1#!/usr/bin/env python
2"""Calls C-Reduce to create a minimal reproducer for clang crashes.
3
4Output files:
5  *.reduced.sh -- crash reproducer with minimal arguments
6  *.reduced.cpp -- the reduced file
7  *.test.sh -- interestingness test for C-Reduce
8"""
9
10from __future__ import print_function
11from argparse import ArgumentParser, RawTextHelpFormatter
12import os
13import re
14import stat
15import sys
16import subprocess
17import pipes
18import shlex
19import tempfile
20import shutil
21from distutils.spawn import find_executable
22
23verbose = False
24creduce_cmd = None
25clang_cmd = None
26not_cmd = None
27
28def verbose_print(*args, **kwargs):
29  if verbose:
30    print(*args, **kwargs)
31
32def check_file(fname):
33  fname = os.path.normpath(fname)
34  if not os.path.isfile(fname):
35    sys.exit("ERROR: %s does not exist" % (fname))
36  return fname
37
38def check_cmd(cmd_name, cmd_dir, cmd_path=None):
39  """
40  Returns absolute path to cmd_path if it is given,
41  or absolute path to cmd_dir/cmd_name.
42  """
43  if cmd_path:
44    # Make the path absolute so the creduce test can be run from any directory.
45    cmd_path = os.path.abspath(cmd_path)
46    cmd = find_executable(cmd_path)
47    if cmd:
48      return cmd
49    sys.exit("ERROR: executable `%s` not found" % (cmd_path))
50
51  cmd = find_executable(cmd_name, path=cmd_dir)
52  if cmd:
53    return cmd
54
55  if not cmd_dir:
56    cmd_dir = "$PATH"
57  sys.exit("ERROR: `%s` not found in %s" % (cmd_name, cmd_dir))
58
59def quote_cmd(cmd):
60  return ' '.join(pipes.quote(arg) for arg in cmd)
61
62def write_to_script(text, filename):
63  with open(filename, 'w') as f:
64    f.write(text)
65  os.chmod(filename, os.stat(filename).st_mode | stat.S_IEXEC)
66
67class Reduce(object):
68  def __init__(self, crash_script, file_to_reduce):
69    crash_script_name, crash_script_ext = os.path.splitext(crash_script)
70    file_reduce_name, file_reduce_ext = os.path.splitext(file_to_reduce)
71
72    self.testfile = file_reduce_name + '.test.sh'
73    self.crash_script = crash_script_name + '.reduced' + crash_script_ext
74    self.file_to_reduce = file_reduce_name + '.reduced' + file_reduce_ext
75    shutil.copy(file_to_reduce, self.file_to_reduce)
76
77    self.clang = clang_cmd
78    self.clang_args = []
79    self.expected_output = []
80    self.is_crash = True
81    self.creduce_flags = ["--tidy"]
82
83    self.read_clang_args(crash_script, file_to_reduce)
84    self.read_expected_output()
85
86  def get_crash_cmd(self, cmd=None, args=None, filename=None):
87    if not cmd:
88      cmd = self.clang
89    if not args:
90      args = self.clang_args
91    if not filename:
92      filename = self.file_to_reduce
93
94    return [cmd] + args + [filename]
95
96  def read_clang_args(self, crash_script, filename):
97    print("\nReading arguments from crash script...")
98    with open(crash_script) as f:
99      # Assume clang call is the first non comment line.
100      cmd = []
101      for line in f:
102        if not line.lstrip().startswith('#'):
103          cmd = shlex.split(line)
104          break
105    if not cmd:
106      sys.exit("Could not find command in the crash script.");
107
108    # Remove clang and filename from the command
109    # Assume the last occurrence of the filename is the clang input file
110    del cmd[0]
111    for i in range(len(cmd)-1, -1, -1):
112      if cmd[i] == filename:
113        del cmd[i]
114        break
115    self.clang_args = cmd
116    verbose_print("Clang arguments:", quote_cmd(self.clang_args))
117
118  def read_expected_output(self):
119    print("\nGetting expected crash output...")
