csmith-project / creduce

C-Reduce, a C and C++ program reducer

C-Reduce

About

C-Reduce is a tool that takes a large C or C++ program that has a property of interest (such as triggering a compiler bug) and automatically produces a much smaller C/C++ program that has the same property. It is intended for use by people who discover and report bugs in compilers and other tools that process C/C++ code.

NOTE: C-Reduce happens to do a pretty good job reducing the size of programs in languages other than C/C++, such as JavaScript and Rust. If you need to reduce programs in some other language, please give it a try.

Documentation and other information can be found at the C-Reduce web page

Installation

See INSTALL.md.

Notes

1. When set to use more than one core, C-Reduce can cause space in /tmp to be leaked. This happens because sometimes C-Reduce will kill a compiler invocation when a result that is computed in parallel makes it clear that that compiler invocation is no longer useful. If the compiler leaves files in /tmp when it is killed, C-Reduce has no way to discover and remove the files. You will need to do this manually from time to time if temporary file space is limited. The leakage is typically pretty slow. If you need to avoid this problem altogether, you can run C-Reduce on a single core (using --n 1) in which case C-Reduce will never kill a running compiler instance. Alternatively, a command line option such as -pipe (supported by GCC) may suppress the creation of temporary files altogether. Another possibility is to set the TMPDIR environment variable to something like /tmp/creduce-stuff before invoking C-Reduce -- assuming that the tools you are invoking respect this variable.

2. Each invocation of the interestingness test is performed in a fresh temporary directory containing a copy of the file that is being reduced. If your interestingness test requires access to other files, you should either copy them into the current working directory or else refer to them using an absolute path.

creduce's Issues

allow setting the tools used for the tests

Please allow running specific clang/gcc versions in the tests (patch against the llvm-svn-compatible branch)

versioned-tools.txt

Copy propagation of a variable affects its own definition

The file test.txt contains the line
b = a[b];
and the the copy propagation propagates b into its own definition, which leads to
b = a[a[b]];
b = a[a[a[a[b]]]];
b = a[a[a[a[a[a[a[a[b]]]]]]]];
and so on. (It eventually stop doing this but afterwards clang-format uses a lot of memory.)

The issue occurs with creduce-2.4.0. I also attached a check "script".

test.txt
check.txt

Endless loop

Hi,

When running creduce on the following .c file, with the attached script, I get an endless loop after pass_clang :: local-to-global:

...
(-218.4 %, 6989 bytes)
(-219.3 %, 7009 bytes)
(-220.2 %, 7029 bytes)
(-221.1 %, 7049 bytes)
(-222.1 %, 7069 bytes)
(-223.0 %, 7089 bytes)
...

Test.sh

#!/bin/bash -e
gcc -m64 -Wall -O3  -c c_enc.c
nm c_enc.o | grep "U CAST_S_table0"

e_enc.c

# define CAST_LONG unsigned int
typedef struct cast_key_st                 CAST_KEY;
#if definedCAST_PTR
#else
# define E_CAST(n,key,L,R,OP1,OP2,OP3) \
        CAST_LONG a,b,c,d; \
        a=CAST_S_table0[t>> 8&0xff]; \
        b=CAST_S_table1[t    &0xff]; \
        c=CAST_S_table2[t>>24&0xff]; \
        d=CAST_S_table3[t>>16&0xff]; \
        L^=a OP2 b&0xffffffffL OP3 c&0xffffffffL OP1 d&0xffffffffL; \

#endif
extern const CAST_LONG CAST_S_table0[256];
                                extern const CAST_LONG CAST_S_table1[256];
                                extern const CAST_LONG CAST_S_table2[256];
                                extern const CAST_LONG CAST_S_table3[256];
                                void fn1(CAST_LONG *data, const CAST_KEY *key) {
                        CAST_LONG l, t;
                        E_CAST(1, k, l, r, -, +, ^) data[1] = l;
                        }

Thank you!

CMake builds

It seems that cmake doesn't quite work:

• It doesn't install creduce in ...bin/creduce
• It seems there is no creduce script doesn't get created in the build dir.
• There is one creduce.pl generated but the it's path to the creduce_modules is broken.

Which is the mid/long term build system? I personally prefer cmake, because adding new passes seems easier.

Guidance for fetching dependencies on Mac

http://embed.cs.utah.edu/creduce/ claims that C-Reduce has been tested on Mac, but INSTALL only provides guidance for Linux.

Can you provide an easy homebrew commandline so Mac users can easily get up and running with the required dependencies?

