Analysis Debuggers, Tools and Profilers
Aaron Bloomfield CS 415 Fall 2005
1
What is a Debugger?
"A software tool that is used to detect the source of program or script errors, by performing step-by-step execution of application code and viewing the content of code variables." -MSDN
2
What is a Debugger? (con't)
A debugger is not an IDE
Though the two can be integrated, they are separate entities.
A debugger loads in a program (compiled executable, or interpreted source code) and allows the user to trace through the execution. Debuggers typically can do disassembly, stack traces, expression watches, and more.
3
Other Forms of Debugging
Periodic printf/cout/print/write/etc.
Statements with relevant information
Assert statements Desk Checking
NOTE: this is errors found in programs that are correct according to the syntax and grammar of the language.
4
Why use a Debugger?
No need for precognition of what the error might be. Flexible
Allows for "live" error checking no need to re-write and re-compile when you realize a certain type of error may be occuring Dynamic Can view the entire relevant scope
5
Why people don't use a Debugger?
With simple errors, may not want to bother with starting up the debugger environment.
Obvious error Simple to check using prints/asserts
Hard-to-use debugger environment Error occurs in optimized code Changes execution of program (error doesn't occur while running debugger)
6
Types of Debuggers
Two types of debuggers (really, two types of languages)
Interpreted language debuggers Compiled language debuggers
Which do you think is easier to write?
7
Debuggers for Compiled Languages
Harder to implement
Generally, would like information about source code (not normally included in compiled executables) Work on a lower level
Need special "debug" executables. More complex, and we'll focus on these.
8
Functions of a Debugger
Disassembly Execution Tracing/Stack tracing Symbol watches
9
Disassembly
Most basic form of debugging Translating machine code into assembly instructions that are more easily understood by the user. Typically implementable as a simple lookup table No higher-level information (variable names, etc.) Relatively easy to implement. 10
Execution Tracing
Follows the program through the execution. Users can step through line-byline, or use breakpoints. Typically allows for "watches" on registers, memory locations, symbols Allows for tracing up the stack of runtime errors (back traces) Allows user to trace the causes of unexpected behavior and fix them
11
Symbol Information
Problem a compiler/assembler translates variable names and other symbols into internally consistent memory addresses How does a debugger know which location is denoted by a particular symbol? We need a "debug" executable.
12
Debug vs. Release Builds
Debug builds usually are not optimized Debug executables contain:
program's symbol tables location of the source file line number tags for assembly instuctions.
13
Profilers
14
What are they?
Time Profilers:
How many people have used these?
Tells you where your program spent its time Tells you which functions called which other functions while it was executing
15
What are they?
Space Profiler:
Also called "heap profiling" or "memory profiling" Space profiling is useful to help you reduce the amount of memory your program uses.
16
How do they work?
Time profiler:
Profiling works by changing how every function in your program is compiled so that when it is called, it will stash away some information about where it was called from. From this, the profiler can figure out what function called it, and can count how many times it was called
17
How do they work? (2)
Space Profiler:
Stops execution and examines the stack Stops execution when a page of memory is allocated Collects Data about which function asked for the memory
18
How do they work? (3)
After the data is collected by the profiler, an interpreter must be run to display the data in an understandable format Can be text-based or graphical
19
Why do I need a time profiler?
Find where the program is spending most of it's time
That's where you should focus optimization efforts
The program performs the proper functions, but is too slow
Important in real time systems Important to web applications
The program is too large or too complex to analyze by reading the source
20
Why do I need a space profiler?
The program needs to use a fixed amount of memory The program is too large to conceive of the overall memory usage or how often memory requests are made Profilers can show the memory usage of libraries used by your program
21
Some Profiler Examples Time
gprof GNU compile Profiler
programs with the pg option execute program to generate data run gprof to interpret the data
22
gprof sample data Flat Profile
Each sample counts as 0.01 seconds. % cumulative self time seconds seconds 33.34 16.67 16.67 16.67 16.67 0.00 0.00 0.02 0.03 0.04 0.05 0.06 0.06 0.06 0.02 0.01 0.01 0.01 0.01 0.00 0.00 236 192 0.00 0.00 0.00 0.00 self total calls ms/call ms/call name 7208 244 8 7 0.00 0.04 1.25 1.43 0.00 open 0.12 offtime 1.25 memccpy 1.43 write mcount tzset tolower
23
gprof sample data Call graph
index % time self 0.00 [3] 100.0 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 children 0.05 0.05 0.03 0.01 0.01 0.00 0.00 0.00 0.00 0.00 called 1/1 1 8/8 1/1 9/9 12/34 8/8 1/1 8/8 8/16 name main [2] report [3] timelocal [6] print [9] fgets [12] strncmp <cycle 1> [40] lookup [20] fopen [21] chewtime [24] skipspace [44] -----------------------------------------------
-----------------------------------------------
24
Some Profiler Examples Space
Massif
Space Profiler for C and C++ Provides relative space data on 5 different areas:
Heap blocks Heap administration blocks Stack sizes Code size Data size
25
Massif sample data - basic
==1012== Total spacetime: 917,098,589 ms.B ==1012== heap: 0.0% ==1012== heap admin: 0.0% ==1012== stack(s): 0.0% ==1012== static code: 44.4% ==1012== static data: 55.3%
26
Massif sample data Space-time Graph
27
Analysis Tools
28
Purpose of Analysis Tools
Need for a feasible method to catch bugs in large projects. Formal verification techniques require unreasonable effort on large projects. Augment traditional debugging techniques without adding unreasonable burden to the development process.
29
30
Two Types of Analysis Tools
Static Analysis Run-time (dynamic) Analysis
31
Static Analysis
Examine a program for bugs without running the program. Examples:
Splint (www.splint.org), PolySpace C Verifier (www.polyspace.com).
32
Splint
Open Source Static Analysis Tool developed at U.Va by Professor Dave Evans. Based on Lint.
33
Errors Splint will detect
Dereferencing a possibly null pointer. Using possibly undefined storage or returning storage that is not properly defined. Type mismatches, with greater precision and flexibility than provided by C compilers. Violations of information hiding. Memory management errors including uses of dangling references and memory leaks. Dangerous aliasing.
34
Errors Splint will detect continued...
Modifications and global variable uses that are inconsistent with specified interfaces. Problematic control flow such as likely infinite loops. Buffer overflow vulnerabilities. Dangerous macro initializations and invocations. Violations of customized naming conventions.
35
What's wrong with this code?
void strcpy(char* str1, char* str2) { while (str2 != 0) { *str1 = *str2; str1++; str2++; } str1 = 0; //null terminate...