1//===- RandomIRBuilder.h - Utils for randomly mutation IR -------*- C++ -*-===// 2// 3// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4// See https://llvm.org/LICENSE.txt for license information. 5// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6// 7//===----------------------------------------------------------------------===// 8// 9// Provides the Mutator class, which is used to mutate IR for fuzzing. 10// 11//===----------------------------------------------------------------------===// 12 13#ifndef LLVM_FUZZMUTATE_RANDOMIRBUILDER_H 14#define LLVM_FUZZMUTATE_RANDOMIRBUILDER_H 15 16#include "llvm/ADT/SmallPtrSet.h" 17#include "llvm/FuzzMutate/IRMutator.h" 18#include "llvm/FuzzMutate/Random.h" 19#include <random> 20 21namespace llvm { 22 23using RandomEngine = std::mt19937; 24 25struct RandomIRBuilder { 26 RandomEngine Rand; 27 SmallVector<Type *, 16> KnownTypes; 28 29 RandomIRBuilder(int Seed, ArrayRef<Type *> AllowedTypes) 30 : Rand(Seed), KnownTypes(AllowedTypes.begin(), AllowedTypes.end()) {} 31 32 // TODO: Try to make this a bit less of a random mishmash of functions. 33 34 /// Find a "source" for some operation, which will be used in one of the 35 /// operation's operands. This either selects an instruction in \c Insts or 36 /// returns some new arbitrary Value. 37 Value *findOrCreateSource(BasicBlock &BB, ArrayRef<Instruction *> Insts); 38 /// Find a "source" for some operation, which will be used in one of the 39 /// operation's operands. This either selects an instruction in \c Insts that 40 /// matches \c Pred, or returns some new Value that matches \c Pred. The 41 /// values in \c Srcs should be source operands that have already been 42 /// selected. 43 Value *findOrCreateSource(BasicBlock &BB, ArrayRef<Instruction *> Insts, 44 ArrayRef<Value *> Srcs, fuzzerop::SourcePred Pred); 45 /// Create some Value suitable as a source for some operation. 46 Value *newSource(BasicBlock &BB, ArrayRef<Instruction *> Insts, 47 ArrayRef<Value *> Srcs, fuzzerop::SourcePred Pred); 48 /// Find a viable user for \c V in \c Insts, which should all be contained in 49 /// \c BB. This may also create some new instruction in \c BB and use that. 50 void connectToSink(BasicBlock &BB, ArrayRef<Instruction *> Insts, Value *V); 51 /// Create a user for \c V in \c BB. 52 void newSink(BasicBlock &BB, ArrayRef<Instruction *> Insts, Value *V); 53 Value *findPointer(BasicBlock &BB, ArrayRef<Instruction *> Insts, 54 ArrayRef<Value *> Srcs, fuzzerop::SourcePred Pred); 55 Type *chooseType(LLVMContext &Context, ArrayRef<Value *> Srcs, 56 fuzzerop::SourcePred Pred); 57}; 58 59} // end llvm namespace 60 61#endif // LLVM_FUZZMUTATE_RANDOMIRBUILDER_H 62