[FuzzMutate] InstModificationStrategy, add FastMath flags and exact flags to instructions.

[Peter]

Summary

I think there are more attributes, flags we can add to call, functions declarations and global variables. Let's start with these two flags.

[arsenm]

llvm/lib/FuzzMutate/IRMutator.cpp

222–224

I don't know exactly how the fuzz argument works, but won't these interfere? Setting all is superfluous with setting every individual flag

llvm/unittests/FuzzMutate/StrategiesTest.cpp

330

Separate ASSERT_TRUE for each

354

Do we even allow fmf on arrays of vectors?

368–374

Missing paces. Can you also reduce the indentation level by factoring out the innermost loop or something?

[Peter]

1. fix indentation
2. remove the probability where we repeatedly setting the same thing.

llvm/lib/FuzzMutate/IRMutator.cpp

222–224

Yes, setting all is superfluous. I removed the repeated part, now we are only flipping the setting. (So we don't set true to ture).

It takes a lot of mutations to set(or unset) every flag, so I think its a good idea that we keep an option to set everything at once.

llvm/unittests/FuzzMutate/StrategiesTest.cpp

354

https://godbolt.org/z/nGarYT6Ef

I think we do. The documentation (for call, phi, and select) says "that return a floating-point scalar or vector type, or an array (nested to any depth) of floating-point scalar or vector types", and llc is not complaining about this.

[arsenm]

llvm/lib/FuzzMutate/IRMutator.cpp

251–252

Why don't these do the set the opposite value like the fmf? Same for the existing GEP case (if you want to change the GEP case, do it in a separate change)

265–276

You can dyn_cast to FPMathOperator to get all fast math flag compatible operations without maintaining the instruction list

[Peter]

fliping isExact as well. Using isa<FPMathOperator>(&Inst) to do test if FastMath is compatable.

[Peter]

llvm/lib/FuzzMutate/IRMutator.cpp

265–276

I didn't know FPMathOperator can work on call inst. Thanks for pointing out.

llvm/lib/FuzzMutate/IRMutator.cpp

 #include "llvm/ADT/SmallSet.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/Bitcode/BitcodeReader.h"
 #include "llvm/Bitcode/BitcodeWriter.h"
 #include "llvm/FuzzMutate/Operations.h"
 #include "llvm/FuzzMutate/Random.h"
 #include "llvm/FuzzMutate/RandomIRBuilder.h"
 #include "llvm/IR/BasicBlock.h"
+#include "llvm/IR/FMF.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/InstIterator.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/Module.h"
+#include "llvm/IR/Operator.h"
 #include "llvm/IR/Verifier.h"
 #include "llvm/Support/MemoryBuffer.h"
 #include "llvm/Support/SourceMgr.h"
 #include "llvm/Transforms/Scalar/DCE.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
 
 using namespace llvm;
 

 void InstModificationIRStrategy::mutate(Instruction &Inst,
                                         RandomIRBuilder &IB) {
   SmallVector<std::function<void()>, 8> Modifications;
   CmpInst *CI = nullptr;
   GetElementPtrInst *GEP = nullptr;
   switch (Inst.getOpcode()) {
   default:
     break;
+  // Add nsw, nuw flag
   case Instruction::Add:
   case Instruction::Mul:
   case Instruction::Sub:
   case Instruction::Shl:
     Modifications.push_back([&Inst]() { Inst.setHasNoSignedWrap(true); });
     Modifications.push_back([&Inst]() { Inst.setHasNoSignedWrap(false); });
     Modifications.push_back([&Inst]() { Inst.setHasNoUnsignedWrap(true); });
     Modifications.push_back([&Inst]() { Inst.setHasNoUnsignedWrap(false); });
-
     break;
   case Instruction::ICmp:
     CI = cast<ICmpInst>(&Inst);
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_EQ); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_NE); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_UGT); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_UGE); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_ULT); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_ULE); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SGT); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SGE); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SLT); });
-    Modifications.push_back([CI]() { CI->setPredicate(CmpInst::ICMP_SLE); });
+    for (unsigned p = CmpInst::FIRST_ICMP_PREDICATE;
+         p <= CmpInst::LAST_ICMP_PREDICATE; p++) {
+      Modifications.push_back(
+          [CI, p]() { CI->setPredicate(static_cast<CmpInst::Predicate>(p)); });
+    }
     break;
+  // Add inbound flag.
   case Instruction::GetElementPtr:
     GEP = cast<GetElementPtrInst>(&Inst);
     Modifications.push_back([GEP]() { GEP->setIsInBounds(true); });
     Modifications.push_back([GEP]() { GEP->setIsInBounds(false); });
     break;
+  // Add exact flag.
+  case Instruction::UDiv:
+  case Instruction::SDiv:
+  case Instruction::LShr:
+  case Instruction::AShr:
+    Modifications.push_back([&Inst] { Inst.setIsExact(!Inst.isExact()); });
+    break;
+
+  case Instruction::FCmp:
+    CI = cast<ICmpInst>(&Inst);
+    for (unsigned p = CmpInst::FIRST_FCMP_PREDICATE;
+         p <= CmpInst::LAST_FCMP_PREDICATE; p++) {
+      Modifications.push_back(
+          [CI, p]() { CI->setPredicate(static_cast<CmpInst::Predicate>(p)); });
+    }
+    break;
+  }
+
+  // Add fast math flag if possible.
+  if (isa<FPMathOperator>(&Inst)) {
+    // Try setting everything unless they are already on.
+    Modifications.push_back(
+        [&Inst] { Inst.setFast(!Inst.getFastMathFlags().all()); });
+    // Try unsetting everything unless they are already off.
+    Modifications.push_back(
+        [&Inst] { Inst.setFast(!Inst.getFastMathFlags().none()); });
+    // Individual setting by flipping the bit
+    Modifications.push_back(
+        [&Inst] { Inst.setHasAllowReassoc(!Inst.hasAllowReassoc()); });
+    Modifications.push_back([&Inst] { Inst.setHasNoNaNs(!Inst.hasNoNaNs()); });
+    Modifications.push_back([&Inst] { Inst.setHasNoInfs(!Inst.hasNoInfs()); });
+    Modifications.push_back(
+        [&Inst] { Inst.setHasNoSignedZeros(!Inst.hasNoSignedZeros()); });
+    Modifications.push_back(
+        [&Inst] { Inst.setHasAllowReciprocal(!Inst.hasAllowReciprocal()); });
+    Modifications.push_back(
+        [&Inst] { Inst.setHasAllowContract(!Inst.hasAllowContract()); });
+    Modifications.push_back(
+        [&Inst] { Inst.setHasApproxFunc(!Inst.hasApproxFunc()); });
   }
 
