tools/llvm-opt-fuzzer/llvm-opt-fuzzer.cpp

   1 //===--- llvm-opt-fuzzer.cpp - Fuzzer for instruction selection ----------===//
   2 //
   3 //                     The LLVM Compiler Infrastructure
   4 //
   5 // This file is distributed under the University of Illinois Open Source
   6 // License. See LICENSE.TXT for details.
   7 //
   8 //===----------------------------------------------------------------------===//
   9 //
  10 // Tool to fuzz optimization passes using libFuzzer.
  11 //
  12 //===----------------------------------------------------------------------===//
  13
  14 #include "llvm/Bitcode/BitcodeReader.h"
  15 #include "llvm/Bitcode/BitcodeWriter.h"
  16 #include "llvm/CodeGen/CommandFlags.inc"
  17 #include "llvm/FuzzMutate/FuzzerCLI.h"
  18 #include "llvm/FuzzMutate/IRMutator.h"
  19 #include "llvm/IR/Verifier.h"
  20 #include "llvm/Passes/PassBuilder.h"
  21 #include "llvm/Support/SourceMgr.h"
  22 #include "llvm/Support/TargetRegistry.h"
  23 #include "llvm/Support/TargetSelect.h"
  24
  25 using namespace llvm;
  26
  27 static cl::opt<std::string>
  28     TargetTripleStr("mtriple", cl::desc("Override target triple for module"));
  29
  30 // Passes to run for this fuzzer instance. Expects new pass manager syntax.
  31 static cl::opt<std::string> PassPipeline(
  32     "passes",
  33     cl::desc("A textual description of the pass pipeline for testing"));
  34
  35 static std::unique_ptr<IRMutator> Mutator;
  36 static std::unique_ptr<TargetMachine> TM;
  37
  38 std::unique_ptr<IRMutator> createOptMutator() {
  39   std::vector<TypeGetter> Types{
  40       Type::getInt1Ty,  Type::getInt8Ty,  Type::getInt16Ty, Type::getInt32Ty,
  41       Type::getInt64Ty, Type::getFloatTy, Type::getDoubleTy};
  42
  43   std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
  44   Strategies.push_back(
  45       llvm::make_unique<InjectorIRStrategy>(
  46           InjectorIRStrategy::getDefaultOps()));
  47   Strategies.push_back(
  48       llvm::make_unique<InstDeleterIRStrategy>());
  49
  50   return llvm::make_unique<IRMutator>(std::move(Types), std::move(Strategies));
  51 }
  52
  53 extern "C" LLVM_ATTRIBUTE_USED size_t LLVMFuzzerCustomMutator(
  54     uint8_t *Data, size_t Size, size_t MaxSize, unsigned int Seed) {
  55
  56   assert(Mutator &&
  57       "IR mutator should have been created during fuzzer initialization");
  58
  59   LLVMContext Context;
  60   auto M = parseAndVerify(Data, Size, Context);
  61   if (!M) {
  62     errs() << "error: mutator input module is broken!\n";
  63     return 0;
  64   }
  65
  66   Mutator->mutateModule(*M, Seed, Size, MaxSize);
  67
  68   if (verifyModule(*M, &errs())) {
  69     errs() << "mutation result doesn't pass verification\n";
  70 #ifndef NDEBUG
  71     M->dump();
  72 #endif
  73     // Avoid adding incorrect test cases to the corpus.
  74     return 0;
  75   }
  76
  77   std::string Buf;
  78   {
  79     raw_string_ostream OS(Buf);
  80     WriteBitcodeToFile(*M, OS);
  81   }
  82   if (Buf.size() > MaxSize)
  83     return 0;
  84
  85   // There are some invariants which are not checked by the verifier in favor
  86   // of having them checked by the parser. They may be considered as bugs in the
  87   // verifier and should be fixed there. However until all of those are covered
  88   // we want to check for them explicitly. Otherwise we will add incorrect input
  89   // to the corpus and this is going to confuse the fuzzer which will start
  90   // exploration of the bitcode reader error handling code.
  91   auto NewM = parseAndVerify(
  92       reinterpret_cast<const uint8_t*>(Buf.data()), Buf.size(), Context);
  93   if (!NewM) {
  94     errs() << "mutator failed to re-read the module\n";
  95 #ifndef NDEBUG
  96     M->dump();
  97 #endif
  98     return 0;
  99   }
 100
 101   memcpy(Data, Buf.data(), Buf.size());
 102   return Buf.size();
 103 }
 104
 105 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
 106   assert(TM && "Should have been created during fuzzer initialization");
 107
 108   if (Size <= 1)
 109     // We get bogus data given an empty corpus - ignore it.
