Home | History | Annotate | Download | only in bugpoint
      1 //===- CrashDebugger.cpp - Debug compilation crashes ----------------------===//
      2 //
      3 //                     The LLVM Compiler Infrastructure
      4 //
      5 // This file is distributed under the University of Illinois Open Source
      6 // License. See LICENSE.TXT for details.
      7 //
      8 //===----------------------------------------------------------------------===//
      9 //
     10 // This file defines the bugpoint internals that narrow down compilation crashes
     11 //
     12 //===----------------------------------------------------------------------===//
     13 
     14 #include "BugDriver.h"
     15 #include "ToolRunner.h"
     16 #include "ListReducer.h"
     17 #include "llvm/Constants.h"
     18 #include "llvm/DerivedTypes.h"
     19 #include "llvm/Instructions.h"
     20 #include "llvm/Module.h"
     21 #include "llvm/Pass.h"
     22 #include "llvm/PassManager.h"
     23 #include "llvm/ValueSymbolTable.h"
     24 #include "llvm/ADT/SmallPtrSet.h"
     25 #include "llvm/Analysis/Verifier.h"
     26 #include "llvm/Support/CFG.h"
     27 #include "llvm/Transforms/Scalar.h"
     28 #include "llvm/Transforms/Utils/Cloning.h"
     29 #include "llvm/Support/FileUtilities.h"
     30 #include "llvm/Support/CommandLine.h"
     31 #include <set>
     32 using namespace llvm;
     33 
     34 namespace {
     35   cl::opt<bool>
     36   KeepMain("keep-main",
     37            cl::desc("Force function reduction to keep main"),
     38            cl::init(false));
     39   cl::opt<bool>
     40   NoGlobalRM ("disable-global-remove",
     41          cl::desc("Do not remove global variables"),
     42          cl::init(false));
     43 }
     44 
     45 namespace llvm {
     46   class ReducePassList : public ListReducer<std::string> {
     47     BugDriver &BD;
     48   public:
     49     ReducePassList(BugDriver &bd) : BD(bd) {}
     50 
     51     // doTest - Return true iff running the "removed" passes succeeds, and
     52     // running the "Kept" passes fail when run on the output of the "removed"
     53     // passes.  If we return true, we update the current module of bugpoint.
     54     //
     55     virtual TestResult doTest(std::vector<std::string> &Removed,
     56                               std::vector<std::string> &Kept,
     57                               std::string &Error);
     58   };
     59 }
     60 
     61 ReducePassList::TestResult
     62 ReducePassList::doTest(std::vector<std::string> &Prefix,
     63                        std::vector<std::string> &Suffix,
     64                        std::string &Error) {
     65   sys::Path PrefixOutput;
     66   Module *OrigProgram = 0;
     67   if (!Prefix.empty()) {
     68     outs() << "Checking to see if these passes crash: "
     69            << getPassesString(Prefix) << ": ";
     70     std::string PfxOutput;
     71     if (BD.runPasses(BD.getProgram(), Prefix, PfxOutput))
     72       return KeepPrefix;
     73 
     74     PrefixOutput.set(PfxOutput);
     75     OrigProgram = BD.Program;
     76 
     77     BD.Program = ParseInputFile(PrefixOutput.str(), BD.getContext());
     78     if (BD.Program == 0) {
     79       errs() << BD.getToolName() << ": Error reading bitcode file '"
     80              << PrefixOutput.str() << "'!\n";
     81       exit(1);
     82     }
     83     PrefixOutput.eraseFromDisk();
     84   }
     85 
     86   outs() << "Checking to see if these passes crash: "
     87          << getPassesString(Suffix) << ": ";
     88 
     89   if (BD.runPasses(BD.getProgram(), Suffix)) {
     90     delete OrigProgram;            // The suffix crashes alone...
     91     return KeepSuffix;
     92   }
     93 
     94   // Nothing failed, restore state...
     95   if (OrigProgram) {
     96     delete BD.Program;
     97     BD.Program = OrigProgram;
     98   }
     99   return NoFailure;
    100 }
    101 
    102 namespace {
    103   /// ReduceCrashingGlobalVariables - This works by removing the global
    104   /// variable's initializer and seeing if the program still crashes. If it
    105   /// does, then we keep that program and try again.
