#include "llvm/FuzzMutate/RandomIRBuilder.h"

Public Types
enum	SourceType { SrcFromInstInCurBlock , FunctionArgument , InstInDominator , SrcFromGlobalVariable , NewConstOrStack , EndOfValueSource }

enum	SinkType { SinkToInstInCurBlock , PointersInDominator , InstInDominatee , NewStore , SinkToGlobalVariable , EndOfValueSink }

Public Member Functions
	RandomIRBuilder (int Seed, ArrayRef< Type * > AllowedTypes)

AllocaInst *	createStackMemory (Function F, Type Ty, Value *Init=nullptr)
	Create a stack memory at the head of the function, store `Init` to the memory if provided.

std::pair< GlobalVariable *, bool >	findOrCreateGlobalVariable (Module M, ArrayRef< Value > Srcs, fuzzerop::SourcePred Pred)
	Find or create a global variable.

Value *	findOrCreateSource (BasicBlock &BB, ArrayRef< Instruction * > Insts)
	Find a "source" for some operation, which will be used in one of the operation's operands.

Value *	findOrCreateSource (BasicBlock &BB, ArrayRef< Instruction * > Insts, ArrayRef< Value * > Srcs, fuzzerop::SourcePred Pred, bool allowConstant=true)
	Find a "source" for some operation, which will be used in one of the operation's operands.

Value *	newSource (BasicBlock &BB, ArrayRef< Instruction * > Insts, ArrayRef< Value * > Srcs, fuzzerop::SourcePred Pred, bool allowConstant=true)
	Create some Value suitable as a source for some operation.

Instruction *	connectToSink (BasicBlock &BB, ArrayRef< Instruction * > Insts, Value *V)
	Find a viable user for `V` in `Insts`, which should all be contained in `BB`.

Instruction *	newSink (BasicBlock &BB, ArrayRef< Instruction * > Insts, Value *V)
	Create a user for `V` in `BB`.

Value *	findPointer (BasicBlock &BB, ArrayRef< Instruction * > Insts)

Type *	randomType ()
	Return a uniformly choosen type from `AllowedTypes`.

Function *	createFunctionDeclaration (Module &M, uint64_t ArgNum)

Function *	createFunctionDeclaration (Module &M)

Function *	createFunctionDefinition (Module &M, uint64_t ArgNum)

Function *	createFunctionDefinition (Module &M)

Public Attributes
RandomEngine	Rand

SmallVector< Type *, 16 >	KnownTypes

uint64_t	MinArgNum = 0

uint64_t	MaxArgNum = 5

uint64_t	MinFunctionNum = 1

Detailed Description

Definition at line 37 of file RandomIRBuilder.h.

Member Enumeration Documentation

◆ SinkType

enum llvm::RandomIRBuilder::SinkType

Enumerator
SinkToInstInCurBlock	TODO: Also consider pointers in function argument.
PointersInDominator
InstInDominatee
NewStore
SinkToGlobalVariable
EndOfValueSink

Definition at line 84 of file RandomIRBuilder.h.

◆ SourceType

enum llvm::RandomIRBuilder::SourceType

Enumerator
SrcFromInstInCurBlock
FunctionArgument
InstInDominator
SrcFromGlobalVariable
NewConstOrStack
EndOfValueSource

Definition at line 59 of file RandomIRBuilder.h.

Constructor & Destructor Documentation

◆ RandomIRBuilder()

llvm::RandomIRBuilder::RandomIRBuilder	(	int	Seed,
		ArrayRef< Type * >	AllowedTypes
	)

inline

Definition at line 45 of file RandomIRBuilder.h.

Member Function Documentation

◆ connectToSink()

Instruction * RandomIRBuilder::connectToSink	(	BasicBlock &	BB,
		ArrayRef< Instruction * >	Insts,
		Value *	V
	)

Find a viable user for V in Insts, which should all be contained in BB.

This may also create some new instruction in BB and use that.

TODO: allocate a new stack memory.

Definition at line 291 of file RandomIRBuilder.cpp.

References llvm::ArrayRef< T >::back(), llvm::SmallVectorTemplateCommon< T, typename >::begin(), llvm::SmallVectorTemplateCommon< T, typename >::end(), EndOfValueSink, findOrCreateGlobalVariable(), getDominatees(), getDominators(), llvm::GlobalValue::getParent(), llvm::BasicBlock::getParent(), I, InstInDominatee, isCompatibleReplacement(), llvm_unreachable, newSink(), NewStore, llvm::fuzzerop::onlyType(), PointersInDominator, llvm::SmallVectorTemplateBase< T, bool >::push_back(), Rand, SinkToGlobalVariable, and SinkToInstInCurBlock.

