In this recipe, you will learn about a useful tool provided by LLVM infrastructure, known as bugpoint. Bugpoint allows us to narrow down the source of problems in the LLVM's tools and passes. It is helpful in debugging optimizer crashes, miscompilations by optimizers, or bad native code generation. Using this, we can get a small test case for our problem and work on that.
Perform the following steps:
- Write the test cases using the bugpoint tool:
$ cat crash-narrowfunctiontest.ll define i32 @foo() { ret i32 1 } define i32 @test() { call i32 @test() ret i32 %1 } define i32 @bar() { ret i32 2 }
- Use bugpoint in this test case to view the results :
$ bugpoint -load path-to-llvm/build/./lib/BugpointPasses.so crash-narrowfunctiontest.ll -output-prefix crash-narrowfunctiontest.ll.tmp -bugpoint-cras hcalls -silence-passes Read input file : 'crash-narrowfunctiontest.ll' *** All input ok Running selected passes on program to test for crash: Crashed: Aborted (core dumped) Dumped core *** Debugging optimizer crash! Checking to see if these passes crash: -bugpoint-crashcalls: Crashed: Aborted (core dumped) Dumped core *** Found crashing pass: -bugpoint-crashcalls Emitted bitcode to 'crash-narrowfunctiontest.ll.tmp-passes.bc' *** You can reproduce the problem with: opt crash-narrowfunctiontest.ll.tmp-passes.bc -load /home/mayur/LLVMSVN_REV/llvm/llvm/rbuild/./lib/BugpointPasses.so -bugpoint-crashcalls *** Attempting to reduce the number of functions in the testcase Checking for crash with only these functions: foo test bar: Crashed: Aborted (core dumped) Dumped core Checking for crash with only these functions: foo test: Crashed: Aborted (core dumped) Dumped core Checking for crash with only these functions: test: Crashed: Aborted (core dumped) Dumped core Emitted bitcode to 'crash-narrowfunctiontest.ll.tmp-reduced-function.bc' *** You can reproduce the problem with: opt crash-narrowfunctiontest.ll.tmp-reduced-function.bc -load /home/mayur/LLVMSVN_REV/llvm/llvm/rbuild/./lib/BugpointPasses.so -bugpoint-crashcalls Checking for crash with only these blocks: : Crashed: Aborted (core dumped) Dumped core Emitted bitcode to 'crash-narrowfunctiontest.ll.tmp-reduced-blocks.bc' *** You can reproduce the problem with: opt crash-narrowfunctiontest.ll.tmp-reduced-blocks.bc -load /home/mayur/LLVMSVN_REV/llvm/llvm/rbuild/./lib/BugpointPasses.so -bugpoint-crashcalls Checking for crash with only 1 instruction: Crashed: Aborted (core dumped) Dumped core *** Attempting to reduce testcase by deleting instructions: Simplification Level #1 Checking instruction: %1 = call i32 @test()Success! *** Attempting to reduce testcase by deleting instructions: Simplification Level #0 Checking instruction: %1 = call i32 @test()Success! *** Attempting to perform final cleanups: Crashed: Aborted (core dumped) Dumped core Emitted bitcode to 'crash-narrowfunctiontest.ll.tmp-reduced-simplified.bc' *** You can reproduce the problem with: opt crash-narrowfunctiontest.ll.tmp-reduced-simplified.bc -load /home/mayur/LLVMSVN_REV/llvm/llvm/rbuild/./lib/BugpointPasses.so -bugpoint-crashcalls
- Now, to see the reduced test case, use the
llvm-discommand to convert thecrash-narrowfunctiontest.ll.tmp-reduced-simplified.bcfile to the.llform. Then, view the reduced test case:$ llvm-dis crash-narrowfunctiontest.ll.tmp-reduced-simplified.bc $ cat $ cat crash-narrowfunctiontest.ll.tmp-reduced-simplified.ll define void @test() { call void @test() ret void }
The bugpoint tool runs all the passes specified in the command line on the test program. If any of these passes crash, bugpoint starts the crash debugger. The crash debugger tries to reduce the list of passes that cause this crash. Then it tries to removes unnecessary functions. Once able to reduce the test program to a single function, it tries to deletes the edges of the control flow graph to reduce the size of the function. After this, it proceeds to remove the individual LLVM instructions whose absence does not impact the failure. In the end, bugpoint gives the output showing which pass is causing the crash and a simplified reduced test case.
If the –output option wasn't specified, then bugpoint runs the program on a "safe" backend and generated reference output. It then compares the output generated by the selected code generator. If there is a crash, it runs the crash debugger as explained in the previous paragraph. Other than this, if the output generated by the code generator differs from the reference output, it starts the code generator debugger, which reduces the test case through techniques similar to those of the crash debugger.
Finally, if the output generated by the code generator and the reference output are the same, then bugpoint runs all the LLVM passes and checks the output against the reference output. If there is any mismatch, then it runs the miscompilation debugger. The miscompilation debugger works by splitting the test program into two pieces. It runs the optimizations as specified on one piece, then links the two pieces back together, and finally executes the result. It tries to narrow down to the pass that is causing miscompilation from the list of passes, and then pinpoints the portion of the test program that is being miscompiled. It outputs the reduced case that is causing the miscompilation.
In the preceding test case, bugpoint checks for the crash in all functions, and ends up knowing that the problem lies in the test function. It also tries to reduce the instructions within the function. The output for every stage is displayed on the terminal, which is self-explanatory. In the end, it produces a simplified reduced test case in the bitcode format, which we can convert to the LLVM IR and get the reduced test case.
- To read more on bugpoint, go to http://llvm.org/docs/Bugpoint.html