feat: LLVM 16 + New Pass Manager + C++17 migration + TestComp 2026 checkpoint by GuilhermeBn198 · Pull Request #47 · hbgit/Map2Check

GuilhermeBn198 · 2026-06-19T01:44:04Z

Summary

Migração completa do Map2Check v7.3 (LLVM 6 + Legacy PM) para Map2Check v8 (LLVM 16 + New PM + C++17), com validação end-to-end contra benchmarks do TestComp 2026.

84 files changed | +5,785 / −657 lines | 35 commits

What changed

Phase 1.1–1.2: Infrastructure

Dockerfile.dev: Ubuntu 22.04 + LLVM 16 pre-installed + sanitizers + cppcheck
CMake modules migrated to LLVM 16
GitHub Actions CI + Docker publish workflow

Phase 1.3: New Pass Manager (9 passes)

Simple: AssertPass, TargetPass, LoopPredAssumePass, Map2CheckLibrary
Medium: NonDetPass, TrackBasicBlockPass
Complex: OverflowPass, GenerateAutomataTruePass, MemoryTrackPass
isRequired() added to all passes

Phase 1.4: Frontend C++17

C++17 standard (std::filesystem, structured bindings)
Frontend KLEE/libFuzzer orchestration updated for LLVM 16
E2E smoke test validating the full pipeline

Phase 1.4.3: TestComp 2026 Checkpoint

Full execution of C.coverage-error-call.Heap sub-category
594 tasks (Heap 428 + LinkedLists 166)
Score: 57
264 TRUE (44.4%), 271 UNKNOWN (45.6%), 56 FALSE (9.4%)

CI/CD + Static Analysis

GitHub Actions CI workflow (build + unit tests)
Docker publish to GHCR
.clang-tidy + .cppcheck-suppressions.txt
ASAN/UBSAN/TSAN sanitizer targets

3 Critical Bugs Found & Fixed

Bug	Symptom	Root Cause	Commit
KLEE 3.x flags	Unknown command line argument	Removed flags in KLEE 3.x	`284aef1`
isRequired() missing	All 9 passes skipped silently	optnone + New PM behavior change	`0deb84e`
Target function not propagated	__VERIFIER_error instead of reach_error	env var vs cl::opt mismatch	`0deb84e`

Test Results

Unit tests: 7/7 passing
Pass plugin load: 9/9 loading correctly with opt-16
E2E smoke test: 2/2 loops benchmarks correct (reachable + unreachable)
TestComp 2026 Heap: 594 tasks, score 57

Known Issues / Next Steps (Phase 2)

UNKNOWN rate at 45.6% needs investigation (timeout tuning, solver strategy)
No E2E integration tests in CI yet (all 3 bugs were missed by unit tests alone)
ControlFlow benchmarks used no-overflow property, not comparable with reachability mode
strcpy usage flagged as CWE-119 (needs migration to strncpy)

- Cherry-pick 68cd2eb from fuzzer-option branch (PR #44) - Adds --nondet-generator CLI option (fuzzer/symex) - Fix GoogleTest GIT_TAG to release-1.12.1 for CMake compat - Build OK (50/50), unit tests 7/7 passed - Migration report: docs/migration/0.1-pr44-nondet-generator.md

- Unit tests: 7/7 passed - Regression: 3/9 correct (6 failures due to WSL2 memory limits) - PR #44 (nondet-generator): 4/4 scenarios validated - PR #46 (target-function-name): validated - 4 runs confirm 100% deterministic results - Official baseline for LLVM 16 migration comparison

…ses to LLVM 16 API - Create Dockerfile.dev with LLVM 16.0.6, KLEE 3.1, Z3 4.8.12, STP 2.3.3 - Upgrade CMAKE_CXX_STANDARD from 11 to 17 (required by LLVM 16 headers) - Replace getCalledValue() with getCalledOperand() (removed in LLVM 11) - Replace llvm::make_unique with std::make_unique (removed in LLVM 10) - Replace TerminatorInst with Instruction (removed in LLVM 10) - Replace Type::getInt8PtrTy() with PointerType::get(Ctx, 0) (opaque pointers) - Replace getPointerElementType() with getAllocatedType()/getValueType() - Replace Constant* with FunctionCallee for getOrInsertFunction() returns - Fix StringRef implicit conversion to std::string with .str() - Fix boost/uuid/sha1.hpp path for Boost 1.74 - Add #include <unistd.h> for getpid() in ContainerBTree.c - Add migration docs and testimony report

