[FuzzMutate] introduce vector operations, select and fneg into InstInjectorStrategy

[arsenm]

llvm/include/llvm/FuzzMutate/OpDescriptor.h

95–106

This is just Type::getScalarType

104

No need for make

125–133

This is just Ty->isIntOrIntVectorTy(1)

144

Ty->isFPOrFPVectorTy()

194

no else after return

209

Pretty sure those don't exist. Closest would be vectors in arrays, which I don't think support arithmetic operations

llvm/unittests/FuzzMutate/StrategiesTest.cpp

37–38

The odd sizes, particularly 1 and 3, are most likely to break something

[Peter]

use API provided by Type

[Peter]

llvm/include/llvm/FuzzMutate/OpDescriptor.h

125–133

With the API you mentioned, (really helpful btw), I think I'll remove anyXorVecX for now, they won't come back until I finish bitcast instructions, which is so complicated I have to put it in a stand alone patch.

[Peter]

@arsenm Hey Matt, does these changes look good to you? If so we can merge it, I have some more patches depending on this one. I am hoping we can get these patches out so to better help fuzzing in the community. :)

[Peter]

@arsenm Hi Matt, Would you mind spend some time and review this patch?

[arsenm]

llvm/include/llvm/FuzzMutate/OpDescriptor.h

190–191

Separate declaration statements with dyn_cast?

192

Usual style is to not include the explicit nullptr comparisons throughout here

207

Do you mean VectorType::isValidElementType?

llvm/unittests/FuzzMutate/OperationsTest.cpp

189

Add some tests with scalable vectors, and vectors of pointers

[Peter]

Add more tests.

llvm/include/llvm/FuzzMutate/OpDescriptor.h

 
 #ifndef LLVM_FUZZMUTATE_OPDESCRIPTOR_H
 #define LLVM_FUZZMUTATE_OPDESCRIPTOR_H
 
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/DerivedTypes.h"
+#include "llvm/IR/InstrTypes.h"
 #include "llvm/IR/Type.h"
 #include "llvm/IR/Value.h"
 #include <functional>
 
 namespace llvm {
 class Instruction;
 namespace fuzzerop {
 

 
 /// A description of some operation we can build while fuzzing IR.
 struct OpDescriptor {
   unsigned Weight;
   SmallVector<SourcePred, 2> SourcePreds;
   std::function<Value *(ArrayRef<Value *>, Instruction *)> BuilderFunc;
 };
 
 static inline SourcePred onlyType(Type *Only) {
   auto Pred = [Only](ArrayRef<Value *>, const Value *V) {
     return V->getType() == Only;
   };
   auto Make = [Only](ArrayRef<Value *>, ArrayRef<Type *>) {
     return makeConstantsWithType(Only);
   };
   return {Pred, Make};
 }
 
 static inline SourcePred anyType() {
   auto Pred = [](ArrayRef<Value *>, const Value *V) {
     return !V->getType()->isVoidTy();
   };
   auto Make = std::nullopt;
   return {Pred, Make};
 }
 
 static inline SourcePred anyIntType() {
   auto Pred = [](ArrayRef<Value *>, const Value *V) {
     return V->getType()->isIntegerTy();
   };
   auto Make = std::nullopt;
   return {Pred, Make};
 }
 
+static inline SourcePred anyIntOrVecIntType() {
+  auto Pred = [](ArrayRef<Value *>, const Value *V) {
+    return V->getType()->isIntOrIntVectorTy();
+  };
+  return {Pred, std::nullopt};
+}
+
+static inline SourcePred boolOrVecBoolType() {
+  auto Pred = [](ArrayRef<Value *>, const Value *V) {
+    return V->getType()->isIntOrIntVectorTy(1);
+  };
+  return {Pred, std::nullopt};
+}
+
 static inline SourcePred anyFloatType() {
   auto Pred = [](ArrayRef<Value *>, const Value *V) {
     return V->getType()->isFloatingPointTy();
   };
   auto Make = std::nullopt;
   return {Pred, Make};
 }
 
