Slicing using frama-c

Question

I'm using frama-c in order to do some experiments on program slicing. The tool is great and there are a lot of different types of slicing (by result or by statement, for example). I'm using a program data structure like:

typedef struct ComplexData {
    int x;
    int y;
    char string_[100];
    size_t n;
} ComplexData;

It's just an example in order to understand how frama-c can slice the program by the result produced by the function. Basically, the main method calls a function which returns a value of the type ComplexData. How the comparison between different executions is performed? There is a check for each value of the struct? Like this?

byako · Accepted Answer · 2017-01-23T20:03:58.467

2

The option -slice-return f of Frama-C instructs the slicer to keep all statements that contribute to the computation of the return code of f. For your type ComplexData, this means the contents of any of the fields. Any statement that computes e.g. y, or one the characters in string_, will be kept.

Regarding comparison between different executions, static slicers actually work differently. They approximate the behavior of each function, across all possible executions. (In the case of Frama-C, this is done using a technique known as abstract interpretation.) Thus, there is no need to compare two executions.

edited Jan 23 '17 at 20:03

answered Jan 20 '17 at 10:55

byako

3,372
2
21
36

Thank you very much for your clear reply. Most of the articles that I read, describe _dynamic slicing_ and in particular they tried to compare the trajectory on different executions. So, may abstract interpretation used only for _static slicing_? Finally, regarding what I read, the trajectory was stored in an output file and I have only seen criterion based on data primitives like _integers_. For this reason, I thought that there was also a similar comparison for data structures. Even if, in that case one needs to compare each field. – Luke Jan 20 '17 at 11:08
2

Right, I forgot about dynamic slicing. I edited my answer accordingly. Abstract interpretation is inherently static, so I dont think it can be used for dynamic slicing. – byako Jan 20 '17 at 14:14
Ok. Yes, you're right. Anyway, it could have great advantages when you have to compare complex data structures. – Luke Jan 20 '17 at 14:26

Slicing using frama-c

1 Answers1