[FuzzMutate] Handle BB without predecessor, avoid insertion after `musttail call`, avoid sinking token type

FuzzMutate didn't consider some corner cases and leads to mutation failure when mutating s

[FuzzMutate] Handle BB without predecessor, avoid insertion after `musttail call`, avoid sinking token type

FuzzMutate didn't consider some corner cases and leads to mutation failure when mutating some modules.
This patch fixes 3 bugs:

- Add null check when encountering basic blocks without predecessor to avoid segmentation fault
- Avoid insertion after `musttail call` instruction
- Avoid sinking token type

Unit tests are also added.

Reviewed By: Peter

Differential Revision: https://reviews.llvm.org/D151936

show more ...

[FuzzMutate] Avoid calling function with metadata/token parameter/return type for `InsertFunctionStrategy`

When there is a function with metadata/token parameter/return type, `InsertFunctionStrategy

[FuzzMutate] Avoid calling function with metadata/token parameter/return type for `InsertFunctionStrategy`

When there is a function with metadata/token parameter/return type, `InsertFunctionStrategy` will crash.

This patch fixes the problem by falling back to create function declaration when the sampled function contains metadata/token parameter/return type.

Reviewed By: Peter

Differential Revision: https://reviews.llvm.org/D150627

show more ...

[FuzzMutate] Module size heuristics

IRMutation::mutateModule() currently requires the bitcode size of the module.
To compute the bitcode size, one way is to write the module to a buffer using
Bitcod

[FuzzMutate] Module size heuristics

IRMutation::mutateModule() currently requires the bitcode size of the module.
To compute the bitcode size, one way is to write the module to a buffer using
BitcodeWriter and calculating the buffer size. This would be fine for a single
mutation, but infeasible for repeated mutations due to the large overhead. It
turns out that the only IR strategy weight calculation method that depends on
the current module size is InstDeleterStrategy, which deletes instructions more
frequently as the module size approaches a given max size. However, there is no
real need for the size to be in bytes of bitcode, so we can use a different
metric. One alternative is to let the size be the number of objects in the
Module, including instructions, basic blocks, globals, and aliases. Although
getting the number of instructions is still O(n), it should have significantly
less overhead than BitcodeWriter. This suggestion would cause a change to the
IRMutator API, since IRMutator::mutateModule() can calculate the Module size
itself.

Reviewed By: Peter

Differential Revision: https://reviews.llvm.org/D149989

show more ...

[FuzzMutate] Skip EHPad during mutation and avoid replacing callee with pointer when sinking

This patch addresses 2 problems:

- In `ShuffleBlockStrategy`, when `BB` is an EHPad, `BB.getFirstInserti

[FuzzMutate] Skip EHPad during mutation and avoid replacing callee with pointer when sinking

This patch addresses 2 problems:

- In `ShuffleBlockStrategy`, when `BB` is an EHPad, `BB.getFirstInsertionPt()` will return `BB.end()`, which cannot be dereferenced and will cause crash in following loop.
- In `isCompatibleReplacement`, a call instruction's callee might be replaced by a pointer, causing 2 subproblems:
- we cannot guarantee that the pointer is a function pointer (even if it is, we cannot guarantee it matches the signature).
- after such a replacement, `getCalledFunction` will from then on return `nullptr` (since it's indirect call) which causes Segmentation Fault in the lines below.

This patch fixes the first problem by checking if a block to be mutated is an EHPad in base class `IRMutationStrategy` and skipping mutating it if so.

This patch fixes the second problem by avoiding replacing callee with pointer and adding a null check for indirect calls.

Reviewed By: Peter

Differential Revision: https://reviews.llvm.org/D148853

show more ...

[FuzzMutate] Correct type cast and add unit test for FCmp

This revision fixes an incorrect type cast from Instruction to ICmpInstr, which should have been to FCmpInstr instead. It turns out that Str

[FuzzMutate] Correct type cast and add unit test for FCmp

This revision fixes an incorrect type cast from Instruction to ICmpInstr, which should have been to FCmpInstr instead. It turns out that StrategiesTest.cpp was missing a test case for InstModificationIRStrategy and FCmp, which is also now implemented in this revision. After this revision, [[ https://reviews.llvm.org/D148854 | llvm-stress in D148854 ]] no longer crashes randomly.