+static inline SourcePred anyFloatOrVecFloatType() {
+  auto Pred = [](ArrayRef<Value *>, const Value *V) {
+    return V->getType()->isFPOrFPVectorTy();
+  };
+  return {Pred, std::nullopt};
+}
+
 static inline SourcePred anyPtrType() {
   auto Pred = [](ArrayRef<Value *>, const Value *V) {
     return V->getType()->isPointerTy() && !V->isSwiftError();
   };
   auto Make = [](ArrayRef<Value *>, ArrayRef<Type *> Ts) {
     std::vector<Constant *> Result;
     // TODO: Should these point at something?
     for (Type *T : Ts)
for (Type *T : Ts)
       if (T->isSized())
         Result.push_back(UndefValue::get(PointerType::getUnqual(T)));
 
     return Result;
   };
   return {Pred, Make};
 }
 
+static inline SourcePred matchFirstLengthWAnyType() {
+  auto Pred = [](ArrayRef<Value *> Cur, const Value *V) {
+    assert(!Cur.empty() && "No first source yet");
+    Type *This = V->getType(), *First = Cur[0]->getType();
+    VectorType *ThisVec = dyn_cast<VectorType>(This);
+    VectorType *FirstVec = dyn_cast<VectorType>(First);
+    if (ThisVec && FirstVec) {
+      return ThisVec->getElementCount() == FirstVec->getElementCount();
+    }
+    return (ThisVec == nullptr) && (FirstVec == nullptr) && (!This->isVoidTy());
+  };
+  auto Make = [](ArrayRef<Value *> Cur, ArrayRef<Type *> BaseTypes) {
+    assert(!Cur.empty() && "No first source yet");
+    std::vector<Constant *> Result;
+    ElementCount EC;
+    bool isVec = false;
+    if (VectorType *VecTy = dyn_cast<VectorType>(Cur[0]->getType())) {
+      EC = VecTy->getElementCount();
+      isVec = true;
+    }
+    for (Type *T : BaseTypes) {
+      if (VectorType::isValidElementType(T)) {
+        if (isVec)
+          // If the first pred is <i1 x N>, make the result <T x N>
+          makeConstantsWithType(VectorType::get(T, EC), Result);
+        else
+          makeConstantsWithType(T, Result);
+      }
+    }
+    assert(!Result.empty() && "No potential constants.");
+    return Result;
+  };
+  return {Pred, Make};
+}
+
+/// Match values that have the same type as the first source.
+static inline SourcePred matchSecondType() {
+  auto Pred = [](ArrayRef<Value *> Cur, const Value *V) {
+    assert((Cur.size() > 1) && "No second source yet");
+    return V->getType() == Cur[1]->getType();
+  };
+  auto Make = [](ArrayRef<Value *> Cur, ArrayRef<Type *>) {
+    assert((Cur.size() > 1) && "No second source yet");
+    return makeConstantsWithType(Cur[1]->getType());
+  };
+  return {Pred, Make};
+}
+
 static inline SourcePred anyAggregateType() {
   auto Pred = [](ArrayRef<Value *>, const Value *V) {
     // We can't index zero sized arrays.
     if (isa<ArrayType>(V->getType()))
       return V->getType()->getArrayNumElements() > 0;
 
     // Structs can also be zero sized. I.e opaque types.
     if (isa<StructType>(V->getType()))

llvm/include/llvm/FuzzMutate/Operations.h

 /// Getters for the default sets of operations, per general category.
 /// @{
 void describeFuzzerIntOps(std::vector<fuzzerop::OpDescriptor> &Ops);
 void describeFuzzerFloatOps(std::vector<fuzzerop::OpDescriptor> &Ops);
 void describeFuzzerControlFlowOps(std::vector<fuzzerop::OpDescriptor> &Ops);
 void describeFuzzerPointerOps(std::vector<fuzzerop::OpDescriptor> &Ops);
 void describeFuzzerAggregateOps(std::vector<fuzzerop::OpDescriptor> &Ops);
 void describeFuzzerVectorOps(std::vector<fuzzerop::OpDescriptor> &Ops);
+void describeFuzzerUnaryOperations(std::vector<fuzzerop::OpDescriptor> &Ops);
+void describeFuzzerOtherOps(std::vector<fuzzerop::OpDescriptor> &Ops);
 /// @}
 
