ( )/69949 (-2)/357 XD flex () (3-4)/62235 (7-8)/692 IXD 9825 () (6-7)/42823 (9-9)/648 IXD 539 () (3-4)/2244 (7-8)/889 IXD 5 73 (7-76)/23292 (6-8)/542 IXD 8925 (4-4)/899 (3-3)/68 IXD 956 (4-4)/595 (3-3)/79 IXD ( )/22886 (27-229)/28 IXD 742 (76-86)/842 (9-23)/73 IXD 8925 () (74-75)/2249 (7-8)/786 IXD 6867 (5-5)/5756 (-)/8 IXD 692 (5-5)/39484 (-)/552 IXD (5-5)/ (-)/72 IXD () (7-7)/32 (4-4)/824 IXD 692 () (7-7)/72756 (4-4)/988 IXD () (96-96)/2987 (9-9)/94 IXD (-)/2293 (-)/632 IXD 584 (-)/8655 (-)/83 IXD 567 (-)/8733 (-)/864 IXD () (35-54)/3229 (6-2)/764 IXD 2955 () (35-35)/9833 (6-6)/947 IXD 6777 () (32-33)/3822 (5-6)/98 IXD (). Part f the wrng utput appeared t be crrect; able 3. Pruning effectiveness results f faulty versins fr up t three test inputs. Benchmark (All.PDS min All.PDS max)/ (D.PDS min D.PDS max) All.DS/ D.DS/ All.DS D.DS All.PDS max D.PDS max print tkens (34-345)/32 (35-35)/ print tkens2 ( )/6543 (55-55)/ replace (3-546)/42 (43-6)/ schedule ( )/388 (56-7)/ schedule2 (562-63)/2358 (5-58) gzip ( )/69949 (-2)/ flex (232-24)/ (25-27) Benchmark All.PDS max/all.pds min D.PDS max/d.pds min IX X IX X print tkens. NA NA print tkens2. NA. NA replace schedule schedule2.54 NA.29 NA gzip NA NA 2. flex.5 NA.4 NA able 4. Summary f results acrss all versins. Nrmalized PDS Size Replace V R3 Errr cntained All Distinct Nrmalized PDS Size Replace V2 R2 Errr cntained All Distinct Nrmalized PDS Size Schedule V7 R2 All Errr cntained Distinct Cnfidence Cnfidence Cnfidence Figure 9. Pruned dynamic slice fr varying threshld (versin Vi run Rj).

10 \n at the end f the string. If we assume the YY USER ACION is crrect, the wrng printf will get verified. slve this prblem, we divide the utput int units, which is lines in this case, and cmpute slice n the first character f the wrng unit. Interactive Pruning. It is pssible that PDS max is still quite big. Hwever, pruning can be further carried ut during debugging. During the curse f debugging the prgrammer usually investigates the values in gdb and decides if they are crrect r wrng. his infrmatin can be fed back t ur cnfidence analysis t enable further pruning. Similarly, the user can als lk at the slice and tell ur system if certain values seem t be crrect. We cnducted an experiment trying t simulate this prcedure. We picked replace versin v4, ne f whse three prunings (the third run) is quite successful and s we are able t understand the relatin frm the errr t the wrng utput. We use the mst cnservative pruned slice in the third run, PDS 3 max, as a reference when we start examining the PDS max f the first run. We find the first statement which is in PDS max but nt in PDS 3 max and mark it as crrect in ur system. PDS max is further pruned t 587/74 (all/distinct) frm 656/88. After anther tw interactins, we are able t reduce it t 93/23, which is very clse t dependence chain alng which errr is prpagated. We als tried the same experiment with replace v3 we used the secnd run as a reference t prune the first run and fund that in nly ne step, we reduce the slice frm 67/86 (all/distinct) t 33/5 and it still cntained the errr. Varying threshld. S far we have been lking at either PDS min r PDS max. In this experiment, we study the relatinship between the threshld τ and the crrespnding PDS τ s size and its fault lcatin effectiveness. he results fr three different runs are pltted in Fig. 9. As we expected, the PDS τ drps in bth size and fault lcatin effectiveness as τ decreases. Hwever, we did nt bserve the existence f a value f τ that nicely balances between the size and the fault lcatin effectiveness. 