[FuzzMutate] Avoid using swifterror as a source operand

[igor-laevsky]

Summary

When transforming arbitrary llvm ir code we may encounter swifterror operands with rather restricted semantics. In this change I simply drop such operands from possible source candidates.

[igor-laevsky]

Hi. Any comments here?

[igor-laevsky]

Hi. Slight ping on this?

[bogner]

I don't really like how specific of a special case this is, but I guess that's more of a problem with swifterror itself than with this pass. LGTM.

include/llvm/FuzzMutate/OpDescriptor.h

 #ifndef LLVM_FUZZMUTATE_OPDESCRIPTOR_H
 #define LLVM_FUZZMUTATE_OPDESCRIPTOR_H
 
 #include "llvm/ADT/ArrayRef.h"
 #include "llvm/ADT/STLExtras.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/DerivedTypes.h"
+#include "llvm/IR/Instructions.h"
 #include "llvm/IR/Type.h"
 #include "llvm/IR/Value.h"
 #include <functional>
 
 namespace llvm {
 namespace fuzzerop {
 
 /// @{
auto Pred = [](ArrayRef<Value *>, const Value *V) {
     return V->getType()->isFloatingPointTy();
   };
   auto Make = None;
   return {Pred, Make};
 }
 
 static inline SourcePred anyPtrType() {
   auto Pred = [](ArrayRef<Value *>, const Value *V) {
-    return V->getType()->isPointerTy();
+    return V->getType()->isPointerTy() && !V->isSwiftError();
   };
   auto Make = [](ArrayRef<Value *>, ArrayRef<Type *> Ts) {
     std::vector<Constant *> Result;
     // TODO: Should these point at something?
     for (Type *T : Ts)
       Result.push_back(UndefValue::get(PointerType::getUnqual(T)));
     return Result;
   };
   return {Pred, Make};
 }
 
 static inline SourcePred sizedPtrType() {
   auto Pred = [](ArrayRef<Value *>, const Value *V) {
+    if (V->isSwiftError())
+      return false;
+
     if (const auto *PtrT = dyn_cast<PointerType>(V->getType()))
       return PtrT->getElementType()->isSized();
     return false;
   };
   auto Make = [](ArrayRef<Value *>, ArrayRef<Type *> Ts) {
     std::vector<Constant *> Result;
 
     for (Type *T : Ts)

unittests/FuzzMutate/RandomIRBuilderTest.cpp

TEST(RandomIRBuilderTest, InsertValueArray) {
   // Check that we can always pick the last two operands.
   for (int i = 0; i < 10; ++i) {
     Srcs[0] = Source;
     Srcs[1] = IB.findOrCreateSource(BB, {Source}, Srcs, Descr.SourcePreds[1]);
     IB.findOrCreateSource(BB, {}, Srcs, Descr.SourcePreds[2]);
   }
 }
 
+TEST(RandomIRBuilderTest, SwiftError) {
+  // Check that we never pick swifterror value as a source for operation
+  // other than load, store and call.
+
+  LLVMContext Ctx;
+  const char *SourceCode = "declare void @use(i8** swifterror %err)"
+                           "define void @test() {\n"
+                           "entry:\n"
+                           "  %err = alloca swifterror i8*, align 8\n"
+                           "  call void @use(i8** swifterror %err)\n"
+                           "  ret void\n"
+                           "}";
+  auto M = parseAssembly(SourceCode, Ctx);
+
+  std::vector<Type *> Types = {Type::getInt8Ty(Ctx)};
+  RandomIRBuilder IB(Seed, Types);
+
+  // Get first basic block of the test function
+  Function &F = *M->getFunction("test");
+  BasicBlock &BB = *F.begin();
+  Instruction *Alloca = &*BB.begin();
+
+  fuzzerop::OpDescriptor Descr = fuzzerop::gepDescriptor(1);
+
+  for (int i = 0; i < 10; ++i) {
+    Value *V = IB.findOrCreateSource(BB, {Alloca}, {}, Descr.SourcePreds[0]);
+    ASSERT_FALSE(isa<AllocaInst>(V));
+  }
+}
+
 }