bugpoint Enhancement.

[DiamondLovesYou]

Summary

This patch adds two flags to bugpoint: "-replace-funcs-with-null" and "-disable-pass-list-reduction".

When "-replace-funcs-with-null" is specified, bugpoint will, instead of simply deleting function bodies, replace all uses of functions and then will delete functions completely from the test module, correctly handling aliasing and @llvm.used && @llvm.compiler.used. This part was conceived while trying to debug the PNaCl IR simplification passes, which don't allow undefined functions (ie no declarations).

With "-disable-pass-list-reduction", bugpoint won't try to reduce the set of passes causing the "crash". This is needed in cases where one is trying to debug an issue inside the PNaCl IR simplification passes which is causing an PNaCl ABI verification error, for example.

[jfb]

Could you also add tests for this in test/BugPoint/?

tools/bugpoint/CrashDebugger.cpp

49

disable-pass-list-reduction would be more idiomatic.

209

Isn't this always false? At least InstrProfiling.cpp does cast<ConstantArray>(LLVMUsed->getInitializer()) so one of these is wrong :-)

216

Using Value *V is clearer.

307

Can you instead replace all uses of the function with Undef of that type before deleting the function?

[DiamondLovesYou]

Fixed JF's comments.

tools/bugpoint/CrashDebugger.cpp

49

You're right; done!

209

No, because LLVM will replace an array with zeroinitializer when the last non-null value is replaced with null.

216

Done.

307

undef isn't considered a null value, meaning isNullValue would return false. It's not impossible to do, but I'm guessing it would change quite a bit of behavior and given that calling either null or undef is undefined behavior, I'd rather not mess with it post-mortem.

[jfb]

lgtm, let's leave this open if there are any other comments.

test/BugPoint/replace-funcs-with-null.ll

+; Test that bugpoint can reduce the set of functions by replacing them with null.
+;
+; RUN: bugpoint -load %llvmshlibdir/BugpointPasses%shlibext %s -output-prefix %t -replace-funcs-with-null -bugpoint-crash-decl-funcs -silence-passes -safe-run-llc
+; REQUIRES: loadable_module
+
+@foo2 = alias i32 ()* @foo
+
+define i32 @foo() { ret i32 1 }
+
+define i32 @test() {
+  call i32 @test()
+  ret i32 %1
+}
+
+define i32 @bar() { ret i32 2 }
+
[e-mail] = appending global [1 x i8*] [i8* bitcast (i32 ()* @foo to i8*)], section "llvm.metadata"

tools/bugpoint-passes/TestPasses.cpp

bool runOnBasicBlock(BasicBlock &BB) override {
             CI->replaceAllUsesWith(Constant::getNullValue(CI->getType()));
           CI->getParent()->getInstList().erase(CI);
           break;
         }
       return false;
     }
   };
 }
- 
 char DeleteCalls::ID = 0;
 static RegisterPass<DeleteCalls>
   Y("bugpoint-deletecalls",
     "BugPoint Test Pass - Intentionally 'misoptimize' CallInsts");
+
+namespace {
+  /// CrashOnDeclFunc - This pass is used to test bugpoint.  It intentionally
+  /// crash if the module has an undefined function (ie a function that is
+  /// defined in an external module).
+  class CrashOnDeclFunc : public ModulePass {
+  public:
+    static char ID; // Pass ID, replacement for typeid
+    CrashOnDeclFunc() : ModulePass(ID) {}
+  private:
+    bool runOnModule(Module &M) override {
+      for (auto &F : M.functions()) {
+        if (F.isDeclaration())
+          abort();
+      }
+      return false;
+    }
+  };
+}
+
+char CrashOnDeclFunc::ID = 0;
+static RegisterPass<CrashOnDeclFunc>
+  Z("bugpoint-crash-decl-funcs",
+    "BugPoint Test Pass - Intentionally crash on declared functions");

tools/bugpoint/CrashDebugger.cpp

namespace {
   cl::opt<bool>
   KeepMain("keep-main",
            cl::desc("Force function reduction to keep main"),
            cl::init(false));
   cl::opt<bool>
   NoGlobalRM ("disable-global-remove",
          cl::desc("Do not remove global variables"),
          cl::init(false));
+
+  cl::opt<bool>
+  ReplaceFuncsWithNull("replace-funcs-with-null",
+         cl::desc("When stubbing functions, replace all uses will null"),
+         cl::init(false));
+  cl::opt<bool>
+  DontReducePassList("disable-pass-list-reduction",
+                     cl::desc("Skip pass list reduction steps"),
+                     cl::init(false));
 }
 
 namespace llvm {
   class ReducePassList : public ListReducer<std::string> {
     BugDriver &BD;
   public:
     ReducePassList(BugDriver &bd) : BD(bd) {}
 
TestResult doTest(std::vector<Function*> &Prefix,
         return KeepPrefix;
       return NoFailure;
     }
 
