6024e5c395
clang 20.0.0 (based on r547379) from build 12806354. Bug: http://b/379133546 Test: N/A Change-Id: I2eb8938af55d809de674be63cb30cf27e801862b Upstream-Commit: ad834e67b1105d15ef907f6255d4c96e8e733f57
111 lines
4.0 KiB
C++
111 lines
4.0 KiB
C++
//===- RandomIRBuilder.h - Utils for randomly mutation IR -------*- C++ -*-===//
|
|
//
|
|
// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
|
|
// See https://llvm.org/LICENSE.txt for license information.
|
|
// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
//
|
|
// Provides the Mutator class, which is used to mutate IR for fuzzing.
|
|
//
|
|
//===----------------------------------------------------------------------===//
|
|
|
|
#ifndef LLVM_FUZZMUTATE_RANDOMIRBUILDER_H
|
|
#define LLVM_FUZZMUTATE_RANDOMIRBUILDER_H
|
|
|
|
#include "llvm/ADT/ArrayRef.h"
|
|
#include "llvm/ADT/SmallVector.h"
|
|
#include <random>
|
|
|
|
namespace llvm {
|
|
class AllocaInst;
|
|
class BasicBlock;
|
|
class Function;
|
|
class GlobalVariable;
|
|
class Instruction;
|
|
class LLVMContext;
|
|
class Module;
|
|
class Type;
|
|
class Value;
|
|
|
|
namespace fuzzerop {
|
|
class SourcePred;
|
|
}
|
|
|
|
using RandomEngine = std::mt19937;
|
|
|
|
struct RandomIRBuilder {
|
|
RandomEngine Rand;
|
|
SmallVector<Type *, 16> KnownTypes;
|
|
|
|
uint64_t MinArgNum = 0;
|
|
uint64_t MaxArgNum = 5;
|
|
uint64_t MinFunctionNum = 1;
|
|
|
|
RandomIRBuilder(int Seed, ArrayRef<Type *> AllowedTypes)
|
|
: Rand(Seed), KnownTypes(AllowedTypes) {}
|
|
|
|
// TODO: Try to make this a bit less of a random mishmash of functions.
|
|
|
|
/// Create a stack memory at the head of the function, store \c Init to the
|
|
/// memory if provided.
|
|
AllocaInst *createStackMemory(Function *F, Type *Ty, Value *Init = nullptr);
|
|
/// Find or create a global variable. It will be initialized by random
|
|
/// constants that satisfies \c Pred. It will also report whether this global
|
|
/// variable found or created.
|
|
std::pair<GlobalVariable *, bool>
|
|
findOrCreateGlobalVariable(Module *M, ArrayRef<Value *> Srcs,
|
|
fuzzerop::SourcePred Pred);
|
|
enum SourceType {
|
|
SrcFromInstInCurBlock,
|
|
FunctionArgument,
|
|
InstInDominator,
|
|
SrcFromGlobalVariable,
|
|
NewConstOrStack,
|
|
EndOfValueSource,
|
|
};
|
|
/// Find a "source" for some operation, which will be used in one of the
|
|
/// operation's operands. This either selects an instruction in \c Insts or
|
|
/// returns some new arbitrary Value.
|
|
Value *findOrCreateSource(BasicBlock &BB, ArrayRef<Instruction *> Insts);
|
|
/// Find a "source" for some operation, which will be used in one of the
|
|
/// operation's operands. This either selects an instruction in \c Insts that
|
|
/// matches \c Pred, or returns some new Value that matches \c Pred. The
|
|
/// values in \c Srcs should be source operands that have already been
|
|
/// selected.
|
|
Value *findOrCreateSource(BasicBlock &BB, ArrayRef<Instruction *> Insts,
|
|
ArrayRef<Value *> Srcs, fuzzerop::SourcePred Pred,
|
|
bool allowConstant = true);
|
|
/// Create some Value suitable as a source for some operation.
|
|
Value *newSource(BasicBlock &BB, ArrayRef<Instruction *> Insts,
|
|
ArrayRef<Value *> Srcs, fuzzerop::SourcePred Pred,
|
|
bool allowConstant = true);
|
|
|
|
enum SinkType {
|
|
/// TODO: Also consider pointers in function argument.
|
|
SinkToInstInCurBlock,
|
|
PointersInDominator,
|
|
InstInDominatee,
|
|
NewStore,
|
|
SinkToGlobalVariable,
|
|
EndOfValueSink,
|
|
};
|
|
/// Find a viable user for \c V in \c Insts, which should all be contained in
|
|
/// \c BB. This may also create some new instruction in \c BB and use that.
|
|
Instruction *connectToSink(BasicBlock &BB, ArrayRef<Instruction *> Insts,
|
|
Value *V);
|
|
/// Create a user for \c V in \c BB.
|
|
Instruction *newSink(BasicBlock &BB, ArrayRef<Instruction *> Insts, Value *V);
|
|
Value *findPointer(BasicBlock &BB, ArrayRef<Instruction *> Insts);
|
|
/// Return a uniformly choosen type from \c AllowedTypes
|
|
Type *randomType();
|
|
Function *createFunctionDeclaration(Module &M, uint64_t ArgNum);
|
|
Function *createFunctionDeclaration(Module &M);
|
|
Function *createFunctionDefinition(Module &M, uint64_t ArgNum);
|
|
Function *createFunctionDefinition(Module &M);
|
|
};
|
|
|
|
} // namespace llvm
|
|
|
|
#endif // LLVM_FUZZMUTATE_RANDOMIRBUILDER_H
|