 namespace fuzzerop {
 
 /// Descriptors for individual operations.
 /// @{
+OpDescriptor selectDescriptor(unsigned Weight);
+OpDescriptor fnegDescriptor(unsigned Weight);
 OpDescriptor binOpDescriptor(unsigned Weight, Instruction::BinaryOps Op);
 OpDescriptor cmpOpDescriptor(unsigned Weight, Instruction::OtherOps CmpOp,
                              CmpInst::Predicate Pred);
 OpDescriptor splitBlockDescriptor(unsigned Weight);
 OpDescriptor gepDescriptor(unsigned Weight);
 OpDescriptor extractValueDescriptor(unsigned Weight);
 OpDescriptor insertValueDescriptor(unsigned Weight);
 OpDescriptor extractElementDescriptor(unsigned Weight);
 OpDescriptor insertElementDescriptor(unsigned Weight);
 OpDescriptor shuffleVectorDescriptor(unsigned Weight);
+
 /// @}
 
 } // namespace fuzzerop
 
 } // namespace llvm
 
 #endif // LLVM_FUZZMUTATE_OPERATIONS_H

llvm/lib/FuzzMutate/OpDescriptor.cpp

 #include "llvm/IR/Constants.h"
 
 using namespace llvm;
 using namespace fuzzerop;
 
 void fuzzerop::makeConstantsWithType(Type *T, std::vector<Constant *> &Cs) {
   if (auto *IntTy = dyn_cast<IntegerType>(T)) {
     uint64_t W = IntTy->getBitWidth();
+    Cs.push_back(ConstantInt::get(IntTy, 0));
+    Cs.push_back(ConstantInt::get(IntTy, 1));
+    Cs.push_back(ConstantInt::get(IntTy, 42));
     Cs.push_back(ConstantInt::get(IntTy, APInt::getMaxValue(W)));
     Cs.push_back(ConstantInt::get(IntTy, APInt::getMinValue(W)));
     Cs.push_back(ConstantInt::get(IntTy, APInt::getSignedMaxValue(W)));
     Cs.push_back(ConstantInt::get(IntTy, APInt::getSignedMinValue(W)));
     Cs.push_back(ConstantInt::get(IntTy, APInt::getOneBitSet(W, W / 2)));
   } else if (T->isFloatingPointTy()) {
     auto &Ctx = T->getContext();
     auto &Sem = T->getFltSemantics();
     Cs.push_back(ConstantFP::get(Ctx, APFloat::getZero(Sem)));
+    Cs.push_back(ConstantFP::get(Ctx, APFloat(Sem, 1)));
+    Cs.push_back(ConstantFP::get(Ctx, APFloat(Sem, 42)));
     Cs.push_back(ConstantFP::get(Ctx, APFloat::getLargest(Sem)));
     Cs.push_back(ConstantFP::get(Ctx, APFloat::getSmallest(Sem)));
-  } else
+    Cs.push_back(ConstantFP::get(Ctx, APFloat::getInf(Sem)));
+    Cs.push_back(ConstantFP::get(Ctx, APFloat::getNaN(Sem)));
+  } else if (VectorType *VecTy = dyn_cast<VectorType>(T)) {
+    std::vector<Constant *> EleCs;
+    Type *EltTy = VecTy->getElementType();
+    makeConstantsWithType(EltTy, EleCs);
+    ElementCount EC = VecTy->getElementCount();
+    for (Constant *Elt : EleCs) {
+      Cs.push_back(ConstantVector::getSplat(EC, Elt));
+    }
+  } else {
     Cs.push_back(UndefValue::get(T));
+    Cs.push_back(PoisonValue::get(T));
+  }
 }
 
 std::vector<Constant *> fuzzerop::makeConstantsWithType(Type *T) {
   std::vector<Constant *> Result;
   makeConstantsWithType(T, Result);
   return Result;
 }

llvm/lib/FuzzMutate/Operations.cpp

void llvm::describeFuzzerFloatOps(std::vector<fuzzerop::OpDescriptor> &Ops) {
   Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_UGT));
   Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_UGE));
   Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_ULT));
   Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_ULE));
   Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_UNE));
   Ops.push_back(cmpOpDescriptor(1, Instruction::FCmp, CmpInst::FCMP_TRUE));
 }
 
