[FuzzMutate] Don't use index operands as sinks

[igor-laevsky]

Summary

This fixes typo in the sink generator. We can't use index operands as sinks from the arbitrary instructions. This is actually two problems: shufflevector was missing from the switch case, and ">" was used instead of ">=". I believe this check can be made less conservative, but I figured it's better to be correct for now.

[bogner]

Agreed, we should be able to make this less conservative at some point. This is good for now.

lib/FuzzMutate/RandomIRBuilder.cpp

static bool isCompatibleReplacement(const Instruction *I, const Use &Operand,
   if (Operand->getType() != Replacement->getType())
     return false;
   switch (I->getOpcode()) {
   case Instruction::GetElementPtr:
   case Instruction::ExtractElement:
   case Instruction::ExtractValue:
     // TODO: We could potentially validate these, but for now just leave indices
     // alone.
-    if (Operand.getOperandNo() > 1)
+    if (Operand.getOperandNo() >= 1)
       return false;
     break;
   case Instruction::InsertValue:
   case Instruction::InsertElement:
-    if (Operand.getOperandNo() > 2)
+  case Instruction::ShuffleVector:
+    if (Operand.getOperandNo() >= 2)
       return false;
     break;
   default:
     break;
   }
   return true;
 }
 

unittests/FuzzMutate/RandomIRBuilderTest.cpp

for (int i = 0; i < 10; ++i) {
       // Try to pick correct index
       Value *Src = IB.findOrCreateSource(
           BB, &*BB.begin(), Srcs, IVDescr.SourcePreds[2]);
       ASSERT_TRUE(IVDescr.SourcePreds[2].matches(Srcs, Src));
     }
   }
 }
 
+TEST(RandomIRBuilderTest, ShuffleVectorSink) {
+  // Check that we will never use shuffle vector mask as a sink form the
+  // unrelated operation.
+
+  LLVMContext Ctx;
+  const char *SourceCode =
+      "define void @test(<4 x i32> %a) {\n"
+      "  %S1 = shufflevector <4 x i32> %a, <4 x i32> %a, <4 x i32> undef\n"
+      "  %S2 = shufflevector <4 x i32> %a, <4 x i32> %a, <4 x i32> undef\n"
+      "  ret void\n"
+      "}";
+  auto M = parseAssembly(SourceCode, Ctx);
+
+  fuzzerop::OpDescriptor IVDescr = fuzzerop::insertValueDescriptor(1);
+
+  RandomIRBuilder IB(Seed, {});
+
+  // Get first basic block of the first function
+  Function &F = *M->begin();
+  BasicBlock &BB = *F.begin();
+
+  // Source is %S1
+  Instruction *Source = &*BB.begin();
+  // Sink is %S2
+  SmallVector<Instruction *, 1> Sinks = {&*std::next(BB.begin())};
+
+  // Loop to account for random decisions
+  for (int i = 0; i < 10; ++i) {
+    // Try to connect S1 to S2. We should always create new sink.
+    IB.connectToSink(BB, Sinks, Source);
+    ASSERT_TRUE(!verifyModule(*M, &errs()));
+  }
+}
+
 }