32 Commits

Author SHA1 Message Date
Igor Laevsky
7724d6bcaf [llvm-opt-fuzzer] Add irce to the fuzzing options
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@327969 91177308-0d34-0410-b5e6-96231b3b80d8
2018-03-20 11:32:13 +00:00
Igor Laevsky
de603ec82d [llvm-opt-fuzzer] Add another pack of passes for continuous fuzzing
Differential Revision: https://reviews.llvm.org/D43384



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@325487 91177308-0d34-0410-b5e6-96231b3b80d8
2018-02-19 11:57:07 +00:00
Rafael Espindola
06d6207c1c Pass a reference to a module to the bitcode writer.
This simplifies most callers as they are already using references or
std::unique_ptr.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@325155 91177308-0d34-0410-b5e6-96231b3b80d8
2018-02-14 19:11:32 +00:00
Igor Laevsky
a32887991d [llvm-opt-fuzzer] Avoid adding incorrect inputs to the fuzzer corpus
Differential Revision: https://reviews.llvm.org/D42414



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@324225 91177308-0d34-0410-b5e6-96231b3b80d8
2018-02-05 11:05:47 +00:00
Igor Laevsky
1d27d9a3c5 [FuzzMutate] Inst deleter doesn't work with PhiNodes
Differential Revision: https://reviews.llvm.org/D42412



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@323409 91177308-0d34-0410-b5e6-96231b3b80d8
2018-01-25 09:22:18 +00:00
Igor Laevsky
20b5be1d09 [llvm-opt-fuzzer] Add couple of popular passes
Differential Revision: https://reviews.llvm.org/D42410



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@323314 91177308-0d34-0410-b5e6-96231b3b80d8
2018-01-24 09:57:17 +00:00
Igor Laevsky
f416f4809a [FuzzMutate] Don't crash when mutator is unable to find operation
Differential Revision: https://reviews.llvm.org/D41009



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@321062 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-19 08:52:51 +00:00
Michael Zolotukhin
e2c2606c9e Remove redundant includes from various places.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@320629 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-13 21:31:03 +00:00
Igor Laevsky
a3d1ab8186 [FuzzMutate] Only generate loads and stores to the first class sized types
Differential Revision: https://reviews.llvm.org/D41109



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@320573 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-13 11:49:04 +00:00
Igor Laevsky
033683a63f [FuzzMutate] Correctly split landingpad blocks
Differential Revision: https://reviews.llvm.org/D41112



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@320571 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-13 11:45:53 +00:00
Igor Laevsky
2ccc42083e [FuzzMutate] Correctly insert sinks and sources around invoke instructions
Differential Revision: https://reviews.llvm.org/D40840



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@320136 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-08 08:53:16 +00:00
Igor Laevsky
9fb4bebf8e [FuzzMutate] Allow only sized pointers for the GEP instruction
Differential Revision: https://reviews.llvm.org/D40837



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@320032 91177308-0d34-0410-b5e6-96231b3b80d8
2017-12-07 11:10:11 +00:00
Igor Laevsky
4a8c2b625b [FuzzMutate] Bailout from injecting into empty basic blocks.
In rare cases we can receive request to inject into completelly empty basic block. In the normal case 
all basic blocks contain at least terminator instruction, but it is possible that the only instruction is 
catchpad instruction which is not part of the instruction iterator. This case seems rare enough to not care
about it.
Submiting without review, since it seems almost NFC. I couldn't come up with any reasonable way to test this.



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@319444 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-30 15:41:58 +00:00
Igor Laevsky
afc2161e86 [FuzzMutate] Correctly handle vector types in the insertvalue operation
Differential Revision: https://reviews.llvm.org/D40397



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@319442 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-30 15:31:13 +00:00
Igor Laevsky
21b2a00254 [FuzzMutate] Don't use index operands as sinks
Differential Revision: https://reviews.llvm.org/D40396



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@319441 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-30 15:29:16 +00:00
Igor Laevsky
59e987ce53 [FuzzMutate] Pick correct index for the insertvalue instruction
Differential Revision: https://reviews.llvm.org/D40395



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@319440 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-30 15:26:48 +00:00
Igor Laevsky
703237d8da [FuzzMutate] Don't create load as a new source if it doesn't match with the descriptor
Differential Revision: https://reviews.llvm.org/D40394



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@319439 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-30 15:24:41 +00:00
Igor Laevsky
c4f19979c7 [FuzzMutate] Don't crash when we can't remove instruction from empty function
Differential Revision: https://reviews.llvm.org/D40393



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@319438 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-30 15:07:38 +00:00
Igor Laevsky
4a2948db03 [FuzzMutate] Fix windows build after rL318407.
Add correct library dependence.



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@318409 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-16 16:17:32 +00:00
Igor Laevsky
1404e4cc81 [FuzzMutate] NFC. Move parseModule and writeModule from llvm-isel-fuzzer into FuzzMutate.
This is to be able to reuse them in the llvm-opt-fuzzer.



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@318407 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-16 15:23:08 +00:00
Igor Laevsky
089f886ad9 [llvm-opt-fuzzer] Introduce llvm-opt-fuzzer for fuzzing optimization passes
This change adds generic fuzzing tools capable of running libFuzzer tests on
any optimization pass or combination of them.

Differential Revision: https://reviews.llvm.org/D39555



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@317883 91177308-0d34-0410-b5e6-96231b3b80d8
2017-11-10 12:19:08 +00:00
Justin Bogner
6ec40b1040 FuzzMutate: Fix arch parsing in FuzzerCLI
The right way to parse arch names is by creating a triple. This was
using getArchTypeForLLVMName before, which doesn't really do the right
thing here.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@315965 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-17 02:39:40 +00:00
Matt Morehouse
5cb6ac0fdb [llvm-isel-fuzzer] Use "--" as separator rather than '='.
Summary: OSS-Fuzz doesn't support '=' in filenames.

