1 // Copyright 2021 The Tint Authors. 2 // 3 // Licensed under the Apache License, Version 2.0 (the "License"); 4 // you may not use this file except in compliance with the License. 5 // You may obtain a copy of the License at 6 // 7 // http://www.apache.org/licenses/LICENSE-2.0 8 // 9 // Unless required by applicable law or agreed to in writing, software 10 // distributed under the License is distributed on an "AS IS" BASIS, 11 // WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 // See the License for the specific language governing permissions and 13 // limitations under the License. 14 15 #ifndef FUZZERS_TINT_AST_FUZZER_MUTATION_FINDER_H_ 16 #define FUZZERS_TINT_AST_FUZZER_MUTATION_FINDER_H_ 17 18 #include <memory> 19 #include <vector> 20 21 #include "fuzzers/tint_ast_fuzzer/mutation.h" 22 #include "fuzzers/tint_ast_fuzzer/node_id_map.h" 23 #include "fuzzers/tint_ast_fuzzer/probability_context.h" 24 25 #include "src/program.h" 26 27 namespace tint { 28 namespace fuzzers { 29 namespace ast_fuzzer { 30 31 /// Instances of this class traverse the `tint::Program`, looking for 32 /// opportunities to apply mutations and return them to the caller. 33 /// 34 /// Ideally, the behaviour of this class (precisely, its `FindMutations` method) 35 /// should not be probabilistic. This is useful when mutation finders are used 36 /// for test case reduction, because it enables the test case reducer to 37 /// systematically explore all available mutations. There may be some 38 /// exceptions, however. For example, if a huge number of mutations is returned, 39 /// it would make sense to apply only a probabilistically selected subset of 40 /// them. 41 class MutationFinder { 42 public: 43 /// Virtual destructor. 44 virtual ~MutationFinder(); 45 46 /// @brief Traverses the `program`, looking for opportunities to apply 47 /// mutations. 48 /// 49 /// @param program - the program being fuzzed. 50 /// @param node_id_map - a map from `tint::ast::` nodes in the `program` to 51 /// their unique ids. 52 /// @param probability_context - determines various probabilistic stuff in the 53 /// mutator. This should ideally be used as less as possible. 54 /// @return all the found mutations. 55 virtual MutationList FindMutations( 56 const tint::Program& program, 57 NodeIdMap* node_id_map, 58 ProbabilityContext* probability_context) const = 0; 59 60 /// @brief Compute a probability of applying a single mutation, returned by 61 /// this class. 62 /// 63 /// @param probability_context - contains information about various 64 /// non-deterministic stuff in the fuzzer. 65 /// @return a number in the range [0; 100] which is a chance of applying a 66 /// mutation. 67 virtual uint32_t GetChanceOfApplyingMutation( 68 ProbabilityContext* probability_context) const = 0; 69 }; 70 71 using MutationFinderList = std::vector<std::unique_ptr<MutationFinder>>; 72 73 } // namespace ast_fuzzer 74 } // namespace fuzzers 75 } // namespace tint 76 77 #endif // FUZZERS_TINT_AST_FUZZER_MUTATION_FINDER_H_ 78