[FuzzMutate] InstModificationStrategy, add FastMath flags and exact flags to instructions.

[Peter]

Summary

I think there are more attributes, flags we can add to call, functions declarations and global variables. Let's start with these two flags.

[arsenm]

llvm/lib/FuzzMutate/IRMutator.cpp

221–223

I don't know exactly how the fuzz argument works, but won't these interfere? Setting all is superfluous with setting every individual flag

llvm/unittests/FuzzMutate/StrategiesTest.cpp

330

Separate ASSERT_TRUE for each

354

Do we even allow fmf on arrays of vectors?

368–374

Missing paces. Can you also reduce the indentation level by factoring out the innermost loop or something?

[Peter]

1. fix indentation
2. remove the probability where we repeatedly setting the same thing.

llvm/lib/FuzzMutate/IRMutator.cpp

221–223

Yes, setting all is superfluous. I removed the repeated part, now we are only flipping the setting. (So we don't set true to ture).

It takes a lot of mutations to set(or unset) every flag, so I think its a good idea that we keep an option to set everything at once.

llvm/unittests/FuzzMutate/StrategiesTest.cpp

354

https://godbolt.org/z/nGarYT6Ef

I think we do. The documentation (for call, phi, and select) says "that return a floating-point scalar or vector type, or an array (nested to any depth) of floating-point scalar or vector types", and llc is not complaining about this.

[arsenm]

llvm/lib/FuzzMutate/IRMutator.cpp

250–251

Why don't these do the set the opposite value like the fmf? Same for the existing GEP case (if you want to change the GEP case, do it in a separate change)

264–275

You can dyn_cast to FPMathOperator to get all fast math flag compatible operations without maintaining the instruction list

[Peter]

fliping isExact as well. Using isa<FPMathOperator>(&Inst) to do test if FastMath is compatable.

[Peter]

llvm/lib/FuzzMutate/IRMutator.cpp

264–275

I didn't know FPMathOperator can work on call inst. Thanks for pointing out.

llvm/lib/FuzzMutate/IRMutator.cpp

 #include "llvm/ADT/SmallSet.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/Bitcode/BitcodeReader.h"
 #include "llvm/Bitcode/BitcodeWriter.h"
 #include "llvm/FuzzMutate/Operations.h"
 #include "llvm/FuzzMutate/Random.h"
 #include "llvm/FuzzMutate/RandomIRBuilder.h"
 #include "llvm/IR/BasicBlock.h"
+#include "llvm/IR/FMF.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/InstIterator.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/Module.h"
+#include "llvm/IR/Operator.h"
 #include "llvm/IR/Verifier.h"
 #include "llvm/Support/MemoryBuffer.h"
 #include "llvm/Support/SourceMgr.h"
 #include "llvm/Transforms/Scalar/DCE.h"
 
 using namespace llvm;
 
 static void createEmptyFunction(Module &M) {

 void InstModificationIRStrategy::mutate(Instruction &Inst,
                                         RandomIRBuilder &IB) {
   SmallVector<std::function<void()>, 8> Modifications;
   CmpInst *CI = nullptr;
   GetElementPtrInst *GEP = nullptr;
   switch (Inst.getOpcode()) {
   default:
     break;
+  // Add nsw, nuw flag
   case Instruction::Add:
   case Instruction::Mul:
   case Instruction::Sub:
   case Instruction::Shl:
     Modifications.push_back([&Inst]() { Inst.setHasNoSignedWrap(true); });
     Modifications.push_back([&Inst]() { Inst.setHasNoSignedWrap(false); });
     Modifications.push_back([&Inst]() { Inst.setHasNoUnsignedWrap(true); });
     Modifications.push_back([&Inst]() { Inst.setHasNoUnsignedWrap(false); });
-
     break;
   case Instruction::ICmp:
     CI = cast<ICmpInst>(&Inst);
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_EQ); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_NE); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_UGT); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_UGE); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_ULT); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_ULE); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SGT); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SGE); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SLT); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SLE); });
+    for (unsigned p = CmpInst::FIRST_ICMP_PREDICATE;
+         p <= CmpInst::LAST_ICMP_PREDICATE; p++) {
+      Modifications.push_back(
+          [CI, p]() { CI->setPredicate(static_cast<CmpInst::Predicate>(p)); });
+    }
     break;
+  // Add inbound flag.
   case Instruction::GetElementPtr:
     GEP = cast<GetElementPtrInst>(&Inst);
     Modifications.push_back([GEP]() { GEP->setIsInBounds(true); });
     Modifications.push_back([GEP]() { GEP->setIsInBounds(false); });
     break;
+  // Add exact flag.
+  case Instruction::UDiv:
+  case Instruction::SDiv:
+  case Instruction::LShr:
+  case Instruction::AShr:
+    Modifications.push_back([&Inst] { Inst.setIsExact(!Inst.isExact()); });
+    break;
+
+  case Instruction::FCmp:
+    CI = cast<ICmpInst>(&Inst);
+    for (unsigned p = CmpInst::FIRST_FCMP_PREDICATE;
+         p <= CmpInst::LAST_FCMP_PREDICATE; p++) {
+      Modifications.push_back(
+          [CI, p]() { CI->setPredicate(static_cast<CmpInst::Predicate>(p)); });
+    }
+    break;
+  }
+
+  // Add fast math flag if possible.
+  if (isa<FPMathOperator>(&Inst)) {
+    // Try setting everything unless they are already on.
+    Modifications.push_back(
+        [&Inst] { Inst.setFast(!Inst.getFastMathFlags().all()); });
+    // Try unsetting everything unless they are already off.
+    Modifications.push_back(
+        [&Inst] { Inst.setFast(!Inst.getFastMathFlags().none()); });
+    // Individual setting by flipping the bit
+    Modifications.push_back(
+        [&Inst] { Inst.setHasAllowReassoc(!Inst.hasAllowReassoc()); });
+    Modifications.push_back([&Inst] { Inst.setHasNoNaNs(!Inst.hasNoNaNs()); });
+    Modifications.push_back([&Inst] { Inst.setHasNoInfs(!Inst.hasNoInfs()); });
+    Modifications.push_back(
+        [&Inst] { Inst.setHasNoSignedZeros(!Inst.hasNoSignedZeros()); });
+    Modifications.push_back(
+        [&Inst] { Inst.setHasAllowReciprocal(!Inst.hasAllowReciprocal()); });
+    Modifications.push_back(
+        [&Inst] { Inst.setHasAllowContract(!Inst.hasAllowContract()); });
+    Modifications.push_back(
+        [&Inst] { Inst.setHasApproxFunc(!Inst.hasApproxFunc()); });
   }
 
