• A_guide_to_testcase_reduction

A Guide to Testcase Reduction

Our bug reporting instructions ask that a bug report include the preprocessed version of the file that triggers the bug. There are several methods to minimise a testcase.

This page ought to serve as an introduction to automatic testcase reduction using the Delta tool.

For Fortran exists a patched version of Delta which takes subroutine/do/if boundaries into account.

Simple ICE reduction

• We'll start with the most simple case, reducing the testcase for an internal compiler error (ICE). Start from the preprocessed input as got from using

  the -save-temps compiler option (the .i or .ii file), in the following we'll assume it is called testcase.i. As a first step remove empty lines and line/file markers inserted by the preprocessor

  > cat testcase.i | grep -v '^# .*$' | grep -v '^[[:space:]]*$' > testcase.x
  > mv testcase.x testcase.i

• The Delta tool requires us to create a script that exits with status zero in case of the intermediate reduced testcase still is a testcase for what we got it in the first place (the same ICE is produced). A sample script may look like (the testcase filename is passed as argument to the script)

  #!/bin/sh
  gcc -c -O -Wfatal-errors $1 2>&1 | grep 'internal compiler error: in typeck.c:2534'
  if ! test $? = 0; then
   exit 1
  fi
  exit 0

• Note the -Wfatal-errors option can greatly speed up reducing large testcases, because the compiler will not try error recovery and continue compiling invalid testcases. Of course if you start with an ICE-on-invalid testcase, this is not a good idea. You should be able to verify your script by invoking it with the unreduced testcase. Try if it has zero exit code. Now we can invoke Delta to have it reduce the testcase using the script we just wrote

  > ~/bin/delta -test=check.sh -suffix=.i -cp_minimal=testcase-min.i testcase.i

• This will reduce the testcase until no single line can be removed from it without the check.sh script failing to identify it as a valid testcase.

Using topformflat

• The way delta reduces a testcase by removing complete lines often conflicts with the syntactic structure of a C/C++ testcase. To make testcase reduction faster and more accurate there exists the topformflat tool in the Delta distribution that puts syntactically related tokens on one line, thereby making it possible to, f.i. restrict reduction to whole-function removal in a first step. Basically you can control the nesting level up to which tokens are put to separate lines where a level of zero is all toplevel constructs onto a line on their own, level one would be each statement of a toplevel function on a separate line. Reducing a big C++ testcase one usually starts with level zero, increasing it until Delta no longer can reduce the testcase further (due to the line-oriented reduction it may be worthwhile to start over with level zero again and iterate until there's no further reduction). An improved topformflat was posted at

  http://gcc.gnu.org/ml/gcc-patches/2005-08/msg01503.html where you can additionally specify if you want to ignore namespace and extern "C" as a nesting construct by specifying a second command line argument to topformflat.

  > ~/bin/topformflat 0 x < testcase.i > testcase.0x.i

Using multidelta

All the above can be simplified by using the multidelta tool that comes with the Delta distribution. The only differences is that the script should be able to be called without parameters. In the above example, the new script would be:

  #!/bin/bash
  TESTCASE=${1:-testcase.i}
  gcc -c -O -Wfatal-errors -w $TESTCASE 2>&1 | grep -q 'internal compiler error: in typeck.c:2534'
  if ! test $? = 0; then
   exit 1
  fi
  exit 0

The fastest is this script, the fastest the reduction will be:

• Avoid optimizing -O0 if it is a bug in the front-ends.

• If the bug is not triggered by a warning, disable all warnings -w.

• If the bug is an ICE that also happens with -fpermissive, then use it.

• If the bug is not in the preprocessor, use -fpreprocessed, otherwhise use -E.

• Use -S to avoid assembling.

• -o /dev/null if you do not need to analyze the output files.

• It may be slightly faster to invoke cc1 and cc1plus directly if the bug is not in the driver.

• For grepping, it is faster to not use regular expressions and invoke fgrep directly. It is also faster to use the option "--quiet".

Then, you may run multidelta with the command:

multidelta -level=2 ./check.sh testcase.i &> /dev/null

Where -level= is the level of topformflat (see above). Check the progress in the files log and multidelta.log. Multidelta modifies the input file, but it creates a backup .bak file). The last successful reduction is always stored in testcase.i.ok.

