There has recently been a great deal of interest in search– based test data generation, with many local and global search algorithms being proposed. However, to date, there has been no investigation of the relationship between the size of the input domain (the search space) and performance of search–based algorithms. Static analysis can be used to remove irrelevant variables for a given test data generation problem, thereby reducing the search space size. This paper studies the effect of this domain reduction, presenting results from the application of local and global search algorithms to real world examples. This provides evidence to support the claim that domain reduction has implications for practical search–based test data generation.

Buffer overflows cause serious problems in different categories of software systems. For example, if present in network or security applications, they can be exploited to gain unauthorized grant or access to the system. In embedded systems, such as avionics or automotive systems, they can be the cause of serious accidents. This paper proposes to combine static analysis and program slicing with evolutionary testing, to detect buffer overflow threats. Static analysis identifies vulnerable statements, while slicing and data dependency analysis identify the relationship between these statements and program or function inputs, thus reducing the search space. To guide the search towards discovering buffer overflow in this work we define three multi-objective fitness functions and compare them on two open-source systems. These functions account for terms such as the statement coverage, the coverage of vulnerable statements, the distance form buffer boundaries and the coverage of unconstrained nodes of the control flow graph.

A dependence cluster is a set of program statements, all of which are mutually inter-dependent. This paper reports a large scale empirical study of dependence clusters in C program source code. The study reveals that large dependence clusters are surprisingly commonplace. Most of the 45 programs studied have clusters of dependence that consume more than 10 % of the whole program. Some even have clusters consuming 80 % or more. The widespread existence of clusters has implications for source code analyses such as program comprehension, software maintenance, software testing, reverse engineering, reuse, and parallelization.

This paper presents results from a study of techniques that improve the performance of graphbased interprocedural slicing of the System Dependence Graph (SDG). This is useful in “massive slicing ” where slices are required for many or all of the possible set of slicing criteria. Several different techniques are considered, including forming strongly connected components, topological sorting, and removing transitive edges. Data collected from a test bed of just over 1,000,000 lines of code are presented. This data illustrates the impact on computation time of the techniques. Together, the best combination produces a 71 % reduction in run-time (and a 64 % reduction in memory usage). The complete set of techniques also illustrates the point at which faster computation is not viable due to prohibitive preprocessing costs.

A Dependence Anti Pattern is a dependence structure that may indicate potential problems for on–going software maintenance and evolution. Dependence anti patterns are not structures that must always be avoided. Rather, they denote warnings that should be investigated. This paper defines a set of dependence anti patterns and presents a series of case studies that show how these patterns can be identified using techniques for dependence analysis and visualization. The paper reports the results of this analysis on six real world programs, two of which are open source and four of which are part of production code in use with Daimler. 1

This paper introduces an approach to locating dependence structures in a program by searching the space of the powerset of the set of all possible program slices. The paper formulates this problem as a search based software engineering problem. To evaluate the approach, the paper introduces an instance of a search based slicing problem concerned with locating sets of slices that decompose a program into a set of covering slices that minimize inter-slice overlap. The paper reports the result of an empirical study of algorithm performance and result-similarity for hill climbing, genetic, random search and greedy algorithms applied to a set of 12 C programs.

This paper presents results of a study of the effect of global variables on the quantity of dependence in general and on the presence of dependence clusters in particular. The paper introduces a simple transformation–based analysis algorithm for measuring the impact of globals on dependence. It reports on the application of this approach to the detailed assessment of dependence in an empirical study of 21 programs consisting of just over 50K lines of code. The technique is used to identify global variables that have a significant impact upon program dependence and to identify and characterize the ways in which global variable dependence may lead to dependence clusters. In the study, over half of the programs include such a global variable and a quarter have one that is solely responsible for a dependence cluster.

Change impact analysis, i.e., knowing the potential consequences of a software change, is critical for the risk analysis, developer effort estimation, and regression testing of evolving software. Static program slicing is an attractive option for enabling routine change impact analysis for newly committed changesets during daily software build. For small programs with a few thousand lines of code, static program slicing scales well and can assist precise change impact analysis. However, as we demonstrate in this paper, static program slicing faces unique challenges when applied routinely on large and evolving industrial software systems. Despite recent advances in static program slicing, to our knowledge, there have been no studies of static change impact analysis applied on large and evolving industrial software systems. In this paper, we share our experiences in designing a static change impact analysis framework for such software systems. We have implemented our framework as a tool called Imp and have applied Imp on an industrial codebase with over a million lines of C / C++ code with promising empirical results.

This paper addresses the question: "How can animated visualisation be used to express interesting properties of static analysis?" The particular focus is upon static dependence analysis, but the approach adopted in the paper is applicable to other forms of static analysis. The challenge is twofold. First, there is the inherent difficultly of using animation, which is inherently dynamic, as a representation of static analysis, which is not. The paper shows one way in which this apparent contradiction can be overcome. Second, there is the harder challenge of ensuring that the animations so-produced correspond to features of genuine interest in the source code that are hard to visualize without animation.