unittests/FuzzMutate/RandomIRBuilderTest.cpp

   1 //===- RandomIRBuilderTest.cpp - Tests for injector strategy --------------===//
   2 //
   3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
   4 // See https://llvm.org/LICENSE.txt for license information.
   5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
   6 //
   7 //===----------------------------------------------------------------------===//
   8
   9 #include "llvm/FuzzMutate/RandomIRBuilder.h"
  10 #include "llvm/ADT/StringRef.h"
  11 #include "llvm/AsmParser/Parser.h"
  12 #include "llvm/AsmParser/SlotMapping.h"
  13 #include "llvm/FuzzMutate/IRMutator.h"
  14 #include "llvm/FuzzMutate/OpDescriptor.h"
  15 #include "llvm/FuzzMutate/Operations.h"
  16 #include "llvm/IR/Constants.h"
  17 #include "llvm/IR/Instructions.h"
  18 #include "llvm/IR/LLVMContext.h"
  19 #include "llvm/IR/Module.h"
  20 #include "llvm/IR/Verifier.h"
  21 #include "llvm/Support/SourceMgr.h"
  22
  23 #include "gtest/gtest.h"
  24
  25 using namespace llvm;
  26
  27 static constexpr int Seed = 5;
  28
  29 namespace {
  30
  31 std::unique_ptr<Module> parseAssembly(
  32     const char *Assembly, LLVMContext &Context) {
  33
  34   SMDiagnostic Error;
  35   std::unique_ptr<Module> M = parseAssemblyString(Assembly, Error, Context);
  36
  37   std::string ErrMsg;
  38   raw_string_ostream OS(ErrMsg);
  39   Error.print("", OS);
  40
  41   assert(M && !verifyModule(*M, &errs()));
  42   return M;
  43 }
  44
  45 TEST(RandomIRBuilderTest, ShuffleVectorIncorrectOperands) {
  46   // Test that we don't create load instruction as a source for the shuffle
  47   // vector operation.
  48
  49   LLVMContext Ctx;
  50   const char *Source =
  51       "define <2 x i32> @test(<2 x i1> %cond, <2 x i32> %a) {\n"
  52       "  %A = alloca <2 x i32>\n"
  53       "  %I = insertelement <2 x i32> %a, i32 1, i32 1\n"
  54       "  ret <2 x i32> undef\n"
  55       "}";
  56   auto M = parseAssembly(Source, Ctx);
  57
  58   fuzzerop::OpDescriptor Descr = fuzzerop::shuffleVectorDescriptor(1);
  59
  60   // Empty known types since we ShuffleVector descriptor doesn't care about them
  61   RandomIRBuilder IB(Seed, {});
  62
  63   // Get first basic block of the first function
  64   Function &F = *M->begin();
  65   BasicBlock &BB = *F.begin();
  66
  67   SmallVector<Instruction *, 32> Insts;
  68   for (auto I = BB.getFirstInsertionPt(), E = BB.end(); I != E; ++I)
  69     Insts.push_back(&*I);
  70
  71   // Pick first and second sources
  72   SmallVector<Value *, 2> Srcs;
  73   ASSERT_TRUE(Descr.SourcePreds[0].matches(Srcs, Insts[1]));
  74   Srcs.push_back(Insts[1]);
  75   ASSERT_TRUE(Descr.SourcePreds[1].matches(Srcs, Insts[1]));
  76   Srcs.push_back(Insts[1]);
  77
  78   // Create new source. Check that it always matches with the descriptor.
  79   // Run some iterations to account for random decisions.
