Program Analysis

1
Program Analysis

• CS2335
• Summer 2003

2
Agenda

• TA Application start 7July
• Control Flow Graphs
• Data Flow Graphs
• McCabe Measure
• Halstead Measure

3
Why do Program Analysis?

• Select Test Cases for whitebox (structural)
  testing
• Estimate Complexity of modules (McCabe)
• Estimate Errors (Halstead)

4
Control Flow Graphs
Graphical Representation of the programs control
structure as a directed graph. Basic Block
sequence of instructions with no branching.
Single entry and exit. Decision point at which
control flow can diverge. Junction point at
which control flow can merge Control Flow Graph
is NOT a flowchart
5
Constructs
X7 y9 Zx5 y5
1-13
Basic Block
T
if
if (xgt54) y9 z5x4
F
31
If then block
32-35
if (xgt54) y9 else y0 x9 z5x4
F
T
if
28
29-30
32-35
If then else block
6
Constructs
Switch/Case
Switch (ch) case a
handleMessage(ACTION) break case q
quit() break default
unknownMessage() break
for (i9ilt50i) arrayi0 Zarray10
7
Sample 1
1 int main(int argc, char argv) 2 int x, y 3
if (argclt4) 4 usage() 5 exit(-1) 6 7
xatoi(argv1) 34 8 for (y0ylt5y) 9
yxargv2 10 11
8
Sample 2
1 INPUT X,Y 2 ZXY 3 VX-Y 4 IF Zgt 0 GOTO
SAM 5 JOE ZZ-1 6 SAM ZZV 7 FOR U0 TO Z 8
V(U),U(V)(ZV)U 9 IF V(U)0 GOTO JOE 10
ZZ-1 11 IF Z0 GOTO ELL 12 UU1 13 NEXT U 14
V(U-1)V(U1)U(V-1) 15 ELL V(UU(V))UV 16
IF UV GOTO JOE 17 IF UgtV THEN UZ 18 ZU 19 END
9
Data Flow Graph

• Annotate a CFG with data info
• d defined, created, initialized
• k killed, undefined, released
• u used for something
• c used in a calculation
• p used in a predicate

10
Sample 1 (Data)
d
d
1-2
p
1 int main(int argc, char argv) 2 int x0int
y5 3 if (argclt4) 4 usage() 5
exit(-1) 6 7 xatoi(argv1) 34 8 for
(y0ylt5y) 9 yxargv2 10 11
if
4-5
d
7
for
c
9
Bold argc Italics x Normal y
11
11
Sample (Data)
d
d
1 INPUT X,Y 2 ZXY 3 VX-Y 4 IF Zgt 0 GOTO
SAM 5 JOE ZZ-1 6 SAM ZZV 7 FOR U0 TO Z 8
V(U),U(V)(ZV)U 9 IF V(U)0 GOTO JOE 10
ZZ-1 11 IF Z0 GOTO ELL 12 UU1 13 NEXT U 14
V(U-1)V(U1)U(V-1) 15 ELL V(UU(V))UV 16
IF UV GOTO JOE 17 IF UgtV THEN UZ 18 ZU 19 END
p
c
c
c
d
p
c
c
c
p
c
p
p
c
c
Bold V Italics Z
12
McCabes Measure

• Based on idea that complexity is caused by
  complex control flow
• Maximum complexity for a quality routine is 10
• Three ways to compute
• Number of Predicates 1
• Edges-Nodes2 from CFG
• Number of Regions in CFG

13
Sample 1
Edges 8 Nodes 7 Complexity 8-72 3
Region 1
Complexity 3
Region 2
Region 3
2 predicates argclt4, ylt5 Complexity 2 1
3
14
Sample 2
Edges 23 Nodes 17 Complexity 23 17
2 7
6 Predicates 1 7
7 Regions
15
Halsteads Complexity Measure

• Complexity is based on tokens in language and
  variables
• n1 of distinct operators (keywords)
• n2 of distinct operands (data objects)
• N1 Program operator count
• N2 Program operand count
• Paired operators count as one (do while)

16
Measures
H n1 log2 n1 n2 log2 n2 AKA Program Length
Note can estimate BEFORE code written Bugs
(N1 N2) log2 (n1 n2 )
3000
17
Sample 1
n1 19 n2 14 N1 50 N2 26
1 int main(int argc, char argv) 2 int x0int
y5 3 if (argclt4) 4 usage() 5
exit(-1) 6 7 xatoi(argv1) 34 8 for
(y0ylt5y) 9 yxargv2 10 11
H19 log2 19 14 log2 14134.01
B(5026) log2 (1915)/3000 .13
18
Practice
protected void getValues()
enableSemanticsOutput.setSelected(getShowSemantics
()) latexStyle.setSelected(Semant
ics.texMode) pseudoCode.setSelect
ed(!Semantics.texMode)
19
final public boolean Annotation() throws
ParseException boolean b switch
((jj_ntk-1)?jj_ntk()jj_ntk) case NOT
case INOT case OPAR case ID b
BoolExpr() if ( !b ) return false
break default jj_la10 jj_gen
switch ((jj_ntk-1)?jj_ntk()jj_nt
k) case DELIM jj_consume_token(DELIM)
OutSignals() break default
jj_la11 jj_gen return
true throw new Error("Missing return
statement in function")
20
Next Up
Whitebox Testing