Mull corrupted LLVM module. cxx_logical_and_to_or

[correaa]

I have a mull configuration working fairly well.
When I add - ccx_logical_and_to_or I get this error message during exit.

[error] Uh oh! Mull corrupted LLVM module.
Please, report the following error message here https://github.com/mull-project/mull/issues
Underlying error message:
Instruction does not dominate all uses!
  %27 = call noundef zeroext i1 @_ZNK5boost5multi16elements_range_tIPKdNS0_8layout_tILl1ElEEEeqIS3_S5_EEbRKNS1_IT_T0_EE(ptr noundef nonnull align 8 dereferenceable(56) %7, ptr noundef nonnull align 8 dereferenceable(56) %8), !dbg !44053
  %30 = phi i1 [ %27, %28 ], [ %27, %24 ], !dbg !44054

The module was corrupted by 'cxx_logical_and_to_or' mutator.
To disable it, add the following:
ignoreMutators:
  - cxx_logical_and_to_or
to the config file (/home/correaa/boost-multi/mull.yml)

[error] Error messages are treated as fatal errors. Exiting now.

The same thing happens with - cxx_logical_or_to_and

This is the full mull.yml file:

mutators:
 - cxx_add_assign_to_sub_assign  # Replaces += with -=
 - cxx_add_to_sub  # Replaces + with -
 - cxx_and_assign_to_or_assign  # Replaces &= with |=
 - cxx_and_to_or  # Replaces & with |
 - cxx_assign_const  # Replaces `a = b` with `a = 42`
 - cxx_bitwise_not_to_noop  # Replaces ~x with x
 - cxx_div_assign_to_mul_assign  # Replaces /= with *=
 - cxx_div_to_mul  # Replaces / with *
 - cxx_eq_to_ne  # Replaces == with !=
 - cxx_ge_to_gt  # Replaces >= with >
 - cxx_ge_to_lt  # Replaces >= with <
 - cxx_gt_to_ge  # Replaces > with >=
 - cxx_gt_to_le  # Replaces > with <=
 - cxx_init_const  # Replaces ‘T a = b’ with ‘T a = 42’
 - cxx_le_to_gt  # Replaces <= with >
 - cxx_le_to_lt  # Replaces <= with <
 - cxx_logical_and_to_or  # Replaces && with ||
#- cxx_logical_or_to_and  # Replaces || with &&  # The module was corrupted by 'cxx_logical_or_to_and' mutator.
 - cxx_lshift_assign_to_rshift_assign  # Replaces <<= with >>=
 - cxx_lshift_to_rshift  # Replaces << with >>
 - cxx_lt_to_ge  # Replaces < with >=
 - cxx_lt_to_le  # Replaces < with <=  # TODO(correaa) investigate why this mutant survives with the range.contains function
 - cxx_minus_to_noop  # Replaces -x with x
 - cxx_mul_assign_to_div_assign  # Replaces *= with /=
 - cxx_mul_to_div  # Replaces * with /
 - cxx_ne_to_eq  # Replaces != with ==
 - cxx_or_assign_to_and_assign  # Replaces |= with &=
 - cxx_or_to_and  # Replaces | with &
 - cxx_post_dec_to_post_inc  # Replaces x– with x++
 - cxx_post_inc_to_post_dec  # Replaces x++ with x–
 - cxx_pre_dec_to_pre_inc  # Replaces –x with ++x
 - cxx_pre_inc_to_pre_dec  # Replaces ++x with –x
 - cxx_rem_assign_to_div_assign  # Replaces %= with /=
 - cxx_rem_to_div  # Replaces % with /
 - cxx_remove_negation  # Replaces !a with a
 - cxx_remove_void_call  # Removes calls to a function returning void
 - cxx_replace_scalar_call  # Replaces call to a function with 42
 - cxx_rshift_assign_to_lshift_assign  # Replaces >>= with <<=
 - cxx_rshift_to_lshift  # Replaces << with >>
 - cxx_sub_assign_to_add_assign  # Replaces -= with +=
 - cxx_sub_to_add  # Replaces - with +
 - cxx_xor_assign_to_or_assign  # Replaces ^= with |=
 - cxx_xor_to_or  # Replaces ^ with |
timeout: 1000  # in milliseconds
debug:
 slowIRVerification: true
quiet: true  # additional logging?
excludePaths:
  - .*test.*

[AlexDenisov]

Hi @correaa, could you share more information about the setup under which the issue is happening?

