TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

How we use binary search to find compiler bugs

78 pointsby tekknolagiover 2 years ago

11 comments

hedoraover 2 years ago
Check out the Delta Debugging paper. There has been a ton of follow-on work (1000+ direct citations), and lots of tools exist.<p>Here&#x27;s the citation, abstract and link to a PDF copy:<p>Simplifying and isolating failure-inducing input Andreas Zeller, Ralf Hildebrandt IEEE Transactions on Software Engineering 28 (2), 183-200, 2002<p><i>Given some test case, a program fails. Which circumstances of the test case are responsible for the particular failure? The delta debugging algorithm generalizes and simplifies the failing test case to a minimal test case that still produces the failure. It also isolates the difference between a passing and a failing test case. In a case study, the Mozilla Web browser crashed after 95 user actions. Our prototype implementation automatically simplified the input to three relevant user actions. Likewise, it simplified 896 lines of HTML to the single line that caused the failure. The case study required 139 automated test runs or 35 minutes on a 500 MHz PC.</i><p><a href="http:&#x2F;&#x2F;cs.purdue.edu&#x2F;homes&#x2F;xyzhang&#x2F;fall07&#x2F;Papers&#x2F;delta-debugging.pdf" rel="nofollow">http:&#x2F;&#x2F;cs.purdue.edu&#x2F;homes&#x2F;xyzhang&#x2F;fall07&#x2F;Papers&#x2F;delta-debug...</a><p>Edit: adjusted tone
anderskaseorgover 2 years ago
An even more fine-grained binary search technique for isolating compiler bugs is optimization fuel:<p><a href="http:&#x2F;&#x2F;blog.ezyang.com&#x2F;2011&#x2F;06&#x2F;debugging-compilers-with-optimization-fuel&#x2F;" rel="nofollow">http:&#x2F;&#x2F;blog.ezyang.com&#x2F;2011&#x2F;06&#x2F;debugging-compilers-with-opti...</a>
mhh__over 2 years ago
<a href="https:&#x2F;&#x2F;dlang.org&#x2F;blog&#x2F;2020&#x2F;04&#x2F;13&#x2F;dustmite-the-general-purpose-data-reduction-tool&#x2F;" rel="nofollow">https:&#x2F;&#x2F;dlang.org&#x2F;blog&#x2F;2020&#x2F;04&#x2F;13&#x2F;dustmite-the-general-purpo...</a><p>Dustmite (say thank you to cybershadow) is the D community&#x27;s beloved test case reduction tool
airtnpover 2 years ago
JReduce (<a href="https:&#x2F;&#x2F;dl.acm.org&#x2F;doi&#x2F;abs&#x2F;10.1145&#x2F;3453483.3454091" rel="nofollow">https:&#x2F;&#x2F;dl.acm.org&#x2F;doi&#x2F;abs&#x2F;10.1145&#x2F;3453483.3454091</a>) uses similar technique but with semantics for debugging such problems with Java decompiler and bytecodes.<p>The problem is we don&#x27;t know if compiling with these functions follows the monotonicity of binary searching: what if a problem is caused by a special combination of two functions? You have to arrange these two functions in the right order in order to find the problem.
eyelidlessnessover 2 years ago
Binary search is also helpful in code that doesn’t reliably produce useful stack traces (<i>side eyes Promise.then</i>). Comment out half of the potentially implicated code. If you get the same error, you very likely haven’t found a stack frame. If you get a different error or no error at all, keep halving until you either isolate the thing or know where to look.
FeepingCreatureover 2 years ago
D also has Dustmite (<a href="https:&#x2F;&#x2F;dlang.org&#x2F;blog&#x2F;2020&#x2F;04&#x2F;13&#x2F;dustmite-the-general-purpose-data-reduction-tool&#x2F;" rel="nofollow">https:&#x2F;&#x2F;dlang.org&#x2F;blog&#x2F;2020&#x2F;04&#x2F;13&#x2F;dustmite-the-general-purpo...</a>), same idea.
Genghis_9000over 2 years ago
&gt; You may have heard of bisecting from geometry or from git bisect1. Those are the two places I heard about it<p>I heard of it from when I first started programming and I cut the code in half (maybe 3rds or other units, close enough) until I found which part was breaking the program.
drdreyover 2 years ago
bugpoint is the equivalent for llvm: <a href="https:&#x2F;&#x2F;www.llvm.org&#x2F;docs&#x2F;CommandGuide&#x2F;bugpoint.html" rel="nofollow">https:&#x2F;&#x2F;www.llvm.org&#x2F;docs&#x2F;CommandGuide&#x2F;bugpoint.html</a>
tantalorover 2 years ago
I have wondered how to extend this to combinations of elements.<p>What if the bad outcome only happens when two or more elements are enabled?<p>Is there a generalization of binary search for powersets?<p>Can this be done efficiently?
评论 #33298073 未加载
评论 #33296915 未加载
评论 #33300477 未加载
eimrineover 2 years ago
Is this a fuzzing?
评论 #33258530 未加载
pabs3over 2 years ago
cvise is another tool for test case reduction, similar to creduce mentioned in the article:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;marxin&#x2F;cvise" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;marxin&#x2F;cvise</a>
评论 #33285030 未加载