Miscompilation.cpp revision 5e783ab0b5fc3407ec59f1a598fdb9ef3b96b287
1//===- Miscompilation.cpp - Debug program miscompilations -----------------===// 2// 3// The LLVM Compiler Infrastructure 4// 5// This file was developed by the LLVM research group and is distributed under 6// the University of Illinois Open Source License. See LICENSE.TXT for details. 7// 8//===----------------------------------------------------------------------===// 9// 10// This file implements optimizer and code generation miscompilation debugging 11// support. 12// 13//===----------------------------------------------------------------------===// 14 15#include "BugDriver.h" 16#include "ListReducer.h" 17#include "llvm/Constants.h" 18#include "llvm/DerivedTypes.h" 19#include "llvm/Instructions.h" 20#include "llvm/Module.h" 21#include "llvm/Pass.h" 22#include "llvm/Analysis/Verifier.h" 23#include "llvm/Support/Mangler.h" 24#include "llvm/Transforms/Utils/Cloning.h" 25#include "llvm/Transforms/Utils/Linker.h" 26#include "Support/CommandLine.h" 27#include "Support/FileUtilities.h" 28using namespace llvm; 29 30namespace llvm { 31 extern cl::list<std::string> InputArgv; 32 cl::opt<bool> 33 EnableBlockExtraction("enable-block-extraction", 34 cl::desc("Enable basic block extraction for " 35 "miscompilation debugging (experimental)")); 36} 37 38namespace { 39 class ReduceMiscompilingPasses : public ListReducer<const PassInfo*> { 40 BugDriver &BD; 41 public: 42 ReduceMiscompilingPasses(BugDriver &bd) : BD(bd) {} 43 44 virtual TestResult doTest(std::vector<const PassInfo*> &Prefix, 45 std::vector<const PassInfo*> &Suffix); 46 }; 47} 48 49/// TestResult - After passes have been split into a test group and a control 50/// group, see if they still break the program. 51/// 52ReduceMiscompilingPasses::TestResult 53ReduceMiscompilingPasses::doTest(std::vector<const PassInfo*> &Prefix, 54 std::vector<const PassInfo*> &Suffix) { 55 // First, run the program with just the Suffix passes. If it is still broken 56 // with JUST the kept passes, discard the prefix passes. 57 std::cout << "Checking to see if '" << getPassesString(Suffix) 58 << "' compile correctly: "; 59 60 std::string BytecodeResult; 61 if (BD.runPasses(Suffix, BytecodeResult, false/*delete*/, true/*quiet*/)) { 62 std::cerr << " Error running this sequence of passes" 63 << " on the input program!\n"; 64 BD.setPassesToRun(Suffix); 65 BD.EmitProgressBytecode("pass-error", false); 66 exit(BD.debugOptimizerCrash()); 67 } 68 69 // Check to see if the finished program matches the reference output... 70 if (BD.diffProgram(BytecodeResult, "", true /*delete bytecode*/)) { 71 std::cout << " nope.\n"; 72 return KeepSuffix; // Miscompilation detected! 73 } 74 std::cout << " yup.\n"; // No miscompilation! 75 76 if (Prefix.empty()) return NoFailure; 77 78 // Next, see if the program is broken if we run the "prefix" passes first, 79 // then separately run the "kept" passes. 80 std::cout << "Checking to see if '" << getPassesString(Prefix) 81 << "' compile correctly: "; 82 83 // If it is not broken with the kept passes, it's possible that the prefix 84 // passes must be run before the kept passes to break it. If the program 85 // WORKS after the prefix passes, but then fails if running the prefix AND 86 // kept passes, we can update our bytecode file to include the result of the 87 // prefix passes, then discard the prefix passes. 88 // 89 if (BD.runPasses(Prefix, BytecodeResult, false/*delete*/, true/*quiet*/)) { 90 std::cerr << " Error running this sequence of passes" 91 << " on the input program!\n"; 92 BD.setPassesToRun(Prefix); 93 BD.EmitProgressBytecode("pass-error", false); 94 exit(BD.debugOptimizerCrash()); 95 } 96 97 // If the prefix maintains the predicate by itself, only keep the prefix! 98 if (BD.diffProgram(BytecodeResult)) { 99 std::cout << " nope.\n"; 100 removeFile(BytecodeResult); 101 return KeepPrefix; 102 } 103 std::cout << " yup.