clang/utils/modfuzz.py

   1 #!/usr/bin/env python
   2
   3 # To use:
   4 #  1) Update the 'decls' list below with your fuzzing configuration.
   5 #  2) Run with the clang binary as the command-line argument.
   6
   7 from __future__ import absolute_import, division, print_function
   8 import random
   9 import subprocess
  10 import sys
  11 import os
  12
  13 clang = sys.argv[1]
  14 none_opts = 0.3
  15
  16
  17 class Decl(object):
  18     def __init__(self, text, depends=[], provides=[], conflicts=[]):
  19         self.text = text
  20         self.depends = depends
  21         self.provides = provides
  22         self.conflicts = conflicts
  23
  24     def valid(self, model):
  25         for i in self.depends:
  26             if i not in model.decls:
  27                 return False
  28         for i in self.conflicts:
  29             if i in model.decls:
  30                 return False
  31         return True
  32
  33     def apply(self, model, name):
  34         for i in self.provides:
  35             model.decls[i] = True
  36         model.source += self.text % {"name": name}
  37
  38
  39 decls = [
  40     Decl("struct X { int n; };\n", provides=["X"], conflicts=["X"]),
  41     Decl('static_assert(X{.n=1}.n == 1, "");\n', depends=["X"]),
  42     Decl("X %(name)s;\n", depends=["X"]),
  43 ]
  44
  45
  46 class FS(object):
  47     def __init__(self):
  48         self.fs = {}
  49         self.prevfs = {}
  50
  51     def write(self, path, contents):
  52         self.fs[path] = contents
  53
  54     def done(self):
  55         for f, s in self.fs.items():
  56             if self.prevfs.get(f) != s:
  57                 f = file(f, "w")
  58                 f.write(s)
  59                 f.close()
  60
  61         for f in self.prevfs:
  62             if f not in self.fs:
  63                 os.remove(f)
  64
  65         self.prevfs, self.fs = self.fs, {}
  66
  67
  68 fs = FS()
  69
  70
  71 class CodeModel(object):
  72     def __init__(self):
  73         self.source = ""
  74         self.modules = {}
  75         self.decls = {}
  76         self.i = 0
  77
  78     def make_name(self):
  79         self.i += 1
  80         return "n" + str(self.i)
  81
  82     def fails(self):
  83         fs.write(
  84             "module.modulemap",
  85             "".join(
  86                 'module %s { header "%s.h" export * }\n' % (m, m)
  87                 for m in self.modules.keys()
  88             ),
  89         )
  90
  91         for m, (s, _) in self.modules.items():
  92             fs.write("%s.h" % m, s)
  93
  94         fs.write("main.cc", self.source)
  95         fs.done()
  96
  97         return (
  98             subprocess.call(
  99                 [clang, "-std=c++11", "-c", "-fmodules", "main.cc", "-o", "/dev/null"]
 100             )
 101             != 0
 102         )
 103
 104
 105 def generate():
 106     model = CodeModel()
 107     m = []
 108
 109     try:
 110         for d in mutations(model):
 111             d(model)
 112             m.append(d)
 113         if not model.fails():
 114             return
 115     except KeyboardInterrupt:
 116         print()
 117         return True
 118
 119     sys.stdout.write("\nReducing:\n")
 120     sys.stdout.flush()
 121
 122     try:
 123         while True:
 124             assert m, "got a failure with no steps; broken clang binary?"
 125             i = random.choice(list(range(len(m))))
 126             x = m[0:i] + m[i + 1 :]
 127             m2 = CodeModel()
 128             for d in x:
 129                 d(m2)
 130             if m2.fails():
 131                 m = x
 132                 model = m2
 133             else:
 134                 sys.stdout.write(".")
 135                 sys.stdout.flush()
 136     except KeyboardInterrupt:
 137         # FIXME: Clean out output directory first.
 138         model.fails()
 139         return model
 140
 141
 142 def choose(options):
 143     while True:
 144         i = int(random.uniform(0, len(options) + none_opts))
 145         if i >= len(options):
 146             break
 147         yield options[i]
 148
 149
 150 def mutations(model):
 151     options = [create_module, add_top_level_decl]
 152     for opt in choose(options):
 153         yield opt(model, options)
 154
 155
 156 def create_module(model, options):
 157     n = model.make_name()
 158
 159     def go(model):
 160         model.modules[n] = (model.source, model.decls)
 161         (model.source, model.decls) = ("", {})
 162
 163     options += [lambda model, options: add_import(model, options, n)]
 164     return go
 165
 166
 167 def add_top_level_decl(model, options):
 168     n = model.make_name()
 169     d = random.choice([decl for decl in decls if decl.valid(model)])
 170
 171     def go(model):
 172         if not d.valid(model):
 173             return
 174         d.apply(model, n)
 175
 176     return go
 177
 178
 179 def add_import(model, options, module_name):
 180     def go(model):
 181         if module_name in model.modules:
 182             model.source += '#include "%s.h"\n' % module_name
 183             model.decls.update(model.modules[module_name][1])
 184
 185     return go
 186
 187
 188 sys.stdout.write("Finding bug: ")
 189 while True:
 190     if generate():
 191         break
 192     sys.stdout.write(".")
 193     sys.stdout.flush()