+void llvm::describeFuzzerUnaryOperations(
+    std::vector<fuzzerop::OpDescriptor> &Ops) {
+  Ops.push_back(fnegDescriptor(1));
+}
+
 void llvm::describeFuzzerControlFlowOps(
     std::vector<fuzzerop::OpDescriptor> &Ops) {
   Ops.push_back(splitBlockDescriptor(1));
 }
 
+void llvm::describeFuzzerOtherOps(std::vector<fuzzerop::OpDescriptor> &Ops) {
+  Ops.push_back(selectDescriptor(1));
+}
+
 void llvm::describeFuzzerPointerOps(std::vector<fuzzerop::OpDescriptor> &Ops) {
   Ops.push_back(gepDescriptor(1));
 }
 
 void llvm::describeFuzzerAggregateOps(
     std::vector<fuzzerop::OpDescriptor> &Ops) {
   Ops.push_back(extractValueDescriptor(1));
   Ops.push_back(insertValueDescriptor(1));
 }
 
 void llvm::describeFuzzerVectorOps(std::vector<fuzzerop::OpDescriptor> &Ops) {
   Ops.push_back(extractElementDescriptor(1));
   Ops.push_back(insertElementDescriptor(1));
   Ops.push_back(shuffleVectorDescriptor(1));
 }
 
+OpDescriptor llvm::fuzzerop::selectDescriptor(unsigned Weight) {
+  auto buildOp = [](ArrayRef<Value *> Srcs, Instruction *Inst) {
+    return SelectInst::Create(Srcs[0], Srcs[1], Srcs[2], "S", Inst);
+  };
+  return {Weight,
+          {boolOrVecBoolType(), matchFirstLengthWAnyType(), matchSecondType()},
+          buildOp};
+}
+
+OpDescriptor llvm::fuzzerop::fnegDescriptor(unsigned Weight) {
+  auto buildOp = [](ArrayRef<Value *> Srcs, Instruction *Inst) {
+    return UnaryOperator::Create(Instruction::FNeg, Srcs[0], "F", Inst);
+  };
+  return {Weight, {anyFloatOrVecFloatType()}, buildOp};
+}
+
 OpDescriptor llvm::fuzzerop::binOpDescriptor(unsigned Weight,
                                              Instruction::BinaryOps Op) {
   auto buildOp = [Op](ArrayRef<Value *> Srcs, Instruction *Inst) {
     return BinaryOperator::Create(Op, Srcs[0], Srcs[1], "B", Inst);
   };
   switch (Op) {
   case Instruction::Add:
   case Instruction::Sub:
   case Instruction::Mul:
   case Instruction::SDiv:
   case Instruction::UDiv:
   case Instruction::SRem:
   case Instruction::URem:
   case Instruction::Shl:
   case Instruction::LShr:
   case Instruction::AShr:
   case Instruction::And:
   case Instruction::Or:
   case Instruction::Xor:
-    return {Weight, {anyIntType(), matchFirstType()}, buildOp};
+    return {Weight, {anyIntOrVecIntType(), matchFirstType()}, buildOp};
   case Instruction::FAdd:
   case Instruction::FSub:
   case Instruction::FMul:
   case Instruction::FDiv:
   case Instruction::FRem:
-    return {Weight, {anyFloatType(), matchFirstType()}, buildOp};
+    return {Weight, {anyFloatOrVecFloatType(), matchFirstType()}, buildOp};
   case Instruction::BinaryOpsEnd:
     llvm_unreachable("Value out of range of enum");
   }
   llvm_unreachable("Covered switch");
 }
 
 OpDescriptor llvm::fuzzerop::cmpOpDescriptor(unsigned Weight,
                                              Instruction::OtherOps CmpOp,
                                              CmpInst::Predicate Pred) {
   auto buildOp = [CmpOp, Pred](ArrayRef<Value *> Srcs, Instruction *Inst) {
     return CmpInst::Create(CmpOp, Pred, Srcs[0], Srcs[1], "C", Inst);
   };
 
   switch (CmpOp) {
   case Instruction::ICmp:
-    return {Weight, {anyIntType(), matchFirstType()}, buildOp};
+    return {Weight, {anyIntOrVecIntType(), matchFirstType()}, buildOp};
   case Instruction::FCmp:
-    return {Weight, {anyFloatType(), matchFirstType()}, buildOp};
+    return {Weight, {anyFloatOrVecFloatType(), matchFirstType()}, buildOp};
   default:
     llvm_unreachable("CmpOp must be ICmp or FCmp");
   }
 }
 