I tried reproducing it against 54b9100ad7bd68bbb8d02af320c86b82bdceef09 (top of the master branch at the time of writing), but cannot see the issue.

[correaa]

Is this good to replicate the problem?

https://gitlab.com/correaa/boost-multi/-/jobs/8733770928#L646

The commands are

$ curl -1sLf 'https://dl.cloudsmith.io/public/mull-project/mull-stable/setup.deb.sh' | bash
$ apt-get -qq update
$ apt-get -qq install --no-install-recommends -y --quiet mull-16 libclang-cpp16

$ git clone https://github.com/correaa/boost-multi.git
$ cd boost-multi
$ mkdir build && cd build

$ CXX=clang++-16 cmake .. -DCMAKE_CXX_FLAGS="-O1 -fpass-plugin=/usr/lib/mull-ir-frontend-16 -g -grecord-command-line -fprofile-instr-generate -fcoverage-mapping"
$ cmake --build . --parallel 2

[AlexDenisov]

@correaa thank you, I've got the reproducer now 🥳

One more needed command:

apt-get -qq install --no-install-recommends -y --quiet gnupg curl wget ca-certificates clang-16 cmake libclang-rt-16-dev make libboost-timer-dev libboost-serialization-dev libblas-dev libfftw3-dev liblapack-dev pkg-config

[AlexDenisov]

Reproducer:

/usr/bin/clang++-17  -I/workspaces/mull/boost-multi/include -O1 -fpass-plugin=/usr/lib/mull-ir-frontend-17 -g -grecord-command-line -fprofile-instr-generate -o allocator.cpp.o -c /workspaces/mull/boost-multi/test/allocator.cpp

Interestingly enough, removal of -fprofile-instr-generate makes the problem disappear.

Next step: creduce the input and add an integration test showing the problem in isolation.

[correaa]

ok, can I safely remove that option?

Since I don't know what these options do, I am afraid to invalidate the whole mutation testing.
In particular, I am afraid of repeatedly running gratuitously hours of CI computation for nothing.

That is the reason I am tiptoeing with the automated system.

[AlexDenisov]

You can safely remove it unless you use code coverage support in mull, i.e. https://mull.readthedocs.io/en/0.24.0/tutorials/ControlMutationsTutorial.html

I identified the underlying problem, but can't give an ETA for the solution as it's not very trivial.

[correaa]

thanks, I don't know what the code coverage support does exactly.
Mull can be more efficient if it know the coverage before hand?

I have a coverage run, I could run it at the same time with mull but I don't understand the mechanics.

https://app.codecov.io/gl/correaa/boost-multi/tree/master/include%2Fboost%2Fmulti

[AlexDenisov]

thanks, I don't know what the code coverage support does exactly. Mull can be more efficient if it know the coverage before hand?

I have a coverage run, I could run it at the same time with mull but I don't understand the mechanics.

https://app.codecov.io/gl/correaa/boost-multi/tree/master/include%2Fboost%2Fmulti

The idea is to collect coverage information for a certain run and then only consider mutants that were actually executed. It eliminates the problem when unreachable mutants are reported as survived.

[correaa]

I see, it makes sense. Although another (inefficient, non-intended) use of mull could be to detect missing coverage. I am using it like that.

…

On Mon, Dec 30, 2024 at 11:28 AM Alex Denisov ***@***.***> wrote: thanks, I don't know what the code coverage support does exactly. Mull can be more efficient if it know the coverage before hand? I have a coverage run, I could run it at the same time with mull but I don't understand the mechanics. https://app.codecov.io/gl/correaa/boost-multi/tree/master/include%2Fboost%2Fmulti The idea is to collect coverage information for a certain run and then only consider mutants that were actually executed. It eliminates the problem when unreachable mutants are reported as survived. — Reply to this email directly, view it on GitHub <#1077 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAXICU4CFYTBWPTLHCZKBIT2IGNENAVCNFSM6AAAAABUFMKZUKVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDKNRVHA2DCOJYHE> . You are receiving this because you were mentioned.Message ID: ***@***.***>