    106   ///
    107   class ReduceCrashingGlobalVariables : public ListReducer<GlobalVariable*> {
    108     BugDriver &BD;
    109     bool (*TestFn)(const BugDriver &, Module *);
    110   public:
    111     ReduceCrashingGlobalVariables(BugDriver &bd,
    112                                   bool (*testFn)(const BugDriver &, Module *))
    113       : BD(bd), TestFn(testFn) {}
    114 
    115     virtual TestResult doTest(std::vector<GlobalVariable*> &Prefix,
    116                               std::vector<GlobalVariable*> &Kept,
    117                               std::string &Error) {
    118       if (!Kept.empty() && TestGlobalVariables(Kept))
    119         return KeepSuffix;
    120       if (!Prefix.empty() && TestGlobalVariables(Prefix))
    121         return KeepPrefix;
    122       return NoFailure;
    123     }
    124 
    125     bool TestGlobalVariables(std::vector<GlobalVariable*> &GVs);
    126   };
    127 }
    128 
    129 bool
    130 ReduceCrashingGlobalVariables::TestGlobalVariables(
    131                               std::vector<GlobalVariable*> &GVs) {
    132   // Clone the program to try hacking it apart...
    133   ValueToValueMapTy VMap;
    134   Module *M = CloneModule(BD.getProgram(), VMap);
    135 
    136   // Convert list to set for fast lookup...
    137   std::set<GlobalVariable*> GVSet;
    138 
    139   for (unsigned i = 0, e = GVs.size(); i != e; ++i) {
    140     GlobalVariable* CMGV = cast<GlobalVariable>(VMap[GVs[i]]);
    141     assert(CMGV && "Global Variable not in module?!");
    142     GVSet.insert(CMGV);
    143   }
    144 
    145   outs() << "Checking for crash with only these global variables: ";
    146   PrintGlobalVariableList(GVs);
    147   outs() << ": ";
    148 
    149   // Loop over and delete any global variables which we aren't supposed to be
    150   // playing with...
    151   for (Module::global_iterator I = M->global_begin(), E = M->global_end();
    152        I != E; ++I)
    153     if (I->hasInitializer() && !GVSet.count(I)) {
    154       I->setInitializer(0);
    155       I->setLinkage(GlobalValue::ExternalLinkage);
    156     }
    157 
    158   // Try running the hacked up program...
    159   if (TestFn(BD, M)) {
    160     BD.setNewProgram(M);        // It crashed, keep the trimmed version...
    161 
    162     // Make sure to use global variable pointers that point into the now-current
    163     // module.
    164     GVs.assign(GVSet.begin(), GVSet.end());
    165     return true;
    166   }
    167 
    168   delete M;
    169   return false;
    170 }
    171 
    172 namespace llvm {
    173   /// ReduceCrashingFunctions reducer - This works by removing functions and
    174   /// seeing if the program still crashes. If it does, then keep the newer,
    175   /// smaller program.
    176   ///
    177   class ReduceCrashingFunctions : public ListReducer<Function*> {
    178     BugDriver &BD;
    179     bool (*TestFn)(const BugDriver &, Module *);
    180   public:
    181     ReduceCrashingFunctions(BugDriver &bd,
    182                             bool (*testFn)(const BugDriver &, Module *))
    183       : BD(bd), TestFn(testFn) {}
    184 
    185     virtual TestResult doTest(std::vector<Function*> &Prefix,
    186                               std::vector<Function*> &Kept,
    187                               std::string &Error) {
    188       if (!Kept.empty() && TestFuncs(Kept))
    189         return KeepSuffix;
    190       if (!Prefix.empty() && TestFuncs(Prefix))
    191         return KeepPrefix;
    192       return NoFailure;
    193     }
    194 
    195     bool TestFuncs(std::vector<Function*> &Prefix);
    196   };
    197 }
    198 
    199 bool ReduceCrashingFunctions::TestFuncs(std::vector<Function*> &Funcs) {
    200 
    201   //if main isn't present, claim there is no problem
    202   if (KeepMain && find(Funcs.begin(), Funcs.end(),
    203                        BD.getProgram()->getFunction("main")) == Funcs.end())
    204     return false;
    205 
    206   // Clone the program to try hacking it apart...