\n"; // No miscompilation! 104 105 // Ok, so now we know that the prefix passes work, try running the suffix 106 // passes on the result of the prefix passes. 107 // 108 Module *PrefixOutput = ParseInputFile(BytecodeResult); 109 if (PrefixOutput == 0) { 110 std::cerr << BD.getToolName() << ": Error reading bytecode file '" 111 << BytecodeResult << "'!\n"; 112 exit(1); 113 } 114 removeFile(BytecodeResult); // No longer need the file on disk 115 116 // Don't check if there are no passes in the suffix. 117 if (Suffix.empty()) 118 return NoFailure; 119 120 std::cout << "Checking to see if '" << getPassesString(Suffix) 121 << "' passes compile correctly after the '" 122 << getPassesString(Prefix) << "' passes: "; 123 124 Module *OriginalInput = BD.swapProgramIn(PrefixOutput); 125 if (BD.runPasses(Suffix, BytecodeResult, false/*delete*/, true/*quiet*/)) { 126 std::cerr << " Error running this sequence of passes" 127 << " on the input program!\n"; 128 BD.setPassesToRun(Suffix); 129 BD.EmitProgressBytecode("pass-error", false); 130 exit(BD.debugOptimizerCrash()); 131 } 132 133 // Run the result... 134 if (BD.diffProgram(BytecodeResult, "", true/*delete bytecode*/)) { 135 std::cout << " nope.\n"; 136 delete OriginalInput; // We pruned down the original input... 137 return KeepSuffix; 138 } 139 140 // Otherwise, we must not be running the bad pass anymore. 141 std::cout << " yup.\n"; // No miscompilation! 142 delete BD.swapProgramIn(OriginalInput); // Restore orig program & free test 143 return NoFailure; 144} 145 146namespace { 147 class ReduceMiscompilingFunctions : public ListReducer<Function*> { 148 BugDriver &BD; 149 bool (*TestFn)(BugDriver &, Module *, Module *); 150 public: 151 ReduceMiscompilingFunctions(BugDriver &bd, 152 bool (*F)(BugDriver &, Module *, Module *)) 153 : BD(bd), TestFn(F) {} 154 155 virtual TestResult doTest(std::vector<Function*> &Prefix, 156 std::vector<Function*> &Suffix) { 157 if (!Suffix.empty() && TestFuncs(Suffix)) 158 return KeepSuffix; 159 if (!Prefix.empty() && TestFuncs(Prefix)) 160 return KeepPrefix; 161 return NoFailure; 162 } 163 164 bool TestFuncs(const std::vector<Function*> &Prefix); 165 }; 166} 167 168/// TestMergedProgram - Given two modules, link them together and run the 169/// program, checking to see if the program matches the diff. If the diff 170/// matches, return false, otherwise return true. If the DeleteInputs argument 171/// is set to true then this function deletes both input modules before it 172/// returns. 173/// 174static bool TestMergedProgram(BugDriver &BD, Module *M1, Module *M2, 175 bool DeleteInputs) { 176 // Link the two portions of the program back to together. 177 std::string ErrorMsg; 178 if (!DeleteInputs) M1 = CloneModule(M1); 179 if (LinkModules(M1, M2, &ErrorMsg)) { 180 std::cerr << BD.getToolName() << ": Error linking modules together:" 181 << ErrorMsg << "\n"; 182 exit(1); 183 } 184 if (DeleteInputs) delete M2; // We are done with this module... 185 186 Module *OldProgram = BD.swapProgramIn(M1); 187 188 // Execute the program. If it does not match the expected output, we must 189 // return true. 190 bool Broken = BD.diffProgram(); 191 192 // Delete the linked module & restore the original 193 BD.swapProgramIn(OldProgram); 194 delete M1; 195 return Broken; 196} 197 198/// TestFuncs - split functions in a Module into two groups: those that are 199/// under consideration for miscompilation vs. those that are not, and test 200/// accordingly. Each group of functions becomes a separate Module. 201/// 202bool ReduceMiscompilingFunctions::TestFuncs(const std::vector<Function*>&Funcs){ 203 // Test to see if the function is misoptimized if we ONLY run it on the 204 // functions listed in Funcs. 