[FuzzMutate] Correctly split landingpad blocks

[igor-laevsky]

Summary

When splitting block with landingpad instruction we will make a conditional branch back into it. This is wrong because landingpad blocks can only be branched from the exception handling instructions.
In this change I added early bailout from the split operation for the landingpad blocks. That way we will split them but will not add conditional branch at the end. On the next iterations we may split the new block which will no longer be a landingpad and we will treat it as usual.

lib/FuzzMutate/Operations.cpp

default:
     llvm_unreachable("CmpOp must be ICmp or FCmp");
   }
 }
 
 OpDescriptor llvm::fuzzerop::splitBlockDescriptor(unsigned Weight) {
   auto buildSplitBlock = [](ArrayRef<Value *> Srcs, Instruction *Inst) {
     BasicBlock *Block = Inst->getParent();
     BasicBlock *Next = Block->splitBasicBlock(Inst, "BB");
-    if (Block != &Block->getParent()->getEntryBlock()) {
-      // Loop back on this block by replacing the unconditional forward branch
-      // with a conditional with a backedge.
+
+    // If it was an exception handling block, we are done.
+    if (Block->isEHPad())
+      return nullptr;
+
+    if (Block != &Block->getParent()->getEntryBlock()) {
       BranchInst::Create(Block, Next, Srcs[0], Block->getTerminator());
       Block->getTerminator()->eraseFromParent();
 
       // We need values for each phi in the block. Since there isn't a good way
       // to do a variable number of input values currently, we just fill them
       // with undef.
       for (PHINode &PHI : Block->phis())
         PHI.addIncoming(UndefValue::get(PHI.getType()), Block);

unittests/FuzzMutate/OperationsTest.cpp

TEST(OperationsTest, SplitBlock) {
   ASSERT_THAT(CondBr->getSuccessor(0), Eq(BB1));
   auto *BB2 = CondBr->getSuccessor(1);
   EXPECT_THAT(AI->getParent(), Eq(BB2));
   EXPECT_THAT(RI->getParent(), Eq(BB2));
 
   EXPECT_FALSE(verifyModule(M, &errs()));
 }
 
+TEST(OperationsTest, SplitEHBlock) {
+  // Check that we will not try to branch back to the landingpad block using
+  // regular branch instruction
+
+  LLVMContext Ctx;
+  const char *SourceCode =
+      "declare i32* @f()"
+      "declare i32 @personality_function()"
+      "define i32* @test() personality i32 ()* @personality_function {\n"
+      "entry:\n"
+      "  %val = invoke i32* @f()\n"
+      "          to label %normal unwind label %exceptional\n"
+      "normal:\n"
+      "  ret i32* %val\n"
+      "exceptional:\n"
+      "  %landing_pad4 = landingpad token cleanup\n"
+      "  ret i32* undef\n"
+      "}";
+  auto M = parseAssembly(SourceCode, Ctx);
+
+  // Get the landingpad block
+  BasicBlock &BB = *std::next(M->getFunction("test")->begin(), 2);
+
+  fuzzerop::OpDescriptor Descr = fuzzerop::splitBlockDescriptor(1);
+
+  Descr.BuilderFunc({ConstantInt::getTrue(Ctx)},&*BB.getFirstInsertionPt());
+  ASSERT_TRUE(!verifyModule(*M, &errs()));
+}
+
 TEST(OperationsTest, SplitBlockWithPhis) {
   LLVMContext Ctx;
 
   Type *Int8Ty = Type::getInt8Ty(Ctx);
 
   Module M("M", Ctx);
   Function *F = Function::Create(FunctionType::get(Type::getVoidTy(Ctx), {},
                                                    /*isVarArg=*/false),