Fails to build against clang 3.1

With clang 3.1 Debian packages, at the end of the build, I am getting the error:
clang_delta-Transformation.o:(.data.rel.ro._ZTI14Transformation[typeinfo for Transformation]+0x8): undefined reference to `typeinfo for clang::ASTConsumer'

The full command being:
libtool: link: g++ -I/usr/lib/llvm-3.1/include -DNDEBUG -D_GNU_SOURCE -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS -g -O2 -fomit-frame-pointer -fvisibility-inlines-hidden -fno-exceptions -fPIC -Woverloaded-virtual -Wcast-qual -g -O3 -fno-strict-aliasing -Wall -Wextra -Wno-long-long -Wno-unused-parameter -o clang_delta clang_delta-AggregateToScalar.o clang_delta-BinOpSimplification.o clang_delta-CallExprToValue.o clang_delta-ClangDelta.o clang_delta-ClassTemplateToClass.o clang_delta-CombineGlobalVarDecl.o clang_delta-CombineLocalVarDecl.o clang_delta-CopyPropagation.o clang_delta-EmptyStructToInt.o clang_delta-LiftAssignmentExpr.o clang_delta-LocalToGlobal.o clang_delta-MoveFunctionBody.o clang_delta-MoveGlobalVar.o clang_delta-ParamToGlobal.o clang_delta-ParamToLocal.o clang_delta-ReduceArrayDim.o clang_delta-ReduceArraySize.o clang_delta-ReduceClassTemplateParameter.o clang_delta-ReducePointerLevel.o clang_delta-RemoveBaseClass.o clang_delta-RemoveCtorInitializer.o clang_delta-RemoveNamespace.o clang_delta-RemoveNestedFunction.o clang_delta-RemoveTrivialBaseTemplate.o clang_delta-RemoveUnresolvedBase.o clang_delta-RemoveUnusedFunction.o clang_delta-RemoveUnusedStructField.o clang_delta-RemoveUnusedVar.o clang_delta-RenameClass.o clang_delta-RenameFun.o clang_delta-RenameParam.o clang_delta-RenameVar.o clang_delta-ReplaceCallExpr.o clang_delta-ReplaceDerivedClass.o clang_delta-ReplaceSimpleTypedef.o clang_delta-ReturnVoid.o clang_delta-RewriteUtils.o clang_delta-SimpleInliner.o clang_delta-SimplifyCallExpr.o clang_delta-SimplifyCommaExpr.o clang_delta-SimplifyDependentTypedef.o clang_delta-SimplifyIf.o clang_delta-SimplifyStructUnionDecl.o clang_delta-Transformation.o clang_delta-TransformationManager.o clang_delta-UnifyFunctionDecl.o clang_delta-UnionToStruct.o -lclangFrontendTool -lclangFrontend -lclangDriver -lclangSerialization -lclangCodeGen -lclangParse -lclangSema -lclangAnalysis -lclangRewrite -lclangAST -lclangLex -lclangBasic -lclangEdit -lLLVMX86AsmParser -lLLVMX86Disassembler -lLLVMX86CodeGen -lLLVMSelectionDAG -lLLVMAsmPrinter -lLLVMMCParser -lLLVMX86Desc -lLLVMX86Info -lLLVMX86AsmPrinter -lLLVMX86Utils -lLLVMJIT -lLLVMRuntimeDyld -lLLVMExecutionEngine -lLLVMCodeGen -lLLVMScalarOpts -lLLVMInstCombine -lLLVMTransformUtils -lLLVMipa -lLLVMAnalysis -lLLVMTarget -lLLVMMC -lLLVMObject -lLLVMCore -lLLVMSupport -L/usr/lib/llvm-3.1/lib -lpthread -lffi -ldl -lm

The master is not usable

I am trying to use creduce on Yosemite:

../src/configure --prefix=/Users/vvassilev/workspace/github/creduce/inst/ --with-llvm=/Users/vvassilev/workspace/github/creduce/dependencies/clang+llvm-3.7.0-x86_64-apple-darwin/ --enable-trans-assert TOPFORMFLAT=/Users/vvassilev/workspace/github/creduce/dependencies/delta-2006.08.03/

It builds fine then when I try the demo on your page it says:

./inst/bin/creduce --verbose ./test1.sh small.c 
successfully checked prereqs for pass_blank
successfully checked prereqs for pass_clang_binsrch
prereqs not found for pass pass_lines at ./inst/bin/creduce line 246.

I also tried to use creduce-2.3 with clang/llvm toolchain 3.6.2 and ran into the same sort of issues.

The dependencies (configure-wise) seem to be fine. Any ideas what might be wrong?

clang_delta --query-instances=replace-function-def-with-decl hits assert

clang_delta: ReplaceFunctionDefWithDecl.cpp:254: void ReplaceFunctionDefWithDecl::rewriteOneFunctionDef(const clang::FunctionDecl*): Assertion `!Ctor->isDefaulted() && "Implicit Def!"' failed.

http://people.mozilla.org/~jmuizelaar/creduce-crash-module2.cc

'pass_lines' pass doesn't check if bug is reproducable

I'm trying to reproduce a bug in clang-tidy (trunk version), when I noticed that my test file is reduced to empty, while reduce.sh doesn't agree with this being a valid case.

I can reproduce this by running following command on the attached files
(reproduction.zip)
:
creduce --no-default-passes --debug --add-pass pass_lines 0 1 reduce.sh t.cpp
The debug output can be found in debug.txt

If I afterwards run reduce.sh on the resulting (empty) t.cpp, it indicates that the bug is not reproducable.

I noticed this behavior both with the default version on ubuntu 14.04 ( 2.2.1 ) as with trunk version (creduce 2.5.0 (a47dc02)).