    207   ValueToValueMapTy VMap;
    208   Module *M = CloneModule(BD.getProgram(), VMap);
    209 
    210   // Convert list to set for fast lookup...
    211   std::set<Function*> Functions;
    212   for (unsigned i = 0, e = Funcs.size(); i != e; ++i) {
    213     Function *CMF = cast<Function>(VMap[Funcs[i]]);
    214     assert(CMF && "Function not in module?!");
    215     assert(CMF->getFunctionType() == Funcs[i]->getFunctionType() && "wrong ty");
    216     assert(CMF->getName() == Funcs[i]->getName() && "wrong name");
    217     Functions.insert(CMF);
    218   }
    219 
    220   outs() << "Checking for crash with only these functions: ";
    221   PrintFunctionList(Funcs);
    222   outs() << ": ";
    223 
    224   // Loop over and delete any functions which we aren't supposed to be playing
    225   // with...
    226   for (Module::iterator I = M->begin(), E = M->end(); I != E; ++I)
    227     if (!I->isDeclaration() && !Functions.count(I))
    228       DeleteFunctionBody(I);
    229 
    230   // Try running the hacked up program...
    231   if (TestFn(BD, M)) {
    232     BD.setNewProgram(M);        // It crashed, keep the trimmed version...
    233 
    234     // Make sure to use function pointers that point into the now-current
    235     // module.
    236     Funcs.assign(Functions.begin(), Functions.end());
    237     return true;
    238   }
    239   delete M;
    240   return false;
    241 }
    242 
    243 
    244 namespace {
    245   /// ReduceCrashingBlocks reducer - This works by setting the terminators of
    246   /// all terminators except the specified basic blocks to a 'ret' instruction,
    247   /// then running the simplify-cfg pass.  This has the effect of chopping up
    248   /// the CFG really fast which can reduce large functions quickly.
    249   ///
    250   class ReduceCrashingBlocks : public ListReducer<const BasicBlock*> {
    251     BugDriver &BD;
    252     bool (*TestFn)(const BugDriver &, Module *);
    253   public:
    254     ReduceCrashingBlocks(BugDriver &bd,
    255                          bool (*testFn)(const BugDriver &, Module *))
    256       : BD(bd), TestFn(testFn) {}
    257 
    258     virtual TestResult doTest(std::vector<const BasicBlock*> &Prefix,
    259                               std::vector<const BasicBlock*> &Kept,
    260                               std::string &Error) {
    261       if (!Kept.empty() && TestBlocks(Kept))
    262         return KeepSuffix;
    263       if (!Prefix.empty() && TestBlocks(Prefix))
    264         return KeepPrefix;
    265       return NoFailure;
    266     }
    267 
    268     bool TestBlocks(std::vector<const BasicBlock*> &Prefix);
    269   };
    270 }
    271 
    272 bool ReduceCrashingBlocks::TestBlocks(std::vector<const BasicBlock*> &BBs) {
    273   // Clone the program to try hacking it apart...
    274   ValueToValueMapTy VMap;
    275   Module *M = CloneModule(BD.getProgram(), VMap);
    276 
    277   // Convert list to set for fast lookup...
    278   SmallPtrSet<BasicBlock*, 8> Blocks;
    279   for (unsigned i = 0, e = BBs.size(); i != e; ++i)
    280     Blocks.insert(cast<BasicBlock>(VMap[BBs[i]]));
    281 
    282   outs() << "Checking for crash with only these blocks:";
    283   unsigned NumPrint = Blocks.size();
    284   if (NumPrint > 10) NumPrint = 10;
    285   for (unsigned i = 0, e = NumPrint; i != e; ++i)
    286     outs() << " " << BBs[i]->getName();
    287   if (NumPrint < Blocks.size())
    288     outs() << "... <" << Blocks.size() << " total>";
    289   outs() << ": ";
    290 
    291   // Loop over and delete any hack up any blocks that are not listed...
    292   for (Module::iterator I = M->begin(), E = M->end(); I != E; ++I)
    293     for (Function::iterator BB = I->begin(), E = I->end(); BB != E; ++BB)
    294       if (!Blocks.count(BB) && BB->getTerminator()->getNumSuccessors()) {
    295         // Loop over all of the successors of this block, deleting any PHI nodes
    296         // that might include it.
