Learning objectives Understand goals and implications of finite - PowerPoint PPT Presentation

Learning objectives • Understand goals and implications of finite state abstraction • Learn how to model program control flow with Finite Models graphs • Learn how to model the software system structure with call graphs • Learn how to model finite state behavior with finite state machines (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 1 (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 2 Properties of Models Graph Representations: directed graphs • Compact : representable and manipulable in a reasonably compact • Directed graph: form – N (set of nodes) – What is reasonably compact depends largely on how the model will be used – E (relation on the set of nodes ) edges • Predictive : must represent some salient characteristics of the modeled artifact well enough to distinguish between good and bad outcomes of analysis – no single model represents all characteristics well enough to be useful for all kinds of analysis Nodes: {a, b, c} a • Semantically meaningful : it is usually necessary to interpret Edges: {(a,b), (a, c), (c, a)} b a c analysis results in a way that permits diagnosis of the causes of failure b c • Sufficiently general : models intended for analysis of some important characteristic must be general enough for practical use in the intended domain of application (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 3 (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 4

Graph Representations: labels and code Multidimensional Graph Representations • Sometimes we draw a single diagram to • We can label nodes with the names or descriptions of the entities they represent. represent more than one directed graph, drawing the shared nodes only once – If nodes a and b represent program regions containing assignment statements, we might draw the two nodes and an – class B extends (is a subclass of) class A edge (a,b) connecting them in this way: – class B has a field that is an object of type C extends relation a x = y + z; NODES = {A, B, C} EDGES = {(A,B)} includes relation a = f(x); b c NODES = {A, B, C} EDGES = {(B,C)} (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 5 (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 6 Finite Abstraction of Behavior (Intraprocedural) Control Flow Graph an abstraction function suppresses some details of program execution • nodes = regions of source code (basic blocks) – Basic block = maximal program region with a single entry and single exit point – Often statements are grouped in single regions to get a compact model – Sometime single statements are broken into more than one � node to model control flow within the statement it lumps together execution states that differ with respect to the • directed edges = possibility that program execution suppressed details but are otherwise identical proceeds from the end of one region directly to the beginning of another (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 7 (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 8

Example of Control Flow Graph Linear Code Sequence and Jump (LCSJ) Essentially subpaths of the control flow graph from one public static String collapseNewlines (String argStr) public static String collapseNewlines(String argStr) branch to another { { b2 char last = argStr.charAt(0); char last = argStr.charAt(0); StringBuffer argBuf = new StringBuffer(); StringBuffer argBuf = new StringBuffer(); for (int cIdx = 0 ; b1 public static String collapseNewlines (String argStr) From Sequence of basic blocs To for (int cIdx = 0 ; cIdx < argStr.length(); cIdx++) cIdx < argStr.length(); b3 { b2 char last = argStr.charAt(0); { Entry b1 b2 b3 jX False True StringBuffer argBuf = new StringBuffer(); char ch = argStr.charAt(cIdx); for (int cIdx = 0 ; b4 { if (ch != '\n' || last != '\n') Entry b1 b2 b3 b4 jT char ch = argStr.charAt(cIdx); if (ch != '\n' { cIdx < argStr.length(); b3 Entry b1 b2 b3 b4 b5 jE argBuf.append(ch); False True True False jX last = ch; b4 || last != '\n') b5 { Entry b1 b2 b3 b4 b5 b6 b7 jL char ch = argStr.charAt(cIdx); } True if (ch != '\n' } { False True jX b8 ret b6 argBuf .append(ch); jT || last != '\n') b5 last = ch; } jL b3 b4 jT return argBuf.toString(); True jE { } False b6 argBuf .append(ch); jL b3 b4 b5 jE } last = ch; b7 } cIdx++) False jL b3 b4 b5 b6 b7 jL } b7 cIdx++) b8 return argBuf.toString(); } jL b8 return argBuf.toString(); } (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 9 (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 10 Interprocedural control flow graph Overestimating the calls relation The static call graph includes calls through dynamic • Call graphs bindings that never occur in execution. – Nodes represent procedures public class C { • Methods public static C cFactory(String kind) { if (kind == "C") return new C(); • C functions if (kind == "S") return new S(); return null; } • ... void foo() { System.out.println("You called the parent's method"); – Edges represent calls relation } public static void main(String args[]) { (new A()).check(); } A.check() } class S extends C { void foo() { System.out.println("You called the child's method"); } } class A { void check() { C myC = C.cFactory("S"); C.foo() S.foo() CcFactory(string) myC.foo(); } } (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 11 (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 12

Contex Insensitive Call graphs Contex Sensitive Call graphs public class Context { public class Context { public static void main(String args[]) { public static void main(String args[]) { Context c = new Context(); Context c = new Context(); c.foo(3); c.foo(3); main main c.bar(17); c.bar(17); } } void foo(int n) { void foo(int n) { int[] myArray = new int[ n ]; int[] myArray = new int[ n ]; depends( myArray, 2) ; depends( myArray, 2) ; C.foo C.bar C.bar(17) } } C.foo(3) void bar(int n) { void bar(int n) { int[] myArray = new int[ n ]; int[] myArray = new int[ n ]; depends( myArray, 16) ; depends( myArray, 16) ; } } C.depends C.depends(int ! 3),a,2) C.depends (int ! 3),a,2) void depends( int[] a, int n ) { void depends( int[] a, int n ) { a[n] = 42; a[n] = 42; } } } } (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 13 (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 14 Context Sensitive CFG Finite state machines exponential growth • finite set of states (nodes) • set of transitions among states (edges) A 1 context A Graph representation (Mealy machine) Tabular representation B C LF_ Other char apend emit LF_ 2 contexts AB AC emit LF CR EOF other D E e w Emty Within buffer line e e/emit e/emit d/- w/append Other char 4 contexts ABD ABE ACD ACE append F G w e/emit e/emit d/emit w/append Other char CR_ append EOF LF emit emit CR_ l e/- d/- w/append 8 contexts … emit H I l d Looking for Done optional DOS LF EOF 16 calling contexts … EOF J (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 15 (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 16

Using Models to Reason about System Abstraction Function Properties (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 17 (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 18 Summary • Models must be much simpler than the artifact they describe to be understandable and analyzable • Must also be sufficiently detailed to be useful • CFG are built from software • FSM can be built before software to documentintended behavior (c) 2007 Mauro Pezzè & Michal Young Ch 5, slide 19