120    p = subprocess.Popen(self.get_crash_cmd(),
121                         stdout=subprocess.PIPE,
122                         stderr=subprocess.STDOUT)
123    crash_output, _ = p.communicate()
124    result = []
125
126    # Remove color codes
127    ansi_escape = r'\x1b\[[0-?]*m'
128    crash_output = re.sub(ansi_escape, '', crash_output.decode('utf-8'))
129
130    # Look for specific error messages
131    regexes = [r"Assertion `(.+)' failed", # Linux assert()
132               r"Assertion failed: (.+),", # FreeBSD/Mac assert()
133               r"fatal error: error in backend: (.+)",
134               r"LLVM ERROR: (.+)",
135               r"UNREACHABLE executed (at .+)?!",
136               r"LLVM IR generation of declaration '(.+)'",
137               r"Generating code for declaration '(.+)'",
138               r"\*\*\* Bad machine code: (.+) \*\*\*"]
139    for msg_re in regexes:
140      match = re.search(msg_re, crash_output)
141      if match:
142        msg = match.group(1)
143        result = [msg]
144        print("Found message:", msg)
145
146        if "fatal error:" in msg_re:
147          self.is_crash = False
148        break
149
150    # If no message was found, use the top five stack trace functions,
151    # ignoring some common functions
152    # Five is a somewhat arbitrary number; the goal is to get a small number
153    # of identifying functions with some leeway for common functions
154    if not result:
155      stacktrace_re = r'[0-9]+\s+0[xX][0-9a-fA-F]+\s*([^(]+)\('
156      filters = ["PrintStackTraceSignalHandler",
157                 "llvm::sys::RunSignalHandlers",
158                 "SignalHandler", "__restore_rt", "gsignal", "abort"]
159      matches = re.findall(stacktrace_re, crash_output)
160      result = [x for x in matches if x and x.strip() not in filters][:5]
161      for msg in result:
162        print("Found stack trace function:", msg)
163
164    if not result:
165      print("ERROR: no crash was found")
166      print("The crash output was:\n========\n%s========" % crash_output)
167      sys.exit(1)
168
169    self.expected_output = result
170
171  def check_expected_output(self, args=None, filename=None):
172    if not args:
173      args = self.clang_args
174    if not filename:
175      filename = self.file_to_reduce
176
177    p = subprocess.Popen(self.get_crash_cmd(args=args, filename=filename),
178                         stdout=subprocess.PIPE,
179                         stderr=subprocess.STDOUT)
180    crash_output, _ = p.communicate()
181    return all(msg in crash_output.decode('utf-8') for msg in
182               self.expected_output)
183
184  def write_interestingness_test(self):
185    print("\nCreating the interestingness test...")
186
187    crash_flag = "--crash" if self.is_crash else ""
188
189    output = "#!/bin/bash\n%s %s %s >& t.log || exit 1\n" % \
190        (pipes.quote(not_cmd), crash_flag, quote_cmd(self.get_crash_cmd()))
191
192    for msg in self.expected_output:
193      output += 'grep -F %s t.log || exit 1\n' % pipes.quote(msg)
194
195    write_to_script(output, self.testfile)
196    self.check_interestingness()
197
198  def check_interestingness(self):
199    testfile = os.path.abspath(self.testfile)
200
201    # Check that the test considers the original file interesting
202    with open(os.devnull, 'w') as devnull:
203      returncode = subprocess.call(testfile, stdout=devnull)
204    if returncode:
205      sys.exit("The interestingness test does not pass for the original file.")
206
207    # Check that an empty file is not interesting
208    # Instead of modifying the filename in the test file, just run the command
209    with tempfile.NamedTemporaryFile() as empty_file:
210      is_interesting = self.check_expected_output(filename=empty_file.name)
211    if is_interesting:
212      sys.exit("The interestingness test passes for an empty file.")
213
214  def clang_preprocess(self):
215    print("\nTrying to preprocess the source file...")