 OpDescriptor llvm::fuzzerop::splitBlockDescriptor(unsigned Weight) {
   auto buildSplitBlock = [](ArrayRef<Value *> Srcs, Instruction *Inst) {
     BasicBlock *Block = Inst->getParent();

llvm/unittests/FuzzMutate/OperationsTest.cpp

TEST(OperationsTest, SourcePreds) {
   Constant *i64 = ConstantInt::get(Type::getInt64Ty(Ctx),
                                    std::numeric_limits<uint64_t>::max());
   Constant *f16 = ConstantFP::getInfinity(Type::getHalfTy(Ctx));
   Constant *f32 = ConstantFP::get(Type::getFloatTy(Ctx), 0.0);
   Constant *f64 = ConstantFP::get(Type::getDoubleTy(Ctx), 123.45);
   Constant *s = ConstantStruct::get(StructType::create(Ctx, "OpaqueStruct"));
   Constant *a =
       ConstantArray::get(ArrayType::get(i32->getType(), 2), {i32, i32});
+  Constant *v8i1 = ConstantVector::getSplat(ElementCount::getFixed(8), i1);
   Constant *v8i8 = ConstantVector::getSplat(ElementCount::getFixed(8), i8);
   Constant *v4f16 = ConstantVector::getSplat(ElementCount::getFixed(4), f16);
   Constant *p0i32 =
       ConstantPointerNull::get(PointerType::get(i32->getType(), 0));
+  Constant *v8p0i32 =
+      ConstantVector::getSplat(ElementCount::getFixed(8), p0i32);
+  Constant *vni32 = ConstantVector::getSplat(ElementCount::getScalable(8), i32);
+  Constant *vnf64 = ConstantVector::getSplat(ElementCount::getScalable(8), f64);
+  Constant *vnp0i32 =
+      ConstantVector::getSplat(ElementCount::getScalable(8), p0i32);
 
   auto OnlyI32 = onlyType(i32->getType());
   EXPECT_TRUE(OnlyI32.matches({}, i32));
   EXPECT_FALSE(OnlyI32.matches({}, i64));
   EXPECT_FALSE(OnlyI32.matches({}, p0i32));
   EXPECT_FALSE(OnlyI32.matches({}, a));
 
   EXPECT_THAT(OnlyI32.generate({}, {}),
TEST(OperationsTest, SourcePreds) {
   EXPECT_TRUE(AnyInt.matches({}, i64));
   EXPECT_FALSE(AnyInt.matches({}, f32));
   EXPECT_FALSE(AnyInt.matches({}, v4f16));
 
   EXPECT_THAT(
       AnyInt.generate({}, {i32->getType(), f16->getType(), v8i8->getType()}),
       AllOf(SizeIs(Ge(1u)), Each(TypesMatch(i32))));
 
+  auto AnyIntOrVecInt = anyIntOrVecIntType();
+  EXPECT_TRUE(AnyIntOrVecInt.matches({}, i1));
+  EXPECT_TRUE(AnyIntOrVecInt.matches({}, i64));
+  EXPECT_FALSE(AnyIntOrVecInt.matches({}, f32));
+  EXPECT_FALSE(AnyIntOrVecInt.matches({}, v4f16));
+  EXPECT_TRUE(AnyIntOrVecInt.matches({}, v8i8));
+  EXPECT_FALSE(AnyIntOrVecInt.matches({}, v4f16));
+  EXPECT_FALSE(AnyIntOrVecInt.matches({}, v8p0i32));
+  EXPECT_TRUE(AnyIntOrVecInt.matches({}, vni32));
+  EXPECT_FALSE(AnyIntOrVecInt.matches({}, vnf64));
+  EXPECT_FALSE(AnyIntOrVecInt.matches({}, vnp0i32));
+
+  EXPECT_THAT(AnyIntOrVecInt.generate({}, {v8i8->getType()}),
+              AllOf(Each(TypesMatch(v8i8))));
+
+  auto BoolOrVecBool = boolOrVecBoolType();
+  EXPECT_TRUE(BoolOrVecBool.matches({}, i1));
+  EXPECT_FALSE(BoolOrVecBool.matches({}, i64));
+  EXPECT_FALSE(BoolOrVecBool.matches({}, f32));
+  EXPECT_FALSE(BoolOrVecBool.matches({}, v4f16));
+  EXPECT_TRUE(BoolOrVecBool.matches({}, v8i1));
+  EXPECT_FALSE(BoolOrVecBool.matches({}, v4f16));
+  EXPECT_FALSE(BoolOrVecBool.matches({}, v8p0i32));
+  EXPECT_FALSE(BoolOrVecBool.matches({}, vni32));
+  EXPECT_FALSE(BoolOrVecBool.matches({}, vnf64));
+  EXPECT_FALSE(BoolOrVecBool.matches({}, vnp0i32));
+
+  EXPECT_THAT(BoolOrVecBool.generate({}, {v8i8->getType(), v8i1->getType()}),
+              AllOf(Each(TypesMatch(v8i1))));
+
   auto AnyFP = anyFloatType();
   EXPECT_TRUE(AnyFP.matches({}, f16));
   EXPECT_TRUE(AnyFP.matches({}, f32));
   EXPECT_FALSE(AnyFP.matches({}, i16));
   EXPECT_FALSE(AnyFP.matches({}, p0i32));
   EXPECT_FALSE(AnyFP.matches({}, v4f16));
 
