include/llvm/FuzzMutate/IRMutator.h

   1 //===-- IRMutator.h - Mutation engine for fuzzing IR ------------*- C++ -*-===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8 //
   9 // Provides the IRMutator class, which drives mutations on IR based on a
  10 // configurable set of strategies. Some common strategies are also included
  11 // here.
  12 //
  13 //===----------------------------------------------------------------------===//
  14
  15 #ifndef LLVM_FUZZMUTATE_IRMUTATOR_H
  16 #define LLVM_FUZZMUTATE_IRMUTATOR_H
  17
  18 #include "llvm/ADT/Optional.h"
  19 #include "llvm/FuzzMutate/OpDescriptor.h"
  20 #include "llvm/Support/ErrorHandling.h"
  21
  22 namespace llvm {
  23 class BasicBlock;
  24 class Function;
  25 class Instruction;
  26 class Module;
  27
  28 struct RandomIRBuilder;
  29
  30 /// Base class for describing how to mutate a module. mutation functions for
  31 /// each IR unit forward to the contained unit.
  32 class IRMutationStrategy {
  33 public:
  34   virtual ~IRMutationStrategy() = default;
  35
  36   /// Provide a weight to bias towards choosing this strategy for a mutation.
  37   ///
  38   /// The value of the weight is arbitrary, but a good default is "the number of
  39   /// distinct ways in which this strategy can mutate a unit". This can also be
  40   /// used to prefer strategies that shrink the overall size of the result when
  41   /// we start getting close to \c MaxSize.
  42   virtual uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
  43                              uint64_t CurrentWeight) = 0;
  44
  45   /// @{
  46   /// Mutators for each IR unit. By default these forward to a contained
  47   /// instance of the next smaller unit.
  48   virtual void mutate(Module &M, RandomIRBuilder &IB);
  49   virtual void mutate(Function &F, RandomIRBuilder &IB);
  50   virtual void mutate(BasicBlock &BB, RandomIRBuilder &IB);
  51   virtual void mutate(Instruction &I, RandomIRBuilder &IB) {
  52     llvm_unreachable("Strategy does not implement any mutators");
  53   }
  54   /// @}
  55 };
  56
  57 using TypeGetter = std::function<Type *(LLVMContext &)>;
  58
  59 /// Entry point for configuring and running IR mutations.
  60 class IRMutator {
  61   std::vector<TypeGetter> AllowedTypes;
  62   std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
  63
  64 public:
  65   IRMutator(std::vector<TypeGetter> &&AllowedTypes,
  66             std::vector<std::unique_ptr<IRMutationStrategy>> &&Strategies)
  67       : AllowedTypes(std::move(AllowedTypes)),
  68         Strategies(std::move(Strategies)) {}
  69
  70   void mutateModule(Module &M, int Seed, size_t CurSize, size_t MaxSize);
  71 };
  72
  73 /// Strategy that injects operations into the function.
  74 class InjectorIRStrategy : public IRMutationStrategy {
  75   std::vector<fuzzerop::OpDescriptor> Operations;
  76
  77   Optional<fuzzerop::OpDescriptor> chooseOperation(Value *Src,
  78                                                    RandomIRBuilder &IB);
  79
  80 public:
  81   InjectorIRStrategy(std::vector<fuzzerop::OpDescriptor> &&Operations)
  82       : Operations(std::move(Operations)) {}
  83   static std::vector<fuzzerop::OpDescriptor> getDefaultOps();
  84
  85   uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
  86                      uint64_t CurrentWeight) override {
  87     return Operations.size();
  88   }
  89
  90   using IRMutationStrategy::mutate;
  91   void mutate(Function &F, RandomIRBuilder &IB) override;
  92   void mutate(BasicBlock &BB, RandomIRBuilder &IB) override;
  93 };
  94
  95 class InstDeleterIRStrategy : public IRMutationStrategy {
  96 public:
  97   uint64_t getWeight(size_t CurrentSize, size_t MaxSize,
  98                      uint64_t CurrentWeight) override;
  99
 100   using IRMutationStrategy::mutate;
 101   void mutate(Function &F, RandomIRBuilder &IB) override;
 102   void mutate(Instruction &Inst, RandomIRBuilder &IB) override;
 103 };
 104
 105 } // end llvm namespace
 106
 107 #endif // LLVM_FUZZMUTATE_IRMUTATOR_H