|
134
|
1 //===- RandomIRBuilderTest.cpp - Tests for injector strategy --------------===//
|
|
|
2 //
|
|
147
|
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
|
4 // See https://llvm.org/LICENSE.txt for license information.
|
|
|
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
134
|
6 //
|
|
|
7 //===----------------------------------------------------------------------===//
|
|
|
8
|
|
|
9 #include "llvm/FuzzMutate/RandomIRBuilder.h"
|
|
|
10 #include "llvm/ADT/StringRef.h"
|
|
|
11 #include "llvm/AsmParser/Parser.h"
|
|
|
12 #include "llvm/AsmParser/SlotMapping.h"
|
|
|
13 #include "llvm/FuzzMutate/IRMutator.h"
|
|
|
14 #include "llvm/FuzzMutate/OpDescriptor.h"
|
|
|
15 #include "llvm/FuzzMutate/Operations.h"
|
|
|
16 #include "llvm/IR/Constants.h"
|
|
|
17 #include "llvm/IR/Instructions.h"
|
|
|
18 #include "llvm/IR/LLVMContext.h"
|
|
|
19 #include "llvm/IR/Module.h"
|
|
|
20 #include "llvm/IR/Verifier.h"
|
|
|
21 #include "llvm/Support/SourceMgr.h"
|
|
|
22
|
|
|
23 #include "gtest/gtest.h"
|
|
|
24
|
|
|
25 using namespace llvm;
|
|
|
26
|
|
|
27 static constexpr int Seed = 5;
|
|
|
28
|
|
|
29 namespace {
|
|
|
30
|
|
|
31 std::unique_ptr<Module> parseAssembly(
|
|
|
32 const char *Assembly, LLVMContext &Context) {
|
|
|
33
|
|
|
34 SMDiagnostic Error;
|
|
|
35 std::unique_ptr<Module> M = parseAssemblyString(Assembly, Error, Context);
|
|
|
36
|
|
|
37 std::string ErrMsg;
|
|
|
38 raw_string_ostream OS(ErrMsg);
|
|
|
39 Error.print("", OS);
|
|
|
40
|
|
|
41 assert(M && !verifyModule(*M, &errs()));
|
|
|
42 return M;
|
|
|
43 }
|
|
|
44
|
|
|
45 TEST(RandomIRBuilderTest, ShuffleVectorIncorrectOperands) {
|
|
|
46 // Test that we don't create load instruction as a source for the shuffle
|
|
|
47 // vector operation.
|
|
|
48
|
|
|
49 LLVMContext Ctx;
|
|
|
50 const char *Source =
|
|
|
51 "define <2 x i32> @test(<2 x i1> %cond, <2 x i32> %a) {\n"
|
|
|
52 " %A = alloca <2 x i32>\n"
|
|
|
53 " %I = insertelement <2 x i32> %a, i32 1, i32 1\n"
|
|
|
54 " ret <2 x i32> undef\n"
|
|
|
55 "}";
|
|
|
56 auto M = parseAssembly(Source, Ctx);
|
|
|
57
|
|
|
58 fuzzerop::OpDescriptor Descr = fuzzerop::shuffleVectorDescriptor(1);
|
|
|
59
|
|
|
60 // Empty known types since we ShuffleVector descriptor doesn't care about them
|
|
|
61 RandomIRBuilder IB(Seed, {});
|
|
|
62
|
|
|
63 // Get first basic block of the first function
|
|
|
64 Function &F = *M->begin();
|
|
|
65 BasicBlock &BB = *F.begin();
|
|
|
66
|
|
|
67 SmallVector<Instruction *, 32> Insts;
|
|
|
68 for (auto I = BB.getFirstInsertionPt(), E = BB.end(); I != E; ++I)
|
|
|
69 Insts.push_back(&*I);
|
|
|
70
|
|
|
71 // Pick first and second sources
|
|
|
72 SmallVector<Value *, 2> Srcs;
|
|
|
73 ASSERT_TRUE(Descr.SourcePreds[0].matches(Srcs, Insts[1]));
|
|
|
74 Srcs.push_back(Insts[1]);
|
|
|
75 ASSERT_TRUE(Descr.SourcePreds[1].matches(Srcs, Insts[1]));
|
|
|
76 Srcs.push_back(Insts[1]);
|
|
|
77
|
|
|
78 // Create new source. Check that it always matches with the descriptor.