   // Randomly switch operands of instructions
   std::pair<int, int> NoneItem({-1, -1}), ShuffleItems(NoneItem);
   switch (Inst.getOpcode()) {
   case Instruction::SDiv:
   case Instruction::UDiv:
   case Instruction::SRem:

llvm/unittests/FuzzMutate/StrategiesTest.cpp

 //===- InjectorIRStrategyTest.cpp - Tests for injector strategy -----------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/AsmParser/Parser.h"
 #include "llvm/AsmParser/SlotMapping.h"
 #include "llvm/FuzzMutate/IRMutator.h"
 #include "llvm/FuzzMutate/Operations.h"
 #include "llvm/FuzzMutate/RandomIRBuilder.h"
+#include "llvm/IR/FMF.h"
 #include "llvm/IR/Instructions.h"
 #include "llvm/IR/LLVMContext.h"
 #include "llvm/IR/Module.h"
 #include "llvm/IR/Verifier.h"
 #include "llvm/Support/SourceMgr.h"
 #include <random>
 
 #include "gtest/gtest.h"
void VerfyOperandShuffled(StringRef Source, std::pair<int, int> ShuffleItems) {
   Instruction *Inst = &*F.begin()->begin();
   ASSERT_TRUE(M && !verifyModule(*M, &errs()));
   ASSERT_TRUE(Inst->getOperand(ShuffleItems.first) ==
               dyn_cast<Value>(F.getArg(ShuffleItems.first)));
   ASSERT_TRUE(Inst->getOperand(ShuffleItems.second) ==
               dyn_cast<Value>(F.getArg(ShuffleItems.second)));
 
   Mutator->mutateModule(*M, 0, Source.size(), Source.size() + 100);
-  EXPECT_TRUE(!verifyModule(*M, &errs()));
+  ASSERT_TRUE(!verifyModule(*M, &errs()));
 
-  EXPECT_TRUE(Inst->getOperand(ShuffleItems.first) ==
+  ASSERT_TRUE(Inst->getOperand(ShuffleItems.first) ==
               dyn_cast<Value>(F.getArg(ShuffleItems.second)));
-  EXPECT_TRUE(Inst->getOperand(ShuffleItems.second) ==
+  ASSERT_TRUE(Inst->getOperand(ShuffleItems.second) ==
               dyn_cast<Value>(F.getArg(ShuffleItems.first)));
 }
 