◆ createFunctionDeclaration() [1/2]

Function * RandomIRBuilder::createFunctionDeclaration ( Module & M )

Definition at line 414 of file RandomIRBuilder.cpp.

References createFunctionDeclaration(), MaxArgNum, MinArgNum, and Rand.

◆ createFunctionDeclaration() [2/2]

Function * RandomIRBuilder::createFunctionDeclaration	(	Module &	M,
		uint64_t	ArgNum
	)

Definition at line 400 of file RandomIRBuilder.cpp.

References llvm::Function::Create(), llvm::GlobalValue::ExternalLinkage, F, llvm::FunctionType::get(), and randomType().

Referenced by createFunctionDeclaration(), and createFunctionDefinition().

◆ createFunctionDefinition() [1/2]

Function * RandomIRBuilder::createFunctionDefinition ( Module & M )

Definition at line 440 of file RandomIRBuilder.cpp.

References createFunctionDefinition(), MaxArgNum, MinArgNum, and Rand.

◆ createFunctionDefinition() [2/2]

Function * RandomIRBuilder::createFunctionDefinition	(	Module &	M,
		uint64_t	ArgNum
	)

Definition at line 419 of file RandomIRBuilder.cpp.

References llvm::ReturnInst::Create(), llvm::BasicBlock::Create(), createFunctionDeclaration(), DL, F, llvm::Type::getVoidTy(), and RetTy.

Referenced by createFunctionDefinition().

◆ createStackMemory()

AllocaInst * RandomIRBuilder::createStackMemory	(	Function *	F,
		Type *	Ty,
		Value *	Init = `nullptr`
	)

Create a stack memory at the head of the function, store Init to the memory if provided.

TODO: For all Allocas, maybe allocate an array.

Definition at line 66 of file RandomIRBuilder.cpp.

References DL, F, llvm::BasicBlock::getFirstInsertionPt(), and llvm::ilist_node_impl< OptionsT >::getIterator().

Referenced by newSink(), and newSource().

◆ findOrCreateGlobalVariable()

std::pair< GlobalVariable *, bool > RandomIRBuilder::findOrCreateGlobalVariable	(	Module *	M,
		ArrayRef< Value * >	Srcs,
		fuzzerop::SourcePred	Pred
	)

Find or create a global variable.

It will be initialized by random constants that satisfies Pred. It will also report whether this global variable found or created.

Definition at line 79 of file RandomIRBuilder.cpp.

References llvm::fuzzerop::SourcePred::generate(), llvm::PoisonValue::get(), KnownTypes, llvm::make_filter_range(), llvm::makeSampler(), llvm::fuzzerop::SourcePred::matches(), llvm::GlobalValue::NotThreadLocal, llvm::SmallVectorTemplateBase< T, bool >::push_back(), and Rand.

Referenced by connectToSink(), and findOrCreateSource().

◆ findOrCreateSource() [1/2]

Value * RandomIRBuilder::findOrCreateSource	(	BasicBlock &	BB,
		ArrayRef< Instruction * >	Insts
	)

Find a "source" for some operation, which will be used in one of the operation's operands.

This either selects an instruction in Insts or returns some new arbitrary Value.

Definition at line 109 of file RandomIRBuilder.cpp.

References llvm::fuzzerop::anyType(), and findOrCreateSource().

Referenced by findOrCreateSource().

◆ findOrCreateSource() [2/2]

Value * RandomIRBuilder::findOrCreateSource	(	BasicBlock &	BB,
		ArrayRef< Instruction * >	Insts,
		ArrayRef< Value * >	Srcs,
		fuzzerop::SourcePred	Pred,
		bool	allowConstant = `true`
	)

Find a "source" for some operation, which will be used in one of the operation's operands.

This either selects an instruction in Insts that matches Pred, or returns some new Value that matches Pred. The values in Srcs should be source operands that have already been selected.

Definition at line 114 of file RandomIRBuilder.cpp.

References llvm::SmallVectorTemplateCommon< T, typename >::begin(), llvm::SmallVectorTemplateCommon< T, typename >::end(), EndOfValueSource, llvm::Instruction::eraseFromParent(), F, findOrCreateGlobalVariable(), FunctionArgument, getDominators(), llvm::BasicBlock::getFirstInsertionPt(), llvm::GlobalValue::getParent(), llvm::BasicBlock::getParent(), llvm::BasicBlock::getTerminator(), I, InstInDominator, llvm_unreachable, llvm::make_filter_range(), llvm::makeSampler(), llvm::fuzzerop::SourcePred::matches(), NewConstOrStack, newSource(), llvm::SmallVectorTemplateBase< T, bool >::push_back(), Rand, SrcFromGlobalVariable, and SrcFromInstInCurBlock.

