77
Dynamic Analysis Tudor Gîrba www.tudorgirba.com

Dynamic Analysis (EVO 2008)

Embed Size (px)

DESCRIPTION

I used this set of slides for a lecture I gave at the University of Bern.

Citation preview

Page 1: Dynamic Analysis (EVO 2008)

Dynamic Analysis

Tudor Gîrbawww.tudorgirba.com

Page 2: Dynamic Analysis (EVO 2008)
Page 3: Dynamic Analysis (EVO 2008)
Page 4: Dynamic Analysis (EVO 2008)
Page 5: Dynamic Analysis (EVO 2008)

Ball 1999

Dynamic analysis is the analysis of the properties of a running program

Page 6: Dynamic Analysis (EVO 2008)

Ball 1999

Dynamic analysis is the analysis of the properties of a running program

What properties?

Page 7: Dynamic Analysis (EVO 2008)

main()

Page 8: Dynamic Analysis (EVO 2008)

method()

Page 9: Dynamic Analysis (EVO 2008)

method2(param)

Page 10: Dynamic Analysis (EVO 2008)
Page 11: Dynamic Analysis (EVO 2008)
Page 12: Dynamic Analysis (EVO 2008)
Page 13: Dynamic Analysis (EVO 2008)
Page 14: Dynamic Analysis (EVO 2008)

Dynamic analysis offers precise information

Page 15: Dynamic Analysis (EVO 2008)

How to instrument

What to capture and why

How to model

What to execute

Page 16: Dynamic Analysis (EVO 2008)

How to instrument

Page 17: Dynamic Analysis (EVO 2008)

…public class BankAccount { private Money balance;

public void deposit(Money amount) { System.out.println(“deposit“); this.balance += money; }}

Page 18: Dynamic Analysis (EVO 2008)

import org.apache.log4j.Logger;…public class BankAccount { private Money balance;

public void deposit(Money amount) { logger.info(“deposit“); this.balance += money; }}

Page 19: Dynamic Analysis (EVO 2008)
Page 20: Dynamic Analysis (EVO 2008)

Method Wrappers and Aspects intervene before and after each interesting method

Page 21: Dynamic Analysis (EVO 2008)

Profilers probe the system

Page 22: Dynamic Analysis (EVO 2008)

3 + 4

pushConstant: 3 pushConstant: 4 popIntoTemp: 0 “put argument in temp 0”popIntoTemp: 1 “put receiver in temp 1” send: + “perform addition”returnTop

Page 23: Dynamic Analysis (EVO 2008)

Denker 2008

pushConstant: 3 pushConstant: 4 popIntoTemp: 0 "put argument in temp 0" popIntoTemp: 1 "put receiver in temp 1" pushLit: ##Transcript "start of inserted code"pushTemp: 1 "push receiver for

printing" send: asStringsend: show: pop "end of inserted code" pushTemp: 1 "rebuild the stack" pushTemp: 0send: +returnTop

3 + 4… insertBefore: 'Transcript show: <meta: #receiver>'

Page 24: Dynamic Analysis (EVO 2008)

Denker etal 2007

Message (+)

Receiver (3)

Arguments (4)

3 + 4

Page 25: Dynamic Analysis (EVO 2008)

Denker etal 2007

Message (+)

Receiver (3)

Arguments (4)

Message (+)

Receiver (3)

Arguments (4)

Transcript show: <meta: #receiver>before

3 + 4… insertBefore: 'Transcript show: <meta: #receiver>'

Page 26: Dynamic Analysis (EVO 2008)

How to instrument

Page 27: Dynamic Analysis (EVO 2008)

How to instrumentWhat to capture and why

Page 28: Dynamic Analysis (EVO 2008)
Page 29: Dynamic Analysis (EVO 2008)

Collecting Garbage is a Dynamic Analysis

Page 30: Dynamic Analysis (EVO 2008)

The Control Flow is the most common focus

Page 31: Dynamic Analysis (EVO 2008)

De Pauw etal 1998

Page 32: Dynamic Analysis (EVO 2008)

De Pauw etal 1998

Page 33: Dynamic Analysis (EVO 2008)

De Pauw etal 1998

Page 34: Dynamic Analysis (EVO 2008)

Kuhn, Greevy 2006

Trace Signals reveal similar execution traces

Page 35: Dynamic Analysis (EVO 2008)

De Pauw etal 1993

Inter Class Call Matrix shows how classescollaborate at runtime

Page 36: Dynamic Analysis (EVO 2008)

Ducasse etal 2004

Communication Interaction shows how classes collaborate at runtime

Page 37: Dynamic Analysis (EVO 2008)

