[FuzzMutate] InsertFunctionStrategy

[Peter]

Summary

InsertFunctionStrategy does two things:

1. Add a random function declaration or definition to the module. This would replace previously used createEmptyFunction.
2. Add a random function call between instructions.

[arsenm]

llvm/lib/FuzzMutate/IRMutator.cpp

346

Don't see the point of the initializer here

359

arg_empty

[Peter]

use arg_empty

[Peter]

update

[Peter]

[FuzzMutate] InsertFunctionStrategy

InsertFunctionStrategy does two things:

Add a random function declaration or definition to the module. This would replace previously used createEmptyFunction.
Add a random function call between instructions.

[Peter]

sync with upstream

[Peter]

llvm/lib/FuzzMutate/IRMutator.cpp

346

If the mutator select nullptr, we can create a new function. This is to give us a chance to define more functions.

359

Fixed, thanks for pointint out.

[Peter]

sync with upstream

[arsenm]

llvm/lib/FuzzMutate/IRMutator.cpp

374

Can use make_range(BB.getFirstInsertionPt(), BB.end())

llvm/lib/FuzzMutate/RandomIRBuilder.cpp

426 ↗

(On Diff #515030)

Missing alloca address space

[Peter]

use make range and add address space

[Peter]

update

llvm/lib/FuzzMutate/IRMutator.cpp

static uint64_t getUniqueCaseValue(SmallSet<uint64_t, 4> &CasesTaken,
   } while (CasesTaken.count(tmp) != 0);
   CasesTaken.insert(tmp);
   return tmp;
 }
 
 void InsertFunctionStrategy::mutate(BasicBlock &BB, RandomIRBuilder &IB) {
   Module *M = BB.getParent()->getParent();
   // If nullptr is selected, we will create a new function declaration.
   SmallVector<Function *, 32> Functions({nullptr});
   for (Function &F : M->functions()) {
     Functions.push_back(&F);
   }
 
   auto RS = makeSampler(IB.Rand, Functions);
   Function *F = RS.getSelection();
   if (!F)
     F = IB.createFunctionDeclaration(*M);
 
   FunctionType *FTy = F->getFunctionType();
   SmallVector<fuzzerop::SourcePred, 2> SourcePreds;
-  if (F->arg_empty()) {
+  if (!F->arg_empty()) {
     for (Type *ArgTy : FTy->params()) {
       SourcePreds.push_back(fuzzerop::onlyType(ArgTy));
     }
   }
   bool isRetVoid = (F->getReturnType() == Type::getVoidTy(M->getContext()));
   auto BuilderFunc = [FTy, F, isRetVoid](ArrayRef<Value *> Srcs,
                                          Instruction *Inst) {
     StringRef Name = isRetVoid ? nullptr : "C";
     CallInst *Call = CallInst::Create(FTy, F, Srcs, Name, Inst);
     // Don't return this call inst if it return void as it can't be sinked.
     return isRetVoid ? nullptr : Call;
   };
 
   SmallVector<Instruction *, 32> Insts;
   for (auto I = BB.getFirstInsertionPt(), E = BB.end(); I != E; ++I)
     Insts.push_back(&*I);
   if (Insts.size() < 1)
     return;
 
   // Choose an insertion point for our new call instruction.
   uint64_t IP = uniform<uint64_t>(IB.Rand, 0, Insts.size() - 1);
 
   auto InstsBefore = ArrayRef(Insts).slice(0, IP);
   auto InstsAfter = ArrayRef(Insts).slice(IP);