◆ findPointer()

Value * RandomIRBuilder::findPointer	(	BasicBlock &	BB,
		ArrayRef< Instruction * >	Insts
	)

Definition at line 380 of file RandomIRBuilder.cpp.

References llvm::Value::getType(), llvm::Type::isPointerTy(), llvm::make_filter_range(), llvm::makeSampler(), and Rand.

Referenced by newSink(), and newSource().

◆ newSink()

Instruction * RandomIRBuilder::newSink	(	BasicBlock &	BB,
		ArrayRef< Instruction * >	Insts,
		Value *	V
	)

Create a user for V in BB.

Definition at line 365 of file RandomIRBuilder.cpp.

References llvm::ArrayRef< T >::back(), createStackMemory(), findPointer(), llvm::PointerType::get(), llvm::PoisonValue::get(), llvm::BasicBlock::getParent(), Ptr, Rand, and llvm::uniform().

Referenced by connectToSink().

◆ newSource()

Value * RandomIRBuilder::newSource	(	BasicBlock &	BB,
		ArrayRef< Instruction * >	Insts,
		ArrayRef< Value * >	Srcs,
		fuzzerop::SourcePred	Pred,
		bool	allowConstant = `true`
	)

Create some Value suitable as a source for some operation.

Definition at line 198 of file RandomIRBuilder.cpp.

References assert(), createStackMemory(), llvm::BasicBlock::end(), F, findPointer(), llvm::fuzzerop::SourcePred::generate(), llvm::BasicBlock::getFirstInsertionPt(), llvm::ilist_node_impl< OptionsT >::getIterator(), llvm::BasicBlock::getParent(), llvm::BasicBlock::getTerminator(), llvm::Value::getType(), I, KnownTypes, llvm::fuzzerop::SourcePred::matches(), Ptr, and Rand.

Referenced by findOrCreateSource().

◆ randomType()

Type * RandomIRBuilder::randomType ( )

Return a uniformly choosen type from AllowedTypes.

Definition at line 395 of file RandomIRBuilder.cpp.

References KnownTypes, and Rand.

Referenced by createFunctionDeclaration().

Member Data Documentation

◆ KnownTypes

SmallVector<Type *, 16> llvm::RandomIRBuilder::KnownTypes

Definition at line 39 of file RandomIRBuilder.h.

Referenced by findOrCreateGlobalVariable(), newSource(), and randomType().

◆ MaxArgNum

uint64_t llvm::RandomIRBuilder::MaxArgNum = 5

Definition at line 42 of file RandomIRBuilder.h.

Referenced by createFunctionDeclaration(), and createFunctionDefinition().

◆ MinArgNum

uint64_t llvm::RandomIRBuilder::MinArgNum = 0

Definition at line 41 of file RandomIRBuilder.h.

Referenced by createFunctionDeclaration(), and createFunctionDefinition().

◆ MinFunctionNum

uint64_t llvm::RandomIRBuilder::MinFunctionNum = 1

Definition at line 43 of file RandomIRBuilder.h.

◆ Rand

RandomEngine llvm::RandomIRBuilder::Rand

Definition at line 38 of file RandomIRBuilder.h.

Referenced by connectToSink(), createFunctionDeclaration(), createFunctionDefinition(), findOrCreateGlobalVariable(), findOrCreateSource(), findPointer(), newSink(), newSource(), and randomType().

The documentation for this struct was generated from the following files:

include/llvm/FuzzMutate/RandomIRBuilder.h
lib/FuzzMutate/RandomIRBuilder.cpp

Public Types

Public Member Functions

Public Attributes

Detailed Description

Member Enumeration Documentation

◆ SinkType

◆ SourceType

Constructor & Destructor Documentation

◆ RandomIRBuilder()

Member Function Documentation

◆ connectToSink()

◆ createFunctionDeclaration() [1/2]

◆ createFunctionDeclaration() [2/2]

◆ createFunctionDefinition() [1/2]

◆ createFunctionDefinition() [2/2]

◆ createStackMemory()

◆ findOrCreateGlobalVariable()

◆ findOrCreateSource() [1/2]

◆ findOrCreateSource() [2/2]

◆ findPointer()

◆ newSink()

◆ newSource()

◆ randomType()

Member Data Documentation

◆ KnownTypes

◆ MaxArgNum

◆ MinArgNum

◆ MinFunctionNum

◆ Rand