| //===-- Operations.cpp ----------------------------------------------------===// |
| // |
| // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. |
| // See https://llvm.org/LICENSE.txt for license information. |
| // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception |
| // |
| //===----------------------------------------------------------------------===// |
| |
| #include "llvm/FuzzMutate/Operations.h" |
| #include "llvm/IR/BasicBlock.h" |
| #include "llvm/IR/Constants.h" |
| #include "llvm/IR/Function.h" |
| #include "llvm/IR/Instructions.h" |
| |
| using namespace llvm; |
| using namespace fuzzerop; |
| |
| void llvm::describeFuzzerIntOps(std::vector<fuzzerop::OpDescriptor> &Ops) { |
| Ops.push_back(binOpDescriptor(1, Instruction::Add)); |
| Ops.push_back(binOpDescriptor(1, Instruction::Sub)); |
| Ops.push_back(binOpDescriptor(1, Instruction::Mul)); |
| Ops.push_back(binOpDescriptor(1, Instruction::SDiv)); |
| Ops.push_back(binOpDescriptor(1, Instruction::UDiv)); |
| Ops.push_back(binOpDescriptor(1, Instruction::SRem)); |
| Ops.push_back(binOpDescriptor(1, Instruction::URem)); |
| Ops.push_back(binOpDescriptor(1, Instruction::Shl)); |
| Ops.push_back(binOpDescriptor(1, Instruction::LShr)); |
| Ops.push_back(binOpDescriptor(1, Instruction::AShr)); |
| Ops.push_back(binOpDescriptor(1, Instruction::And)); |
| Ops.push_back(binOpDescriptor(1, Instruction::Or)); |
| Ops.push_back(binOpDescriptor(1, Instruction::Xor)); |
| |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_EQ)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_NE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_UGT)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_UGE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_ULT)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_ULE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_SGT)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_SGE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_SLT)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::ICmp, CmpInst::ICMP_SLE)); |
| } |
| |
| void llvm::describeFuzzerFloatOps(std::vector<fuzzerop::OpDescriptor> &Ops) { |
| Ops.push_back(binOpDescriptor(1, Instruction::FAdd)); |
| Ops.push_back(binOpDescriptor(1, Instruction::FSub)); |
| Ops.push_back(binOpDescriptor(1, Instruction::FMul)); |
| Ops.push_back(binOpDescriptor(1, Instruction::FDiv)); |
| Ops.push_back(binOpDescriptor(1, Instruction::FRem)); |
| |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_FALSE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_OEQ)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_OGT)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_OGE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_OLT)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_OLE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_ONE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_ORD)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_UNO)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_UEQ)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_UGT)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_UGE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_ULT)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_ULE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_UNE)); |
| Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_TRUE)); |
| } |
| |
| void llvm::describeFuzzerControlFlowOps( |
| std::vector<fuzzerop::OpDescriptor> &Ops) { |
| Ops.push_back(splitBlockDescriptor(1)); |
| } |
| |
| void llvm::describeFuzzerPointerOps(std::vector<fuzzerop::OpDescriptor> &Ops) { |
| Ops.push_back(gepDescriptor(1)); |
| } |
| |
| void llvm::describeFuzzerAggregateOps( |
| std::vector<fuzzerop::OpDescriptor> &Ops) { |
| Ops.push_back(extractValueDescriptor(1)); |
| Ops.push_back(insertValueDescriptor(1)); |
| } |
| |
| void llvm::describeFuzzerVectorOps(std::vector<fuzzerop::OpDescriptor> &Ops) { |
| Ops.push_back(extractElementDescriptor(1)); |
| Ops.push_back(insertElementDescriptor(1)); |
| Ops.push_back(shuffleVectorDescriptor(1)); |
| } |
| |
| OpDescriptor llvm::fuzzerop::binOpDescriptor(unsigned Weight, |
| Instruction::BinaryOps Op) { |
| auto buildOp = [Op](ArrayRef<Value *> Srcs, Instruction *Inst) { |
