Hey Peter, thanks for your reply. Here is a link II think wil help you understand backward and forward slicing: http://www0.cs.ucl.ac.uk/staff/mharman/exe1.html

If you take a look at Figure 6, I think the forward slice is quite similar to the taint analysis.

If you compare the Figure 6 with the example in Wikipedia Taint checking, you can find that both of them are measuring the impacts of certain variables to other variables .

Hey Peter, I will just describe my thought with the function below.

void foo(int x)

{

int y=3;

int p=x+y;

int z=y*3;

if(p==0)

z=y-1;

}

So the forward slices for input parameter x are as follows: (Please forgive me that I use the word forward again.)

int p=x+y;

if(p==0)

z=y-1

However, if we use taint analysis to track the impact of x, you will also find variable p needs to access the memory address of x. And since the value of p could determine the value of z, so z is also indirectly impact by x. So the results of taint analysis are similar with the above one.

I cannot tell the difference and when I should use taint analysis or I should use forward slicing. So would you please talk about their usage when doing program analysis? And it would be better if you have good papers that is related to them,