[FuzzMutate] Update InstModifierStrategy

[Peter]

Summary

We can randomly switch two operands of an instruction now.
Also add more comments to mutator.

[Peter]

format

[Peter]

diff with upstream main

[Peter]

rebase to upstream main. Was based on a corrupted commit

[arsenm]

llvm/lib/FuzzMutate/IRMutator.cpp

165–167

These clang-format changes and comment changes should be separate from the functionality change

[Peter]

llvm/lib/FuzzMutate/IRMutator.cpp

165–167

Can we submit only format changes? If so I will push one to upstream.

[Peter]

rebase to remove comment changes

[Peter]

update test so windows tests pass

llvm/lib/FuzzMutate/IRMutator.cpp

if (Line < 0)
     return 0;
   return Line;
 }
 
 void InstDeleterIRStrategy::mutate(Function &F, RandomIRBuilder &IB) {
   auto RS = makeSampler<Instruction *>(IB.Rand);
   for (Instruction &Inst : instructions(F)) {
     // TODO: We can't handle these instructions.
     if (Inst.isTerminator() || Inst.isEHPad() || Inst.isSwiftError() ||
         isa<PHINode>(Inst))
       continue;
 
     RS.sample(&Inst, /*Weight=*/1);
   }
   if (RS.isEmpty())
     return;
 
   // Delete the instruction.
   mutate(*RS.getSelection(), IB);
void InstModificationIRStrategy::mutate(Instruction &Inst,
   GetElementPtrInst *GEP = nullptr;
   switch (Inst.getOpcode()) {
   default:
     break;
   case Instruction::Add:
   case Instruction::Mul:
   case Instruction::Sub:
   case Instruction::Shl:
-    Modifications.push_back([&Inst]() { Inst.setHasNoSignedWrap(true); }),
-        Modifications.push_back([&Inst]() { Inst.setHasNoSignedWrap(false); });
+    Modifications.push_back([&Inst]() { Inst.setHasNoSignedWrap(true); });
     Modifications.push_back([&Inst]() { Inst.setHasNoUnsignedWrap(true); });
     Modifications.push_back([&Inst]() { Inst.setHasNoUnsignedWrap(false); });
 
     break;
   case Instruction::ICmp:
     CI = cast<ICmpInst>(&Inst);
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_EQ); });
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_NE); });
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_UGT); });
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_UGE); });
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_ULT); });
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_ULE); });
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SGT); });
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SGE); });
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SLT); });
     Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SLE); });
     break;
   case Instruction::GetElementPtr:
     GEP = cast<GetElementPtrInst>(&Inst);
     Modifications.push_back([GEP]() { GEP->setIsInBounds(true); });
     Modifications.push_back([GEP]() { GEP->setIsInBounds(false); });
     break;
   }
 
+  // Randomly switch operands of instructions
+  std::pair<int, int> NoneItem({-1, -1}), ShuffleItems(NoneItem);
+  switch (Inst.getOpcode()) {
+  case Instruction::SDiv:
+  case Instruction::UDiv:
+  case Instruction::SRem:
+  case Instruction::URem:
+  case Instruction::FDiv:
+  case Instruction::FRem: {
+    // Verify that the after shuffle the second operand is not
+    // constant 0.
+    Value *Operand = Inst.getOperand(0);
+    if (Constant *C = dyn_cast<Constant>(Operand)) {
+      if (!C->isZeroValue()) {
+        ShuffleItems = {0, 1};
+      }
+    }
+    break;
+  }
+  case Instruction::Select:
+    ShuffleItems = {1, 2};
+    break;
+  case Instruction::Add:
+  case Instruction::Sub:
+  case Instruction::Mul:
+  case Instruction::Shl:
+  case Instruction::LShr:
+  case Instruction::AShr:
+  case Instruction::And:
+  case Instruction::Or:
+  case Instruction::Xor:
+  case Instruction::FAdd:
+  case Instruction::FSub:
+  case Instruction::FMul:
+  case Instruction::ICmp:
+  case Instruction::FCmp:
+  case Instruction::ShuffleVector:
+    ShuffleItems = {0, 1};
+    break;
+  }
+  if (ShuffleItems != NoneItem) {
+    Modifications.push_back([&Inst, &ShuffleItems]() {
+      Value *Op0 = Inst.getOperand(ShuffleItems.first);
+      Inst.setOperand(ShuffleItems.first, Inst.getOperand(ShuffleItems.second));
+      Inst.setOperand(ShuffleItems.second, Op0);
+    });
+  }
+
   auto RS = makeSampler(IB.Rand, Modifications);
   if (RS)
     RS.getSelection()();
 }
 
 std::unique_ptr<Module> llvm::parseModule(const uint8_t *Data, size_t Size,
                                           LLVMContext &Context) {
 