216    with tempfile.NamedTemporaryFile() as tmpfile:
217      cmd_preprocess = self.get_crash_cmd() + ['-E', '-o', tmpfile.name]
218      cmd_preprocess_no_lines = cmd_preprocess + ['-P']
219      try:
220        subprocess.check_call(cmd_preprocess_no_lines)
221        if self.check_expected_output(filename=tmpfile.name):
222          print("Successfully preprocessed with line markers removed")
223          shutil.copy(tmpfile.name, self.file_to_reduce)
224        else:
225          subprocess.check_call(cmd_preprocess)
226          if self.check_expected_output(filename=tmpfile.name):
227            print("Successfully preprocessed without removing line markers")
228            shutil.copy(tmpfile.name, self.file_to_reduce)
229          else:
230            print("No longer crashes after preprocessing -- "
231                  "using original source")
232      except subprocess.CalledProcessError:
233        print("Preprocessing failed")
234
235  @staticmethod
236  def filter_args(args, opts_equal=[], opts_startswith=[],
237                  opts_one_arg_startswith=[]):
238    result = []
239    skip_next = False
240    for arg in args:
241      if skip_next:
242        skip_next = False
243        continue
244      if any(arg == a for a in opts_equal):
245        continue
246      if any(arg.startswith(a) for a in opts_startswith):
247        continue
248      if any(arg.startswith(a) for a in opts_one_arg_startswith):
249        skip_next = True
250        continue
251      result.append(arg)
252    return result
253
254  def try_remove_args(self, args, msg=None, extra_arg=None, **kwargs):
255    new_args = self.filter_args(args, **kwargs)
256
257    if extra_arg:
258      if extra_arg in new_args:
259        new_args.remove(extra_arg)
260      new_args.append(extra_arg)
261
262    if (new_args != args and
263        self.check_expected_output(args=new_args)):
264      if msg:
265        verbose_print(msg)
266      return new_args
267    return args
268
269  def try_remove_arg_by_index(self, args, index):
270    new_args = args[:index] + args[index+1:]
271    removed_arg = args[index]
272
273    # Heuristic for grouping arguments:
274    # remove next argument if it doesn't start with "-"
275    if index < len(new_args) and not new_args[index].startswith('-'):
276      del new_args[index]
277      removed_arg += ' ' + args[index+1]
278
279    if self.check_expected_output(args=new_args):
280      verbose_print("Removed", removed_arg)
281      return new_args, index
282    return args, index+1
283
284  def simplify_clang_args(self):
285    """Simplify clang arguments before running C-Reduce to reduce the time the
286    interestingness test takes to run.
287    """
288    print("\nSimplifying the clang command...")
289
290    # Remove some clang arguments to speed up the interestingness test
291    new_args = self.clang_args
292    new_args = self.try_remove_args(new_args,
293                                    msg="Removed debug info options",
294                                    opts_startswith=["-gcodeview",
295                                                     "-debug-info-kind=",
296                                                     "-debugger-tuning="])
297
298    new_args = self.try_remove_args(new_args,
299                                    msg="Removed --show-includes",
300                                    opts_startswith=["--show-includes"])
301    # Not suppressing warnings (-w) sometimes prevents the crash from occurring
302    # after preprocessing
303    new_args = self.try_remove_args(new_args,
304                                    msg="Replaced -W options with -w",
305                                    extra_arg='-w',
306                                    opts_startswith=["-W"])
307    new_args = self.try_remove_args(new_args,
308                                    msg="Replaced optimization level with -O0",
309                                    extra_arg="-O0",
310                                    opts_startswith=["-O"])
311
312    # Try to remove compilation steps
313    new_args = self.try_remove_args(new_args, msg="Added -emit-llvm",
314                                    extra_arg="-emit-llvm")
315    new_args = self.try_remove_args(new_args, msg="Added -fsyntax-only",
316                                    extra_arg="-fsyntax-only")
317
318    # Try to make implicit int an error for more sensible test output
319    new_args = self.try_remove_args(new_args, msg="Added -Werror=implicit-int",
320                                    opts_equal=["-w"],
321                                    extra_arg="-Werror=implicit-int")
322
323    self.clang_args = new_args
324    verbose_print("Simplified command:", quote_cmd(self.get_crash_cmd()))
325
326  def reduce_clang_args(self):
327    """Minimize the clang arguments after running C-Reduce, to get the smallest
328    command that reproduces the crash on the reduced file.