3.3 Cnfidence-based Priritizatin In the preceding sectin we explred the use f cnfidence values t carry ut pruning f the dynamic slice. We bserved that the mst effective pruning strategy is ne in which nly the statements with cnfidence values f are pruned frm the dynamic slice t prduce PDS max. In this sectin we study an additinal use f cnfidence values. he statements in PDS max are priritized in the rder f increasing cnfidence values. lcate faulty cde, the statements are then examined by the prgrammer in the rder f increasing cnfidence values till the faulty cde is encuntered. he effectiveness f this strategy is measured in terms f the percentage f executed statements that are examined by the user befre encuntering the faulty cde. In prir wrk we have shwn that an effective strategy fr explring dynamic slices t lcate the faulty cde is t examine the statements in the dynamic slice in increasing rder f their dependence distance frm the pint at which the errneus value is encuntered during a failed run [27, 28]. We cnducted an experiment in which we cmpared the effectiveness f the tw strategies: explring dynamic slice in rder f increasing dependence distances (DD); and explring pruned dynamic slice PDS max in the rder f increasing cnfidence values (CV). When using the cnfidence value based strategy, if tw statements with same cnfidence value are present, then the dependence distance is used as the tie-breaker. he results f this experiment are given in Figure. Fr a given pint in each graph, the y-axis represents the fractin f faults lcated while the x-axis represents the percentage f executed statements examined t lcate these faults. he results are fr the same failed runs that were used in the experiments presented in the preceding sectin. As we can bserve, fr a given percentage f executed statements examined, typically the fractin f faults that are lcated is higher fr CV in cmparisn t DD. It shuld be nted that there are ther wrks (e.g., [2, 4]) that emply statistical analysis t priritize statements fr fault lcatin. Hwever, these techniques perfrm priritizatin based upn dynamic infrmatin cllected frm multiple prgram runs. As far as we knw, ur technique is the nly ne that perfrms priritizatin f statements based upn dynamic infrmatin cllected frm a single failed run. 3.4 Relevant Slicing It is knwn that a dynamic slice may nt be able t capture the errr even thugh the wrng utput is actually caused by the errr [6]. Figure gives such an example. It is taken frm versin v3 run r f gzip. he errr is in the assignment t save rig name. he crrect cde is save rig name=!n name. Since save rig name cntains the wrng value False, branch S3 is nt taken and thus flags has the wrng value while it shuld have been defined as ORIG NAME at S3. his wrng flags value is finally prpagated t the utput file. he dynamic slice DS f the wrng utput des nt cntain the errr because S4 depends n S2. he fact that S4 culd have had a different value if S3 had taken the ther branch cannt be captured by dynamic slicing technique itself.!"#$%&' ()*+)),,-./))*) 4))23 2)23 Figure. Gzip versin v3 run r One prpsed slutin is t intrduce ptential dependence [6] between S4 and S3 such that S is reachable frm the wrng utput. Hwever, these ptential dependence edges are intrduced fr each nde in the DDG which can result in a much larger slice. In ur example, the cmputed slice has the size f 8977/348 (all/distinct). Being presented with even a larger slice than this may nt be appreciated by the prgrammer. With ur cnfidence analysis, we are able t select a mre reasnable strategy. Even thugh the pruned slice may nt capture the errneus statement, it des capture a part f the dependence chain frm the errneus statement t the incrrect utput. If the pruned slice is small enugh, the prgrammer is able t inspect the entire pruned slice and determine the errr is nt present. Next the prgrammer can request fr expansin f the pruned slice using the ptential dependence f the rt f the dependence chain in the pruned dynamic slice. his apprach results in a small increase in the size f the pruned dynamic slice and als appears t be quite effective. In ur example, the PDS max has the size f 5/6 (all/distinct). It takes just secnds t figure ut that the chain in PDS max that shuld be expanded is S4 S5. By adding the ptential dependence fr the rt f S4, which is S3 here, the errr is reachable by just ne dependence edge. In ther wrds, with cnfidence analysis, the prgrammer is able t search fr the errneus statement by cnsidering ptential dependences in a demand-driven fashin. he prgrammer nly asks fr ptential dependences after explring the pruned dynamic slice.

