[FuzzMutate] Only generate loads and stores to the first class sized types

[igor-laevsky]

Summary

We can't load or store from the non sized or non first class types. I.e loading from a function pointer or opaque struct shouldn't be allowed.

llvm/trunk/lib/FuzzMutate/RandomIRBuilder.cpp

Value *RandomIRBuilder::findPointer(BasicBlock &BB,
                                     ArrayRef<Instruction *> Insts,
                                     ArrayRef<Value *> Srcs, SourcePred Pred) {
   auto IsMatchingPtr = [&Srcs, &Pred](Instruction *Inst) {
     // Invoke instructions sometimes produce valid pointers but currently
     // we can't insert loads or stores from them
     if (isa<TerminatorInst>(Inst))
       return false;
 
-    if (auto PtrTy = dyn_cast<PointerType>(Inst->getType()))
+    if (auto PtrTy = dyn_cast<PointerType>(Inst->getType())) {
+      // We can never generate loads from non first class or non sized types
+      if (!PtrTy->getElementType()->isSized() ||
+          !PtrTy->getElementType()->isFirstClassType())
+        return false;
+
       // TODO: Check if this is horribly expensive.
       return Pred.matches(Srcs, UndefValue::get(PtrTy->getElementType()));
+    }
     return false;
   };
   if (auto RS = makeSampler(Rand, make_filter_range(Insts, IsMatchingPtr)))
     return RS.getSelection();
   return nullptr;
 }

llvm/trunk/unittests/FuzzMutate/RandomIRBuilderTest.cpp

TEST(RandomIRBuilderTest, Invokes) {
 
   // Find source but never insert new load after invoke
   for (int i = 0; i < 10; ++i) {
     (void)IB.findOrCreateSource(BB, {Invoke}, {}, fuzzerop::anyIntType());
     ASSERT_TRUE(!verifyModule(*M, &errs()));
   }
 }
 
+TEST(RandomIRBuilderTest, FirstClassTypes) {
+  // Check that we never insert new source as a load from non first class
+  // or unsized type.
+
+  LLVMContext Ctx;
+  const char *SourceCode = "%Opaque = type opaque\n"
+                           "define void @test(i8* %ptr) {\n"
+                           "entry:\n"
+                           "  %tmp = bitcast i8* %ptr to i32* (i32*)*\n"
+                           "  %tmp1 = bitcast i8* %ptr to %Opaque*\n"
+                           "  ret void\n"
+                           "}";
+  auto M = parseAssembly(SourceCode, Ctx);
+
+  std::vector<Type *> Types = {Type::getInt8Ty(Ctx)};
+  RandomIRBuilder IB(Seed, Types);
+
+  Function &F = *M->getFunction("test");
+  BasicBlock &BB = *F.begin();
+  // Non first class type
+  Instruction *FuncPtr = &*BB.begin();
+  // Unsized type
+  Instruction *OpaquePtr = &*std::next(BB.begin());
+
+  for (int i = 0; i < 10; ++i) {
+    Value *V = IB.findOrCreateSource(BB, {FuncPtr, OpaquePtr});
+    ASSERT_FALSE(isa<LoadInst>(V));
+  }
+}
+
 }