| 52 | donor_suppliers_(std::move(donor_suppliers)) {} |
| 53 | |
| 54 | void FuzzerPassDonateModules::Apply() { |
| 55 | // If there are no donor suppliers, this fuzzer pass is a no-op. |
| 56 | if (donor_suppliers_.empty()) { |
| 57 | return; |
| 58 | } |
| 59 | |
| 60 | // Donate at least one module, and probabilistically decide when to stop |
| 61 | // donating modules. |
| 62 | do { |
| 63 | // Choose a donor supplier at random, and get the module that it provides. |
| 64 | std::unique_ptr<opt::IRContext> donor_ir_context = donor_suppliers_.at( |
| 65 | GetFuzzerContext()->RandomIndex(donor_suppliers_))(); |
| 66 | assert(donor_ir_context != nullptr && "Supplying of donor failed"); |
| 67 | assert( |
| 68 | fuzzerutil::IsValid(donor_ir_context.get(), |
| 69 | GetTransformationContext()->GetValidatorOptions(), |
| 70 | fuzzerutil::kSilentMessageConsumer) && |
| 71 | "The donor module must be valid"); |
| 72 | // Donate the supplied module. |
| 73 | // |
| 74 | // Randomly decide whether to make the module livesafe (see |
| 75 | // FactFunctionIsLivesafe); doing so allows it to be used for live code |
| 76 | // injection but restricts its behaviour to allow this, and means that its |
| 77 | // functions cannot be transformed as if they were arbitrary dead code. |
| 78 | bool make_livesafe = GetFuzzerContext()->ChoosePercentage( |
| 79 | GetFuzzerContext()->ChanceOfMakingDonorLivesafe()); |
| 80 | DonateSingleModule(donor_ir_context.get(), make_livesafe); |
| 81 | } while (GetFuzzerContext()->ChoosePercentage( |
| 82 | GetFuzzerContext()->GetChanceOfDonatingAdditionalModule())); |
| 83 | } |
| 84 | |
| 85 | void FuzzerPassDonateModules::DonateSingleModule( |
| 86 | opt::IRContext* donor_ir_context, bool make_livesafe) { |
nothing calls this directly
no test coverage detected