|
|
|
79 // Run some iterations to account for random decisions.
|
|
|
80 for (int i = 0; i < 10; ++i) {
|
|
|
81 Value *LastSrc = IB.newSource(BB, Insts, Srcs, Descr.SourcePreds[2]);
|
|
|
82 ASSERT_TRUE(Descr.SourcePreds[2].matches(Srcs, LastSrc));
|
|
|
83 }
|
|
|
84 }
|
|
|
85
|
|
|
86 TEST(RandomIRBuilderTest, InsertValueIndexes) {
|
|
|
87 // Check that we will generate correct indexes for the insertvalue operation
|
|
|
88
|
|
|
89 LLVMContext Ctx;
|
|
|
90 const char *Source =
|
|
|
91 "%T = type {i8, i32, i64}\n"
|
|
|
92 "define void @test() {\n"
|
|
|
93 " %A = alloca %T\n"
|
|
|
94 " %L = load %T, %T* %A"
|
|
|
95 " ret void\n"
|
|
|
96 "}";
|
|
|
97 auto M = parseAssembly(Source, Ctx);
|
|
|
98
|
|
|
99 fuzzerop::OpDescriptor IVDescr = fuzzerop::insertValueDescriptor(1);
|
|
|
100
|
|
|
101 std::vector<Type *> Types =
|
|
|
102 {Type::getInt8Ty(Ctx), Type::getInt32Ty(Ctx), Type::getInt64Ty(Ctx)};
|
|
|
103 RandomIRBuilder IB(Seed, Types);
|
|
|
104
|
|
|
105 // Get first basic block of the first function
|
|
|
106 Function &F = *M->begin();
|
|
|
107 BasicBlock &BB = *F.begin();
|
|
|
108
|
|
|
109 // Pick first source
|
|
|
110 Instruction *Src = &*std::next(BB.begin());
|
|
|
111
|
|
|
112 SmallVector<Value *, 2> Srcs(2);
|
|
|
113 ASSERT_TRUE(IVDescr.SourcePreds[0].matches({}, Src));
|
|
|
114 Srcs[0] = Src;
|
|
|
115
|
|
|
116 // Generate constants for each of the types and check that we pick correct
|
|
|
117 // index for the given type
|
|
|
118 for (auto *T: Types) {
|
|
|
119 // Loop to account for possible random decisions
|
|
|
120 for (int i = 0; i < 10; ++i) {
|
|
|
121 // Create value we want to insert. Only it's type matters.
|
|
|
122 Srcs[1] = ConstantInt::get(T, 5);
|
|
|
123
|
|
|
124 // Try to pick correct index
|
|
|
125 Value *Src = IB.findOrCreateSource(
|
|
|
126 BB, &*BB.begin(), Srcs, IVDescr.SourcePreds[2]);
|
|
|
127 ASSERT_TRUE(IVDescr.SourcePreds[2].matches(Srcs, Src));
|
|
|
128 }
|
|
|
129 }
|
|
|
130 }
|
|
|
131
|
|
|
132 TEST(RandomIRBuilderTest, ShuffleVectorSink) {
|
|
|
133 // Check that we will never use shuffle vector mask as a sink form the
|
|
|
134 // unrelated operation.
|
|
|
135
|
|
|
136 LLVMContext Ctx;
|
|
|
137 const char *SourceCode =
|
|
|
138 "define void @test(<4 x i32> %a) {\n"
|
|
|
139 " %S1 = shufflevector <4 x i32> %a, <4 x i32> %a, <4 x i32> undef\n"
|
|
|
140 " %S2 = shufflevector <4 x i32> %a, <4 x i32> %a, <4 x i32> undef\n"
|
|
|
141 " ret void\n"
|
|
|
142 "}";
|
|
|
143 auto M = parseAssembly(SourceCode, Ctx);
|
|
|
144
|
|
|
145 fuzzerop::OpDescriptor IVDescr = fuzzerop::insertValueDescriptor(1);
|
|
|
146
|
|
|
147 RandomIRBuilder IB(Seed, {});
|
|
|
148
|
|
|
149 // Get first basic block of the first function
|
|
|
150 Function &F = *M->begin();
|
|
|
151 BasicBlock &BB = *F.begin();
|
|
|
152
|
|
|
153 // Source is %S1
|
|
|
154 Instruction *Source = &*BB.begin();
|
|
|
155 // Sink is %S2
|
|
|
156 SmallVector<Instruction *, 1> Sinks = {&*std::next(BB.begin())};
|
|
|
157
|
|
|
158 // Loop to account for random decisions
|
|
|
159 for (int i = 0; i < 10; ++i) {
|
|
|
160 // Try to connect S1 to S2. We should always create new sink.