    297         for (succ_iterator SI = succ_begin(BB), E = succ_end(BB); SI != E; ++SI)
    298           (*SI)->removePredecessor(BB);
    299 
    300         TerminatorInst *BBTerm = BB->getTerminator();
    301 
    302         if (!BB->getTerminator()->getType()->isVoidTy())
    303           BBTerm->replaceAllUsesWith(Constant::getNullValue(BBTerm->getType()));
    304 
    305         // Replace the old terminator instruction.
    306         BB->getInstList().pop_back();
    307         new UnreachableInst(BB->getContext(), BB);
    308       }
    309 
    310   // The CFG Simplifier pass may delete one of the basic blocks we are
    311   // interested in.  If it does we need to take the block out of the list.  Make
    312   // a "persistent mapping" by turning basic blocks into <function, name> pairs.
    313   // This won't work well if blocks are unnamed, but that is just the risk we
    314   // have to take.
    315   std::vector<std::pair<std::string, std::string> > BlockInfo;
    316 
    317   for (SmallPtrSet<BasicBlock*, 8>::iterator I = Blocks.begin(),
    318          E = Blocks.end(); I != E; ++I)
    319     BlockInfo.push_back(std::make_pair((*I)->getParent()->getName(),
    320                                        (*I)->getName()));
    321 
    322   // Now run the CFG simplify pass on the function...
    323   std::vector<std::string> Passes;
    324   Passes.push_back("simplifycfg");
    325   Passes.push_back("verify");
    326   Module *New = BD.runPassesOn(M, Passes);
    327   delete M;
    328   if (!New) {
    329     errs() << "simplifycfg failed!\n";
    330     exit(1);
    331   }
    332   M = New;
    333 
    334   // Try running on the hacked up program...
    335   if (TestFn(BD, M)) {
    336     BD.setNewProgram(M);      // It crashed, keep the trimmed version...
    337 
    338     // Make sure to use basic block pointers that point into the now-current
    339     // module, and that they don't include any deleted blocks.
    340     BBs.clear();
    341     const ValueSymbolTable &GST = M->getValueSymbolTable();
    342     for (unsigned i = 0, e = BlockInfo.size(); i != e; ++i) {
    343       Function *F = cast<Function>(GST.lookup(BlockInfo[i].first));
    344       ValueSymbolTable &ST = F->getValueSymbolTable();
    345       Value* V = ST.lookup(BlockInfo[i].second);
    346       if (V && V->getType() == Type::getLabelTy(V->getContext()))
    347         BBs.push_back(cast<BasicBlock>(V));
    348     }
    349     return true;
    350   }
    351   delete M;  // It didn't crash, try something else.
    352   return false;
    353 }
    354 
    355 namespace {
    356   /// ReduceCrashingInstructions reducer - This works by removing the specified
    357   /// non-terminator instructions and replacing them with undef.
    358   ///
    359   class ReduceCrashingInstructions : public ListReducer<const Instruction*> {
    360     BugDriver &BD;
    361     bool (*TestFn)(const BugDriver &, Module *);
    362   public:
    363     ReduceCrashingInstructions(BugDriver &bd,
    364                                bool (*testFn)(const BugDriver &, Module *))
    365       : BD(bd), TestFn(testFn) {}
    366 
    367     virtual TestResult doTest(std::vector<const Instruction*> &Prefix,
    368                               std::vector<const Instruction*> &Kept,
    369                               std::string &Error) {
    370       if (!Kept.empty() && TestInsts(Kept))
    371         return KeepSuffix;
    372       if (!Prefix.empty() && TestInsts(Prefix))
    373         return KeepPrefix;
    374       return NoFailure;
    375     }
    376 
    377     bool TestInsts(std::vector<const Instruction*> &Prefix);
    378   };
    379 }
    380 
    381 bool ReduceCrashingInstructions::TestInsts(std::vector<const Instruction*>
    382                                            &Insts) {
    383   // Clone the program to try hacking it apart...