-TEST(InstModificationIRStrategyTest, ShuffleFAdd) {
+TEST(InstModificationIRStrategyTest, ShuffleAnd) {
   StringRef Source = "\n\
-      define float @test(float %0, float %1) {\n\
-        %add = fadd float %0, %1\n\
-        ret float %add\n\
+      define i32 @test(i32 %0, i32 %1) {\n\
+        %add = and i32 %0, %1\n\
+        ret i32 %add\n\
       }";
   VerfyOperandShuffled(Source, {0, 1});
 }
 TEST(InstModificationIRStrategyTest, ShuffleSelect) {
   StringRef Source = "\n\
-      define float @test(i1 %0, float %1, float %2) {\n\
-        %select = select i1 %0, float %1, float %2\n\
-        ret float %select\n\
+      define i32 @test(i1 %0, i32 %1, i32 %2) {\n\
+        %select = select i1 %0, i32 %1, i32 %2\n\
+        ret i32 %select\n\
       }";
   VerfyOperandShuffled(Source, {1, 2});
 }
 
 void VerfyDivDidntShuffle(StringRef Source) {
   LLVMContext Ctx;
   auto Mutator = createMutator<InstModificationIRStrategy>();
   ASSERT_TRUE(Mutator);

 TEST(InstModificationIRStrategyTest, DidntShuffleFRem) {
   StringRef Source = "\n\
       define <2 x double> @test(<2 x double> %0) {\n\
         %div = frem <2 x double> <double 0.0, double 0.0>, %0\n\
         ret <2 x double> %div\n\
       }";
   VerfyDivDidntShuffle(Source);
 }
+TEST(InstModificationIRStrategy, Exact) {
+  LLVMContext Ctx;
+  StringRef Source = "\n\
+      define i32 @test(i32 %a, i32 %b) {\n\
+        %c = ashr i32 %a, %b \n\
+        ret i32 %c\n\
+      }";
+
+  auto Mutator = createMutator<InstModificationIRStrategy>();
+  ASSERT_TRUE(Mutator);
+
+  std::unique_ptr<Module> M = parseAssembly(Source.data(), Ctx);
+  std::mt19937 mt(Seed);
+  std::uniform_int_distribution<int> RandInt(INT_MIN, INT_MAX);
+  auto &F = *M->begin();
+  BinaryOperator *AShr = cast<BinaryOperator>(&*F.begin()->begin());
+  bool FoundExact = false;
+  for (int i = 0; i < 100; ++i) {
+    Mutator->mutateModule(*M, RandInt(mt), Source.size(), Source.size() + 100);
+    ASSERT_FALSE(verifyModule(*M, &errs()));
+    FoundExact |= AShr->isExact();
+  }
+
+  EXPECT_TRUE(FoundExact);
+}
+TEST(InstModificationIRStrategy, FastMath) {
+  LLVMContext Ctx;
+  StringRef Source = "\n\
+      declare [4 x <4 x double>] @vecdouble(double)  \n\
+      define double @test(i1 %C, double %a, double %b) {  \n\
+      Entry:  \n\
+        br i1 %C, label %True, label %False  \n\
+      True:  \n\
+        br label %Exit  \n\
+      False:  \n\
+        br label %Exit  \n\
+      Exit:  \n\
+        %PHIi32 = phi i32 [1, %True], [2, %False]  \n\
+        %PHIdouble = phi double [%a, %True], [%b, %False]  \n\
+        %Call = call [4 x <4 x double>] @vecdouble(double %PHIdouble)  \n\
+        %c = fneg double %PHIdouble  \n\
+        %s = select i1 %C, double %a, double %b  \n\
+        %d = fadd double %s, %c  \n\
+        ret double %d \n\
+      }";
+
+  auto Mutator = createMutator<InstModificationIRStrategy>();
+  ASSERT_TRUE(Mutator);
+
+  std::unique_ptr<Module> M = parseAssembly(Source.data(), Ctx);
+  std::mt19937 mt(Seed);
+  std::uniform_int_distribution<int> RandInt(INT_MIN, INT_MAX);
+  DenseMap<Instruction *, bool> FPOpsHasFastMath;
+  for (auto &F : *M) {
+    for (auto &BB : F) {
+      for (auto &I : BB) {
+        Type *Ty = I.getType();
+        if (Ty->isFPOrFPVectorTy() || Ty->isArrayTy()) {
+          FPOpsHasFastMath[&I] = false;
+        }
+      }
+    }
+  }
+  ASSERT_TRUE(M && !verifyModule(*M, &errs()));
+  for (int i = 0; i < 300; ++i) {
+    Mutator->mutateModule(*M, RandInt(mt), Source.size(), Source.size() + 100);
+    for (auto p : FPOpsHasFastMath)
+      FPOpsHasFastMath[p.first] |= p.first->getFastMathFlags().any();
+    ASSERT_FALSE(verifyModule(*M, &errs()));
+  }
+  for (auto p : FPOpsHasFastMath)
+    ASSERT_TRUE(p.second);
+}
 
 template <class Strategy>
 static void mutateAndVerifyModule(StringRef Source, int repeat = 100) {
   LLVMContext Ctx;
   auto Mutator = createMutator<Strategy>();
   ASSERT_TRUE(Mutator);
 
   auto M = parseAssembly(Source.data(), Ctx);