llvm/unittests/FuzzMutate/StrategiesTest.cpp

std::unique_ptr<IRMutator> createInjectorMutator() {
 
   std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
   Strategies.push_back(std::make_unique<InjectorIRStrategy>(
       InjectorIRStrategy::getDefaultOps()));
 
   return std::make_unique<IRMutator>(std::move(Types), std::move(Strategies));
 }
 
-std::unique_ptr<IRMutator> createDeleterMutator() {
+template <class Strategy> std::unique_ptr<IRMutator> createMutator() {
   std::vector<TypeGetter> Types{
       Type::getInt1Ty,  Type::getInt8Ty,  Type::getInt16Ty, Type::getInt32Ty,
       Type::getInt64Ty, Type::getFloatTy, Type::getDoubleTy};
 
   std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
-  Strategies.push_back(std::make_unique<InstDeleterIRStrategy>());
-
-  return std::make_unique<IRMutator>(std::move(Types), std::move(Strategies));
-}
-
-std::unique_ptr<IRMutator> createInstModifierMutator() {
-  std::vector<TypeGetter> Types{
-      Type::getInt1Ty,  Type::getInt8Ty,  Type::getInt16Ty, Type::getInt32Ty,
-      Type::getInt64Ty, Type::getFloatTy, Type::getDoubleTy};
-
-  std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
-  Strategies.push_back(std::make_unique<InstModificationIRStrategy>());
+  Strategies.push_back(std::make_unique<Strategy>());
 
   return std::make_unique<IRMutator>(std::move(Types), std::move(Strategies));
 }
 
 std::unique_ptr<Module> parseAssembly(const char *Assembly,
                                       LLVMContext &Context) {
 
   SMDiagnostic Error;
StringRef Source = ""
                      "}\n"
                      "\n"
                      "define i32 @func2() {\n"
                      "%A9 = alloca i32\n"
                      "%L6 = load i32, i32* %A9\n"
                      "ret i32 %L6\n"
                      "}\n";
 
-  auto Mutator = createDeleterMutator();
+  auto Mutator = createMutator<InstDeleterIRStrategy>();
   ASSERT_TRUE(Mutator);
 
   IterateOnSource(Source, *Mutator);
 }
 
 TEST(InstDeleterIRStrategyTest, PhiNodes) {
   // Test that inst deleter works correctly with the phi nodes.
 
StringRef Source = "\n\
         br label %sw.epilog\n\
       \n\
       sw.epilog:\n\
         %a.0 = phi i32 [ 7, %entry ],  [ 9, %sw.bb1 ]\n\
         %b.0 = phi i32 [ 10, %entry ], [ 4, %sw.bb1 ]\n\
         ret i32 %a.0\n\
       }";
 
-  auto Mutator = createDeleterMutator();
+  auto Mutator = createMutator<InstDeleterIRStrategy>();
   ASSERT_TRUE(Mutator);
 
   IterateOnSource(Source, *Mutator);
 }
 
 static void checkModifyNoUnsignedAndNoSignedWrap(StringRef Opc) {
   LLVMContext Ctx;
   std::string Source = std::string("\n\
       define i32 @test(i32 %x) {\n\
         %a = ") + Opc.str() +
                        std::string(" i32 %x, 10\n\
         ret i32 %a\n\
       }");
 
-  auto Mutator = createInstModifierMutator();
+  auto Mutator = createMutator<InstModificationIRStrategy>();
   ASSERT_TRUE(Mutator);
 
   auto M = parseAssembly(Source.data(), Ctx);
   auto &F = *M->begin();
   auto *AddI = &*F.begin()->begin();
   ASSERT_TRUE(M && !verifyModule(*M, &errs()));
   bool FoundNUW = false;
   bool FoundNSW = false;

 TEST(InstModificationIRStrategyTest, ICmp) {
   LLVMContext Ctx;
   StringRef Source = "\n\
       define i1 @test(i32 %x) {\n\
         %a = icmp eq i32 %x, 10\n\
         ret i1 %a\n\
       }";
 
-  auto Mutator = createInstModifierMutator();
+  auto Mutator = createMutator<InstModificationIRStrategy>();
   ASSERT_TRUE(Mutator);
 
   auto M = parseAssembly(Source.data(), Ctx);
   auto &F = *M->begin();
   CmpInst *CI = cast<CmpInst>(&*F.begin()->begin());
   ASSERT_TRUE(M && !verifyModule(*M, &errs()));
   bool FoundNE = false;
   for (int i = 0; i < 100; ++i) {
     Mutator->mutateModule(*M, Seed + i, Source.size(), Source.size() + 100);
     EXPECT_TRUE(!verifyModule(*M, &errs()));
     FoundNE |= CI->getPredicate() == CmpInst::ICMP_NE;
   }
 
   EXPECT_TRUE(FoundNE);
 }
 
 TEST(InstModificationIRStrategyTest, GEP) {
   LLVMContext Ctx;
   StringRef Source = "\n\
       define i32* @test(i32* %ptr) {\n\
         %gep = getelementptr i32, i32* %ptr, i32 10\n\
         ret i32* %gep\n\
       }";
 