| return BinaryOperator::Create(Op, Srcs[0], Srcs[1], "B", Inst); |
| }; |
| switch (Op) { |
| case Instruction::Add: |
| case Instruction::Sub: |
| case Instruction::Mul: |
| case Instruction::SDiv: |
| case Instruction::UDiv: |
| case Instruction::SRem: |
| case Instruction::URem: |
| case Instruction::Shl: |
| case Instruction::LShr: |
| case Instruction::AShr: |
| case Instruction::And: |
| case Instruction::Or: |
| case Instruction::Xor: |
| return {Weight, {anyIntType(), matchFirstType()}, buildOp}; |
| case Instruction::FAdd: |
| case Instruction::FSub: |
| case Instruction::FMul: |
| case Instruction::FDiv: |
| case Instruction::FRem: |
| return {Weight, {anyFloatType(), matchFirstType()}, buildOp}; |
| case Instruction::BinaryOpsEnd: |
| llvm_unreachable("Value out of range of enum"); |
| } |
| llvm_unreachable("Covered switch"); |
| } |
| |
| OpDescriptor llvm::fuzzerop::cmpOpDescriptor(unsigned Weight, |
| Instruction::OtherOps CmpOp, |
| CmpInst::Predicate Pred) { |
| auto buildOp = [CmpOp, Pred](ArrayRef<Value *> Srcs, Instruction *Inst) { |
| return CmpInst::Create(CmpOp, Pred, Srcs[0], Srcs[1], "C", Inst); |
| }; |
| |
| switch (CmpOp) { |
| case Instruction::ICmp: |
| return {Weight, {anyIntType(), matchFirstType()}, buildOp}; |
| case Instruction::FCmp: |
| return {Weight, {anyFloatType(), matchFirstType()}, buildOp}; |
| default: |
| llvm_unreachable("CmpOp must be ICmp or FCmp"); |
| } |
| } |
| |
| OpDescriptor llvm::fuzzerop::splitBlockDescriptor(unsigned Weight) { |
| auto buildSplitBlock = [](ArrayRef<Value *> Srcs, Instruction *Inst) { |
| BasicBlock *Block = Inst->getParent(); |
| BasicBlock *Next = Block->splitBasicBlock(Inst, "BB"); |
| |
| // If it was an exception handling block, we are done. |
| if (Block->isEHPad()) |
| return nullptr; |
| |
| // Loop back on this block by replacing the unconditional forward branch |
| // with a conditional with a backedge. |
| if (Block != &Block->getParent()->getEntryBlock()) { |
| BranchInst::Create(Block, Next, Srcs[0], Block->getTerminator()); |
| Block->getTerminator()->eraseFromParent(); |
| |
| // We need values for each phi in the block. Since there isn't a good way |
| // to do a variable number of input values currently, we just fill them |
| // with undef. |
| for (PHINode &PHI : Block->phis()) |
| PHI.addIncoming(UndefValue::get(PHI.getType()), Block); |
| } |
| return nullptr; |
| }; |
| SourcePred isInt1Ty{[](ArrayRef<Value *>, const Value *V) { |
| return V->getType()->isIntegerTy(1); |
| }, |
| None}; |
| return {Weight, {isInt1Ty}, buildSplitBlock}; |
| } |
| |
| OpDescriptor llvm::fuzzerop::gepDescriptor(unsigned Weight) { |
| auto buildGEP = [](ArrayRef<Value *> Srcs, Instruction *Inst) { |
| Type *Ty = cast<PointerType>(Srcs[0]->getType())->getElementType(); |
| auto Indices = makeArrayRef(Srcs).drop_front(1); |
| return GetElementPtrInst::Create(Ty, Srcs[0], Indices, "G", Inst); |
| }; |
| // TODO: Handle aggregates and vectors |
| // TODO: Support multiple indices. |
| // TODO: Try to avoid meaningless accesses. |
| return {Weight, {sizedPtrType(), anyIntType()}, buildGEP}; |
| } |
| |
| static uint64_t getAggregateNumElements(Type *T) { |
| assert(T->isAggregateType() && "Not a struct or array"); |
| if (isa<StructType>(T)) |
| return T->getStructNumElements(); |
| return T->getArrayNumElements(); |
| } |
| |
| static SourcePred validExtractValueIndex() { |
| auto Pred = [](ArrayRef<Value *> Cur, const Value *V) { |
| if (auto *CI = dyn_cast<ConstantInt>(V)) |
| if (!CI->uge(getAggregateNumElements(Cur[0]->getType()))) |
| return true; |
| return false; |
| }; |
| auto Make = [](ArrayRef<Value *> Cur, ArrayRef<Type *> Ts) { |
| std::vector<Constant *> Result; |
| auto *Int32Ty = Type::getInt32Ty(Cur[0]->getContext()); |
| uint64_t N = getAggregateNumElements(Cur[0]->getType()); |
| // Create indices at the start, end, and middle, but avoid dups. |
| Result.push_back(ConstantInt::get(Int32Ty, 0)); |
| if (N > 1) |
| Result.push_back(ConstantInt::get(Int32Ty, N - 1)); |
| if (N > 2) |
| Result.push_back(ConstantInt::get(Int32Ty, N / 2)); |
| return Result; |
| }; |
| return {Pred, Make}; |
| } |
| |
| OpDescriptor llvm::fuzzerop::extractValueDescriptor(unsigned Weight) { |
| auto buildExtract = [](ArrayRef<Value *> Srcs, Instruction *Inst) { |