   EXPECT_THAT(
       AnyFP.generate({}, {i32->getType(), f16->getType(), v8i8->getType()}),
       AllOf(SizeIs(Ge(1u)), Each(TypesMatch(f16))));
 
+  auto AnyFPOrVecFP = anyFloatOrVecFloatType();
+  EXPECT_TRUE(AnyFPOrVecFP.matches({}, f16));
+  EXPECT_TRUE(AnyFPOrVecFP.matches({}, f32));
+  EXPECT_FALSE(AnyFPOrVecFP.matches({}, i16));
+  EXPECT_FALSE(AnyFPOrVecFP.matches({}, p0i32));
+  EXPECT_TRUE(AnyFPOrVecFP.matches({}, v4f16));
+  EXPECT_FALSE(AnyFPOrVecFP.matches({}, v8p0i32));
+  EXPECT_FALSE(AnyFPOrVecFP.matches({}, vni32));
+  EXPECT_TRUE(AnyFPOrVecFP.matches({}, vnf64));
+  EXPECT_FALSE(AnyFPOrVecFP.matches({}, vnp0i32));
+
+  EXPECT_THAT(AnyFPOrVecFP.generate(
+                  {}, {i32->getType(), f16->getType(), v8i8->getType()}),
+              AllOf(SizeIs(Ge(1u)), Each(TypesMatch(f16))));
+  EXPECT_THAT(AnyFPOrVecFP.generate({}, {v4f16->getType()}),
+              AllOf(SizeIs(Ge(1u)), Each(TypesMatch(v4f16))));
+
   auto AnyPtr = anyPtrType();
   EXPECT_TRUE(AnyPtr.matches({}, p0i32));
   EXPECT_FALSE(AnyPtr.matches({}, i8));
   EXPECT_FALSE(AnyPtr.matches({}, a));
   EXPECT_FALSE(AnyPtr.matches({}, v8i8));
+  EXPECT_FALSE(AnyPtr.matches({}, v8p0i32));
+  EXPECT_FALSE(AnyPtr.matches({}, vni32));
 
   auto isPointer = [](Value *V) { return V->getType()->isPointerTy(); };
   EXPECT_THAT(
       AnyPtr.generate({}, {i32->getType(), f16->getType(), v8i8->getType()}),
       AllOf(SizeIs(Ge(3u)), Each(Truly(isPointer))));
 
   auto AnyVec = anyVectorType();
   EXPECT_TRUE(AnyVec.matches({}, v8i8));
   EXPECT_TRUE(AnyVec.matches({}, v4f16));
   EXPECT_FALSE(AnyVec.matches({}, i8));
   EXPECT_FALSE(AnyVec.matches({}, a));
   EXPECT_FALSE(AnyVec.matches({}, s));
+  EXPECT_TRUE(AnyVec.matches({}, v8p0i32));
+  EXPECT_TRUE(AnyVec.matches({}, vni32));
+  EXPECT_TRUE(AnyVec.matches({}, vnf64));
+  EXPECT_TRUE(AnyVec.matches({}, vnp0i32));
 