-  auto Mutator = createInstModifierMutator();
+  auto Mutator = createMutator<InstModificationIRStrategy>();
   ASSERT_TRUE(Mutator);
 
   auto M = parseAssembly(Source.data(), Ctx);
   auto &F = *M->begin();
   GetElementPtrInst *GEP = cast<GetElementPtrInst>(&*F.begin()->begin());
   ASSERT_TRUE(M && !verifyModule(*M, &errs()));
   bool FoundInbounds = false;
   for (int i = 0; i < 100; ++i) {
     Mutator->mutateModule(*M, Seed + i, Source.size(), Source.size() + 100);
     EXPECT_TRUE(!verifyModule(*M, &errs()));
     FoundInbounds |= GEP->isInBounds();
   }
 
   EXPECT_TRUE(FoundInbounds);
 }
+
+/// The caller has to guarantee that function argument are used in the SAME
+/// place as the operand.
+void VerfyOperandShuffled(StringRef Source, std::pair<int, int> ShuffleItems) {
+  LLVMContext Ctx;
+  auto Mutator = createMutator<InstModificationIRStrategy>();
+  ASSERT_TRUE(Mutator);
+
+  auto M = parseAssembly(Source.data(), Ctx);
+  auto &F = *M->begin();
+  Instruction *Inst = &*F.begin()->begin();
+  ASSERT_TRUE(M && !verifyModule(*M, &errs()));
+  ASSERT_TRUE(Inst->getOperand(ShuffleItems.first) ==
+              dyn_cast<Value>(F.getArg(ShuffleItems.first)));
+  ASSERT_TRUE(Inst->getOperand(ShuffleItems.second) ==
+              dyn_cast<Value>(F.getArg(ShuffleItems.second)));
+
+  Mutator->mutateModule(*M, 0, Source.size(), Source.size() + 100);
+  EXPECT_TRUE(!verifyModule(*M, &errs()));
+
+  EXPECT_TRUE(Inst->getOperand(ShuffleItems.first) ==
+              dyn_cast<Value>(F.getArg(ShuffleItems.second)));
+  EXPECT_TRUE(Inst->getOperand(ShuffleItems.second) ==
+              dyn_cast<Value>(F.getArg(ShuffleItems.first)));
+}
+
+TEST(InstModificationIRStrategyTest, ShuffleFAdd) {
+  StringRef Source = "\n\
+      define float @test(float %0, float %1) {\n\
+        %add = fadd float %0, %1\n\
+        ret float %add\n\
+      }";
+  VerfyOperandShuffled(Source, {0, 1});
+}
+TEST(InstModificationIRStrategyTest, ShuffleSelect) {
+  StringRef Source = "\n\
+      define float @test(i1 %0, float %1, float %2) {\n\
+        %select = select i1 %0, float %1, float %2\n\
+        ret float %select\n\
+      }";
+  VerfyOperandShuffled(Source, {1, 2});
+}
+
+void VerfyDivDidntShuffle(StringRef Source) {
+  LLVMContext Ctx;
+  auto Mutator = createMutator<InstModificationIRStrategy>();
+  ASSERT_TRUE(Mutator);
+
+  auto M = parseAssembly(Source.data(), Ctx);
+  auto &F = *M->begin();
+  Instruction *Inst = &*F.begin()->begin();
+  ASSERT_TRUE(M && !verifyModule(*M, &errs()));
+
+  EXPECT_TRUE(isa<Constant>(Inst->getOperand(0)));
+  EXPECT_TRUE(Inst->getOperand(1) == dyn_cast<Value>(F.getArg(0)));
+
+  Mutator->mutateModule(*M, Seed, Source.size(), Source.size() + 100);
+  EXPECT_TRUE(!verifyModule(*M, &errs()));
+
+  // Didn't shuffle.
+  EXPECT_TRUE(isa<Constant>(Inst->getOperand(0)));
+  EXPECT_TRUE(Inst->getOperand(1) == dyn_cast<Value>(F.getArg(0)));
+}
+TEST(InstModificationIRStrategyTest, DidntShuffleSDiv) {
+  StringRef Source = "\n\
+      define i32 @test(i32 %0) {\n\
+        %div = sdiv i32 0, %0\n\
+        ret i32 %div\n\
+      }";
+  VerfyDivDidntShuffle(Source);
+}
+TEST(InstModificationIRStrategyTest, DidntShuffleFRem) {
+  StringRef Source = "\n\
+      define <2 x double> @test(<2 x double> %0) {\n\
+        %div = frem <2 x double> <double 0.0, double 0.0>, %0\n\
+        ret <2 x double> %div\n\
+      }";
+  VerfyDivDidntShuffle(Source);
+}
 } // namespace