|
121
|
1 //===-- IRMutator.h - Mutation engine for fuzzing IR ------------*- C++ -*-===//
|
|
|
2 //
|
|
|
3 // The LLVM Compiler Infrastructure
|
|
|
4 //
|
|
|
5 // This file is distributed under the University of Illinois Open Source
|
|
|
6 // License. See LICENSE.TXT for details.
|
|
|
7 //
|
|
|
8 //===----------------------------------------------------------------------===//
|
|
|
9 //
|
|
|
10 // Provides the IRMutator class, which drives mutations on IR based on a
|
|
|
11 // configurable set of strategies. Some common strategies are also included
|
|
|
12 // here.
|
|
|
13 //
|
|
|
14 //===----------------------------------------------------------------------===//
|
|
|
15
|
|
|
16 #ifndef LLVM_FUZZMUTATE_IRMUTATOR_H
|
|
|
17 #define LLVM_FUZZMUTATE_IRMUTATOR_H
|
|
|
18
|
|
|
19 #include "llvm/FuzzMutate/OpDescriptor.h"
|
|
|
20 #include "llvm/Support/ErrorHandling.h"
|
|
|
21
|
|
|
22 namespace llvm {
|
|
|
23 class BasicBlock;
|
|
|
24 class Function;
|
|
|
25 class Instruction;
|
|
|
26 class Module;
|
|
|
27
|
|
|
28 struct RandomIRBuilder;
|
|
|
29
|
|
|
30 /// Base class for describing how to mutate a module. mutation functions for
|
|
|
31 /// each IR unit forward to the contained unit.
|
|
|
32 class IRMutationStrategy {
|
|
|
33 public:
|
|
|
34 virtual ~IRMutationStrategy() = default;
|
|
|
35
|
|
|
36 /// Provide a weight to bias towards choosing this strategy for a mutation.
|
|
|
37 ///
|
|
|
38 /// The value of the weight is arbitrary, but a good default is "the number of
|
|
|
39 /// distinct ways in which this strategy can mutate a unit". This can also be
|
|
|
40 /// used to prefer strategies that shrink the overall size of the result when
|
|
|
41 /// we start getting close to \c MaxSize.
|
|
|
42 virtual uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
|
|
|
43 uint64_t CurrentWeight) = 0;
|
|
|
44
|
|
|
45 /// @{
|
|
|
46 /// Mutators for each IR unit. By default these forward to a contained
|
|
|
47 /// instance of the next smaller unit.
|
|
|
48 virtual void mutate(Module &M, RandomIRBuilder &IB);
|
|
|
49 virtual void mutate(Function &F, RandomIRBuilder &IB);
|
|
|
50 virtual void mutate(BasicBlock &BB, RandomIRBuilder &IB);
|
|
|
51 virtual void mutate(Instruction &I, RandomIRBuilder &IB) {
|
|
|
52 llvm_unreachable("Strategy does not implement any mutators");
|
|
|
53 }
|
|
|
54 /// @}
|
|
|
55 };
|
|
|
56
|
|
|
57 using TypeGetter = std::function<Type *(LLVMContext &)>;
|
|
|
58
|
|
|
59 /// Entry point for configuring and running IR mutations.
|
|
|
60 class IRMutator {
|
|
|
61 std::vector<TypeGetter> AllowedTypes;
|
|
|
62 std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
|
|
|
63
|
|
|
64 public:
|
|
|
65 IRMutator(std::vector<TypeGetter> &&AllowedTypes,
|
|
|
66 std::vector<std::unique_ptr<IRMutationStrategy>> &&Strategies)
|
|
|
67 : AllowedTypes(std::move(AllowedTypes)),
|
|
|
68 Strategies(std::move(Strategies)) {}
|
|
|
69
|
|
|
70 void mutateModule(Module &M, int Seed, size_t CurSize, size_t MaxSize);
|
|
|
71 };
|
|
|
72
|
|
|
73 /// Strategy that injects operations into the function.
|
|
|
74 class InjectorIRStrategy : public IRMutationStrategy {
|
|
|
75 std::vector<fuzzerop::OpDescriptor> Operations;
|
|
|
76
|
|
|
77 fuzzerop::OpDescriptor chooseOperation(Value *Src, RandomIRBuilder &IB);
|
|
|
78
|
|
|
79 public:
|
|
|
80 InjectorIRStrategy(std::vector<fuzzerop::OpDescriptor> &&Operations)
|
|
|
81 : Operations(std::move(Operations)) {}
|
|
|
82 static std::vector<fuzzerop::OpDescriptor> getDefaultOps();
|
|
|
83
|
|
|
84 uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
|
|
|
85 uint64_t CurrentWeight) override {
|
|
|
86 return Operations.size();
|
|
|
87 }
|
|
|
88
|
|
|
89 using IRMutationStrategy::mutate;
|
|
|
90 void mutate(Function &F, RandomIRBuilder &IB) override;
|
|
|
91 void mutate(BasicBlock &BB, RandomIRBuilder &IB) override;
|
|
|
92 };
|
|
|
93
|
|
|
94 class InstDeleterIRStrategy : public IRMutationStrategy {
|
|
|
95 public:
|
|
|
96 uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
|
|
|
97 uint64_t CurrentWeight) override;
|
|
|
98
|
|
|
99 using IRMutationStrategy::mutate;
|
|
|
100 void mutate(Function &F, RandomIRBuilder &IB) override;
|
|
|
101 void mutate(Instruction &Inst, RandomIRBuilder &IB) override;
|
|
|
102 };
|
|
|
103
|
|
|
104 } // end llvm namespace
|
|
|
105
|
|
|
106 #endif // LLVM_FUZZMUTATE_IRMUTATOR_H
|