Reviewers: bogner, kcc

Reviewed By: kcc

Subscribers: javed.absar, hiraditya, llvm-commits

Differential Revision: https://reviews.llvm.org/D38866

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@315647 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-13 00:18:32 +00:00
Justin Bogner
58658afbec Re-commit "llvm-isel-fuzzer: Handle a subset of backend flags in the exec name"
Here we add a secondary option parser to llvm-isel-fuzzer (and provide
it for use with other fuzzers). With this, you can copy the fuzzer to
a name like llvm-isel-fuzzer=aarch64-gisel for a fuzzer that fuzzer
AArch64 with GlobalISel enabled, or fuzzer=x86_64 to fuzz x86, with no
flags required. This should be useful for running these in OSS-Fuzz.

Note that this handrolls a subset of cl::opts to recognize, rather
than embedding a complete command parser for argv[0]. If we find we
really need the flexibility of handling arbitrary options at some
point we can rethink this.

This re-applies 315545 using "=" instead of ":" as a separator for
arguments.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@315557 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-12 04:35:32 +00:00
Hans Wennborg
fba3ac1b76 Revert r315545 "llvm-isel-fuzzer: Handle a subset of backend flags in the executable name"
It broke some tests on Windows:

Failing Tests (4):
    LLVM :: tools/llvm-isel-fuzzer/execname-options.ll
    LLVM :: tools/llvm-isel-fuzzer/missing-triple.ll
    LLVM :: tools/llvm-isel-fuzzer/x86-empty-bc.ll
    LLVM :: tools/llvm-isel-fuzzer/x86-empty.ll

> llvm-isel-fuzzer: Handle a subset of backend flags in the executable name
>
> Here we add a secondary option parser to llvm-isel-fuzzer (and provide
> it for use with other fuzzers). With this, you can copy the fuzzer to
> a name like llvm-isel-fuzzer:aarch64-gisel for a fuzzer that fuzzer
> AArch64 with GlobalISel enabled, or fuzzer:x86_64 to fuzz x86, with no
> flags required. This should be useful for running these in OSS-Fuzz.
>
> Note that this handrolls a subset of cl::opts to recognize, rather
> than embedding a complete command parser for argv[0]. If we find we
> really need the flexibility of handling arbitrary options at some
> point we can rethink this.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@315554 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-12 03:32:09 +00:00
Justin Bogner
58e4a84347 llvm-isel-fuzzer: Handle a subset of backend flags in the executable name
Here we add a secondary option parser to llvm-isel-fuzzer (and provide
it for use with other fuzzers). With this, you can copy the fuzzer to
a name like llvm-isel-fuzzer:aarch64-gisel for a fuzzer that fuzzer
AArch64 with GlobalISel enabled, or fuzzer:x86_64 to fuzz x86, with no
flags required. This should be useful for running these in OSS-Fuzz.

Note that this handrolls a subset of cl::opts to recognize, rather
than embedding a complete command parser for argv[0]. If we find we
really need the flexibility of handling arbitrary options at some
point we can rethink this.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@315545 91177308-0d34-0410-b5e6-96231b3b80d8
2017-10-12 01:57:49 +00:00
Justin Bogner
16edf9bff8 Move some CLI utils out of llvm-isel-fuzzer and into the library
FuzzMutate might not be the best place for these, but it makes more
sense than an entirely new library for now. This will make setting up
fuzz targets with consistent CLI handling easier.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@312425 91177308-0d34-0410-b5e6-96231b3b80d8
2017-09-02 23:43:04 +00:00
Justin Bogner
0f87ccdc99 Re-apply "Introduce FuzzMutate library"
Same as r311392 with some fixes for library dependencies. Thanks to
Chapuni for helping work those out!

Original commit message:

This introduces the FuzzMutate library, which provides structured
fuzzing for LLVM IR, as described in my EuroLLVM 2017 talk. Most of
the basic mutators to inject and delete IR are provided, with support
for most basic operations.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311402 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-21 22:57:06 +00:00
Justin Bogner
cf9591e827 Revert "Re-apply "Introduce FuzzMutate library""
The dependencies for the new library seem to be misconfigured on some
linux configs:

  http://bb.pgr.jp/builders/llvm-i686-linux-RA/builds/5435/steps/build_all/logs/stdio

This reverts r311392.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311393 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-21 22:28:47 +00:00
Justin Bogner
6b52665a1c Re-apply "Introduce FuzzMutate library"
Redo r311356 with a fix to avoid std::uniform_int_distribution<bool>.
The bool specialization is undefined according to the standard, even
though libc++ seems to have it.

Original commit message:

This introduces the FuzzMutate library, which provides structured
fuzzing for LLVM IR, as described in my [EuroLLVM 2017 talk][1]. Most
of the basic mutators to inject and delete IR are provided, with
support for most basic operations.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311392 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-21 22:25:04 +00:00
Justin Bogner
7c45ace552 Revert "Introduce FuzzMutate library"
Looks like this fails to build with libstdc++.

This reverts r311356

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311358 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-21 17:57:12 +00:00
Justin Bogner
943140e61c Introduce FuzzMutate library
This introduces the FuzzMutate library, which provides structured
fuzzing for LLVM IR, as described in my [EuroLLVM 2017 talk][1]. Most
of the basic mutators to inject and delete IR are provided, with
support for most basic operations.

I will follow up with the instruction selection fuzzer, which is
implemented in terms of this library.

[1]: http://llvm.org/devmtg/2017-03//2017/02/20/accepted-sessions.html#2

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311356 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-21 17:44:36 +00:00