205 std::cout << "Checking to see if the program is misoptimized when " 206 << (Funcs.size()==1 ? "this function is" : "these functions are") 207 << " run through the pass" 208 << (BD.getPassesToRun().size() == 1 ? "" : "es") << ":"; 209 PrintFunctionList(Funcs); 210 std::cout << "\n"; 211 212 // Split the module into the two halves of the program we want. 213 Module *ToNotOptimize = CloneModule(BD.getProgram()); 214 Module *ToOptimize = SplitFunctionsOutOfModule(ToNotOptimize, Funcs); 215 216 // Run the predicate, not that the predicate will delete both input modules. 217 return TestFn(BD, ToOptimize, ToNotOptimize); 218} 219 220/// DisambiguateGlobalSymbols - Mangle symbols to guarantee uniqueness by 221/// modifying predominantly internal symbols rather than external ones. 222/// 223static void DisambiguateGlobalSymbols(Module *M) { 224 // Try not to cause collisions by minimizing chances of renaming an 225 // already-external symbol, so take in external globals and functions as-is. 226 // The code should work correctly without disambiguation (assuming the same 227 // mangler is used by the two code generators), but having symbols with the 228 // same name causes warnings to be emitted by the code generator. 229 Mangler Mang(*M); 230 for (Module::giterator I = M->gbegin(), E = M->gend(); I != E; ++I) 231 I->setName(Mang.getValueName(I)); 232 for (Module::iterator I = M->begin(), E = M->end(); I != E; ++I) 233 I->setName(Mang.getValueName(I)); 234} 235 236/// ExtractLoops - Given a reduced list of functions that still exposed the bug, 237/// check to see if we can extract the loops in the region without obscuring the 238/// bug. If so, it reduces the amount of code identified. 239/// 240static bool ExtractLoops(BugDriver &BD, 241 bool (*TestFn)(BugDriver &, Module *, Module *), 242 std::vector<Function*> &MiscompiledFunctions) { 243 bool MadeChange = false; 244 while (1) { 245 Module *ToNotOptimize = CloneModule(BD.getProgram()); 246 Module *ToOptimize = SplitFunctionsOutOfModule(ToNotOptimize, 247 MiscompiledFunctions); 248 Module *ToOptimizeLoopExtracted = BD.ExtractLoop(ToOptimize); 249 if (!ToOptimizeLoopExtracted) { 250 // If the loop extractor crashed or if there were no extractible loops, 251 // then this chapter of our odyssey is over with. 252 delete ToNotOptimize; 253 delete ToOptimize; 254 return MadeChange; 255 } 256 257 std::cerr << "Extracted a loop from the breaking portion of the program.\n"; 258 delete ToOptimize; 259 260 // Bugpoint is intentionally not very trusting of LLVM transformations. In 261 // particular, we're not going to assume that the loop extractor works, so 262 // we're going to test the newly loop extracted program to make sure nothing 263 // has broken. If something broke, then we'll inform the user and stop 264 // extraction. 265 AbstractInterpreter *AI = BD.switchToCBE(); 266 if (TestMergedProgram(BD, ToOptimizeLoopExtracted, ToNotOptimize, false)) { 267 BD.switchToInterpreter(AI); 268 269 // Merged program doesn't work anymore! 270 std::cerr << " *** ERROR: Loop extraction broke the program. :(" 271 << " Please report a bug!\n"; 272 std::cerr << " Continuing on with un-loop-extracted version.\n"; 273 delete ToNotOptimize; 274 delete ToOptimizeLoopExtracted; 275 return MadeChange; 276 } 277 BD.switchToInterpreter(AI); 278 279 std::cout << " Testing after loop extraction:\n"; 280 // Clone modules, the tester function will free them. 281 Module *TOLEBackup = CloneModule(ToOptimizeLoopExtracted); 282 Module *TNOBackup = CloneModule(ToNotOptimize); 283 if (!TestFn(BD, ToOptimizeLoopExtracted, ToNotOptimize)) { 284 std::cout << "*** Loop extraction masked the problem. Undoing.\n"; 285 // If the program is not still broken, then loop extraction did something 286 // that masked the error. Stop loop extraction now. 287 delete TOLEBackup; 288 delete TNOBackup; 289 return MadeChange; 290 } 291 ToOptimizeLoopExtracted = TOLEBackup; 292 ToNotOptimize = TNOBackup; 293 294 std::cout << "*** Loop extraction successful!