| // TODO: It's pretty inefficient to shuffle this all through constants. |
| unsigned Idx = cast<ConstantInt>(Srcs[1])->getZExtValue(); |
| return ExtractValueInst::Create(Srcs[0], {Idx}, "E", Inst); |
| }; |
| // TODO: Should we handle multiple indices? |
| return {Weight, {anyAggregateType(), validExtractValueIndex()}, buildExtract}; |
| } |
| |
| static SourcePred matchScalarInAggregate() { |
| auto Pred = [](ArrayRef<Value *> Cur, const Value *V) { |
| if (auto *ArrayT = dyn_cast<ArrayType>(Cur[0]->getType())) |
| return V->getType() == ArrayT->getElementType(); |
| |
| auto *STy = cast<StructType>(Cur[0]->getType()); |
| for (int I = 0, E = STy->getNumElements(); I < E; ++I) |
| if (STy->getTypeAtIndex(I) == V->getType()) |
| return true; |
| return false; |
| }; |
| auto Make = [](ArrayRef<Value *> Cur, ArrayRef<Type *>) { |
| if (auto *ArrayT = dyn_cast<ArrayType>(Cur[0]->getType())) |
| return makeConstantsWithType(ArrayT->getElementType()); |
| |
| std::vector<Constant *> Result; |
| auto *STy = cast<StructType>(Cur[0]->getType()); |
| for (int I = 0, E = STy->getNumElements(); I < E; ++I) |
| makeConstantsWithType(STy->getTypeAtIndex(I), Result); |
| return Result; |
| }; |
| return {Pred, Make}; |
| } |
| |
| static SourcePred validInsertValueIndex() { |
| auto Pred = [](ArrayRef<Value *> Cur, const Value *V) { |
| if (auto *CI = dyn_cast<ConstantInt>(V)) |
| if (CI->getBitWidth() == 32) { |
| Type *Indexed = ExtractValueInst::getIndexedType(Cur[0]->getType(), |
| CI->getZExtValue()); |
| return Indexed == Cur[1]->getType(); |
| } |
| return false; |
| }; |
| auto Make = [](ArrayRef<Value *> Cur, ArrayRef<Type *> Ts) { |
| std::vector<Constant *> Result; |
| auto *Int32Ty = Type::getInt32Ty(Cur[0]->getContext()); |
| auto *BaseTy = Cur[0]->getType(); |
| int I = 0; |
| while (Type *Indexed = ExtractValueInst::getIndexedType(BaseTy, I)) { |
| if (Indexed == Cur[1]->getType()) |
| Result.push_back(ConstantInt::get(Int32Ty, I)); |
| ++I; |
| } |
| return Result; |
| }; |
| return {Pred, Make}; |
| } |
| |
| OpDescriptor llvm::fuzzerop::insertValueDescriptor(unsigned Weight) { |
| auto buildInsert = [](ArrayRef<Value *> Srcs, Instruction *Inst) { |
| // TODO: It's pretty inefficient to shuffle this all through constants. |
| unsigned Idx = cast<ConstantInt>(Srcs[2])->getZExtValue(); |
| return InsertValueInst::Create(Srcs[0], Srcs[1], {Idx}, "I", Inst); |
| }; |
| return { |
| Weight, |
| {anyAggregateType(), matchScalarInAggregate(), validInsertValueIndex()}, |
| buildInsert}; |
| } |
| |
| OpDescriptor llvm::fuzzerop::extractElementDescriptor(unsigned Weight) { |
| auto buildExtract = [](ArrayRef<Value *> Srcs, Instruction *Inst) { |
| return ExtractElementInst::Create(Srcs[0], Srcs[1], "E", Inst); |
| }; |
| // TODO: Try to avoid undefined accesses. |
| return {Weight, {anyVectorType(), anyIntType()}, buildExtract}; |
| } |
| |
| OpDescriptor llvm::fuzzerop::insertElementDescriptor(unsigned Weight) { |
| auto buildInsert = [](ArrayRef<Value *> Srcs, Instruction *Inst) { |
| return InsertElementInst::Create(Srcs[0], Srcs[1], Srcs[2], "I", Inst); |
| }; |
| // TODO: Try to avoid undefined accesses. |
| return {Weight, |
| {anyVectorType(), matchScalarOfFirstType(), anyIntType()}, |
| buildInsert}; |
| } |
| |
| static SourcePred validShuffleVectorIndex() { |
| auto Pred = [](ArrayRef<Value *> Cur, const Value *V) { |
| return ShuffleVectorInst::isValidOperands(Cur[0], Cur[1], V); |
| }; |
| auto Make = [](ArrayRef<Value *> Cur, ArrayRef<Type *> Ts) { |
| auto *FirstTy = cast<FixedVectorType>(Cur[0]->getType()); |
| auto *Int32Ty = Type::getInt32Ty(Cur[0]->getContext()); |
| // TODO: It's straighforward to make up reasonable values, but listing them |
| // exhaustively would be insane. Come up with a couple of sensible ones. |
| return std::vector<Constant *>{UndefValue::get( |
| FixedVectorType::get(Int32Ty, FirstTy->getNumElements()))}; |
| }; |
| return {Pred, Make}; |
| } |
| |
| OpDescriptor llvm::fuzzerop::shuffleVectorDescriptor(unsigned Weight) { |
| auto buildShuffle = [](ArrayRef<Value *> Srcs, Instruction *Inst) { |
| return new ShuffleVectorInst(Srcs[0], Srcs[1], Srcs[2], "S", Inst); |
| }; |
| return {Weight, |
| {anyVectorType(), matchFirstType(), validShuffleVectorIndex()}, |
| buildShuffle}; |
| } |