Go to the documentation of this file.
18 #ifndef LLVM_FUZZMUTATE_IRMUTATOR_H
19 #define LLVM_FUZZMUTATE_IRMUTATOR_H
31 struct RandomIRBuilder;
64 std::vector<TypeGetter> AllowedTypes;
65 std::vector<std::unique_ptr<IRMutationStrategy>> Strategies;
69 std::vector<std::unique_ptr<IRMutationStrategy>> &&Strategies)
70 : AllowedTypes(
std::
move(AllowedTypes)),
71 Strategies(
std::
move(Strategies)) {}
78 std::vector<fuzzerop::OpDescriptor> Operations;
85 : Operations(
std::
move(Operations)) {}
90 return Operations.size();
144 #endif // LLVM_FUZZMUTATE_IRMUTATOR_H
std::unique_ptr< Module > parseModule(const uint8_t *Data, size_t Size, LLVMContext &Context)
Fuzzer friendly interface for the llvm bitcode parser.
This is an optimization pass for GlobalISel generic memory operations.
We currently emits eax Perhaps this is what we really should generate is Is imull three or four cycles eax eax The current instruction priority is based on pattern complexity The former is more complex because it folds a load so the latter will not be emitted Perhaps we should use AddedComplexity to give LEA32r a higher priority We should always try to match LEA first since the LEA matching code does some estimate to determine whether the match is profitable if we care more about code then imull is better It s two bytes shorter than movl leal On a Pentium M
uint64_t getWeight(size_t CurrentSize, size_t MaxSize, uint64_t CurrentWeight) override
Provide a weight to bias towards choosing this strategy for a mutation.
uint64_t getWeight(size_t CurrentSize, size_t MaxSize, uint64_t CurrentWeight) override
Provide a weight to bias towards choosing this strategy for a mutation.
The instances of the Type class are immutable: once they are created, they are never changed.
void mutate(Instruction &Inst, RandomIRBuilder &IB) override
LLVM Basic Block Representation.
InjectorIRStrategy(std::vector< fuzzerop::OpDescriptor > &&Operations)
uint64_t getWeight(size_t CurrentSize, size_t MaxSize, uint64_t CurrentWeight) override
Provide a weight to bias towards choosing this strategy for a mutation.
Strategy that injects operations into the function.
std::function< Type *(LLVMContext &)> TypeGetter
virtual void mutate(Instruction &I, RandomIRBuilder &IB)
void mutate(Function &F, RandomIRBuilder &IB) override
static ManagedStatic< cl::opt< uint64_t >, CreateSeed > Seed
Entry point for configuring and running IR mutations.
This is an important class for using LLVM in a threaded context.
virtual uint64_t getWeight(size_t CurrentSize, size_t MaxSize, uint64_t CurrentWeight)=0
Provide a weight to bias towards choosing this strategy for a mutation.
void mutate(Function &F, RandomIRBuilder &IB) override
OutputIt move(R &&Range, OutputIt Out)
Provide wrappers to std::move which take ranges instead of having to pass begin/end explicitly.
@ BasicBlock
Various leaf nodes.
print Print MemDeps of function
A Module instance is used to store all the information related to an LLVM module.
Base class for describing how to mutate a module.
virtual ~IRMutationStrategy()=default
#define llvm_unreachable(msg)
Marks that the current location is not supposed to be reachable.
Machine Check Debug Module
static std::vector< fuzzerop::OpDescriptor > getDefaultOps()
virtual void mutate(Module &M, RandomIRBuilder &IB)
void mutateModule(Module &M, int Seed, size_t CurSize, size_t MaxSize)
Common register allocation spilling lr str ldr sxth r3 ldr mla r4 can lr mov lr str ldr sxth r3 mla r4 and then merge mul and lr str ldr sxth r3 mla r4 It also increase the likelihood the store may become dead bb27 Successors according to LLVM BB
IRMutator(std::vector< TypeGetter > &&AllowedTypes, std::vector< std::unique_ptr< IRMutationStrategy >> &&Strategies)
size_t writeModule(const Module &M, uint8_t *Dest, size_t MaxSize)
Fuzzer friendly interface for the llvm bitcode printer.
LLVM Value Representation.
std::unique_ptr< Module > parseAndVerify(const uint8_t *Data, size_t Size, LLVMContext &Context)
Try to parse module and verify it.