IRMutator.h 4.2 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129
  1. #pragma once
  2. #ifdef __GNUC__
  3. #pragma GCC diagnostic push
  4. #pragma GCC diagnostic ignored "-Wunused-parameter"
  5. #endif
  6. //===-- IRMutator.h - Mutation engine for fuzzing IR ------------*- C++ -*-===//
  7. //
  8. // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
  9. // See https://llvm.org/LICENSE.txt for license information.
  10. // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
  11. //
  12. //===----------------------------------------------------------------------===//
  13. //
  14. // Provides the IRMutator class, which drives mutations on IR based on a
  15. // configurable set of strategies. Some common strategies are also included
  16. // here.
  17. //
  18. //===----------------------------------------------------------------------===//
  19. #ifndef LLVM_FUZZMUTATE_IRMUTATOR_H
  20. #define LLVM_FUZZMUTATE_IRMUTATOR_H
  21. #include "llvm/ADT/Optional.h"
  22. #include "llvm/FuzzMutate/OpDescriptor.h"
  23. #include "llvm/Support/ErrorHandling.h"
  24. namespace llvm {
  25. class BasicBlock;
  26. class Function;
  27. class Instruction;
  28. class Module;
  29. struct RandomIRBuilder;
  30. /// Base class for describing how to mutate a module. mutation functions for
  31. /// each IR unit forward to the contained unit.
  32. class IRMutationStrategy {
  33. public:
  34. virtual ~IRMutationStrategy() = default;
  35. /// Provide a weight to bias towards choosing this strategy for a mutation.
  36. ///
  37. /// The value of the weight is arbitrary, but a good default is "the number of
  38. /// distinct ways in which this strategy can mutate a unit". This can also be
  39. /// used to prefer strategies that shrink the overall size of the result when
  40. /// we start getting close to \c MaxSize.
  41. virtual uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
  42. uint64_t CurrentWeight) = 0;
  43. /// @{
  44. /// Mutators for each IR unit. By default these forward to a contained
  45. /// instance of the next smaller unit.
  46. virtual void mutate(Module &M, RandomIRBuilder &IB);
  47. virtual void mutate(Function &F, RandomIRBuilder &IB);
  48. virtual void mutate(BasicBlock &BB, RandomIRBuilder &IB);
  49. virtual void mutate(Instruction &I, RandomIRBuilder &IB) {
  50. llvm_unreachable("Strategy does not implement any mutators");
  51. }
  52. /// @}
  53. };
  54. using TypeGetter = std::function<Type *(LLVMContext &)>;
  55. /// Entry point for configuring and running IR mutations.
  56. class IRMutator {
  57. std::vector<TypeGetter> AllowedTypes;
  58. std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
  59. public:
  60. IRMutator(std::vector<TypeGetter> &&AllowedTypes,
  61. std::vector<std::unique_ptr<IRMutationStrategy>> &&Strategies)
  62. : AllowedTypes(std::move(AllowedTypes)),
  63. Strategies(std::move(Strategies)) {}
  64. void mutateModule(Module &M, int Seed, size_t CurSize, size_t MaxSize);
  65. };
  66. /// Strategy that injects operations into the function.
  67. class InjectorIRStrategy : public IRMutationStrategy {
  68. std::vector<fuzzerop::OpDescriptor> Operations;
  69. Optional<fuzzerop::OpDescriptor> chooseOperation(Value *Src,
  70. RandomIRBuilder &IB);
  71. public:
  72. InjectorIRStrategy(std::vector<fuzzerop::OpDescriptor> &&Operations)
  73. : Operations(std::move(Operations)) {}
  74. static std::vector<fuzzerop::OpDescriptor> getDefaultOps();
  75. uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
  76. uint64_t CurrentWeight) override {
  77. return Operations.size();
  78. }
  79. using IRMutationStrategy::mutate;
  80. void mutate(Function &F, RandomIRBuilder &IB) override;
  81. void mutate(BasicBlock &BB, RandomIRBuilder &IB) override;
  82. };
  83. class InstDeleterIRStrategy : public IRMutationStrategy {
  84. public:
  85. uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
  86. uint64_t CurrentWeight) override;
  87. using IRMutationStrategy::mutate;
  88. void mutate(Function &F, RandomIRBuilder &IB) override;
  89. void mutate(Instruction &Inst, RandomIRBuilder &IB) override;
  90. };
  91. class InstModificationIRStrategy : public IRMutationStrategy {
  92. public:
  93. uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
  94. uint64_t CurrentWeight) override {
  95. return 4;
  96. }
  97. using IRMutationStrategy::mutate;
  98. void mutate(Instruction &Inst, RandomIRBuilder &IB) override;
  99. };
  100. } // end llvm namespace
  101. #endif // LLVM_FUZZMUTATE_IRMUTATOR_H
  102. #ifdef __GNUC__
  103. #pragma GCC diagnostic pop
  104. #endif