  80   for (int i = 0; i < 10; ++i) {
  81     Value *LastSrc = IB.newSource(BB, Insts, Srcs, Descr.SourcePreds[2]);
  82     ASSERT_TRUE(Descr.SourcePreds[2].matches(Srcs, LastSrc));
  83   }
  84 }
  85
  86 TEST(RandomIRBuilderTest, InsertValueIndexes) {
  87   // Check that we will generate correct indexes for the insertvalue operation
  88
  89   LLVMContext Ctx;
  90   const char *Source =
  91       "%T = type {i8, i32, i64}\n"
  92       "define void @test() {\n"
  93       "  %A = alloca %T\n"
  94       "  %L = load %T, %T* %A"
  95       "  ret void\n"
  96       "}";
  97   auto M = parseAssembly(Source, Ctx);
  98
  99   fuzzerop::OpDescriptor IVDescr = fuzzerop::insertValueDescriptor(1);
 100
 101   std::vector<Type *> Types =
 102       {Type::getInt8Ty(Ctx), Type::getInt32Ty(Ctx), Type::getInt64Ty(Ctx)};
 103   RandomIRBuilder IB(Seed, Types);
 104
 105   // Get first basic block of the first function
 106   Function &F = *M->begin();
 107   BasicBlock &BB = *F.begin();
 108
 109   // Pick first source
 110   Instruction *Src = &*std::next(BB.begin());
 111
 112   SmallVector<Value *, 2> Srcs(2);
 113   ASSERT_TRUE(IVDescr.SourcePreds[0].matches({}, Src));
 114   Srcs[0] = Src;
 115
 116   // Generate constants for each of the types and check that we pick correct
 117   // index for the given type
 118   for (auto *T: Types) {
 119     // Loop to account for possible random decisions
 120     for (int i = 0; i < 10; ++i) {
 121       // Create value we want to insert. Only it's type matters.
 122       Srcs[1] = ConstantInt::get(T, 5);
 123
 124       // Try to pick correct index
 125       Value *Src = IB.findOrCreateSource(
 126           BB, &*BB.begin(), Srcs, IVDescr.SourcePreds[2]);
 127       ASSERT_TRUE(IVDescr.SourcePreds[2].matches(Srcs, Src));
 128     }
 129   }
 130 }
 131
 132 TEST(RandomIRBuilderTest, ShuffleVectorSink) {
 133   // Check that we will never use shuffle vector mask as a sink form the
 134   // unrelated operation.
 135
 136   LLVMContext Ctx;
 137   const char *SourceCode =
 138       "define void @test(<4 x i32> %a) {\n"
 139       "  %S1 = shufflevector <4 x i32> %a, <4 x i32> %a, <4 x i32> undef\n"
 140       "  %S2 = shufflevector <4 x i32> %a, <4 x i32> %a, <4 x i32> undef\n"
 141       "  ret void\n"
 142       "}";
 143   auto M = parseAssembly(SourceCode, Ctx);
 144
 145   fuzzerop::OpDescriptor IVDescr = fuzzerop::insertValueDescriptor(1);
 146
 147   RandomIRBuilder IB(Seed, {});
 148
 149   // Get first basic block of the first function
 150   Function &F = *M->begin();
 151   BasicBlock &BB = *F.begin();
 152
 153   // Source is %S1
 154   Instruction *Source = &*BB.begin();
 155   // Sink is %S2
 156   SmallVector<Instruction *, 1> Sinks = {&*std::next(BB.begin())};
 157
 158   // Loop to account for random decisions
 159   for (int i = 0; i < 10; ++i) {
 160     // Try to connect S1 to S2. We should always create new sink.
 161     IB.connectToSink(BB, Sinks, Source);
 162     ASSERT_TRUE(!verifyModule(*M, &errs()));
 163   }
 164 }
 165
 166 TEST(RandomIRBuilderTest, InsertValueArray) {
 167   // Check that we can generate insertvalue for the vector operations
 168
 169   LLVMContext Ctx;
 170   const char *SourceCode =
 171       "define void @test() {\n"
 172       "  %A = alloca [8 x i32]\n"
 173       "  %L = load [8 x i32], [8 x i32]* %A"
 174       "  ret void\n"
 175       "}";
 176   auto M = parseAssembly(SourceCode, Ctx);
 177
 178   fuzzerop::OpDescriptor Descr = fuzzerop::insertValueDescriptor(1);
 179
 180   std::vector<Type *> Types =
 181       {Type::getInt8Ty(Ctx), Type::getInt32Ty(Ctx), Type::getInt64Ty(Ctx)};
 182   RandomIRBuilder IB(Seed, Types);
 183
 184   // Get first basic block of the first function
 185   Function &F = *M->begin();
 186   BasicBlock &BB = *F.begin();
 187
 188   // Pick first source
 189   Instruction *Source = &*std::next(BB.begin());
 190   ASSERT_TRUE(Descr.SourcePreds[0].matches({}, Source));
 191
 192   SmallVector<Value *, 2> Srcs(2);
 193
 194   // Check that we can always pick the last two operands.