   // Randomly switch operands of instructions
   std::pair<int, int> NoneItem({-1, -1}), ShuffleItems(NoneItem);
   switch (Inst.getOpcode()) {
   case Instruction::SDiv:
   case Instruction::UDiv:
   case Instruction::SRem:

llvm/unittests/FuzzMutate/StrategiesTest.cpp

 //===- InjectorIRStrategyTest.cpp - Tests for injector strategy -----------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/AsmParser/Parser.h"
 #include "llvm/AsmParser/SlotMapping.h"
 #include "llvm/FuzzMutate/IRMutator.h"
 #include "llvm/FuzzMutate/Operations.h"
 #include "llvm/FuzzMutate/RandomIRBuilder.h"
+#include "llvm/IR/FMF.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/LLVMContext.h"
 #include "llvm/IR/Module.h"
 #include "llvm/IR/Verifier.h"
 #include "llvm/Support/SourceMgr.h"
 #include <random>
 
 #include "gtest/gtest.h"
void VerfyOperandShuffled(StringRef Source, std::pair<int, int> ShuffleItems) {
   Instruction *Inst = &*F.begin()->begin();
   ASSERT_TRUE(M && !verifyModule(*M, &errs()));
   ASSERT_TRUE(Inst->getOperand(ShuffleItems.first) ==
               dyn_cast<Value>(F.getArg(ShuffleItems.first)));
   ASSERT_TRUE(Inst->getOperand(ShuffleItems.second) ==
               dyn_cast<Value>(F.getArg(ShuffleItems.second)));
 
   Mutator->mutateModule(*M, 0, Source.size(), Source.size() + 100);
-  EXPECT_TRUE(!verifyModule(*M, &errs()));
+  ASSERT_TRUE(!verifyModule(*M, &errs()));
 
-  EXPECT_TRUE(Inst->getOperand(ShuffleItems.first) ==
+  ASSERT_TRUE(Inst->getOperand(ShuffleItems.first) ==
               dyn_cast<Value>(F.getArg(ShuffleItems.second)));
-  EXPECT_TRUE(Inst->getOperand(ShuffleItems.second) ==
+  ASSERT_TRUE(Inst->getOperand(ShuffleItems.second) ==
               dyn_cast<Value>(F.getArg(ShuffleItems.first)));
 }
 