If you need any more info, just let me know.

clang-delta constructs clang analyzer CFGs, which is fragile and probably unnecessary

$ ./clang_delta/clang_delta --transformation=replace-function-def-with-decl t.ii --output=t --counter=1
Stack dump:
0. t.ii:1614:3: current parser token ';'

1.  t.ii:509:5: parsing namespace 'std'
   

2.  t.ii:1567:5: parsing namespace 'llvm'
   

3.  t.ii:1572:5: parsing struct/union/class body 'APInt'
   

4.  t.ii:1581:29: parsing function body 'clearUnusedBits'
   

Segmentation fault (core dumped)

Specifically, it's deep inside clang itself doing CFG construction. My question is, why does clang-delta need CFG construction at all? Is it used for reduction? In this instance, it's trying to run analysis-based warnings:
#0 0x0000000000fcd1aa in (anonymous namespace)::CFGBuilder::addLocalScopeForVarDecl(clang::VarDecl_, (anonymous namespace)::LocalScope_) ()
#1 0x0000000000fce290 in (anonymous namespace)::CFGBuilder::addLocalScopeForStmt(clang::Stmt*) ()
#2 0x0000000000fccde1 in (anonymous namespace)::CFGBuilder::VisitCompoundStmt(clang::CompoundStmt*) ()
#3 0x0000000000fc9010 in (anonymous namespace)::CFGBuilder::Visit(clang::Stmt*, (anonymous namespace)::AddStmtChoice) ()
#4 0x0000000000fc3b0d in clang::CFG::buildCFG(clang::Decl const_, clang::Stmt_, clang::ASTContext*, clang::CFG::BuildOptions const&) ()
#5 0x0000000000fbef2c in clang::AnalysisDeclContext::getCFG() ()
#6 0x0000000000fa505a in clang::sema::AnalysisBasedWarnings::IssueWarnings(clang::sema::AnalysisBasedWarnings::Policy, clang::sema::FunctionScopeInfo_, clang::Decl const_, clang::BlockExpr const*) ()

Why bother? Can you turn these off by default? Is there some way to thread command line flags to clang through clang-delta so that I can turn them off in the field?

Time to drop indent and astyle?

clang_format has matured a lot. Are astyle and indent still necessary?

creduce-2.1.0 does not compile against clang-3.4

When compiling the latest release against clang-3.4.0, I see:

ClassTemplateToClass.cpp: In member function 'void ClassTemplateToClass::rewriteClassTemplatePartialSpecs()':
ClassTemplateToClass.cpp:248:71: error: cannot convert 'const clang::ASTTemplateArgumentListInfo*' to 'clang::TemplateArgumentLoc*' in initialization
     TemplateArgumentLoc *ArgLocs = PartialD->getTemplateArgsAsWritten();
                                                                       ^
ClassTemplateToClass.cpp:253:34: error: 'const class clang::ClassTemplatePartialSpecializationDecl' has no member named 'getNumTemplateArgsAsWritten'
     unsigned NumArgs = PartialD->getNumTemplateArgsAsWritten();
                                  ^

and other problems. I guess this is due to differences between 3.3 and 3.4. The git version seems to depend on llvm-3.4 instead. Can you please make a new release?

Release a version that supports LLVM 3.6

The latest release, 2.2.1, fails with LLVM 3.6 with:

/usr/local/Cellar/creduce/2.2.1/bin/creduce test1.sh test1.c
prereqs not found for pass pass_indent at /usr/local/Cellar/creduce/2.2.1/libexec/creduce line 238.

See:
Homebrew/legacy-homebrew#37260 (comment)
http://bot.brew.sh/job/Homebrew%20Pull%20Requests/25183/version=mavericks/console
http://bot.brew.sh/job/Homebrew%20Pull%20Requests/25183/version=yosemite/console

Looks like master also fails to compile against LLVM 3.6: https://gist.github.com/tamird/881e2bf7f2b920084fa7

Can't run on files in subdirectory

This

creduce test.sh foo/bar.c

fails with some error in File::Copy::copy, while

cp foo/bar.c .
sed -i 's/foo\/bar.c/bar.c/g' test.sh
creduce test.sh bar.c

works.

pass_clang :: remove-unused-function removes functions top-down instead of down to top

When trying to reduce some code, I've noticed that the reduction 'pass_clang :: remove-unused-function' is removing functions from top to bottom instead of vise versa. Doing this the other way around looks more logical.

Consider a cpp file with first a class-definition with pure virtual functions, followed by an implementation of such function, with an override after it. If the script verifies that the cpp-file still can compile, this means that it will always fail when the pure-virtual call is removed, though it could succeed if this implementation is removed.

Result: After running this pass, you can run it a second time to get extra reduction (10% on the file I was looking at)

clang_delta testsuite

I have a fix alongside with a tiny example. Is there a way how I can make a regression test for clang-delta.
Ideally I want to run clang_delta like this and compare the output.

clang_delta --transformation=template-non-type-arg-to-int --counter=1 template_arg_to_int.cxx

Many thanks!
Vassil

Test case not completely minimized

I used creduce to minimize a large test case to the following code:

class A {
public:
  A(bool);
};
template <class Base> class __declspec(dllexport) SecurityWrapper : A {
  constexpr SecurityWrapper() : Base(true) {}
};

template class SecurityWrapper<A>;

But a smaller test case is:

template <class> struct S {
  constexpr S() {}
};
template class __declspec(dllexport) S<void>;

I'm not sure if this is a limitation of creduce that it could not reduce the test case further, but filing this anyway.