-  EXPECT_THAT(AnyVec.generate({}, {v8i8->getType()}),
-              ElementsAre(TypesMatch(v8i8)));
+  EXPECT_THAT(AnyVec.generate({}, {v8i8->getType()}), Each(TypesMatch(v8i8)));
 
   auto First = matchFirstType();
   EXPECT_TRUE(First.matches({i8}, i8));
   EXPECT_TRUE(First.matches({s, a}, s));
   EXPECT_FALSE(First.matches({f16}, f32));
   EXPECT_FALSE(First.matches({v4f16, f64}, f64));
 
   EXPECT_THAT(First.generate({i8}, {}), Each(TypesMatch(i8)));
   EXPECT_THAT(First.generate({f16}, {i8->getType()}), Each(TypesMatch(f16)));
   EXPECT_THAT(First.generate({v8i8, i32}, {}), Each(TypesMatch(v8i8)));
+
+  auto FirstLength = matchFirstLengthWAnyType();
+  EXPECT_TRUE(FirstLength.matches({v8i8}, v8i1));
+
+  EXPECT_THAT(FirstLength.generate({v8i1}, {i8->getType()}),
+              Each(TypesMatch(v8i8)));
+
+  auto Second = matchSecondType();
+  EXPECT_TRUE(Second.matches({i32, i8}, i8));
+  EXPECT_TRUE(Second.matches({i8, f16}, f16));
+
+  EXPECT_THAT(Second.generate({v8i8, i32}, {}), Each(TypesMatch(i32)));
+  EXPECT_THAT(Second.generate({f32, f16}, {f16->getType()}),
+              Each(TypesMatch(f16)));
+
+  auto FirstScalar = matchScalarOfFirstType();
+  EXPECT_TRUE(FirstScalar.matches({v8i8}, i8));
+  EXPECT_TRUE(FirstScalar.matches({i8}, i8));
+  EXPECT_TRUE(FirstScalar.matches({v4f16}, f16));
+
+  EXPECT_THAT(FirstScalar.generate({v8i8}, {i8->getType()}),
+              Each(TypesMatch(i8)));
 }
 
 TEST(OperationsTest, SplitBlock) {
   LLVMContext Ctx;
 
   Module M("M", Ctx);
   Function *F = Function::Create(FunctionType::get(Type::getVoidTy(Ctx), {},
                                                    /*isVarArg=*/false),
GEPOp.BuilderFunc({UndefValue::get(Int8PtrTy), ConstantInt::get(Int32Ty, 0)},
                     RI);
   EXPECT_FALSE(verifyModule(M, &errs()));
 }
 
 TEST(OperationsTest, GEPPointerOperand) {
   // Check that we only pick sized pointers for the GEP instructions
 
   LLVMContext Ctx;
-  const char *SourceCode =
-      "%opaque = type opaque\n"
+  const char *SourceCode = "%opaque = type opaque\n"
                            "declare void @f()\n"
                            "define void @test(%opaque %o) {\n"
                            "  %a = alloca i64, i32 10\n"
                            "  ret void\n"
                            "}";
   auto M = parseAssembly(SourceCode, Ctx);
 
   fuzzerop::OpDescriptor Descr = fuzzerop::gepDescriptor(1);
 
   // Get first basic block of the test function
   Function &F = *M->getFunction("test");
   BasicBlock &BB = *F.begin();
 

llvm/unittests/FuzzMutate/StrategiesTest.cpp

 
 namespace {
 
 std::unique_ptr<IRMutator> createInjectorMutator() {
   std::vector<TypeGetter> Types{
       Type::getInt1Ty,  Type::getInt8Ty,  Type::getInt16Ty, Type::getInt32Ty,
       Type::getInt64Ty, Type::getFloatTy, Type::getDoubleTy};
 
