cross translation unit test case reductiontest case reduction big file with property of interest...
TRANSCRIPT
![Page 1: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/1.jpg)
Cross Translation Unit Test Case ReductionRéka Kovács / [email protected]
Eötvös Loránd University / Ericsson Hungary
![Page 2: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/2.jpg)
Test Case Reduction
big file with property of interest(e.g. triggers crash)
small file with the same property of interest
magic
Delta Debugging:remove contiguous regions from the file, test & repeat
![Page 3: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/3.jpg)
Generalized Delta Debugging: C-Reduce
“Compiler-like” transformations (~74 of them): Clang-Deltae.g. remove a parameter from a function, move a parameter to a global variable, scalar replacement of aggregates, etc.
https://embed.cs.utah.edu/creduce/
Works on one translation unit at a time
![Page 4: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/4.jpg)
Cross Translation Unit Analysisin the Clang Static Analyzer
Developers need minimal testsfor crashes and bugs that
range across TU boundaries
llvm.org/devmtg/2017-03/
![Page 5: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/5.jpg)
Cross TU Analysis: Importing ASTs
analyzed filedependent files
You have 72 preprocessed files with ~100 000 average LOC
ASTs
![Page 6: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/6.jpg)
Cross TU Analysis: Importing ASTs
analyzed filedependent files
You have 72 preprocessed files with ~100 000 average LOCCross TU analysis crashes
ASTs
![Page 7: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/7.jpg)
Cross TU Analysis: Importing ASTs
analyzed filedependent files
You have 72 preprocessed files with ~100 000 average LOCCross TU analysis crashes
Find the bug!
ASTs
![Page 8: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/8.jpg)
Reduction Across Translation Units
void f(int) { __builtin_trap(); }
void f(int);
int main() { f(5); }
b.cpp a.cpp
$ clang++ a.cpp b.cpp$ ./a.outIllegal instruction (core dumped)
![Page 9: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/9.jpg)
Reduction Across Translation Units
void f(int) { __builtin_trap(); } void f(int);
int main() { f(5); }
b.cpp
a.cpp
void f(void) { __builtin_trap(); }
a.cpp
$ clang_delta --transformation=param-to-global a.cpp
![Page 10: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/10.jpg)
Reduction Across Translation Unitsb.cpp a.cpp
$ clang++ a.cpp b.cpp/tmp/b-ef5998.o: In function `main':b.cpp:(.text+0xa): undefined reference to`f(int)'clang-8: error: linker command failed with exit code 1 (use -v to see invocation)
void f(int);
int main() { f(5); }
void f(void) { __builtin_trap(); }
![Page 11: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/11.jpg)
Reduction Across Translation Units
void f(void) { __builtin_trap(); }
b.cpp a.cpp
We need to do the same transformation on the other file
What is the same transformation?
void f(int);
int main() { f(5); }
![Page 12: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/12.jpg)
Reduction Across Translation Units
void f(int) { __builtin_trap(); }
void f(int);
int main() { f(5); }
b.cpp a.cpp
Clang-Delta has no notion of the same transformation across files
It works with a counter of available transformation instances
Transformation: param-to-globalAvailable instances: 0
Transformation: param-to-globalAvailable instances: 1
1
![Page 13: Cross Translation Unit Test Case ReductionTest Case Reduction big file with property of interest (e.g. triggers crash) small file with the same property of interest magic Delta Debugging:](https://reader030.vdocument.in/reader030/viewer/2022040910/5e845684d0f64e1357770604/html5/thumbnails/13.jpg)
Reduction Across Translation Units
void f(int) { __builtin_trap(); }
void f(int);
int main() { f(5); }
b.cpp a.cpp
param-to-global would handleall uses of f() if they were in one TU
Unified Symbol Resolution (USR) ?
Transformation: param-to-globalAvailable instances: 0
Transformation: param-to-globalAvailable instances: 1
1