-TEST(InstModificationIRStrategyTest, ShuffleFAdd) {
+TEST(InstModificationIRStrategyTest, ShuffleAnd) {
   StringRef Source = "\n\
-      define float @test(float %0, float %1) {\n\
-        %add = fadd float %0, %1\n\
-        ret float %add\n\
+      define i32 @test(i32 %0, i32 %1) {\n\
+        %add = and i32 %0, %1\n\
+        ret i32 %add\n\
       }";
   VerfyOperandShuffled(Source, {0, 1});
 }
 TEST(InstModificationIRStrategyTest, ShuffleSelect) {
   StringRef Source = "\n\
-      define float @test(i1 %0, float %1, float %2) {\n\
-        %select = select i1 %0, float %1, float %2\n\
-        ret float %select\n\
+      define i32 @test(i1 %0, i32 %1, i32 %2) {\n\
+        %select = select i1 %0, i32 %1, i32 %2\n\
+        ret i32 %select\n\
       }";
   VerfyOperandShuffled(Source, {1, 2});
 }
 
 void VerfyDivDidntShuffle(StringRef Source) {
   LLVMContext Ctx;
   auto Mutator = createMutator<InstModificationIRStrategy>();
   ASSERT_TRUE(Mutator);

 TEST(InstModificationIRStrategyTest, DidntShuffleFRem) {
   StringRef Source = "\n\
       define <2 x double> @test(<2 x double> %0) {\n\
         %div = frem <2 x double> <double 0.0, double 0.0>, %0\n\
         ret <2 x double> %div\n\
       }";
   VerfyDivDidntShuffle(Source);
 }
+TEST(InstModificationIRStrategy, Exact) {
+  LLVMContext Ctx;
+  StringRef Source = "\n\
+      define i32 @test(i32 %a, i32 %b) {\n\
+        %c = ashr i32 %a, %b \n\
+        ret i32 %c\n\
+      }";
+
+  auto Mutator = createMutator<InstModificationIRStrategy>();
+  ASSERT_TRUE(Mutator);
+
+  std::unique_ptr<Module> M = parseAssembly(Source.data(), Ctx);
+  std::mt19937 mt(Seed);
+  std::uniform_int_distribution<int> RandInt(INT_MIN, INT_MAX);
+  auto &F = *M->begin();
+  BinaryOperator *AShr = cast<BinaryOperator>(&*F.begin()->begin());
+  bool FoundExact = false;
+  for (int i = 0; i < 100; ++i) {
+    Mutator->mutateModule(*M, RandInt(mt), Source.size(), Source.size() + 100);
+    ASSERT_FALSE(verifyModule(*M, &errs()));
+    FoundExact |= AShr->isExact();
+  }
+
+  EXPECT_TRUE(FoundExact);
+}
+TEST(InstModificationIRStrategy, FastMath) {
+  LLVMContext Ctx;
+  StringRef Source = "\n\
+      declare [4 x <4 x double>] @vecdouble(double)  \n\
+      define double @test(i1 %C, double %a, double %b) {  \n\
+      Entry:  \n\
+        br i1 %C, label %True, label %False  \n\
+      True:  \n\
+        br label %Exit  \n\
+      False:  \n\
+        br label %Exit  \n\
+      Exit:  \n\
+        %PHIi32 = phi i32 [1, %True], [2, %False]  \n\
+        %PHIdouble = phi double [%a, %True], [%b, %False]  \n\
+        %Call = call [4 x <4 x double>] @vecdouble(double %PHIdouble)  \n\
+        %c = fneg double %PHIdouble  \n\
+        %s = select i1 %C, double %a, double %b  \n\
+        %d = fadd double %s, %c  \n\
+        ret double %d \n\
+      }";
+
+  auto Mutator = createMutator<InstModificationIRStrategy>();
+  ASSERT_TRUE(Mutator);
+
+  std::unique_ptr<Module> M = parseAssembly(Source.data(), Ctx);
+  std::mt19937 mt(Seed);
+  std::uniform_int_distribution<int> RandInt(INT_MIN, INT_MAX);
+  DenseMap<Instruction *, bool> FPOpsHasFastMath;
+  for (auto &F : *M) {
+    for (auto &BB : F) {
+      for (auto &I : BB) {
+        Type *Ty = I.getType();
+        if (Ty->isFPOrFPVectorTy() || Ty->isArrayTy()) {
+          FPOpsHasFastMath[&I] = false;
+        }
+      }
+    }
+  }
+  ASSERT_TRUE(M && !verifyModule(*M, &errs()));
+  for (int i = 0; i < 300; ++i) {
+    Mutator->mutateModule(*M, RandInt(mt), Source.size(), Source.size() + 100);
+    for (auto p : FPOpsHasFastMath)
+      FPOpsHasFastMath[p.first] |= p.first->getFastMathFlags().any();
+    ASSERT_FALSE(verifyModule(*M, &errs()));
+  }
+  for (auto p : FPOpsHasFastMath)
+    ASSERT_TRUE(p.second);
+}
 
 TEST(InsertPHIStrategy, PHI) {
   LLVMContext Ctx;
   StringRef Source = "\n\
         define void @test(i1 %C1, i1 %C2, i32 %I, double %FP) { \n\
         Entry:  \n\
           %C = and i1 %C1, %C2 \n\
           br i1 %C, label %LoopHead, label %Exit \n\