11 Print_tkens Print_tkens2 Replace 2 CV DD.2 CV DD 2 CV DD Faults detected (%) Faults detected (%) Faults detected (%) Executed statements examined (%) Executed statements examined (%) Executed statements examined (%).2 Schedule CV DD.2 Schedule2 CV DD.2 Flex CV DD Faults detected (%) Faults detected (%) Faults detected (%) Executed statements examined (%) Executed statements examined (%) Executed statements examined (%) Figure. Lcating fault by examining statements in increasing rder f cnfidence values. 4. Related Wrk Dynamic Slicing: Dynamic slicing was intrduced as an aid t debugging [3, ]. Our recent wrks [24, 25] have greatly reduced the space and time cst f dynamic slicing. In [27], we evaluated the effectiveness f backward dynamic slices in fault lcatin. Our result shwed that even thugh dynamic slices can capture the faulty cde, identifying the faulty cde frm the set f statements in the slice still requires nn-trivial human effrt. We first narrwed the scpe f ptentially faulty cde in [5] by, fr the first time, using frward dynamic slices f failure-inducing input difference. We further narrwed the scpe f ptentially faulty cde in [28] by identifying bidirectinal dynamic slices f critical predicates. he intersectin f backward, frward, and bidirectinal slices yielded the Bidirectinal Chp which was ur smallest estimate f ptentially faulty cde. he abve prir wrk is based upn identifying multiple kinds f negative evidence, i.e. prgram entities related t the executin f faulty cde. In cntrast, in this paper, we have demnstrated the use f psitive evidence in frm f crrect prtins f the utput prduced during a failing run t reduce the scpe f ptentially faulty cde. While ur prir techniques carried ut carse-grained pruning f ptentially faulty cde by intersecting different dynamic slices, the technique presented in this paper represents a fine-grained pruning f the backward dynamic slice. Mrever, cnfidence analysis is als useful in priritizing the ptentially faulty statements which was nt pssible using ur prir techniques. he cnfidence based apprach we have presented analyzes bth the prgram state (i.e., values f variables at varius prgram pints) and the relatinships amng the values (i.e., prgram dependences). Analysis f prgram state in cnjunctin with dependences is the reasn why ur apprach is s effective. As we saw, dynamic dicing [3] (PDS min) is nt always effective. his is because while it analyzes dynamic dependences, it des nt carefully cnsider the prgram state. Delta Debugging: In a series f articles [22, 2, 2], the delta debugging algrithm has been develped t autmatically simplify r islate a failure-inducing input [22, 2], prduce cause effect chains [2] and t link cause transitins [4] t the faulty cde. In [4] delta debugging algrithm is used t analyze prgram state changes during the executin f a failed run t identify pints f cause transitins. Cde executed at the pints f cause transitins is expected t be relevant t the fault. Cmparing and changing memry states f C prgram executins at a pint is difficult due t pinters [4]. In additin, t identify pints f cause transitins, the abve state-based analysis has t be perfrmed at a large number f pints alng the failed run. herefre, prgram state based analysis is difficult and time cnsuming fr C prgrams [4]. In cmparisn ur apprach is inexpensive in terms f time taken. Statistical Appraches: A number f statistical appraches that analyze prgram spectra f prgram runs fr multiple inputs, including inputs crrespnding t bth failed and successful runs, are being emplyed fr fault lcatin. Harrld et al. [8] cmpared the spectra f passing and failing runs and fund that failing runs tend t have unusual cverage spectra. Jnes et al. [2] ranked each statement accrding t its rati f failing tests t crrect tests and used this infrmatin t assist fault lcatin. Liblit et al. [4] describe a sampling framewrk and present an apprach t guess and eliminate predicates t islate a deterministic bug. Fr islating nndeterministic bugs, they use statistical regressin techniques t identify predicates that are highly crrelated with the prgram failure. In cntrast, Renieris and Reiss [7] fcused n the difference between the failing run and a single passing run with similar spectra as a means t narrw dwn the search space fr faulty cde. Our wrk differs frm the abve wrk in significant ways. First, it fcuses n a single failed run crrespnding t a single input fr fault lcatin. It is able t priritize the ptentially faulty statements using cnfidence analysis based upn a single run while the abve techniques require multiple runs. Secnd, an advantage f ur apprach is that it prvides dependence relatinships between the faulty cde (i.e., the cause) and the errneus utput (i.e., the effect). his infrmatin is very useful during debugging. Other Wrks: Sme additinal wrks include the fllwing. Xie et al. shw that many redundancies [9] in prgrams crrespnd t hard prgram errrs. Hangal et al. [7] identified the causes f