[FuzzMutate] Skip EHPad during mutation and avoid replacing callee with pointer when sinking

[HazyFish]

Summary

This patch addresses 2 problems:

• In ShuffleBlockStrategy, when BB is an EHPad, BB.getFirstInsertionPt() will return BB.end(), which cannot be dereferenced and will cause crash in following loop.
• In isCompatibleReplacement, a call instruction's callee might be replaced by a pointer, causing 2 subproblems:
  • we cannot guarantee that the pointer is a function pointer (even if it is, we cannot guarantee it matches the signature).
  • after such a replacement, getCalledFunction will from then on return nullptr (since it's indirect call) which causes Segmentation Fault in the lines below.

This patch fixes the first problem by checking if a block to be mutated is an EHPad in base class IRMutationStrategy and skipping mutating it if so.

This patch fixes the second problem by avoiding replacing callee with pointer and adding a null check for indirect calls.

[Peter]

llvm/unittests/FuzzMutate/StrategiesTest.cpp

659

Can you run this module against all strategies?

[HazyFish]

• Add EHPad check logic in base class so it applies to all mutation strategies.
• Fixed a bug causing segmentation fault when invoke/call instruction's callee argument is a pointer.

[HazyFish]

Fix format

[HazyFish]

avoid replacing callee with pointer when sinking

llvm/lib/FuzzMutate/IRMutator.cpp

void SinkInstructionStrategy::mutate(BasicBlock &BB, RandomIRBuilder &IB) {
   LLVMContext &C = BB.getParent()->getParent()->getContext();
   // Don't sink terminators, void function calls, etc.
   if (Inst->getType() != Type::getVoidTy(C))
     // Find a new sink and wire up the results of the operation.
     IB.connectToSink(BB, InstsAfter, Inst);
 }
 
 void ShuffleBlockStrategy::mutate(BasicBlock &BB, RandomIRBuilder &IB) {
-
+  if (BB.isEHPad())
+    return;
   SmallPtrSet<Instruction *, 8> AliveInsts;
   for (auto &I : make_early_inc_range(make_range(
            BB.getFirstInsertionPt(), BB.getTerminator()->getIterator()))) {
     // First gather all instructions that can be shuffled. Don't take
     // terminator.
     AliveInsts.insert(&I);
     // Then remove these instructions from the block
     I.removeFromParent();

llvm/unittests/FuzzMutate/StrategiesTest.cpp

LoopBody: \n\
       store i32 %NewRetVal, ptr %RetValPtr, align 4 \n\
       br label %LoopHead \n\
     Exit: \n\
       %RetVal = load i32, ptr %RetValPtr, align 4 \n\
       ret i32 %RetVal \n\
     }";
   VerifyBlockShuffle(Source);
 }
+
+TEST(ShuffleBlockStrategy, ShuffleEHPad) {
+  StringRef Source = "\n\
+    define void @f(i32 %x) personality ptr @__CxxFrameHandler3 { \n\
+    entry: \n\
+      invoke void @g() to label %try.cont unwind label %catch.dispatch \n\
+    catch.dispatch: \n\
+      %0 = catchswitch within none [label %catch] unwind to caller \n\
+    catch: \n\
+      %1 = catchpad within %0 [ptr null, i32 64, ptr null] \n\
+      catchret from %1 to label %try.cont \n\
+    try.cont: \n\
+      ret void \n\
+    } \n\
+    declare void @g() \n\
+    declare i32 @__CxxFrameHandler3(...) \n\
+    ";
+  VerifyBlockShuffle(Source);
+}
 } // namespace