|
|
|
161 IB.connectToSink(BB, Sinks, Source);
|
|
|
162 ASSERT_TRUE(!verifyModule(*M, &errs()));
|
|
|
163 }
|
|
|
164 }
|
|
|
165
|
|
|
166 TEST(RandomIRBuilderTest, InsertValueArray) {
|
|
|
167 // Check that we can generate insertvalue for the vector operations
|
|
|
168
|
|
|
169 LLVMContext Ctx;
|
|
|
170 const char *SourceCode =
|
|
|
171 "define void @test() {\n"
|
|
|
172 " %A = alloca [8 x i32]\n"
|
|
|
173 " %L = load [8 x i32], [8 x i32]* %A"
|
|
|
174 " ret void\n"
|
|
|
175 "}";
|
|
|
176 auto M = parseAssembly(SourceCode, Ctx);
|
|
|
177
|
|
|
178 fuzzerop::OpDescriptor Descr = fuzzerop::insertValueDescriptor(1);
|
|
|
179
|
|
|
180 std::vector<Type *> Types =
|
|
|
181 {Type::getInt8Ty(Ctx), Type::getInt32Ty(Ctx), Type::getInt64Ty(Ctx)};
|
|
|
182 RandomIRBuilder IB(Seed, Types);
|
|
|
183
|
|
|
184 // Get first basic block of the first function
|
|
|
185 Function &F = *M->begin();
|
|
|
186 BasicBlock &BB = *F.begin();
|
|
|
187
|
|
|
188 // Pick first source
|
|
|
189 Instruction *Source = &*std::next(BB.begin());
|
|
|
190 ASSERT_TRUE(Descr.SourcePreds[0].matches({}, Source));
|
|
|
191
|
|
|
192 SmallVector<Value *, 2> Srcs(2);
|
|
|
193
|
|
|
194 // Check that we can always pick the last two operands.
|
|
|
195 for (int i = 0; i < 10; ++i) {
|
|
|
196 Srcs[0] = Source;
|
|
|
197 Srcs[1] = IB.findOrCreateSource(BB, {Source}, Srcs, Descr.SourcePreds[1]);
|
|
|
198 IB.findOrCreateSource(BB, {}, Srcs, Descr.SourcePreds[2]);
|
|
|
199 }
|
|
|
200 }
|
|
|
201
|
|
|
202 TEST(RandomIRBuilderTest, Invokes) {
|
|
|
203 // Check that we never generate load or store after invoke instruction
|
|
|
204
|
|
|
205 LLVMContext Ctx;
|
|
|
206 const char *SourceCode =
|
|
|
207 "declare i32* @f()"
|
|
|
208 "declare i32 @personality_function()"
|
|
|
209 "define i32* @test() personality i32 ()* @personality_function {\n"
|
|
|
210 "entry:\n"
|
|
|
211 " %val = invoke i32* @f()\n"
|
|
|
212 " to label %normal unwind label %exceptional\n"
|
|
|
213 "normal:\n"
|
|
|
214 " ret i32* %val\n"
|
|
|
215 "exceptional:\n"
|
|
|
216 " %landing_pad4 = landingpad token cleanup\n"
|
|
|
217 " ret i32* undef\n"
|
|
|
218 "}";
|
|
|
219 auto M = parseAssembly(SourceCode, Ctx);
|
|
|
220
|
|
|
221
|
|
|
222 std::vector<Type *> Types = {Type::getInt8Ty(Ctx)};
|
|
|
223 RandomIRBuilder IB(Seed, Types);
|
|
|
224
|
|
|
225 // Get first basic block of the test function
|
|
|
226 Function &F = *M->getFunction("test");
|
|
|
227 BasicBlock &BB = *F.begin();
|
|
|
228
|
|
|
229 Instruction *Invoke = &*BB.begin();
|
|
|
230
|
|
|
231 // Find source but never insert new load after invoke
|
|
|
232 for (int i = 0; i < 10; ++i) {
|
|
|
233 (void)IB.findOrCreateSource(BB, {Invoke}, {}, fuzzerop::anyIntType());
|
|
|
234 ASSERT_TRUE(!verifyModule(*M, &errs()));
|
|
|
235 }
|
|
|
236 }
|
|
|
237
|
|
|
238 TEST(RandomIRBuilderTest, FirstClassTypes) {
|
|
|
239 // Check that we never insert new source as a load from non first class
|
|
|
240 // or unsized type.