 110     return 0;
 111
 112   // Parse module
 113   //
 114
 115   LLVMContext Context;
 116   auto M = parseAndVerify(Data, Size, Context);
 117   if (!M) {
 118     errs() << "error: input module is broken!\n";
 119     return 0;
 120   }
 121
 122   // Set up target dependant options
 123   //
 124
 125   M->setTargetTriple(TM->getTargetTriple().normalize());
 126   M->setDataLayout(TM->createDataLayout());
 127   setFunctionAttributes(TM->getTargetCPU(), TM->getTargetFeatureString(), *M);
 128
 129   // Create pass pipeline
 130   //
 131
 132   PassBuilder PB(TM.get());
 133
 134   LoopAnalysisManager LAM;
 135   FunctionAnalysisManager FAM;
 136   CGSCCAnalysisManager CGAM;
 137   ModulePassManager MPM;
 138   ModuleAnalysisManager MAM;
 139
 140   FAM.registerPass([&] { return PB.buildDefaultAAPipeline(); });
 141   PB.registerModuleAnalyses(MAM);
 142   PB.registerCGSCCAnalyses(CGAM);
 143   PB.registerFunctionAnalyses(FAM);
 144   PB.registerLoopAnalyses(LAM);
 145   PB.crossRegisterProxies(LAM, FAM, CGAM, MAM);
 146
 147   bool Ok = PB.parsePassPipeline(MPM, PassPipeline, false, false);
 148   assert(Ok && "Should have been checked during fuzzer initialization");
 149   (void)Ok; // silence unused variable warning on release builds
 150
 151   // Run passes which we need to test
 152   //
 153
 154   MPM.run(*M, MAM);
 155
 156   // Check that passes resulted in a correct code
 157   if (verifyModule(*M, &errs())) {
 158     errs() << "Transformation resulted in an invalid module\n";
 159     abort();
 160   }
 161
 162   return 0;
 163 }
 164
 165 static void handleLLVMFatalError(void *, const std::string &Message, bool) {
 166   // TODO: Would it be better to call into the fuzzer internals directly?
 167   dbgs() << "LLVM ERROR: " << Message << "\n"
 168          << "Aborting to trigger fuzzer exit handling.\n";
 169   abort();
 170 }
 171
 172 extern "C" LLVM_ATTRIBUTE_USED int LLVMFuzzerInitialize(
 173     int *argc, char ***argv) {
 174   EnableDebugBuffering = true;
 175
 176   // Make sure we print the summary and the current unit when LLVM errors out.
 177   install_fatal_error_handler(handleLLVMFatalError, nullptr);
 178
 179   // Initialize llvm
 180   //
 181
 182   InitializeAllTargets();
 183   InitializeAllTargetMCs();
 184
 185   PassRegistry &Registry = *PassRegistry::getPassRegistry();
 186   initializeCore(Registry);
 187   initializeCoroutines(Registry);
 188   initializeScalarOpts(Registry);
 189   initializeObjCARCOpts(Registry);
 190   initializeVectorization(Registry);
 191   initializeIPO(Registry);
 192   initializeAnalysis(Registry);
 193   initializeTransformUtils(Registry);
 194   initializeInstCombine(Registry);
 195   initializeAggressiveInstCombine(Registry);
 196   initializeInstrumentation(Registry);
 197   initializeTarget(Registry);
 198
 199   // Parse input options
 200   //
 201
 202   handleExecNameEncodedOptimizerOpts(*argv[0]);
 203   parseFuzzerCLOpts(*argc, *argv);
 204
 205   // Create TargetMachine
 206   //
 207
 208   if (TargetTripleStr.empty()) {
 209     errs() << *argv[0] << ": -mtriple must be specified\n";
 210     exit(1);
 211   }
 212   Triple TargetTriple = Triple(Triple::normalize(TargetTripleStr));
 213
 214   std::string Error;
 215   const Target *TheTarget =
 216       TargetRegistry::lookupTarget(MArch, TargetTriple, Error);
 217   if (!TheTarget) {
 218     errs() << *argv[0] << ": " << Error;
 219     exit(1);
 220   }
 221
 222   TargetOptions Options = InitTargetOptionsFromCodeGenFlags();
 223   TM.reset(TheTarget->createTargetMachine(
 224       TargetTriple.getTriple(), getCPUStr(), getFeaturesStr(),
 225      Options, getRelocModel(), getCodeModel(), CodeGenOpt::Default));
 226   assert(TM && "Could not allocate target machine!");
 227
 228   // Check that pass pipeline is specified and correct
 229   //
 230
 231   if (PassPipeline.empty()) {
 232     errs() << *argv[0] << ": at least one pass should be specified\n";
 233     exit(1);
 234   }
 235
 236   PassBuilder PB(TM.get());
 237   ModulePassManager MPM;
 238   if (!PB.parsePassPipeline(MPM, PassPipeline, false, false)) {
 239     errs() << *argv[0] << ": can't parse pass pipeline\n";
 240     exit(1);
 241   }
 242
 243   // Create mutator
 244   //
 245
 246   Mutator = createOptMutator();
 247
 248   return 0;
 249 }