Path Optimization in Programs and Its Application to Debugging ⋆ Akash Lal, Junghee Lim, Marina Polishchuk, and Ben Liblit Computer Sciences Department, University of Wisconsin-Madison {akash, junghee, mpoli, liblit}@cs.wisc.edu Abstract. We present and solve a path optimization problem on programs. Given a set of program nodes, called critical nodes, we find a shortest path through the program’s control flow graph that touches the maximum number of these nodes. Control flow graphs over-approximate real program behavior; by adding dataflow analysis to the control flow graph, we narrow down on the program’s actual be- havior and discard paths deemed infeasible by the dataflow analysis. We derive an efficient algorithm for path optimization based on weighted pushdown systems. We present an application for path optimization by integrating it with the Co- operative Bug Isolation Project (CBI ), a dynamic debugging system. CBI mines instrumentation feedback data to find suspect program behaviors, called bug pre- dictors, that are strongly associated with program failure. Instantiating critical nodes as the nodes containing bug predictors, we solve for a shortest program path that touches these predictors. This path can be used by a programmer to debug his software. We present some early experience on using this hybrid sta- tic/dynamic system for debugging. 1 Introduction Static analysis of programs has been used for a variety of purposes including compiler optimizations, verification of safety properties, and improving program understanding. Static analysis has the advantage of considering all possible executions of a program, thus giving strong guarantees on the program’s behavior. In this paper, we present a static analysis technique for finding a program execution sequence that is optimal with respect to some criteria. Given a set of program locations, which we call critical nodes, we find a trace among all possible program execution traces that touches the maximum number of these critical nodes and has the shortest length among all such traces. Since reachability in programs is undecidable in general, we over-approximate the set of all possible traces through a program by considering all paths in its control flow graph, and solve the optimization problem on this collection of paths. We also consider how to more closely approximate actual program behavior by discarding paths in the con- trol flow graph deemed infeasible by dataflow analysis [1]. We show that the powerful framework of weighted pushdown systems [2] can be used to represent and solve sev- eral variations of the path optimization problem. ⋆ Supported in part by a gift from Microsoft Research. P. Sestoft (Ed.): ESOP 2006, LNCS 3924, pp. 246–263, 2006. c  Springer-Verlag Berlin Heidelberg 2006