\n"; 295 296 // Okay, great! Now we know that we extracted a loop and that loop 297 // extraction both didn't break the program, and didn't mask the problem. 298 // Replace the current program with the loop extracted version, and try to 299 // extract another loop. 300 std::string ErrorMsg; 301 if (LinkModules(ToNotOptimize, ToOptimizeLoopExtracted, &ErrorMsg)) { 302 std::cerr << BD.getToolName() << ": Error linking modules together:" 303 << ErrorMsg << "\n"; 304 exit(1); 305 } 306 307 // All of the Function*'s in the MiscompiledFunctions list are in the old 308 // module. Update this list to include all of the functions in the 309 // optimized and loop extracted module. 310 MiscompiledFunctions.clear(); 311 for (Module::iterator I = ToOptimizeLoopExtracted->begin(), 312 E = ToOptimizeLoopExtracted->end(); I != E; ++I) { 313 if (!I->isExternal()) { 314 Function *NewF = ToNotOptimize->getFunction(I->getName(), 315 I->getFunctionType()); 316 assert(NewF && "Function not found??"); 317 MiscompiledFunctions.push_back(NewF); 318 } 319 } 320 delete ToOptimizeLoopExtracted; 321 322 BD.setNewProgram(ToNotOptimize); 323 MadeChange = true; 324 } 325} 326 327namespace { 328 class ReduceMiscompiledBlocks : public ListReducer<BasicBlock*> { 329 BugDriver &BD; 330 bool (*TestFn)(BugDriver &, Module *, Module *); 331 std::vector<Function*> FunctionsBeingTested; 332 public: 333 ReduceMiscompiledBlocks(BugDriver &bd, 334 bool (*F)(BugDriver &, Module *, Module *), 335 const std::vector<Function*> &Fns) 336 : BD(bd), TestFn(F), FunctionsBeingTested(Fns) {} 337 338 virtual TestResult doTest(std::vector<BasicBlock*> &Prefix, 339 std::vector<BasicBlock*> &Suffix) { 340 if (!Suffix.empty() && TestFuncs(Suffix)) 341 return KeepSuffix; 342 if (TestFuncs(Prefix)) 343 return KeepPrefix; 344 return NoFailure; 345 } 346 347 bool TestFuncs(const std::vector<BasicBlock*> &Prefix); 348 }; 349} 350 351/// TestFuncs - Extract all blocks for the miscompiled functions except for the 352/// specified blocks. If the problem still exists, return true. 353/// 354bool ReduceMiscompiledBlocks::TestFuncs(const std::vector<BasicBlock*> &BBs) { 355 // Test to see if the function is misoptimized if we ONLY run it on the 356 // functions listed in Funcs. 357 std::cout << "Checking to see if the program is misoptimized when all but " 358 << "these " << BBs.size() << " blocks are extracted: "; 359 for (unsigned i = 0, e = BBs.size() < 10 ? BBs.size() : 10; i != e; ++i) 360 std::cout << BBs[i]->getName() << " "; 361 if (BBs.size() > 10) std::cout << "..."; 362 std::cout << "\n"; 363 364 // Split the module into the two halves of the program we want. 365 Module *ToNotOptimize = CloneModule(BD.getProgram()); 366 Module *ToOptimize = SplitFunctionsOutOfModule(ToNotOptimize, 367 FunctionsBeingTested); 368 369 // Try the extraction. If it doesn't work, then the block extractor crashed 370 // or something, in which case bugpoint can't chase down this possibility. 371 if (Module *New = BD.ExtractMappedBlocksFromModule(BBs, ToOptimize)) { 372 delete ToOptimize; 373 // Run the predicate, not that the predicate will delete both input modules. 374 return TestFn(BD, New, ToNotOptimize); 375 } 376 delete ToOptimize; 377 delete ToNotOptimize; 378 return false; 379} 380 381 382/// ExtractBlocks - Given a reduced list of functions that still expose the bug, 383/// extract as many basic blocks from the region as possible without obscuring 384/// the bug. 385/// 386static bool ExtractBlocks(BugDriver &BD, 387 bool (*TestFn)(BugDriver &, Module *, Module *), 388 std::vector<Function*> &MiscompiledFunctions) { 389 // Not enabled?? 