Reviewed By: Peter

Differential Revision: https://reviews.llvm.org/D148972

show more ...

[FuzzMutate] Correct type cast and add unit test for FCmp

This revision fixes an incorrect type cast from Instruction to ICmpInstr, which should have been to FCmpInstr instead. It turns out that Str

[FuzzMutate] Correct type cast and add unit test for FCmp

This revision fixes an incorrect type cast from Instruction to ICmpInstr, which should have been to FCmpInstr instead. It turns out that StrategiesTest.cpp was missing a test case for InstModificationIRStrategy and FCmp, which is also now implemented in this revision. After this revision, [[ https://reviews.llvm.org/D148854 | llvm-stress in D148854 ]] no longer crashes randomly.

Reviewed By: Peter

Differential Revision: https://reviews.llvm.org/D148972

show more ...

[FuzzMutate] Correct type cast and add unit test for FCmp

This revision fixes an incorrect type cast from Instruction to ICmpInstr, which should have been to FCmpInstr instead. It turns out that Str

[FuzzMutate] Correct type cast and add unit test for FCmp

This revision fixes an incorrect type cast from Instruction to ICmpInstr, which should have been to FCmpInstr instead. It turns out that StrategiesTest.cpp was missing a test case for InstModificationIRStrategy and FCmp, which is also now implemented in this revision. After this revision, [[ https://reviews.llvm.org/D148854 | llvm-stress in D148854 ]] no longer crashes randomly.

Reviewed By: Peter

Differential Revision: https://reviews.llvm.org/D148972

show more ...

[FuzzMutate] InsertFunctionStrategy

InsertFunctionStrategy does two things:

1. Add a random function declaration or definition to the module. This would replace previously used `createEmptyFunction

[FuzzMutate] InsertFunctionStrategy

InsertFunctionStrategy does two things:

1. Add a random function declaration or definition to the module. This would replace previously used `createEmptyFunction`.
2. Add a random function call between instructions.

Reviewed By: arsenm

Differential Revision: https://reviews.llvm.org/D148568

show more ...

[FuzzMutate] introduce vector operations, select and fneg into InstInjectorStrategy

Reviewed By: arsenm

Differential Revision: https://reviews.llvm.org/D139894

[NFC] Cleanup: Remove Function::getBasicBlockList() when not required.

This is part of a series of patches that aim at making Function::getBasicBlockList() private.

Differential Revision: https://r

[NFC] Cleanup: Remove Function::getBasicBlockList() when not required.

This is part of a series of patches that aim at making Function::getBasicBlockList() private.

Differential Revision: https://reviews.llvm.org/D139910

show more ...

[FuzzMutate] InstModificationStrategy, add FastMath flags and exact flags to instructions.

I think there are more attributes, flags we can add to `call`, functions declarations and global variables.

[FuzzMutate] InstModificationStrategy, add FastMath flags and exact flags to instructions.

I think there are more attributes, flags we can add to `call`, functions declarations and global variables. Let's start with these two flags.

Reviewed By: arsenm

Differential Revision: https://reviews.llvm.org/D139594

show more ...

[FuzzMutate] New InsertCFGStrategy

Mutating CFG is hard as we have to maintain dominator relations.
We avoid this problem by inserting a CFG into a splitted block.

switch, ret, and br instructions

[FuzzMutate] New InsertCFGStrategy

Mutating CFG is hard as we have to maintain dominator relations.
We avoid this problem by inserting a CFG into a splitted block.

switch, ret, and br instructions are generated.

Reviewed By: arsenm

Differential Revision: https://reviews.llvm.org/D139067

show more ...

[FuzzMutate] New InsertPHINode strategy.

PHI Node can't be modeled like other instructions since its operand
number depends on predecessors. So we have a stand alone strategy for it.

Signed-off-by:

[FuzzMutate] New InsertPHINode strategy.

PHI Node can't be modeled like other instructions since its operand
number depends on predecessors. So we have a stand alone strategy for it.

Signed-off-by: Peter Rong <PeterRong96@gmail.com>

Reviewed By: arsenm

Differential Revision: https://reviews.llvm.org/D138959

show more ...

[FuzzMutate] SinkInstructionStrategy

Randomlly select an instruction and try to use it in the future by replacing it with another instruction's operand.

Reviewed By: arsenm

Differential Revision:

[FuzzMutate] SinkInstructionStrategy

Randomlly select an instruction and try to use it in the future by replacing it with another instruction's operand.

Reviewed By: arsenm

Differential Revision: https://reviews.llvm.org/D138948

show more ...

[FuzzMutate] New strategy `ShuffleBlockStrategy`

`ShuffleBlockStrategy` will shuffle the instructions in a basic block without breaking the dependency of instructions.
It is implemented as a topolog

[FuzzMutate] New strategy `ShuffleBlockStrategy`

`ShuffleBlockStrategy` will shuffle the instructions in a basic block without breaking the dependency of instructions.
It is implemented as a topological sort, only we randomly select instructions with no dependency.

Reviewed By: arsenm

Differential Revision: https://reviews.llvm.org/D138339

show more ...

[FuzzMutate] Update InstModifierStrategy

We can randomly switch two operands of an instruction now

Signed-off-by: Peter Rong <PeterRong96@gmail.com>

[FuzzMutate] change of format and comment for further code

Signed-off-by: Peter Rong <PeterRong96@gmail.com>

Revert "[FuzzMutate] Don't insert instructions after musttail call"

This reverts commit 6a23d2764467bd45c2e02828f6175a0b9f9a1005.

The newly added tests fail on the llvm-clang-x86_64-sie-win
buildbo

Revert "[FuzzMutate] Don't insert instructions after musttail call"

This reverts commit 6a23d2764467bd45c2e02828f6175a0b9f9a1005.

The newly added tests fail on the llvm-clang-x86_64-sie-win
buildbot. Not sure why a failure only occurs there, possibly
differen PRNG sequence?

show more ...

[FuzzMutate] Don't insert instructions after musttail call

[FuzzMutate] Add mutator to modify instruction flags.

This patch adds a new InstModificationIRStrategy to mutate flags/options
for instructions. For example, it may add or remove nuw/nsw flags from

[FuzzMutate] Add mutator to modify instruction flags.

This patch adds a new InstModificationIRStrategy to mutate flags/options
for instructions. For example, it may add or remove nuw/nsw flags from
add, mul, sub, shl instructions or change the predicate for icmp
instructions.

Subtle changes such as those mentioned above should lead to a more
interesting range of inputs. The presence or absence of overflow flags
can expose subtle bugs, for example.

Reviewed By: bogner

Differential Revision: https://reviews.llvm.org/D94905

show more ...

[llvm] Migrate llvm::make_unique to std::make_unique

Now that we've moved to C++14, we no longer need the llvm::make_unique
implementation from STLExtras.h. This patch is a mechanical replacement
of

[llvm] Migrate llvm::make_unique to std::make_unique

Now that we've moved to C++14, we no longer need the llvm::make_unique
implementation from STLExtras.h. This patch is a mechanical replacement
of (hopefully) all the llvm::make_unique instances across the monorepo.

llvm-svn: 369013

show more ...

Update the file headers across all of the LLVM projects in the monorepo
to reflect the new license.

We understand that people may be surprised that we're moving the header
entirely to discuss the ne

Update the file headers across all of the LLVM projects in the monorepo
to reflect the new license.

We understand that people may be surprised that we're moving the header
entirely to discuss the new license. We checked this carefully with the
Foundation's lawyer and we believe this is the correct approach.

Essentially, all code in the project is now made available by the LLVM
project under our new license, so you will see that the license headers
include that license only. Some of our contributors have contributed
code under our old license, and accordingly, we have retained a copy of
our old license notice in the top-level files in each project and
repository.

llvm-svn: 351636

show more ...

[FuzzMutate] Inst deleter doesn't work with PhiNodes

Differential Revision: https://reviews.llvm.org/D42412

llvm-svn: 323409

[FuzzMutate] Don't crash when we can't remove instruction from empty function

Differential Revision: https://reviews.llvm.org/D40393

llvm-svn: 319438