    384   ValueToValueMapTy VMap;
    385   Module *M = CloneModule(BD.getProgram(), VMap);
    386 
    387   // Convert list to set for fast lookup...
    388   SmallPtrSet<Instruction*, 64> Instructions;
    389   for (unsigned i = 0, e = Insts.size(); i != e; ++i) {
    390     assert(!isa<TerminatorInst>(Insts[i]));
    391     Instructions.insert(cast<Instruction>(VMap[Insts[i]]));
    392   }
    393 
    394   outs() << "Checking for crash with only " << Instructions.size();
    395   if (Instructions.size() == 1)
    396     outs() << " instruction: ";
    397   else
    398     outs() << " instructions: ";
    399 
    400   for (Module::iterator MI = M->begin(), ME = M->end(); MI != ME; ++MI)
    401     for (Function::iterator FI = MI->begin(), FE = MI->end(); FI != FE; ++FI)
    402       for (BasicBlock::iterator I = FI->begin(), E = FI->end(); I != E;) {
    403         Instruction *Inst = I++;
    404         if (!Instructions.count(Inst) && !isa<TerminatorInst>(Inst)) {
    405           if (!Inst->getType()->isVoidTy())
    406             Inst->replaceAllUsesWith(UndefValue::get(Inst->getType()));
    407           Inst->eraseFromParent();
    408         }
    409       }
    410 
    411   // Verify that this is still valid.
    412   PassManager Passes;
    413   Passes.add(createVerifierPass());
    414   Passes.run(*M);
    415 
    416   // Try running on the hacked up program...
    417   if (TestFn(BD, M)) {
    418     BD.setNewProgram(M);      // It crashed, keep the trimmed version...
    419 
    420     // Make sure to use instruction pointers that point into the now-current
    421     // module, and that they don't include any deleted blocks.
    422     Insts.clear();
    423     for (SmallPtrSet<Instruction*, 64>::const_iterator I = Instructions.begin(),
    424              E = Instructions.end(); I != E; ++I)
    425       Insts.push_back(*I);
    426     return true;
    427   }
    428   delete M;  // It didn't crash, try something else.
    429   return false;
    430 }
    431 
    432 /// DebugACrash - Given a predicate that determines whether a component crashes
    433 /// on a program, try to destructively reduce the program while still keeping
    434 /// the predicate true.
    435 static bool DebugACrash(BugDriver &BD,
    436                         bool (*TestFn)(const BugDriver &, Module *),
    437                         std::string &Error) {
    438   // See if we can get away with nuking some of the global variable initializers
    439   // in the program...
    440   if (!NoGlobalRM &&
    441       BD.getProgram()->global_begin() != BD.getProgram()->global_end()) {
    442     // Now try to reduce the number of global variable initializers in the
    443     // module to something small.
    444     Module *M = CloneModule(BD.getProgram());
    445     bool DeletedInit = false;
    446 
    447     for (Module::global_iterator I = M->global_begin(), E = M->global_end();
    448          I != E; ++I)
    449       if (I->hasInitializer()) {
    450         I->setInitializer(0);
    451         I->setLinkage(GlobalValue::ExternalLinkage);
    452         DeletedInit = true;
    453       }
    454 
    455     if (!DeletedInit) {
    456       delete M;  // No change made...
    457     } else {
    458       // See if the program still causes a crash...
    459       outs() << "\nChecking to see if we can delete global inits: ";
    460 
    461       if (TestFn(BD, M)) {      // Still crashes?
    462         BD.setNewProgram(M);
    463         outs() << "\n*** Able to remove all global initializers!\n";
    464       } else {                  // No longer crashes?
    465         outs() << "  - Removing all global inits hides problem!\n";
    466         delete M;
    467 
    468         std::vector<GlobalVariable*> GVs;
    469 
    470         for (Module::global_iterator I = BD.getProgram()->global_begin(),
    471                E = BD.getProgram()->global_end(); I != E; ++I)
    472           if (I->hasInitializer())
    473             GVs.push_back(I);
    474 
    475         if (GVs.size() > 1 && !BugpointIsInterrupted) {
    476           outs() << "\n*** Attempting to reduce the number of global "
    477                     << "variables in the testcase\n";
    478 
    479           unsigned OldSize = GVs.size();
    480           ReduceCrashingGlobalVariables(BD, TestFn).reduceList(GVs, Error);
    481           if (!Error.empty())
    482             return true;
    483 
    484           if (GVs.size() < OldSize)
    485             BD.EmitProgressBitcode(BD.getProgram(), "reduced-global-variables");
    486         }
    487       }
    488     }
    489   }
    490 
    491   // Now try to reduce the number of functions in the module to something small.