390 if (!EnableBlockExtraction) return false; 391 392 std::vector<BasicBlock*> Blocks; 393 for (unsigned i = 0, e = MiscompiledFunctions.size(); i != e; ++i) 394 for (Function::iterator I = MiscompiledFunctions[i]->begin(), 395 E = MiscompiledFunctions[i]->end(); I != E; ++I) 396 Blocks.push_back(I); 397 398 // Use the list reducer to identify blocks that can be extracted without 399 // obscuring the bug. The Blocks list will end up containing blocks that must 400 // be retained from the original program. 401 unsigned OldSize = Blocks.size(); 402 ReduceMiscompiledBlocks(BD, TestFn, MiscompiledFunctions).reduceList(Blocks); 403 if (Blocks.size() == OldSize) 404 return false; 405 406 407 408 // FIXME: This should actually update the module in the bugdriver! 409 410 411 412 return false; 413} 414 415 416/// DebugAMiscompilation - This is a generic driver to narrow down 417/// miscompilations, either in an optimization or a code generator. 418/// 419static std::vector<Function*> 420DebugAMiscompilation(BugDriver &BD, 421 bool (*TestFn)(BugDriver &, Module *, Module *)) { 422 // Okay, now that we have reduced the list of passes which are causing the 423 // failure, see if we can pin down which functions are being 424 // miscompiled... first build a list of all of the non-external functions in 425 // the program. 426 std::vector<Function*> MiscompiledFunctions; 427 Module *Prog = BD.getProgram(); 428 for (Module::iterator I = Prog->begin(), E = Prog->end(); I != E; ++I) 429 if (!I->isExternal()) 430 MiscompiledFunctions.push_back(I); 431 432 // Do the reduction... 433 ReduceMiscompilingFunctions(BD, TestFn).reduceList(MiscompiledFunctions); 434 435 std::cout << "\n*** The following function" 436 << (MiscompiledFunctions.size() == 1 ? " is" : "s are") 437 << " being miscompiled: "; 438 PrintFunctionList(MiscompiledFunctions); 439 std::cout << "\n"; 440 441 // See if we can rip any loops out of the miscompiled functions and still 442 // trigger the problem. 443 if (ExtractLoops(BD, TestFn, MiscompiledFunctions)) { 444 // Okay, we extracted some loops and the problem still appears. See if we 445 // can eliminate some of the created functions from being candidates. 446 447 // Loop extraction can introduce functions with the same name (foo_code). 448 // Make sure to disambiguate the symbols so that when the program is split 449 // apart that we can link it back together again. 450 DisambiguateGlobalSymbols(BD.getProgram()); 451 452 // Do the reduction... 453 ReduceMiscompilingFunctions(BD, TestFn).reduceList(MiscompiledFunctions); 454 455 std::cout << "\n*** The following function" 456 << (MiscompiledFunctions.size() == 1 ? " is" : "s are") 457 << " being miscompiled: "; 458 PrintFunctionList(MiscompiledFunctions); 459 std::cout << "\n"; 460 } 461 462 if (ExtractBlocks(BD, TestFn, MiscompiledFunctions)) { 463 // Okay, we extracted some blocks and the problem still appears. See if we 464 // can eliminate some of the created functions from being candidates. 465 466 // Block extraction can introduce functions with the same name (foo_code). 467 // Make sure to disambiguate the symbols so that when the program is split 468 // apart that we can link it back together again. 469 DisambiguateGlobalSymbols(BD.getProgram()); 470 471 // Do the reduction... 472 ReduceMiscompilingFunctions(BD, TestFn).reduceList(MiscompiledFunctions); 473 474 std::cout << "\n*** The following function" 475 << (MiscompiledFunctions.size() == 1 ? " is" : "s are") 476 << " being miscompiled: "; 477 PrintFunctionList(MiscompiledFunctions); 478 std::cout << "\n"; 479 } 480 481 return MiscompiledFunctions; 482} 483 484/// TestOptimizer - This is the predicate function used to check to see if the 485/// "Test" portion of the program is misoptimized. If so, return true. In any 486/// case, both module arguments are deleted. 487/// 488static bool TestOptimizer(BugDriver &BD, Module *Test, Module *Safe) { 489 // Run the optimization passes on ToOptimize, producing a transformed version 490 // of the functions being tested. 