- Update cmake_minimum_required from 3.5 to 3.20 - Bump project version to 8.0.0 - Remove USE_PREBUILT_CLANG option (no longer needed) - Add CMAKE_EXPORT_COMPILE_COMMANDS for IDE support - Rewrite FindZ3.cmake: ExternalProject z3-4.4.1 → find_package Z3 4.8.12 - Rewrite FindMiniSat.cmake: ExternalProject → find_library /usr/local - Rewrite FindSTP.cmake: ExternalProject 2.1.2 → find_library STP 2.3.4 - Rewrite FindKlee.cmake: fork RafaelSa94/klee → KLEE 3.1 in /opt/klee - Rewrite FindKleeUCLibC.cmake: ExternalProject → /opt/klee-uclibc - Rewrite FindLibFuzzer.cmake: SVN download → compiler-rt LLVM 16 - Clean up FindClang.cmake: remove dead USE_PREBUILT_CLANG code - Clean up FindGTest.cmake: remove CMake 2.8 compat - Add migration report docs/migration/1.2-cmake-llvm16.md

Migrate 4 passes from Legacy PM (FunctionPass/LoopPass) to New PM (PassInfoMixin) with plugin registration via llvmGetPassPluginInfo(): - AssertPass: FunctionPass → PassInfoMixin, plugin name 'assert-pass' - TargetPass: FunctionPass → PassInfoMixin, plugin name 'target-pass' - LoopPredAssumePass: LoopPass → PassInfoMixin (Loop PM), name 'loop-pred-assume' - Map2CheckLibrary: FunctionPass → PassInfoMixin, name 'map2check-library' - OperationsFunctions.hpp: llvm/Pass.h → llvm/IR/PassManager.h Common changes per pass: - Remove static char ID and RegisterPass<T> - Remove FunctionPass(ID) / LoopPass(ID) constructors - Change runOnFunction/runOnLoop → run() returning PreservedAnalyses - Add llvmGetPassPluginInfo() for opt -load-pass-plugin usage - Add migration reports in docs/migration/

- NonDetPass: FunctionPass → PassInfoMixin, plugin name 'nondet-pass' All macro-based instrumentation logic preserved unchanged - TrackBasicBlockPass: FunctionPass → PassInfoMixin, plugin name 'track-basic-block' Cleaned up commented-out code in runOnFunction - Common: remove char ID, RegisterPass, add llvmGetPassPluginInfo()

- OverflowPass (446 lines): FunctionPass → PassInfoMixin, plugin name 'overflow-pass' - GenerateAutomataTruePass (599 lines): FunctionPass → PassInfoMixin, name 'generate-automata-true' - MemoryTrackPass (815 lines): FunctionPass → PassInfoMixin, name 'memory-track' Most complex pass with extensive memory instrumentation — all logic preserved - Common: remove char ID, RegisterPass, add llvmGetPassPluginInfo() All 9 passes now use New Pass Manager with plugin registration.

- Add docs/migration/1.3-passes-new-pm.md with pattern documentation - Mark all 9 passes as ✅ in migration-schedule.md

Frontend (caller.cpp): - callPass(): opt -load → opt -load-pass-plugin + -passes='...' - TargetPass: function name passed via MAP2CHECK_TARGET_FUNCTION env var C++17 migration (11 files): - boost::filesystem → std::filesystem (caller, map2check, tools) - boost::make_unique → std::make_unique (counter_example, graph, map2check) - boost::algorithm::string → custom replaceAll/splitString (tools, GenAutomata) - boost::begin/end → std::begin/end (map2check) Kept: boost::program_options (no C++17 equivalent), boost::uuids::sha1

- cmake/FindBoost.cmake: remove filesystem and system components - frontend/CMakeLists.txt: remove -D_GLIBCXX_USE_CXX11_ABI=0 flag (incompatible with std::filesystem, no longer needed)

Prevents cmake reconfiguration loop that was losing SKIP_KLEE/SKIP_LIB_FUZZER cache variables during the second pass.

Build: 100% success (Clang 16.0.6, Boost 1.74.0) Tests: 7/7 unit tests PASSED Plugins: 9/9 pass plugins load and execute OK

Removed deprecated: -suppress-external-warnings, -use-construct-hash-metasmt Normalized single-dash flags to double-dash style

- map2check-wrapper.py for v8 (z3, reach_error direct) - map2check-v8.xml with 6 categories subset - script_execucao.py adapted for Docker execution - Property files for cover-error and cover-branches

All 9 passes now declare isRequired()=true so opt-16 executes them even on functions with optnone attribute (compiled with -O0). Without this, the New PM silently skips all instrumentation. Also fix target function name propagation: use -function-name= cl::opt flag directly instead of unused env var.

- README.md with full manual reproduction steps - Migration report 1.4.3 checkpoint TestComp 2026 - run_all_inside.sh for single-container execution - run_checkpoint.sh for Docker-per-test execution - Updated .gitignore for release artifacts - Wrapper fix: KLEE_RUNTIME_LIBRARY_PATH

- Execute 594 tasks (Heap.set + LinkedLists.set) - Score: 57 bugs found, 98.8% accuracy (169/171) - Add resume script for interrupted executions - Add verdict verification against sv-benchmarks - Update migration docs with full results

- cppcheck: enable warning+portability only (not performance) - cppcheck: suppress pre-existing uninitMemberVar and missingReturn - ASan: disable leak detection (test code tests allocation, not ownership) - UBSan: report but don't halt (BTree OOB tracked for fix)

Legacy C runtime has pre-existing issues (OOB, uninit, dangling ptr). Frontend C++ scan remains strict and blocking.