    492   std::vector<Function*> Functions;
    493   for (Module::iterator I = BD.getProgram()->begin(),
    494          E = BD.getProgram()->end(); I != E; ++I)
    495     if (!I->isDeclaration())
    496       Functions.push_back(I);
    497 
    498   if (Functions.size() > 1 && !BugpointIsInterrupted) {
    499     outs() << "\n*** Attempting to reduce the number of functions "
    500       "in the testcase\n";
    501 
    502     unsigned OldSize = Functions.size();
    503     ReduceCrashingFunctions(BD, TestFn).reduceList(Functions, Error);
    504 
    505     if (Functions.size() < OldSize)
    506       BD.EmitProgressBitcode(BD.getProgram(), "reduced-function");
    507   }
    508 
    509   // Attempt to delete entire basic blocks at a time to speed up
    510   // convergence... this actually works by setting the terminator of the blocks
    511   // to a return instruction then running simplifycfg, which can potentially
    512   // shrinks the code dramatically quickly
    513   //
    514   if (!DisableSimplifyCFG && !BugpointIsInterrupted) {
    515     std::vector<const BasicBlock*> Blocks;
    516     for (Module::const_iterator I = BD.getProgram()->begin(),
    517            E = BD.getProgram()->end(); I != E; ++I)
    518       for (Function::const_iterator FI = I->begin(), E = I->end(); FI !=E; ++FI)
    519         Blocks.push_back(FI);
    520     unsigned OldSize = Blocks.size();
    521     ReduceCrashingBlocks(BD, TestFn).reduceList(Blocks, Error);
    522     if (Blocks.size() < OldSize)
    523       BD.EmitProgressBitcode(BD.getProgram(), "reduced-blocks");
    524   }
    525 
    526   // Attempt to delete instructions using bisection. This should help out nasty
    527   // cases with large basic blocks where the problem is at one end.
    528   if (!BugpointIsInterrupted) {
    529     std::vector<const Instruction*> Insts;
    530     for (Module::const_iterator MI = BD.getProgram()->begin(),
    531            ME = BD.getProgram()->end(); MI != ME; ++MI)
    532       for (Function::const_iterator FI = MI->begin(), FE = MI->end(); FI != FE;
    533            ++FI)
    534         for (BasicBlock::const_iterator I = FI->begin(), E = FI->end();
    535              I != E; ++I)
    536           if (!isa<TerminatorInst>(I))
    537             Insts.push_back(I);
    538 
    539     ReduceCrashingInstructions(BD, TestFn).reduceList(Insts, Error);
    540   }
    541 
    542   // FIXME: This should use the list reducer to converge faster by deleting
    543   // larger chunks of instructions at a time!
    544   unsigned Simplification = 2;
    545   do {
    546     if (BugpointIsInterrupted) break;
    547     --Simplification;
    548     outs() << "\n*** Attempting to reduce testcase by deleting instruc"
    549            << "tions: Simplification Level #" << Simplification << '\n';
    550 
    551     // Now that we have deleted the functions that are unnecessary for the
    552     // program, try to remove instructions that are not necessary to cause the
    553     // crash.  To do this, we loop through all of the instructions in the
    554     // remaining functions, deleting them (replacing any values produced with
    555     // nulls), and then running ADCE and SimplifyCFG.  If the transformed input
    556     // still triggers failure, keep deleting until we cannot trigger failure
    557     // anymore.
    558     //
    559     unsigned InstructionsToSkipBeforeDeleting = 0;
    560   TryAgain:
    561 
    562     // Loop over all of the (non-terminator) instructions remaining in the
    563     // function, attempting to delete them.