Using c_delta

After you have run multidelta it is often beneficial to run c_delta on your testcase. This delta debugger specifically targets C code and makes coordinated changes across the whole program: remove an array dimension, remove a function argument, reorder function calls, etc.

c_delta can be found here: c_delta.pl

You may run c_delta with the same script, that you've already used with multidelta:

c_delta.pl check.sh testcase.i --all

The --all flag tells c_delta to use all its internal methods.

Reducing "works with -O, doesn't work with -O2" type bugs

• First of all, you need to prepare the testcase so that you can easily tell, if it works or not works. The easiest way is to place some abort() in a conditional where you know it failed and ensure you return with zero exit code on success. For verifying if the reduced testcase is still correct, we need to use two compilations and runs, while watching out for possibly created infinite loops by the reduction process (adjust the timeout for your testcase).

  #!/bin/sh
  gcc -o works $1 -O -Wfatal-errors
  if ! test "$?" = "0"; then
    exit 1
  fi
  ( ulimit -t 10; ./works )
  if ! test "$?" = "0"; then
    exit 1
  fi
  gcc -o fails $1 -O2 -Wfatal-errors
  if ! test "$?" = "0"; then
    exit 1
  fi
  ( ulimit -t 10; ./fails )
  if test "$?" = "0"; then
    exit 1
  fi
  exit 0

• You can trivially make this script handle miscompilations that produce infinite loops or segmentation faults by adjusting the return value checks.

Reducing LTO bugs

• If you need to reduce testcases for LTO bugs that happen at link stage you have the problem that many object files (and thus source files) can be involved. If the bug is an internal compiler error you can bisect the files needed to trigger the bug using delta. From the lto1 invocation command extract the list-of-objects file (@/tmp/ccXXXXX), change spaces to newlines in there and prepend the current working directory name. Then use delta on that file with a check script similar to

  #!/bin/sh

  /path/to/lto1 -o /dev/null @$1 rest-of-your-options 2>&1 | grep '...the ICE...'
  if ! test $? = 0; then
    exit 1
  fi

• Now generate preprocessed source for the files required to build the remaining object files. You should be able to reproduce the ICE with

  gcc -r -nostdlib preprocessed-inputs rest-of-your-options

• And the preprocessed files can now be individually reduced with delta. Be careful with creating invalid testcases here though. Safe reduction can be done on topflatform level 0 and level 0 with ignoring namespaces. This is to avoid differences in type layout for same types in different files.

Further hints

• Sometimes it may be advisable to preserve parts of the testcase completely to make delta not reduce the testcase to nonsense still passing your script. This is also useful if you just want the smallest possible self-contained source for a function to ease analyzing whatever you are interested in. Split your testcase into two parts, one to be reduced and one invariant (called tail.i). Now we're going to reduce the first part under the presumption that the full testcase still compiles successfully.

 #!/bin/sh
 cat $1 ../../tail.i > x.i
 gcc -S x.i -Wfatal-errors
 if ! test "$?" = "0"; then
   exit 1
 fi
 exit 0

• You can even check for the same asm created in the above scheme, but you need to carefully create an ed script to cut out the relevant parts. An example could look like

 1,/^_Z8cpp_testRK5ArrayILi2Ed10BrickViewUES3_:/d
 /\.size/,$d
 ,w

• which deletes everything up to the interesting functions label and anything after the size marker after it. Create a sample asm file we can compare against with your initial testcase and the ed script (call it asm.s). Now the check script could look like:

 #!/bin/sh
 cat $1 ../../tail.i > x.i
 gcc -S x.i -Wfatal-errors
 if ! test "$?" = "0"; then
   exit 1
 fi
 ed x.s < ../../testcase.ed
 diff -u ../../asm.s x.s
 if ! test "$?" = "0"; then
   exit 1
 fi
 exit 0

• Sometimes it may be impossible or hard to minimize a testcase when dealing with a miscompilation.

  See Analysing_Large_Testcases for a guide on reducing effort on analyzing miscompilations by using bisection scripts and GCC's debug counters.