Remove Perl-Sys-CPU dependency

Perl-Sys-CPU module has no license information hence it cannot be legally distributed by anyone. This prevents us packaging creduce for openSUSE.

Segmentation fault in transformation remove-unused-enum-member

clang_delta --transformation=remove-unused-enum-member --counter=1 test.txt
Segmentation fault (core dumped)

test.txt

P.S. I used the multifile reduction for this test and it works great :-)

Reduction for C preprocessor

It would be nice if creduce could handle #if and friends as the normal line based approach doesn't work on the multiline nature of such blocks. This even prevents empty statements from being removed.

inliner bug

Here's one where the simple inliner almost works, but turns main() into a template function! Would be nice to fix some of these cases...

regehr@hawking:~$ cat foo.cpp
#include <iostream>
template <typename x0> struct A { static void m_fn1(x0); };
template <typename x0> void A<x0>::m_fn1(x0 p1) { std::cout << p1; }
int main() { A<char *>::m_fn1("Hello"); }
regehr@hawking:~$ ~/creduce-install/libexec/clang_delta --transformation=simple-inliner --counter=1 foo.cpp
#include <iostream>
template <typename x0> struct A { static void m_fn1(x0); };
template <typename x0> 
int main() { {char *p1 = "Hello";
 std::cout << p1; }

; }

clang_delta --query-instances=replace-function-def-with-decl crashes

Here's the file
http://people.mozilla.org/~jmuizelaar/creduce/HTMLLinkElement-360595.cpp.gz

Directory-wide reduce [not-a-bug]

Hi!
First of all, thanks for creduce! This tool helps me many times.
But there are some cases creduce can't handle. Let's suppose I have some IDE/File manager that crashes opening some directory. It would be great to reduce such directory to find relevant set of files (responsible for crash). Is there tool for this? How hard would it be to implement one? I would be glad to see some hints/posts on implementing it.
Sorry for some offtop.

OOPS: pass_indent::regular failed to modify the test case

Testcase 703.js:

fullcompartmentchecks(1);
x = Debugger();
g = newGlobal();
x.addDebuggee(g);
x.memory.trackingAllocationSites = 1;
x.memory.trackingTenurePromotions = 1;
try {
    g();
} catch (e) {}

Script test703.sh:

#! /bin/bash
DESIRED_EXIT_CODE=139
JSBIN='/Users/skywalker/shell-cache/js-dbg-64-dm-nsprBuild-darwin-49683d4e9ebd/js-dbg-64-dm-nsprBuild-darwin-49683d4e9ebd'
ENGINEFLAGS='--fuzzing-safe --no-threads --no-ion'
TESTCASE='703.js'

# Adapted from http://stackoverflow.com/a/5195741
function testing {
    "$@"
    local status=$?
    if [ $status -ne $DESIRED_EXIT_CODE ]; then
        return 0
    fi
    return $status
}

$JSBIN -c $TESTCASE && !(testing $JSBIN $ENGINEFLAGS $TESTCASE)

Run:
creduce --sllooww test703.sh 703.js

Halfway through result:
OOPS: pass_indent::regular failed to
modify the test case, which means you have
encountered a bug in C-Reduce. Please consider
mailing /Users/skywalker/Downloads/aa20150715/creduce_bug_379731 to

creduce_bug_379731 :

 fullcompartmentchecks(1)
                    x = Debugger()
                    g = newGlobal()
                    x.addDebuggee(g)
                    x.memory.trackingAllocationSites = 1
                    x.memory.trackingTenurePromotions = 1
                    try {
                   g()
               }
                    catch (e) {
              }

creduce version:

$ creduce
usage: creduce [options] test_script.sh file.c
       creduce --help to list options
Died at /usr/local/Cellar/creduce/2.3.0_1/libexec/creduce line 113.

Note that creduce completes successfully. Tested on Mac, creduce 2.3.0 installed via homebrew.

Segmentation fault

Dear sirs,

this snippet reproduces Segmfault for version 8a44607

define gFSIZE1 4092

;

;
int stPtr_1_1;
int stPtr_1_0;
volatile int stPtr_0_1;
volatile int stPtr_0_0;
void
gFunc2_1 ( v3 ) {
}

define _GPAL_ASSERT(v1, v2, v3, v4) ((v1? 1:(gFunc2_1(),0)))

define gFunc2(v1,v2) _GPAL_ASSERT(v1, , , )

int
gFunc1 ( ) {
{
( stPtr_0_1 + stPtr_0_0 );
return ( stPtr_1_0 >= stPtr_1_1 ) ? ( stPtr_1_0 - stPtr_1_1 ) : ( stPtr_1_1 + stPtr_1_0 );
}
}

void
gFunc3 ( ) {
{
gFunc1 ( ) ;
} } void
gFunc4 ( ) {
int
uInt1 = gFunc1 ( );
gFunc2 ( gFSIZE1 >= uInt1, );
{
gFunc2 ( uInt1, );
} }