- Detail all cppcheck, UBSan, ASan and compiler findings - Add Phase 2.0 with 9 tasks to fix pre-existing bugs - Prioritize UB/security bugs (2.0.1-2.0.4) before new features

- 3x strcpy insecure API (CWE-119) in map2check.cpp - exceptions.hpp namespace errors - ~20 modernize-use-override, ~30 performance-unnecessary-value-param - 4 dead stores in graph.cpp - Phase 2.0 expanded: 12 tasks (was 9)

…eferred

Rafael Sá Menezes and others added 30 commits November 12, 2020 21:17

added function name option on target pass

3b60f89

removed definition from pass

483aabc

docs(1.3): add consolidated New PM migration report and update schedule

0e87c74

- Add docs/migration/1.3-passes-new-pm.md with pattern documentation - Mark all 9 passes as ✅ in migration-schedule.md

build(1.4.3): update CMake for C++17 migration

dc6777a

- cmake/FindBoost.cmake: remove filesystem and system components - frontend/CMakeLists.txt: remove -D_GLIBCXX_USE_CXX11_ABI=0 flag (incompatible with std::filesystem, no longer needed)

docs(1.4): add frontend and C++17 migration report

7faa87d

fix(cmake): use CACHE FORCE for compiler vars in FindClang

c46551d

Prevents cmake reconfiguration loop that was losing SKIP_KLEE/SKIP_LIB_FUZZER cache variables during the second pass.

docs(1.4): update report with build/test results

ddd98d6

Build: 100% success (Clang 16.0.6, Boost 1.74.0) Tests: 7/7 unit tests PASSED Plugins: 9/9 pass plugins load and execute OK

fix(klee): update CLI flags for KLEE 3.x (LLVM 16)

284aef1

Removed deprecated: -suppress-external-warnings, -use-construct-hash-metasmt Normalized single-dash flags to double-dash style

feat(testcomp): add TestComp 2026 checkpoint framework

9bede1c

- map2check-wrapper.py for v8 (z3, reach_error direct) - map2check-v8.xml with 6 categories subset - script_execucao.py adapted for Docker execution - Property files for cover-error and cover-branches

docs: add smoke test report for checkpoint 1.4

db15d93

docs: update checkpoint report with full smoke test results

9a00b27

ci: add GitHub Actions CI and Docker publish workflows

63e45bb

build: add sanitizer support and cppcheck to dev image

65138ba

chore: add static analysis configs (clang-tidy, cppcheck)

49d1c50

docs: update badges and LLVM version in README

b5ae9de

docs: add Phase 1.5 OpenSSF badge to migration schedule

9de7eb8

fix(ci): use apt install instead of GHCR image

d70c38b

fix: remove comments from cppcheck suppressions file

f82829d

fix(build): enable PIC for sanitizer builds

5855edb

GuilhermeBn198 added 5 commits June 14, 2026 00:14

fix(ci): make C backend cppcheck informational

8961350

Legacy C runtime has pre-existing issues (OOB, uninit, dangling ptr). Frontend C++ scan remains strict and blocking.

docs: document CI findings and add Phase 2.0 code health tasks

f1e0b92

- Detail all cppcheck, UBSan, ASan and compiler findings - Add Phase 2.0 with 9 tasks to fix pre-existing bugs - Prioritize UB/security bugs (2.0.1-2.0.4) before new features

docs: add clang-tidy findings (strcpy CWE-119, dead stores)

c320918

- 3x strcpy insecure API (CWE-119) in map2check.cpp - exceptions.hpp namespace errors - ~20 modernize-use-override, ~30 performance-unnecessary-value-param - 4 dead stores in graph.cpp - Phase 2.0 expanded: 12 tasks (was 9)

docs: update migration schedule status and mark incomplete tasks as d…

1fcfef2

…eferred

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: LLVM 16 + New Pass Manager + C++17 migration + TestComp 2026 checkpoint#47

feat: LLVM 16 + New Pass Manager + C++17 migration + TestComp 2026 checkpoint#47
GuilhermeBn198 wants to merge 35 commits into
developfrom
feat-update

GuilhermeBn198 commented Jun 19, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

GuilhermeBn198 commented Jun 19, 2026

Summary

What changed

Phase 1.1–1.2: Infrastructure

Phase 1.3: New Pass Manager (9 passes)

Phase 1.4: Frontend C++17

Phase 1.4.3: TestComp 2026 Checkpoint

CI/CD + Static Analysis

3 Critical Bugs Found & Fixed

Test Results

Known Issues / Next Steps (Phase 2)

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant