39 auto RS = makeSampler<Function *>(IB.
Rand);
41 if (!
F.isDeclaration())
43 mutate(*RS.getSelection(), IB);
56 std::vector<Type *> Types;
57 for (
const auto &Getter : AllowedTypes)
58 Types.push_back(Getter(M.getContext()));
61 auto RS = makeSampler<IRMutationStrategy *>(IB.
Rand);
62 for (
const auto &Strategy : Strategies)
63 RS.sample(Strategy.get(),
64 Strategy->getWeight(CurSize, MaxSize, RS.totalWeight()));
65 auto Strategy = RS.getSelection();
67 Strategy->mutate(M, IB);
85 std::vector<fuzzerop::OpDescriptor> Ops;
98 return Op.SourcePreds[0].matches({}, Src);
110 if (Insts.
size() < 1)
114 size_t IP = uniform<size_t>(IB.
Rand, 0, Insts.
size() - 1);
125 auto OpDesc = chooseOperation(Srcs[0], IB);
130 for (
const auto &Pred :
makeArrayRef(OpDesc->SourcePreds).slice(1))
133 if (
Value *
Op = OpDesc->BuilderFunc(Srcs, Insts[IP])) {
140 uint64_t CurrentWeight) {
142 if (CurrentSize > MaxSize - 200)
143 return CurrentWeight ? CurrentWeight * 100 : 1;
146 int Line = (-2 * CurrentWeight) * (MaxSize - CurrentSize + 1000);
154 auto RS = makeSampler<Instruction *>(IB.
Rand);
157 if (Inst.isTerminator() || Inst.isEHPad() ||
158 Inst.isSwiftError() || isa<PHINode>(Inst))
167 mutate(*RS.getSelection(), IB);
185 auto RS = makeSampler<Value *>(IB.
Rand);
190 if (Pred.matches({}, &*
I))
195 RS.sample(IB.
newSource(*BB, InstsBefore, {}, Pred), 1);
SymbolTableList< Instruction >::iterator eraseFromParent()
This method unlinks 'this' from the containing basic block and deletes it.
void mutate(Function &F, RandomIRBuilder &IB) override
This class represents lattice values for constants.
static cl::opt< uint64_t > Seed("rng-seed", cl::value_desc("seed"), cl::Hidden, cl::desc("Seed for the random number generator"), cl::init(0))
A Module instance is used to store all the information related to an LLVM module.
void push_back(const T &Elt)
Externally visible function.
bool isTerminator() const
void describeFuzzerControlFlowOps(std::vector< fuzzerop::OpDescriptor > &Ops)
Basic Dead Code Elimination pass.
PreservedAnalyses run(IRUnitT &IR, AnalysisManagerT &AM, ExtraArgTs... ExtraArgs)
Run all of the passes in this manager over the given unit of IR.
uint64_t getWeight(size_t CurrentSize, size_t MaxSize, uint64_t CurrentWeight) override
Provide a weight to bias towards choosing this strategy for a mutation.
void mutate(Function &F, RandomIRBuilder &IB) override
static ReturnInst * Create(LLVMContext &C, Value *retVal=nullptr, Instruction *InsertBefore=nullptr)
ArrayRef< T > makeArrayRef(const T &OneElt)
Construct an ArrayRef from a single element.
bool registerPass(PassBuilderT &&PassBuilder)
Register an analysis pass with the manager.
void describeFuzzerVectorOps(std::vector< fuzzerop::OpDescriptor > &Ops)
std::enable_if_t<!std::is_same< PassT, PassManager >::value > addPass(PassT Pass)
Type * getType() const
All values are typed, get the type of this value.
static FunctionType * get(Type *Result, ArrayRef< Type * > Params, bool isVarArg)
This static method is the primary way of constructing a FunctionType.
void replaceAllUsesWith(Value *V)
Change all uses of this to point to a new Value.
bool isVoidTy() const
Return true if this is 'void'.
static Function * Create(FunctionType *Ty, LinkageTypes Linkage, unsigned AddrSpace, const Twine &N="", Module *M=nullptr)
const_iterator getFirstInsertionPt() const
Returns an iterator to the first instruction in this block that is suitable for inserting a non-PHI i...
static std::vector< fuzzerop::OpDescriptor > getDefaultOps()
LLVM Basic Block Representation.
This is an important class for using LLVM in a threaded context.
static GCRegistry::Add< CoreCLRGC > E("coreclr", "CoreCLR-compatible GC")
void describeFuzzerFloatOps(std::vector< fuzzerop::OpDescriptor > &Ops)
ReservoirSampler< ElT, GenT > makeSampler(GenT &RandGen, RangeT &&Items)
static Type * getVoidTy(LLVMContext &C)
void connectToSink(BasicBlock &BB, ArrayRef< Instruction * > Insts, Value *V)
Find a viable user for V in Insts, which should all be contained in BB.
static void eliminateDeadCode(Function &F)
static BasicBlock * Create(LLVMContext &Context, const Twine &Name="", Function *Parent=nullptr, BasicBlock *InsertBefore=nullptr)
Creates a new BasicBlock.
self_iterator getIterator()
void describeFuzzerPointerOps(std::vector< fuzzerop::OpDescriptor > &Ops)
Pseudo-analysis pass that exposes the PassInstrumentation to pass managers.
This is a 'vector' (really, a variable-sized array), optimized for the case when the array is small.
Module.h This file contains the declarations for the Module class.
static SourcePred onlyType(Type *Only)
void describeFuzzerIntOps(std::vector< fuzzerop::OpDescriptor > &Ops)
Getters for the default sets of operations, per general category.
static void createEmptyFunction(Module &M)
Value * findOrCreateSource(BasicBlock &BB, ArrayRef< Instruction * > Insts)
Find a "source" for some operation, which will be used in one of the operation's operands.
virtual void mutate(Module &M, RandomIRBuilder &IB)
void describeFuzzerAggregateOps(std::vector< fuzzerop::OpDescriptor > &Ops)
void mutateModule(Module &M, int Seed, size_t CurSize, size_t MaxSize)
Value * newSource(BasicBlock &BB, ArrayRef< Instruction * > Insts, ArrayRef< Value * > Srcs, fuzzerop::SourcePred Pred)
Create some Value suitable as a source for some operation.
A description of some operation we can build while fuzzing IR.
iterator_range< filter_iterator< detail::IterOfRange< RangeT >, PredicateT > > make_filter_range(RangeT &&Range, PredicateT Pred)
Convenience function that takes a range of elements and a predicate, and return a new filter_iterator...
Analysis pass providing the TargetLibraryInfo.
assert(ImpDefSCC.getReg()==AMDGPU::SCC &&ImpDefSCC.isDef())
LLVM Value Representation.
inst_range instructions(Function *F)
A container for analyses that lazily runs them and caches their results.
iterator_range< pointer_iterator< WrappedIteratorT > > make_pointer_range(RangeT &&Range)
const BasicBlock * getParent() const