// this should reproduce the crash:
// /work/creduce/creduce/../clang_delta/clang_delta --transformation=simple-inliner --counter=3 /work/creduce/creduce_bug_379797

don't ignore user-specified CXXFLAGS

In the CMakeLists.txt file, this isn't the proper way to add CXXFLAGS

set(CMAKE_CXX_FLAGS "-std=c++11 -fno-rtti -Wall -Wextra -Wno-long-long -Wno-unused-parameter")

as it ignores those specified on the command line. (See http://voices.canonical.com/jussi.pakkanen/2013/03/26/a-list-of-common-cmake-antipatterns/)

terminate called after throwing an instance of 'std::bad_alloc'

Dear sirs,
this example crashes creduce version 8a44607 with msg
terminate called after throwing an instance of 'std::bad_alloc'
what(): std::bad_alloc
Aborted (core dumped)

I'm working on Xubuntu 12.04, and creduce is working good, except for this and previous bug

define gFSIZE1 4092

;

;
int stPtr_1_1;
int stPtr_1_0;
volatile int stPtr_0_1;
volatile int stPtr_0_0;
void
gFunc2_1 ( v3 ) {
}

define _GPAL_ASSERT(v1, v2, v3, v4) ((v1? 1:(gFunc2_1(),0)))

define gFunc2(v1,v2) _GPAL_ASSERT(v1, , , )

int
gFunc1 ( ) {
{
( stPtr_0_1 + stPtr_0_0 );
return ( stPtr_1_0 >= stPtr_1_1 ) ? ( stPtr_1_0 - stPtr_1_1 ) : ( stPtr_1_1 + stPtr_1_0 );
}
}

void
gFunc3 ( ) {
{
gFunc1 ( ) ;
} } void
gFunc4 ( ) {
int
uInt1 = gFunc1 ( );
gFunc2 ( gFSIZE1 >= uInt1, );
{
gFunc2 ( uInt1, );
} }

// this should reproduce the crash:
// /work/creduce/creduce/../clang_delta/clang_delta --transformation=simplify-comma-expr --counter=1 /work/creduce/creduce_bug_757919

clang_delta doesn't link on FreeBSD 10.2

With current master (f137b2e4), on FreeBSD 10.2, with installed package of clang38:

mkdir obj && cd obj
../creduce/configure --with-llvm=/usr/local/llvm38
cd clang_delta
gmake

Compiles but fails to link. Error output:

/usr/local/llvm38/lib/libclangFrontendTool.a(ExecuteCompilerInvocation.cpp.o): In function `clang::ExecuteCompilerInvocation(clang::CompilerInstance*)':
/wrkdirs/usr/ports/devel/llvm38/work/llvm-3.8.0.src/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:(.text+0x40d): undefined reference to `clang::ento::printCheckerHelp(llvm::raw_ostream&, llvm::ArrayRef<std::__1::basic_string<char, std::__1::char_traits<char>, std::__1::allocator<char> > >)'
/wrkdirs/usr/ports/devel/llvm38/work/llvm-3.8.0.src/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:(.text+0xae0): undefined reference to `vtable for clang::ento::AnalysisAction'
/wrkdirs/usr/ports/devel/llvm38/work/llvm-3.8.0.src/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:(.text+0xb2e): undefined reference to `vtable for clang::arcmt::MigrateSourceAction'
/wrkdirs/usr/ports/devel/llvm38/work/llvm-3.8.0.src/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:(.text+0xb3e): undefined reference to `clang::arcmt::FileRemapper::FileRemapper()'
/wrkdirs/usr/ports/devel/llvm38/work/llvm-3.8.0.src/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:(.text+0xc63): undefined reference to `clang::arcmt::ModifyAction::ModifyAction(clang::FrontendAction*)'
/wrkdirs/usr/ports/devel/llvm38/work/llvm-3.8.0.src/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:(.text+0xcb2): undefined reference to `clang::arcmt::CheckAction::CheckAction(clang::FrontendAction*)'
/wrkdirs/usr/ports/devel/llvm38/work/llvm-3.8.0.src/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:(.text+0xd0f): undefined reference to `clang::arcmt::MigrateAction::MigrateAction(clang::FrontendAction*, llvm::StringRef, llvm::StringRef, bool)'
/wrkdirs/usr/ports/devel/llvm38/work/llvm-3.8.0.src/tools/clang/lib/FrontendTool/ExecuteCompilerInvocation.cpp:(.text+0xd6b): undefined reference to `clang::arcmt::ObjCMigrateAction::ObjCMigrateAction(clang::FrontendAction*, llvm::StringRef, unsigned int)'
c++: error: linker command failed with exit code 1 (use -v to see invocation)
Makefile:735: recipe for target 'clang_delta' failed
gmake: *** [clang_delta] Error 1

include topformflat

Requiring Delta to be install just to get topformflat is silly, we should include topformflat and build and install it by default.

replace-function-def-with-decl crashes for given input

I use LLVM 3.7.0 with latest creduce revision.