491 std::cout << " Optimizing functions being tested: "; 492 Module *Optimized = BD.runPassesOn(Test, BD.getPassesToRun(), 493 /*AutoDebugCrashes*/true); 494 std::cout << "done.\n"; 495 delete Test; 496 497 std::cout << " Checking to see if the merged program executes correctly: "; 498 bool Broken = TestMergedProgram(BD, Optimized, Safe, true); 499 std::cout << (Broken ? " nope.\n" : " yup.\n"); 500 return Broken; 501} 502 503 504/// debugMiscompilation - This method is used when the passes selected are not 505/// crashing, but the generated output is semantically different from the 506/// input. 507/// 508bool BugDriver::debugMiscompilation() { 509 // Make sure something was miscompiled... 510 if (!ReduceMiscompilingPasses(*this).reduceList(PassesToRun)) { 511 std::cerr << "*** Optimized program matches reference output! No problem " 512 << "detected...\nbugpoint can't help you with your problem!\n"; 513 return false; 514 } 515 516 std::cout << "\n*** Found miscompiling pass" 517 << (getPassesToRun().size() == 1 ? "" : "es") << ": " 518 << getPassesString(getPassesToRun()) << "\n"; 519 EmitProgressBytecode("passinput"); 520 521 std::vector<Function*> MiscompiledFunctions = 522 DebugAMiscompilation(*this, TestOptimizer); 523 524 // Output a bunch of bytecode files for the user... 525 std::cout << "Outputting reduced bytecode files which expose the problem:\n"; 526 Module *ToNotOptimize = CloneModule(getProgram()); 527 Module *ToOptimize = SplitFunctionsOutOfModule(ToNotOptimize, 528 MiscompiledFunctions); 529 530 std::cout << " Non-optimized portion: "; 531 ToNotOptimize = swapProgramIn(ToNotOptimize); 532 EmitProgressBytecode("tonotoptimize", true); 533 setNewProgram(ToNotOptimize); // Delete hacked module. 534 535 std::cout << " Portion that is input to optimizer: "; 536 ToOptimize = swapProgramIn(ToOptimize); 537 EmitProgressBytecode("tooptimize"); 538 setNewProgram(ToOptimize); // Delete hacked module. 539 540 return false; 541} 542 543/// CleanupAndPrepareModules - Get the specified modules ready for code 544/// generator testing. 545/// 546static void CleanupAndPrepareModules(BugDriver &BD, Module *&Test, 547 Module *Safe) { 548 // Clean up the modules, removing extra cruft that we don't need anymore... 549 Test = BD.performFinalCleanups(Test); 550 551 // If we are executing the JIT, we have several nasty issues to take care of. 552 if (!BD.isExecutingJIT()) return; 553 554 // First, if the main function is in the Safe module, we must add a stub to 555 // the Test module to call into it. Thus, we create a new function `main' 556 // which just calls the old one. 557 if (Function *oldMain = Safe->getNamedFunction("main")) 558 if (!oldMain->isExternal()) { 559 // Rename it 560 oldMain->setName("llvm_bugpoint_old_main"); 561 // Create a NEW `main' function with same type in the test module. 562 Function *newMain = new Function(oldMain->getFunctionType(), 563 GlobalValue::ExternalLinkage, 564 "main", Test); 565 // Create an `oldmain' prototype in the test module, which will 566 // corresponds to the real main function in the same module. 567 Function *oldMainProto = new Function(oldMain->getFunctionType(), 568 GlobalValue::ExternalLinkage, 569 oldMain->getName(), Test); 570 // Set up and remember the argument list for the main function. 571 std::vector<Value*> args; 572 for (Function::aiterator I = newMain->abegin(), E = newMain->aend(), 573 OI = oldMain->abegin(); I != E; ++I, ++OI) { 574 I->setName(OI->getName()); // Copy argument names from oldMain 575 args.push_back(I); 576 } 577 578 // Call the old main function and return its result 579 BasicBlock *BB = new BasicBlock("entry", newMain); 580 CallInst *call = new CallInst(oldMainProto, args); 581 BB->getInstList().push_back(call); 582 583 // If the type of old function wasn't void, return value of call 584 new ReturnInst(oldMain->getReturnType() != Type::VoidTy ? call : 0, BB); 585 } 586 587 // The second nasty issue we must deal with in the JIT is that the Safe 588 // module cannot directly reference any functions defined in the test 589 // module. Instead, we use a JIT API call to dynamically resolve the 590 // symbol. 