    564     unsigned CurInstructionNum = 0;
    565     for (Module::const_iterator FI = BD.getProgram()->begin(),
    566            E = BD.getProgram()->end(); FI != E; ++FI)
    567       if (!FI->isDeclaration())
    568         for (Function::const_iterator BI = FI->begin(), E = FI->end(); BI != E;
    569              ++BI)
    570           for (BasicBlock::const_iterator I = BI->begin(), E = --BI->end();
    571                I != E; ++I, ++CurInstructionNum)
    572             if (InstructionsToSkipBeforeDeleting) {
    573               --InstructionsToSkipBeforeDeleting;
    574             } else {
    575               if (BugpointIsInterrupted) goto ExitLoops;
    576 
    577               outs() << "Checking instruction: " << *I;
    578               Module *M = BD.deleteInstructionFromProgram(I, Simplification);
    579 
    580               // Find out if the pass still crashes on this pass...
    581               if (TestFn(BD, M)) {
    582                 // Yup, it does, we delete the old module, and continue trying
    583                 // to reduce the testcase...
    584                 BD.setNewProgram(M);
    585                 InstructionsToSkipBeforeDeleting = CurInstructionNum;
    586                 goto TryAgain;  // I wish I had a multi-level break here!
    587               }
    588 
    589               // This pass didn't crash without this instruction, try the next
    590               // one.
    591               delete M;
    592             }
    593 
    594     if (InstructionsToSkipBeforeDeleting) {
    595       InstructionsToSkipBeforeDeleting = 0;
    596       goto TryAgain;
    597     }
    598 
    599   } while (Simplification);
    600 ExitLoops:
    601 
    602   // Try to clean up the testcase by running funcresolve and globaldce...
    603   if (!BugpointIsInterrupted) {
    604     outs() << "\n*** Attempting to perform final cleanups: ";
    605     Module *M = CloneModule(BD.getProgram());
    606     M = BD.performFinalCleanups(M, true);
    607 
    608     // Find out if the pass still crashes on the cleaned up program...
    609     if (TestFn(BD, M)) {
    610       BD.setNewProgram(M);     // Yup, it does, keep the reduced version...
    611     } else {
    612       delete M;
    613     }
    614   }
    615 
    616   BD.EmitProgressBitcode(BD.getProgram(), "reduced-simplified");
    617 
    618   return false;
    619 }
    620 
    621 static bool TestForOptimizerCrash(const BugDriver &BD, Module *M) {
    622   return BD.runPasses(M);
    623 }
    624 
    625 /// debugOptimizerCrash - This method is called when some pass crashes on input.
    626 /// It attempts to prune down the testcase to something reasonable, and figure
    627 /// out exactly which pass is crashing.
    628 ///
    629 bool BugDriver::debugOptimizerCrash(const std::string &ID) {
    630   outs() << "\n*** Debugging optimizer crash!\n";
    631 
    632   std::string Error;
    633   // Reduce the list of passes which causes the optimizer to crash...
    634   if (!BugpointIsInterrupted)
    635     ReducePassList(*this).reduceList(PassesToRun, Error);
    636   assert(Error.empty());
    637 
    638   outs() << "\n*** Found crashing pass"
    639          << (PassesToRun.size() == 1 ? ": " : "es: ")
    640          << getPassesString(PassesToRun) << '\n';
    641 
    642   EmitProgressBitcode(Program, ID);
    643 
    644   bool Success = DebugACrash(*this, TestForOptimizerCrash, Error);
    645   assert(Error.empty());
    646   return Success;
    647 }
    648 
    649 static bool TestForCodeGenCrash(const BugDriver &BD, Module *M) {
    650   std::string Error;
    651   BD.compileProgram(M, &Error);
    652   if (!Error.empty()) {
    653     errs() << "<crash>\n";
    654     return true;  // Tool is still crashing.
    655   }
    656   errs() << '\n';
    657   return false;
    658 }
    659 
    660 /// debugCodeGeneratorCrash - This method is called when the code generator
    661 /// crashes on an input.  It attempts to reduce the input as much as possible
    662 /// while still causing the code generator to crash.
    663 bool BugDriver::debugCodeGeneratorCrash(std::string &Error) {
    664   errs() << "*** Debugging code generator crash!\n";
    665 
    666   return DebugACrash(*this, TestForCodeGenCrash, Error);
    667 }
    668