How to instrumentWhat to capture and why

Page 38: Dynamic Analysis (EVO 2008)

How to instrumentWhat to capture and whyHow to model

Page 39: Dynamic Analysis (EVO 2008)
Page 40: Dynamic Analysis (EVO 2008)

0..1 *

sender

Activation

Page 41: Dynamic Analysis (EVO 2008)

0..1 *

sender

Method* 1

Class

*

1

Activation

Page 42: Dynamic Analysis (EVO 2008)

Eisenbarth etal 2003

A feature is an observable unit of behavior of a system triggered by the user

Page 43: Dynamic Analysis (EVO 2008)
Page 44: Dynamic Analysis (EVO 2008)

Feature 1 Feature 2 Feature n...

Page 45: Dynamic Analysis (EVO 2008)

0..1 *

sender

Method* 1

Class

*

1

Activation

Page 46: Dynamic Analysis (EVO 2008)

0..1 *

sender

Method* 1

Class

*

1

Activation

Feature

*

Page 47: Dynamic Analysis (EVO 2008)

Wilde, Scully 1995

Page 48: Dynamic Analysis (EVO 2008)

Wilde, Scully 1995

Page 49: Dynamic Analysis (EVO 2008)

Wilde, Scully 1995

Page 50: Dynamic Analysis (EVO 2008)

Wilde, Scully 1995

Software Reconnaissance identifieswhere features are implemented

Page 51: Dynamic Analysis (EVO 2008)

Zaidman, Demeyer 2004

Page 52: Dynamic Analysis (EVO 2008)

Greevy etal 2006

Feature Views show how features cover classes

addFolder addPage

Page 53: Dynamic Analysis (EVO 2008)

addFolder addPage

Page 54: Dynamic Analysis (EVO 2008)

Greevy etal 2007

Team Collaboration shows howauthors develop features

Page 55: Dynamic Analysis (EVO 2008)

How to instrumentWhat to capture and whyHow to model

Page 56: Dynamic Analysis (EVO 2008)

How to instrumentWhat to capture and whyHow to model

The runtime is more than method activations

Page 57: Dynamic Analysis (EVO 2008)
Page 58: Dynamic Analysis (EVO 2008)
Page 59: Dynamic Analysis (EVO 2008)

return

Page 60: Dynamic Analysis (EVO 2008)

field-read

return

Page 61: Dynamic Analysis (EVO 2008)

field-write

field-read

return

Page 62: Dynamic Analysis (EVO 2008)

field-write

field-read

return

return

Page 63: Dynamic Analysis (EVO 2008)

allocation

field-write field-read

parameterfield-read

return

return

Page 64: Dynamic Analysis (EVO 2008)

Lienhard 2009

Object Flow captures object aliases

Page 65: Dynamic Analysis (EVO 2008)

Lienhard 2009

Object Flow captures object aliases

Page 66: Dynamic Analysis (EVO 2008)

0..1 *

sender

Method* 1

Class

*

1

Activation

Feature

*

Page 67: Dynamic Analysis (EVO 2008)

Instance

0..1 *

sender

Method* 1

Class1*

*

1

Activation

Feature

*

Page 68: Dynamic Analysis (EVO 2008)

Alias

Instance

*0..1

0..1 *

sender

Method* 1

Class1*

*

1

Activationparent receiver

subject

creator

Feature

*

Page 69: Dynamic Analysis (EVO 2008)

Alias

Instance

*0..1

0..1 *

sender

Method* 1

Class1*

*

1

Attribute

1

Activationparent receiver

subject

ArgumentAlias TempAlias FieldAlias

creator

ReturnAlias

*

Feature

*

Page 70: Dynamic Analysis (EVO 2008)

Lienhard etal 2007

Object Flow shows how objects move

Page 71: Dynamic Analysis (EVO 2008)

Lienhard etal 2007

Object Dependencies reveal features dependencies

OpenConnect

Join ChannelSend Message

Page 72: Dynamic Analysis (EVO 2008)
Page 73: Dynamic Analysis (EVO 2008)

Liblit etal 2005

In 50% of the cases the execution stack contains

essentially no information about the bug’s cause

Page 74: Dynamic Analysis (EVO 2008)

Fierz 2008

Back in time debuggers remembermore than the current stack

Page 75: Dynamic Analysis (EVO 2008)

How to instrumentWhat to capture and whyHow to model

The runtime is more than method activations

Page 76: Dynamic Analysis (EVO 2008)

How to instrumentWhat to capture and whyHow to modelWhat to execute

The runtime is more than method activations