To reproduce:

clang_delta --query-instances=replace-function-def-with-decl mytestcase.ii

Backtrace:
Program received signal SIGSEGV, Segmentation fault.
0x00000000015c5a64 in clang::FunctionDecl::isNoReturn() const ()
Missing separate debuginfos, use: zypper install libgcc_s1-debuginfo-4.8.3+r212056-2.2.4.x86_64 libncurses5-debuginfo-5.9-52.2.3.x86_64 libz1-debuginfo-1.2.8-5.1.2.x86_64
(gdb) bt
#0 0x00000000015c5a64 in clang::FunctionDecl::isNoReturn() const ()
#1 0x00000000014e5c4e in (anonymous namespace)::CFGBuilder::addAutomaticObjDtors((anonymous namespace)::LocalScope::const_iterator, (anonymous namespace)::LocalScope::const_iterator, clang::Stmt*) ()
#2 0x00000000014e552c in (anonymous namespace)::CFGBuilder::VisitCompoundStmt(clang::CompoundStmt*) ()
#3 0x00000000014e0d95 in (anonymous namespace)::CFGBuilder::Visit(clang::Stmt*, (anonymous namespace)::AddStmtChoice) ()
#4 0x00000000014e5567 in (anonymous namespace)::CFGBuilder::VisitCompoundStmt(clang::CompoundStmt*) ()
#5 0x00000000014d676b in clang::CFG::buildCFG(clang::Decl const_, clang::Stmt_, clang::ASTContext*, clang::CFG::BuildOptions const&) ()
#6 0x00000000014c26b6 in clang::AnalysisDeclContext::getCFG() ()
#7 0x0000000001497bf7 in clang::sema::AnalysisBasedWarnings::IssueWarnings(clang::sema::AnalysisBasedWarnings::Policy, clang::sema::FunctionScopeInfo_, clang::Decl const_, clang::BlockExpr const*) ()
#8 0x0000000000ffe2c3 in clang::Sema::PopFunctionScopeInfo(clang::sema::AnalysisBasedWarnings::Policy const_, clang::Decl const_, clang::BlockExpr const*) ()
#9 0x00000000010ccfcf in clang::Sema::ActOnFinishFunctionBody(clang::Decl_, clang::Stmt_, bool) ()
#10 0x000000000145a0a6 in clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool) ()
#11 0x000000000145af9a in clang::Sema::PerformPendingInstantiations(bool) ()
#12 0x0000000001459b97 in clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool) ()
#13 0x000000000145af9a in clang::Sema::PerformPendingInstantiations(bool) ()
#14 0x0000000001459b97 in clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool) ()
#15 0x000000000145af9a in clang::Sema::PerformPendingInstantiations(bool) ()
#16 0x0000000001459b97 in clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool) ()
#17 0x000000000145af9a in clang::Sema::PerformPendingInstantiations(bool) ()
#18 0x0000000001459b97 in clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool) ()
#19 0x000000000145af9a in clang::Sema::PerformPendingInstantiations(bool) ()
#20 0x0000000001459b97 in clang::Sema::InstantiateFunctionDefinition(clang::SourceLocation, clang::FunctionDecl*, bool, bool) ()
#21 0x000000000145af9a in clang::Sema::PerformPendingInstantiations(bool) ()
#22 0x0000000000ffa5bd in clang::Sema::ActOnEndOfTranslationUnit() ()
#23 0x0000000000f3e813 in clang::Parser::ParseTopLevelDecl(clang::OpaquePtrclang::DeclGroupRef&) ()
#24 0x0000000000f3a526 in clang::ParseAST(clang::Sema&, bool, bool) ()
#25 0x0000000000cd3f88 in TransformationManager::doTransformation (this=0x2638490, ErrorMsg="", ErrorCode=@0x26237c0: -1) at TransformationManager.cpp:188
#26 0x0000000000493a9c in main (argc=, argv=) at ClangDelta.cpp:211

Thanks,
Martin

Error in clang_delta Makefiles

The latest commit (96e2840) introduced two mistakes in the Makefile.am and Makefile.in in clang_delta. After each change there is a backtick (`) too much and causes parsing errors in the bash shell. I added comments to the commit as well.

Support Objective-C files

clang_delta --query-instances=replace-function-def-with-decl file.mm
Error: Unsupported file type!

Seems that only C and C++ are supported right now.

Assertion `RWBuf && "Empty RewriteBuffer!"' failed.

C-Reduce was compiled with --enable-trans-assert using LLVM v3.3.