591 592 // Add the resolver to the Safe module. 593 // Prototype: void *getPointerToNamedFunction(const char* Name) 594 Function *resolverFunc = 595 Safe->getOrInsertFunction("getPointerToNamedFunction", 596 PointerType::get(Type::SByteTy), 597 PointerType::get(Type::SByteTy), 0); 598 599 // Use the function we just added to get addresses of functions we need. 600 for (Module::iterator F = Safe->begin(), E = Safe->end(); F != E; ++F) { 601 if (F->isExternal() && !F->use_empty() && &*F != resolverFunc && 602 F->getIntrinsicID() == 0 /* ignore intrinsics */) { 603 Function *TestFn = Test->getFunction(F->getName(), F->getFunctionType()); 604 605 // Don't forward functions which are external in the test module too. 606 if (TestFn && !TestFn->isExternal()) { 607 // 1. Add a string constant with its name to the global file 608 Constant *InitArray = ConstantArray::get(F->getName()); 609 GlobalVariable *funcName = 610 new GlobalVariable(InitArray->getType(), true /*isConstant*/, 611 GlobalValue::InternalLinkage, InitArray, 612 F->getName() + "_name", Safe); 613 614 // 2. Use `GetElementPtr *funcName, 0, 0' to convert the string to an 615 // sbyte* so it matches the signature of the resolver function. 616 617 // GetElementPtr *funcName, ulong 0, ulong 0 618 std::vector<Constant*> GEPargs(2,Constant::getNullValue(Type::IntTy)); 619 Value *GEP = 620 ConstantExpr::getGetElementPtr(ConstantPointerRef::get(funcName), 621 GEPargs); 622 std::vector<Value*> ResolverArgs; 623 ResolverArgs.push_back(GEP); 624 625 // Rewrite uses of F in global initializers, etc. to uses of a wrapper 626 // function that dynamically resolves the calls to F via our JIT API 627 if (F->use_begin() != F->use_end()) { 628 // Construct a new stub function that will re-route calls to F 629 const FunctionType *FuncTy = F->getFunctionType(); 630 Function *FuncWrapper = new Function(FuncTy, 631 GlobalValue::InternalLinkage, 632 F->getName() + "_wrapper", 633 F->getParent()); 634 BasicBlock *Header = new BasicBlock("header", FuncWrapper); 635 636 // Resolve the call to function F via the JIT API: 637 // 638 // call resolver(GetElementPtr...) 639 CallInst *resolve = new CallInst(resolverFunc, ResolverArgs, 640 "resolver"); 641 Header->getInstList().push_back(resolve); 642 // cast the result from the resolver to correctly-typed function 643 CastInst *castResolver = 644 new CastInst(resolve, PointerType::get(F->getFunctionType()), 645 "resolverCast"); 646 Header->getInstList().push_back(castResolver); 647 648 // Save the argument list 649 std::vector<Value*> Args; 650 for (Function::aiterator i = FuncWrapper->abegin(), 651 e = FuncWrapper->aend(); i != e; ++i) 652 Args.push_back(i); 653 654 // Pass on the arguments to the real function, return its result 655 if (F->getReturnType() == Type::VoidTy) { 656 CallInst *Call = new CallInst(castResolver, Args); 657 Header->getInstList().push_back(Call); 658 ReturnInst *Ret = new ReturnInst(); 659 Header->getInstList().push_back(Ret); 660 } else { 661 CallInst *Call = new CallInst(castResolver, Args, "redir"); 662 Header->getInstList().push_back(Call); 663 ReturnInst *Ret = new ReturnInst(Call); 664 Header->getInstList().push_back(Ret); 665 } 666 667 // Use the wrapper function instead of the old function 668 F->replaceAllUsesWith(FuncWrapper); 669 } 670 } 671 } 672 } 673 674 if (verifyModule(*Test) || verifyModule(*Safe)) { 675 std::cerr << "Bugpoint has a bug, which corrupted a module!!\n"; 676 abort(); 677 } 678} 679 680 681 682/// TestCodeGenerator - This is the predicate function used to check to see if 683/// the "Test" portion of the program is miscompiled by the code generator under 684/// test. If so, return true. In any case, both module arguments are deleted. 