[llvm-mc-fuzzer] Support untested instruction discovery for variable length instruction sets like microMIPS.

[dsanders]

Summary

For fixed length instructions, we can use -max_len to limit the fuzzer to a
single instruction. This doesn't work for variable length instruction sets
since a 4-byte input could consist of one 4-byte instruction or two 2-byte
instructions.

This patch adds a --insn-limit to llvm-mc-fuzzer to limit the input in
terms of instructions processed.

[kcc]

LGTM

tools/llvm-mc-fuzzer/llvm-mc-fuzzer.cpp

static cl::opt<std::string>
     TripleName("triple", cl::desc("Target triple to assemble for, "
                                   "see -version for available targets"));
 
 static cl::opt<std::string>
     MCPU("mcpu",
          cl::desc("Target a specific cpu type (-mcpu=help for details)"),
          cl::value_desc("cpu-name"), cl::init(""));
 
+// This is useful for variable-length instruction sets.
+static cl::opt<unsigned> InsnLimit(
+    "insn-limit",
+    cl::desc("Limit the number of instructions to process (0 for no limit)"),
+    cl::value_desc("count"), cl::init(0));
+
 static cl::list<std::string>
     MAttrs("mattr", cl::CommaSeparated,
            cl::desc("Target specific attributes (-mattr=help for details)"),
            cl::value_desc("a1,+a2,-a3,..."));
 // The feature string derived from -mattr's values.
 std::string FeaturesStr;
 
 static cl::list<std::string>
     FuzzerArgv("fuzzer-args", cl::Positional,
                cl::desc("Options to pass to the fuzzer"), cl::ZeroOrMore,
                cl::PositionalEatsArgs);
 
 void DisassembleOneInput(const uint8_t *Data, size_t Size) {
   char AssemblyText[AssemblyTextBufSize];
 
   std::vector<uint8_t> DataCopy(Data, Data + Size);
 
   LLVMDisasmContextRef Ctx = LLVMCreateDisasmCPUFeatures(
       TripleName.c_str(), MCPU.c_str(), FeaturesStr.c_str(), nullptr, 0,
       nullptr, nullptr);
   assert(Ctx);
   uint8_t *p = DataCopy.data();
   unsigned Consumed;
+  unsigned InstructionsProcessed = 0;
   do {
     Consumed = LLVMDisasmInstruction(Ctx, p, Size, 0, AssemblyText,
                                      AssemblyTextBufSize);
     Size -= Consumed;
     p += Consumed;
+
+    InstructionsProcessed ++;
+    if (InsnLimit != 0 && InstructionsProcessed < InsnLimit)
+      break;
   } while (Consumed != 0);
   LLVMDisasmDispose(Ctx);
 }
 
 int main(int argc, char **argv) {
   // The command line is unusual compared to other fuzzers due to the need to
   // specify the target. Options like -triple, -mcpu, and -mattr work like
   // their counterparts in llvm-mc, while -fuzzer-args collects options for the