+  // Add vector 1, 2, 3, 4, and 8.
+  int VectorLength[] = {1, 2, 3, 4, 8};
+  std::vector<TypeGetter> BasicTypeGetters(Types);
+  for (auto typeGetter : BasicTypeGetters) {
+    for (int length : VectorLength) {
+      Types.push_back([typeGetter, length](LLVMContext &C) {
+        return VectorType::get(typeGetter(C), length, false);
+      });
+    }
+  }
+
   std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
   Strategies.push_back(std::make_unique<InjectorIRStrategy>(
       InjectorIRStrategy::getDefaultOps()));
 
   return std::make_unique<IRMutator>(std::move(Types), std::move(Strategies));
 }
 
 template <class Strategy> std::unique_ptr<IRMutator> createMutator() {
for (int i = 0; i < 10; ++i) {
     auto M = parseAssembly(Source.data(), Ctx);
     ASSERT_TRUE(M && !verifyModule(*M, &errs()));
 
     Mutator.mutateModule(*M, Seed, Source.size(), Source.size() + 100);
     EXPECT_TRUE(!verifyModule(*M, &errs()));
   }
 }
 
+static void mutateAndVerifyModule(StringRef Source,
+                                  std::unique_ptr<IRMutator> &Mutator,
+                                  int repeat = 100) {
+  LLVMContext Ctx;
+  auto M = parseAssembly(Source.data(), Ctx);
+  std::mt19937 mt(Seed);
+  std::uniform_int_distribution<int> RandInt(INT_MIN, INT_MAX);
+  for (int i = 0; i < repeat; i++) {
+    Mutator->mutateModule(*M, RandInt(mt), Source.size(), Source.size() + 1024);
+    ASSERT_FALSE(verifyModule(*M, &errs()));
+  }
+}
+template <class Strategy>
+static void mutateAndVerifyModule(StringRef Source, int repeat = 100) {
+  auto Mutator = createMutator<Strategy>();
+  ASSERT_TRUE(Mutator);
+  mutateAndVerifyModule(Source, Mutator, repeat);
+}
+
 TEST(InjectorIRStrategyTest, EmptyModule) {
   // Test that we can inject into empty module
 
   LLVMContext Ctx;
   auto M = std::make_unique<Module>("M", Ctx);
   ASSERT_TRUE(M && !verifyModule(*M, &errs()));
 
   auto Mutator = createInjectorMutator();
   ASSERT_TRUE(Mutator);
 
   Mutator->mutateModule(*M, Seed, 1, 1);
   EXPECT_TRUE(!verifyModule(*M, &errs()));
 }
 
+TEST(InjectorIRStrategyTest, LargeInsertion) {
+  StringRef Source = "";
+  auto Mutator = createInjectorMutator();
+  ASSERT_TRUE(Mutator);
+  mutateAndVerifyModule(Source, Mutator, 100);
+}
+
 TEST(InstDeleterIRStrategyTest, EmptyFunction) {
   // Test that we don't crash even if we can't remove from one of the functions.
 
   StringRef Source = ""
                      "define <8 x i32> @func1() {\n"
                      "ret <8 x i32> undef\n"
                      "}\n"
                      "\n"
for (int i = 0; i < 300; ++i) {
     for (auto p : FPOpsHasFastMath)
       FPOpsHasFastMath[p.first] |= p.first->getFastMathFlags().any();
     ASSERT_FALSE(verifyModule(*M, &errs()));
   }
   for (auto p : FPOpsHasFastMath)
     ASSERT_TRUE(p.second);
 }
 
-template <class Strategy>
-static void mutateAndVerifyModule(StringRef Source, int repeat = 100) {
-  LLVMContext Ctx;
-  auto Mutator = createMutator<Strategy>();
-  ASSERT_TRUE(Mutator);
-
-  auto M = parseAssembly(Source.data(), Ctx);
-  std::mt19937 mt(Seed);
-  std::uniform_int_distribution<int> RandInt(INT_MIN, INT_MAX);
-  for (int i = 0; i < repeat; i++) {
-    Mutator->mutateModule(*M, RandInt(mt), Source.size(), Source.size() + 1024);
-    ASSERT_FALSE(verifyModule(*M, &errs()));
-  }
-}
-
 TEST(InsertCFGStrategy, CFG) {
   StringRef Source = "\n\
       define i32 @test(i1 %C1, i1 %C2, i1 %C3, i16 %S1, i16 %S2, i32 %I1) { \n\
         Entry:  \n\
          %I2 = add i32 %I1, 1 \n\
           %C = and i1 %C1, %C2 \n\
         br label %Body \n\
         Body: \n\