685/// 686static bool TestCodeGenerator(BugDriver &BD, Module *Test, Module *Safe) { 687 CleanupAndPrepareModules(BD, Test, Safe); 688 689 std::string TestModuleBC = getUniqueFilename("bugpoint.test.bc"); 690 if (BD.writeProgramToFile(TestModuleBC, Test)) { 691 std::cerr << "Error writing bytecode to `" << TestModuleBC << "'\nExiting."; 692 exit(1); 693 } 694 delete Test; 695 696 // Make the shared library 697 std::string SafeModuleBC = getUniqueFilename("bugpoint.safe.bc"); 698 699 if (BD.writeProgramToFile(SafeModuleBC, Safe)) { 700 std::cerr << "Error writing bytecode to `" << SafeModuleBC << "'\nExiting."; 701 exit(1); 702 } 703 std::string SharedObject = BD.compileSharedObject(SafeModuleBC); 704 delete Safe; 705 706 // Run the code generator on the `Test' code, loading the shared library. 707 // The function returns whether or not the new output differs from reference. 708 int Result = BD.diffProgram(TestModuleBC, SharedObject, false); 709 710 if (Result) 711 std::cerr << ": still failing!\n"; 712 else 713 std::cerr << ": didn't fail.\n"; 714 removeFile(TestModuleBC); 715 removeFile(SafeModuleBC); 716 removeFile(SharedObject); 717 718 return Result; 719} 720 721 722/// debugCodeGenerator - debug errors in LLC, LLI, or CBE. 723/// 724bool BugDriver::debugCodeGenerator() { 725 if ((void*)cbe == (void*)Interpreter) { 726 std::string Result = executeProgramWithCBE("bugpoint.cbe.out"); 727 std::cout << "\n*** The C backend cannot match the reference diff, but it " 728 << "is used as the 'known good'\n code generator, so I can't" 729 << " debug it. Perhaps you have a front-end problem?\n As a" 730 << " sanity check, I left the result of executing the program " 731 << "with the C backend\n in this file for you: '" 732 << Result << "'.\n"; 733 return true; 734 } 735 736 DisambiguateGlobalSymbols(Program); 737 738 std::vector<Function*> Funcs = DebugAMiscompilation(*this, TestCodeGenerator); 739 740 // Split the module into the two halves of the program we want. 741 Module *ToNotCodeGen = CloneModule(getProgram()); 742 Module *ToCodeGen = SplitFunctionsOutOfModule(ToNotCodeGen, Funcs); 743 744 // Condition the modules 745 CleanupAndPrepareModules(*this, ToCodeGen, ToNotCodeGen); 746 747 std::string TestModuleBC = getUniqueFilename("bugpoint.test.bc"); 748 if (writeProgramToFile(TestModuleBC, ToCodeGen)) { 749 std::cerr << "Error writing bytecode to `" << TestModuleBC << "'\nExiting."; 750 exit(1); 751 } 752 delete ToCodeGen; 753 754 // Make the shared library 755 std::string SafeModuleBC = getUniqueFilename("bugpoint.safe.bc"); 756 if (writeProgramToFile(SafeModuleBC, ToNotCodeGen)) { 757 std::cerr << "Error writing bytecode to `" << SafeModuleBC << "'\nExiting."; 758 exit(1); 759 } 760 std::string SharedObject = compileSharedObject(SafeModuleBC); 761 delete ToNotCodeGen; 762 763 std::cout << "You can reproduce the problem with the command line: \n"; 764 if (isExecutingJIT()) { 765 std::cout << " lli -load " << SharedObject << " " << TestModuleBC; 766 } else { 767 std::cout << " llc " << TestModuleBC << " -o " << TestModuleBC << ".s\n"; 768 std::cout << " gcc " << SharedObject << " " << TestModuleBC 769 << ".s -o " << TestModuleBC << ".exe -Wl,-R.\n"; 770 std::cout << " " << TestModuleBC << ".exe"; 771 } 772 for (unsigned i=0, e = InputArgv.size(); i != e; ++i) 773 std::cout << " " << InputArgv[i]; 774 std::cout << "\n"; 775 std::cout << "The shared object was created with:\n llc -march=c " 776 << SafeModuleBC << " -o temporary.c\n" 777 << " gcc -xc temporary.c -O2 -o " << SharedObject 778#if defined(sparc) || defined(__sparc__) || defined(__sparcv9) 779 << " -G" // Compile a shared library, `-G' for Sparc 780#else 781 << " -shared" // `-shared' for Linux/X86, maybe others 782#endif 783 << " -fno-strict-aliasing\n"; 784 785 return false; 786} 787