[creduce-dev] reduction using dynamic information

[John Regehr <regehr@cs.utah.edu>]

I've been reducing some difficult wrong code bugs lately and C-Reduce 
tends to get stuck sometimes, it just can't see the transformations that 
need to be done.

One idea I've had, than I think will help out, is to convince C-Reduce 
to replace a variable (or other expression) with a value that is seen 
during actual execution.  If an expression takes on multiple values 
during execution, we can just pick one of them and try it out.

So what I'm looking for is an easy way to enumerate the expressions in a 
C/C++ compilation unit and then, for the specified one, rewrite the 
program so that the first value taken on by that expression is printed 
out. The other thing we need is to replace the expression with its value 
-- creating a C-Reduce variant that can be run through the 
interestingness test.

Doing this will be pretty slow, but I view it as a strategy of last 
resort that can be used when easier reduction methods have failed.

I imagine the right answer here is a clang plugin.  Does anyone have 
experience enumerating expressions (including all subexpressions) using 
a clang visitor, and also rewriting the subexpressions?

Thanks,

John