Reduced testcase:

script.sh:
"""

!/bin/bash

clang++ /path/to/test.cpp 2>&1 | grep 'expected' >/dev/null
"""

test.cpp:
"""

define M(S, W)\

T *S() {}

class T;
class F {
M(new_, n1)
}
template struct V {
bool d();
}
template <> bool V::d()
"""

$ ./creduce ./script.sh /path/to/test.cpp
===< 9133 >===
running 8 interestingness test(s) in parallel
===< pass_blank :: 0 >===
(0.0 %, 141 bytes)
(0.0 %, 141 bytes)
===< pass_clang_binsrch :: replace-function-def-with-decl >===
clang_delta: Transformation.cpp:101: void Transformation::outputTransformedSource(llvm::raw_ostream&): Assertion `RWBuf && "Empty RewriteBuffer!"' failed.
Aborted (core dumped)
===< pass_lines :: 0 >===
(...)

clang_delta crashes on the following file

http://people.mozilla.org/~jmuizelaar/creduce-crash.cc
In asserts build of llvm it fails the "queried property of class with no definition" assert

exit when file size reaches zero

Creduce will happily create millions of files in /tmp if the size
of the testcase reaches zero and one doesn't hit Ctrl-c quick enough.

What about the following crude patch?

--- creduce.in  2014-08-27 13:42:54.671288733 +0200
+++ creduce.in  2014-08-27 13:43:09.817621768 +0200
@@ -328,6 +330,9 @@
        my $tmpdir = make_tmpdir();
        chdir $tmpdir or die;
        my $tmpfn = File::Spec->rel2abs($orig_tmpfn);
+       if (-s $toreduce_best == 0) {
+           die "filesize reached zero";
+       }
        File::Copy::copy($toreduce_best,$tmpfn) or die;
        # creating the variant is done in the parent, it's only
        # testing it that we parallelize
@@ -746,6 +752,9 @@
 # iterate to global fixpoint
 print "MAIN PASSES\n" if $VERBOSE;
 $file_size = -s $toreduce;
+if ($file_size == 0) {
+    die "filesize reached zero";
+}

 while (1) {
     my $next = pass_iterator("pri");

Implement "skip to next pass" key

One feature that I miss often is the ability to skip to next pass by simply pressing a key (say 's').
Ctrl-c works in some circumstances, but is obviously timing depended and error prone.

single threaded multidelta faster than parallel pass_lines pass

Running multidelta on a testcase is often much faster than
the pass_lines pass that runs in parallel in creduce.

(Jakub Jelinek claimed this on IRC, and at first I could not believe it.
But my measurements confirmed this.)

Provide self-contained, static version for download

On irc/oftc #gcc people frequently ask for a static,
self-contained build of creduce, with no external dependencies.

So it would be great if at least an x86_64 version would be
available somewhere.

(I've build a static version on POWER8 by hand today, and it was
a lot of work unfortunately.)

Thanks.

crash

I'm getting a null ptr deref at RenameCXXMethod.cpp:568, it's easy enough to work around by checking for null but I don't want to ignorantly patch around a bug that needs to be fixed elsewhere.

Program received signal SIGSEGV, Segmentation fault.
RenameCXXMethod::handleOneMemberTemplateFunction (this=0x1d7aeb0, MD=0x1e014d0) at RenameCXXMethod.cpp:568
568   unsigned int NumFuns = I->second;
(gdb) p I
$1 = {<llvm::DebugEpochBase::HandleBase> = {<No data fields>}, Ptr = 0x0, End = <optimized out>}
(gdb) 

C-reduce can't reduce this simple example

After reducing a test case, I noticed C-reduce misses some simple transformations.
To demonstrate, the following code example:

//Filename is main.cpp
#ifndef SOMETHING
#include <iostream>
struct Nothing;
namespace some {
  template<typename T,typename F>
  class cls {
    public:
    static void foo(T a);
  };
}
#endif //SOMETHING
template <typename T,typename F>
void some::cls<T,F>::foo(T a) { std::cout<<a;}

void bar(const char * b) {
  some::cls<const char *,Nothing>::foo(b);
}

int main(int argc, char**argv) {
  bar("hello");
  return 0;
}

Test script

#!/bin/bash -e
g++ main.cpp -o run
./run | grep hello

Is reduced to:

#ifndef SOMETHING
#include <iostream>
template <typename T, typename> class A {
public:
  static void m_fn1(T);
};
#endif
template <typename T, typename F> void A<T, F>::m_fn1(T a) { std::cout << a; }

main() { A<char *, int>::m_fn1("hello"); }

• the #ifndef and #endif can be removed
• the class can be changed to struct
• typename F can be removed from the template
• the template could be replaced with the only instantation with the type <char *>

this would result in the reduced example:

#include <iostream>
main(){std::cout<<"hello";}

clang_delta --query-instances=remove-unused-function crashes on the following file

New crash.
clang_delta --query-instances=remove-unused-function
http://people.mozilla.org/~jmuizelaar/creduce-crash-nsContent-utils.cc

It looks like infinite recursion.

configure error: cannot compile and link test program with selected LLVM

Error: g++: error: unrecognized command line option '-Wcovered-switch-default'

GCC 4.8.1 is used as g++ compiler, but it looks the flag is added according to LLVM flags?

Configure log: http://bpaste.net/show/260371/
config.log: http://bpaste.net/show/260374/

I hope it's not necessary to have LLVM as system default compile instead of GCC?