|
|
|
241
|
|
|
242 LLVMContext Ctx;
|
|
|
243 const char *SourceCode = "%Opaque = type opaque\n"
|
|
|
244 "define void @test(i8* %ptr) {\n"
|
|
|
245 "entry:\n"
|
|
|
246 " %tmp = bitcast i8* %ptr to i32* (i32*)*\n"
|
|
|
247 " %tmp1 = bitcast i8* %ptr to %Opaque*\n"
|
|
|
248 " ret void\n"
|
|
|
249 "}";
|
|
|
250 auto M = parseAssembly(SourceCode, Ctx);
|
|
|
251
|
|
|
252 std::vector<Type *> Types = {Type::getInt8Ty(Ctx)};
|
|
|
253 RandomIRBuilder IB(Seed, Types);
|
|
|
254
|
|
|
255 Function &F = *M->getFunction("test");
|
|
|
256 BasicBlock &BB = *F.begin();
|
|
|
257 // Non first class type
|
|
|
258 Instruction *FuncPtr = &*BB.begin();
|
|
|
259 // Unsized type
|
|
|
260 Instruction *OpaquePtr = &*std::next(BB.begin());
|
|
|
261
|
|
|
262 for (int i = 0; i < 10; ++i) {
|
|
|
263 Value *V = IB.findOrCreateSource(BB, {FuncPtr, OpaquePtr});
|
|
|
264 ASSERT_FALSE(isa<LoadInst>(V));
|
|
|
265 }
|
|
|
266 }
|
|
|
267
|
|
|
268 TEST(RandomIRBuilderTest, SwiftError) {
|
|
|
269 // Check that we never pick swifterror value as a source for operation
|
|
|
270 // other than load, store and call.
|
|
|
271
|
|
|
272 LLVMContext Ctx;
|
|
|
273 const char *SourceCode = "declare void @use(i8** swifterror %err)"
|
|
|
274 "define void @test() {\n"
|
|
|
275 "entry:\n"
|
|
|
276 " %err = alloca swifterror i8*, align 8\n"
|
|
|
277 " call void @use(i8** swifterror %err)\n"
|
|
|
278 " ret void\n"
|
|
|
279 "}";
|
|
|
280 auto M = parseAssembly(SourceCode, Ctx);
|
|
|
281
|
|
|
282 std::vector<Type *> Types = {Type::getInt8Ty(Ctx)};
|
|
|
283 RandomIRBuilder IB(Seed, Types);
|
|
|
284
|
|
|
285 // Get first basic block of the test function
|
|
|
286 Function &F = *M->getFunction("test");
|
|
|
287 BasicBlock &BB = *F.begin();
|
|
|
288 Instruction *Alloca = &*BB.begin();
|
|
|
289
|
|
|
290 fuzzerop::OpDescriptor Descr = fuzzerop::gepDescriptor(1);
|
|
|
291
|
|
|
292 for (int i = 0; i < 10; ++i) {
|
|
|
293 Value *V = IB.findOrCreateSource(BB, {Alloca}, {}, Descr.SourcePreds[0]);
|
|
|
294 ASSERT_FALSE(isa<AllocaInst>(V));
|
|
|
295 }
|
|
|
296 }
|
|
|
297
|
|
|
298 }
|