     bool TestFuncs(std::vector<Function*> &Prefix);
   };
 }
 
+static void RemoveFunctionReferences(Module *M, const char* Name) {
+  auto *UsedVar = M->getGlobalVariable(Name, true);
+  if (!UsedVar || !UsedVar->hasInitializer()) return;
+  if (isa<ConstantAggregateZero>(UsedVar->getInitializer())) {
+    assert(UsedVar->use_empty());
+    UsedVar->eraseFromParent();
+    return;
+  }
+  auto *OldUsedVal = cast<ConstantArray>(UsedVar->getInitializer());
+  std::vector<Constant*> Used;
+  for(Value *V : OldUsedVal->operand_values()) {
+    Constant *Op = cast<Constant>(V->stripPointerCasts());
+    if(!Op->isNullValue()) {
+      Used.push_back(cast<Constant>(V));
+    }
+  }
+  auto *NewValElemTy = OldUsedVal->getType()->getElementType();
+  auto *NewValTy = ArrayType::get(NewValElemTy, Used.size());
+  auto *NewUsedVal = ConstantArray::get(NewValTy, Used);
+  UsedVar->mutateType(NewUsedVal->getType()->getPointerTo());
+  UsedVar->setInitializer(NewUsedVal);
+}
+
 bool ReduceCrashingFunctions::TestFuncs(std::vector<Function*> &Funcs) {
   // If main isn't present, claim there is no problem.
   if (KeepMain && std::find(Funcs.begin(), Funcs.end(),
                             BD.getProgram()->getFunction("main")) ==
                       Funcs.end())
     return false;
 
   // Clone the program to try hacking it apart...
   ValueToValueMapTy VMap;
   Module *M = CloneModule(BD.getProgram(), VMap);
 
   // Convert list to set for fast lookup...
   std::set<Function*> Functions;
   for (unsigned i = 0, e = Funcs.size(); i != e; ++i) {
     Function *CMF = cast<Function>(VMap[Funcs[i]]);
     assert(CMF && "Function not in module?!");
     assert(CMF->getFunctionType() == Funcs[i]->getFunctionType() && "wrong ty");
     assert(CMF->getName() == Funcs[i]->getName() && "wrong name");
     Functions.insert(CMF);
   }
 
   outs() << "Checking for crash with only these functions: ";
   PrintFunctionList(Funcs);
   outs() << ": ";
-
+  if (!ReplaceFuncsWithNull) {
     // Loop over and delete any functions which we aren't supposed to be playing
     // with...
     for (Module::iterator I = M->begin(), E = M->end(); I != E; ++I)
       if (!I->isDeclaration() && !Functions.count(I))
         DeleteFunctionBody(I);
+  } else {
+    std::vector<GlobalValue*> ToRemove;
+    // First, remove aliases to functions we're about to purge.
+    for (GlobalAlias &Alias : M->aliases()) {
+      Constant *Root = Alias.getAliasee()->stripPointerCasts();
+      Function *F = dyn_cast<Function>(Root);
+      if (F) {
+        if (Functions.count(F))
+          // We're keeping this function.
+          continue;
+      } else if (Root->isNullValue()) {
+        // This referenced a globalalias that we've already replaced,
+        // so we still need to replace this alias.
+      } else if (!F) {
+        // Not a function, therefore not something we mess with.
+        continue;
+      }
+
+      PointerType *Ty = cast<PointerType>(Alias.getType());
+      Constant *Replacement = ConstantPointerNull::get(Ty);
+      Alias.replaceAllUsesWith(Replacement);
+      ToRemove.push_back(&Alias);
+    }
+
+    for (Module::iterator I = M->begin(), E = M->end(); I != E; ++I) {
+      if (!I->isDeclaration() && !Functions.count(I)) {
+        PointerType *Ty = cast<PointerType>(I->getType());
+        Constant *Replacement = ConstantPointerNull::get(Ty);
+        I->replaceAllUsesWith(Replacement);
+        ToRemove.push_back(I);
+      }
+    }
 
+    for (auto *F : ToRemove) {
+      F->eraseFromParent();
+    }
+
+    // Finally, remove any null members from any global intrinsic.
+    RemoveFunctionReferences(M, "llvm.used");
+    RemoveFunctionReferences(M, "llvm.compiler.used");
+  }
   // Try running the hacked up program...
   if (TestFn(BD, M)) {
     BD.setNewProgram(M);        // It crashed, keep the trimmed version...
 
     // Make sure to use function pointers that point into the now-current
     // module.
     Funcs.assign(Functions.begin(), Functions.end());
     return true;
   }
   delete M;
   return false;
 }
 
 
 namespace {
   /// ReduceCrashingBlocks reducer - This works by setting the terminators of
for (Module::iterator I = M->begin(), E = M->end(); I != E; ++I)
     for (Function::iterator BB = I->begin(), E = I->end(); BB != E; ++BB)
       if (!Blocks.count(BB) && BB->getTerminator()->getNumSuccessors()) {
         // Loop over all of the successors of this block, deleting any PHI nodes
         // that might include it.
         for (succ_iterator SI = succ_begin(BB), E = succ_end(BB); SI != E; ++SI)
           (*SI)->removePredecessor(BB);
 
         TerminatorInst *BBTerm = BB->getTerminator();
-        
         if (!BB->getTerminator()->getType()->isVoidTy())
           BBTerm->replaceAllUsesWith(Constant::getNullValue(BBTerm->getType()));
 
         // Replace the old terminator instruction.
         BB->getInstList().pop_back();
         new UnreachableInst(BB->getContext(), BB);
       }
 

 /// It attempts to prune down the testcase to something reasonable, and figure
 /// out exactly which pass is crashing.
 ///
 bool BugDriver::debugOptimizerCrash(const std::string &ID) {
   outs() << "\n*** Debugging optimizer crash!\n";
 
   std::string Error;
   // Reduce the list of passes which causes the optimizer to crash...
-  if (!BugpointIsInterrupted)
+  if (!BugpointIsInterrupted && !DontReducePassList)
     ReducePassList(*this).reduceList(PassesToRun, Error);
   assert(Error.empty());
 
   outs() << "\n*** Found crashing pass"
          << (PassesToRun.size() == 1 ? ": " : "es: ")
          << getPassesString(PassesToRun) << '\n';
 
   EmitProgressBitcode(Program, ID);