[FuzzMutate] Avoid calling function with metadata/token parameter/return type for `InsertFunctionStrategy`

[HazyFish]

Summary

When there is a function with metadata/token parameter/return type, InsertFunctionStrategy will crash.

This patch fixes the problem by falling back to create function declaration when the sampled function contains metadata/token parameter/return type.

[HazyFish]

Handle token type and add check for return type as well

[HazyFish]

reorder conditions to improve efficiency

llvm/lib/FuzzMutate/IRMutator.cpp

void InsertFunctionStrategy::mutate(BasicBlock &BB, RandomIRBuilder &IB) {
   // If nullptr is selected, we will create a new function declaration.
   SmallVector<Function *, 32> Functions({nullptr});
   for (Function &F : M->functions()) {
     Functions.push_back(&F);
   }
 
   auto RS = makeSampler(IB.Rand, Functions);
   Function *F = RS.getSelection();
-  if (!F) {
+  auto IsUnsupportedTy = [](Type *T) {
+    return T->isMetadataTy() || T->isTokenTy();
+  };
+  if (!F || IsUnsupportedTy(F->getReturnType()) ||
+      any_of(F->getFunctionType()->params(), IsUnsupportedTy)) {
     F = IB.createFunctionDeclaration(*M);
   }
 
   FunctionType *FTy = F->getFunctionType();
   SmallVector<fuzzerop::SourcePred, 2> SourcePreds;
   if (!F->arg_empty()) {
     for (Type *ArgTy : FTy->params()) {
       SourcePreds.push_back(fuzzerop::onlyType(ArgTy));

llvm/unittests/FuzzMutate/StrategiesTest.cpp

TEST(InstModificationIRStrategyTest, DidntShuffleFRem) {
   StringRef Source = "\n\
       define <2 x double> @test(<2 x double> %0) {\n\
         %div = frem <2 x double> <double 0.0, double 0.0>, %0\n\
         ret <2 x double> %div\n\
       }";
   VerfyDivDidntShuffle(Source);
 }
 
-TEST(FunctionIRStrategy, Func) {
+TEST(InsertFunctionStrategy, Func) {
   LLVMContext Ctx;
   const char *Source = "";
   auto Mutator = createMutator<InsertFunctionStrategy>();
   ASSERT_TRUE(Mutator);
 
   auto M = parseAssembly(Source, Ctx);
   srand(Seed);
   for (int i = 0; i < 100; i++) {
     Mutator->mutateModule(*M, rand(), 1024);
     EXPECT_TRUE(!verifyModule(*M, &errs()));
   }
 }
 
+TEST(InsertFunctionStrategy, AvoidCallingFunctionWithSpecialParam) {
+  LLVMContext Ctx;
+  StringRef Source = "\n\
+      declare void @llvm.dbg.value(metadata %0, metadata %1, metadata %2)\n\
+      declare i1 @llvm.experimental.gc.result.i1(token %0)\n\
+      define i32 @test(i32 %0) gc \"statepoint-example\" {\n\
+        ret i32 %0 \n\
+      }";
+  auto Mutator = createMutator<InsertFunctionStrategy>();
+  auto M = parseAssembly(Source.data(), Ctx);
+  srand(Seed);
+  for (int i = 0; i < 100; i++) {
+    Mutator->mutateModule(*M, rand(), 1024);
+    EXPECT_TRUE(!verifyModule(*M, &errs()));
+  }
+}
+
 TEST(InstModificationIRStrategy, Exact) {
   LLVMContext Ctx;
   StringRef Source = "\n\
       define i32 @test(i32 %a, i32 %b) {\n\
         %c = ashr i32 %a, %b \n\
         ret i32 %c\n\
       }";