 195   for (int i = 0; i < 10; ++i) {
 196     Srcs[0] = Source;
 197     Srcs[1] = IB.findOrCreateSource(BB, {Source}, Srcs, Descr.SourcePreds[1]);
 198     IB.findOrCreateSource(BB, {}, Srcs, Descr.SourcePreds[2]);
 199   }
 200 }
 201
 202 TEST(RandomIRBuilderTest, Invokes) {
 203   // Check that we never generate load or store after invoke instruction
 204
 205   LLVMContext Ctx;
 206   const char *SourceCode =
 207       "declare i32* @f()"
 208       "declare i32 @personality_function()"
 209       "define i32* @test() personality i32 ()* @personality_function {\n"
 210       "entry:\n"
 211       "  %val = invoke i32* @f()\n"
 212       "          to label %normal unwind label %exceptional\n"
 213       "normal:\n"
 214       "  ret i32* %val\n"
 215       "exceptional:\n"
 216       "  %landing_pad4 = landingpad token cleanup\n"
 217       "  ret i32* undef\n"
 218       "}";
 219   auto M = parseAssembly(SourceCode, Ctx);
 220
 221
 222   std::vector<Type *> Types = {Type::getInt8Ty(Ctx)};
 223   RandomIRBuilder IB(Seed, Types);
 224
 225   // Get first basic block of the test function
 226   Function &F = *M->getFunction("test");
 227   BasicBlock &BB = *F.begin();
 228
 229   Instruction *Invoke = &*BB.begin();
 230
 231   // Find source but never insert new load after invoke
 232   for (int i = 0; i < 10; ++i) {
 233     (void)IB.findOrCreateSource(BB, {Invoke}, {}, fuzzerop::anyIntType());
 234     ASSERT_TRUE(!verifyModule(*M, &errs()));
 235   }
 236 }
 237
 238 TEST(RandomIRBuilderTest, FirstClassTypes) {
 239   // Check that we never insert new source as a load from non first class
 240   // or unsized type.
 241
 242   LLVMContext Ctx;
 243   const char *SourceCode = "%Opaque = type opaque\n"
 244                            "define void @test(i8* %ptr) {\n"
 245                            "entry:\n"
 246                            "  %tmp = bitcast i8* %ptr to i32* (i32*)*\n"
 247                            "  %tmp1 = bitcast i8* %ptr to %Opaque*\n"
 248                            "  ret void\n"
 249                            "}";
 250   auto M = parseAssembly(SourceCode, Ctx);
 251
 252   std::vector<Type *> Types = {Type::getInt8Ty(Ctx)};
 253   RandomIRBuilder IB(Seed, Types);
 254
 255   Function &F = *M->getFunction("test");
 256   BasicBlock &BB = *F.begin();
 257   // Non first class type
 258   Instruction *FuncPtr = &*BB.begin();
 259   // Unsized type
 260   Instruction *OpaquePtr = &*std::next(BB.begin());
 261
 262   for (int i = 0; i < 10; ++i) {
 263     Value *V = IB.findOrCreateSource(BB, {FuncPtr, OpaquePtr});
 264     ASSERT_FALSE(isa<LoadInst>(V));
 265   }
 266 }
 267
 268 TEST(RandomIRBuilderTest, SwiftError) {
 269   // Check that we never pick swifterror value as a source for operation
 270   // other than load, store and call.
 271
 272   LLVMContext Ctx;
 273   const char *SourceCode = "declare void @use(i8** swifterror %err)"
 274                            "define void @test() {\n"
 275                            "entry:\n"
 276                            "  %err = alloca swifterror i8*, align 8\n"
 277                            "  call void @use(i8** swifterror %err)\n"
 278                            "  ret void\n"
 279                            "}";
 280   auto M = parseAssembly(SourceCode, Ctx);
 281
 282   std::vector<Type *> Types = {Type::getInt8Ty(Ctx)};
 283   RandomIRBuilder IB(Seed, Types);
 284
 285   // Get first basic block of the test function
 286   Function &F = *M->getFunction("test");
 287   BasicBlock &BB = *F.begin();
 288   Instruction *Alloca = &*BB.begin();
 289
 290   fuzzerop::OpDescriptor Descr = fuzzerop::gepDescriptor(1);
 291
 292   for (int i = 0; i < 10; ++i) {
 293     Value *V = IB.findOrCreateSource(BB, {Alloca}, {}, Descr.SourcePreds[0]);
 294     ASSERT_FALSE(isa<AllocaInst>(V));
 295   }
 296 }
 297
 298 }