This implements a fuzzer tool for instruction selection, as described in my EuroLLVM 2017 talk.
The fuzzer must be given both libFuzzer args and llc-like args to configure the backend. For example, to fuzz AArch64 GlobalISel at -O0, you could invoke like so:
llvm-isel-fuzzer <corpus dirs> -ignore_remaining_args=1 \ -mtriple arm64-apple-ios -global-isel -O0
If you would like to seed the fuzzer with an initial corpus, simply provide a directory of valid LLVM bitcode (not textual IR) as one of the corpus dirs.