Thank you

Simplify C++11 alias templates

creduce doesn't seem to understand alias templates, so for instance the following

    template<typename Type> using alias = Type;
    const alias<int[18]> data {} // missing semicolon
    int main() {}

will reduce (when checking for e.g. "expecting ',' or ';'", with GCC) to

    template <typename Type> using alias = Type;
    alias<int[]> data {}

whereas int data[] would be an equivalent and shorter (a one-liner, even) program exhibiting the same 'error'. Performing this simplification by-hand allows creduce to continue, yielding int a {} as a final program.

I hope the missing semicolon example doesn’t seem too contrived. However when looking for actual compiler bugs I have had to perform such simplifications by hand, so that a small enough program would be produced. This is becoming less and less of an option though as alias template usage increases—in particular, the C++14 Standard Library defines and may use such alias templates (e.g. std::decay_t).

Segmentation fault in transformation empty-struct-to-int

clang_delta --transformation=empty-struct-to-int --counter=1 test.txt
Segmentation fault (core dumped)

test.txt

clang_delta --version
clang_delta 2.5.0
Git version: 7ebf7b8

llvm-config-3.5 command instead of llvm-config in the configure file

At least on Ubuntu 14.04.1 LTS that seems needed.

Missing copyright and license statements in new files

These files, which were added at commit a55522a, are missing comment headers with copyright and license information.

clang_delta/ReplaceArrayAccessWithIndex.cpp
clang_delta/ReplaceArrayAccessWithIndex.h

@mortior, I would welcome a pull request from you to address this issue. Alternatively, if you tell me here that these files can be licensed under the same terms as the rest of C-Reduce, I will insert the appropriate notices myself.

(C-Reduce is primarily licensed under the University of Illinois Open Source License. See the file COPYING for details.)

Thanks!

llvm-config --cxxflags adds -Werror, but creduce usually isn't -Werror clean

It'd be handy if creduce's configure.ac and clang-delta/Makefile filtered -Werror out of llvm-config --cxxflags, otherwise it's unreasonably difficult to build creduce against an LLVM build that used -Werror.

Alternatively, maybe llvm-config shouldn't report -Werror. :)

Does not compile with LLVM SVN

I know supporting ever-changing LLVM API is not easy but this would be nice to check for known crashes with newer llvm versions. Here is the build error:

/havana/t/c/creduce/clang_delta/TransformationManager.cpp: In member function ‘bool TransformationManager::initializeCompilerInstance(std::__cxx11::string&)’:
/havana/t/c/creduce/clang_delta/TransformationManager.cpp:150:23: error: ‘class clang::Builtin::Context’ has no member named ‘InitializeBuiltins’
   PP.getBuiltinInfo().InitializeBuiltins(PP.getIdentifierTable(),
                       ^

Fix is using lower-case "initializeBuiltins" for llvm >= 3.8.0

Inconsistent 2.5.0 release tarball

There is a difference between 2.5.0 tarball file that is provided here on github and the one on utah.edu website:

$ diff -rw creduce-github-2.5.0/ creduce-utah-2.5.0/
Only in creduce-github-2.5.0/: .gitattributes
Only in creduce-github-2.5.0/: .gitignore
Only in creduce-github-2.5.0/: .travis.yml
Only in creduce-github-2.5.0/: Dockerfile
Only in creduce-github-2.5.0/: bootstrap
Only in creduce-github-2.5.0/clang_delta: .gitignore
Only in creduce-github-2.5.0/clex: .gitignore
Only in creduce-utah-2.5.0/clex: clex.c
Only in creduce-utah-2.5.0/clex: strlex.c
Only in creduce-github-2.5.0/creduce: .gitignore
Only in creduce-github-2.5.0/delta: .gitignore
Only in creduce-utah-2.5.0/delta: topformflat.c
Only in creduce-github-2.5.0/scripts: travis_deps.sh
Only in creduce-github-2.5.0/tests: .gitignore
Only in creduce-github-2.5.0/unifdef: .gitignore

unifdef can't build on Windows

It requires the non-standard err.h. This patch allows the code to compile and link:

--- a/unifdef/unifdef.h
+++ b/unifdef/unifdef.h
@@ -26,7 +26,15 @@
 #include <sys/stat.h>

 #include <ctype.h>
+#ifdef _WIN32
+#define errx(code, ...) do { fprintf(stderr, __VA_ARGS__); fprintf(stderr, "\n"); exit(code); } while(0)
+#define err errx
+#define warnx(...) do { fprintf(stderr, __VA_ARGS__); fprintf(stderr, "\n"); } while(0)
+#define warn warnx
+#define vwarnx(fmt, args) do { vfprintf(stderr, fmt, args); fprintf(stderr, "\n"); } while(0)
+#else
 #include <err.h>
+#endif
 #include <stdarg.h>
 #include <stdbool.h>
 #include <stdio.h>
@@ -45,6 +53,8 @@ mktempmode(char *tmp, int mode)
 {
    int fd = mkstemp(tmp);
    if (fd < 0) return (NULL);
+#ifndef _WIN32
    fchmod(fd, mode & (S_IRWXU|S_IRWXG|S_IRWXO));
+#endif
    return (fdopen(fd, "wb"));
 }