329    """
330    print("\nReducing the clang crash command...")
331
332    new_args = self.clang_args
333
334    # Remove some often occurring args
335    new_args = self.try_remove_args(new_args, msg="Removed -D options",
336                                    opts_startswith=["-D"])
337    new_args = self.try_remove_args(new_args, msg="Removed -D options",
338                                    opts_one_arg_startswith=["-D"])
339    new_args = self.try_remove_args(new_args, msg="Removed -I options",
340                                    opts_startswith=["-I"])
341    new_args = self.try_remove_args(new_args, msg="Removed -I options",
342                                    opts_one_arg_startswith=["-I"])
343    new_args = self.try_remove_args(new_args, msg="Removed -W options",
344                                    opts_startswith=["-W"])
345
346    # Remove other cases that aren't covered by the heuristic
347    new_args = self.try_remove_args(new_args, msg="Removed -mllvm",
348                                    opts_one_arg_startswith=["-mllvm"])
349
350    i = 0
351    while i < len(new_args):
352      new_args, i = self.try_remove_arg_by_index(new_args, i)
353
354    self.clang_args = new_args
355
356    reduced_cmd = quote_cmd(self.get_crash_cmd())
357    write_to_script(reduced_cmd, self.crash_script)
358    print("Reduced command:", reduced_cmd)
359
360  def run_creduce(self):
361    print("\nRunning C-Reduce...")
362    try:
363      p = subprocess.Popen([creduce_cmd] + self.creduce_flags +
364                           [self.testfile, self.file_to_reduce])
365      p.communicate()
366    except KeyboardInterrupt:
367      # Hack to kill C-Reduce because it jumps into its own pgid
368      print('\n\nctrl-c detected, killed creduce')
369      p.kill()
370
371def main():
372  global verbose
373  global creduce_cmd
374  global clang_cmd
375  global not_cmd
376
377  parser = ArgumentParser(description=__doc__,
378                          formatter_class=RawTextHelpFormatter)
379  parser.add_argument('crash_script', type=str, nargs=1,
380                      help="Name of the script that generates the crash.")
381  parser.add_argument('file_to_reduce', type=str, nargs=1,
382                      help="Name of the file to be reduced.")
383  parser.add_argument('--llvm-bin', dest='llvm_bin', type=str,
384                      help="Path to the LLVM bin directory.")
385  parser.add_argument('--llvm-not', dest='llvm_not', type=str,
386                      help="The path to the `not` executable. "
387                      "By default uses the llvm-bin directory.")
388  parser.add_argument('--clang', dest='clang', type=str,
389                      help="The path to the `clang` executable. "
390                      "By default uses the llvm-bin directory.")
391  parser.add_argument('--creduce', dest='creduce', type=str,
392                      help="The path to the `creduce` executable. "
393                      "Required if `creduce` is not in PATH environment.")
394  parser.add_argument('-v', '--verbose', action='store_true')
395  args = parser.parse_args()
396
397  verbose = args.verbose
398  llvm_bin = os.path.abspath(args.llvm_bin) if args.llvm_bin else None
399  creduce_cmd = check_cmd('creduce', None, args.creduce)
400  clang_cmd = check_cmd('clang', llvm_bin, args.clang)
401  not_cmd = check_cmd('not', llvm_bin, args.llvm_not)
402
403  crash_script = check_file(args.crash_script[0])
404  file_to_reduce = check_file(args.file_to_reduce[0])
405
406  r = Reduce(crash_script, file_to_reduce)
407
408  r.simplify_clang_args()
409  r.write_interestingness_test()
410  r.clang_preprocess()
411  r.run_creduce()
412  r.reduce_clang_args()
413
414if __name__ == '__main__':
415  main()
416