[
{
"path": ".clang-format",
"content": "---\nBasedOnStyle: LLVM\nStandard: Cpp11\nPointerAlignment: Left\n...\n"
},
{
"path": ".dockerignore",
"content": ".dockerignore\n# Pass `.git` directory so that\n# `jfs --version` gives git hash.\n#.git\n**/.*.swp\n**/*.Dockerfile\nscripts/Dockerfiles/*.patched\nscripts/Dockerfiles/build.sh\nutils/SMT-COMP\n"
},
{
"path": ".gitignore",
"content": "# Vim swap files\n*.swp\n*.swo\nscripts/Dockerfiles/*.patched\n*.pyc\n"
},
{
"path": ".idea/codeStyleSettings.xml",
"content": "\n\n \n \n \n \n"
},
{
"path": "CMakeLists.txt",
"content": "#===------------------------------------------------------------------------===#\n#\n# JFS\n#\n# Copyright 2017-2018 Daniel Liew\n#\n# This file is distributed under the MIT license.\n# See LICENSE.txt for details.\n#\n#===------------------------------------------------------------------------===#\n\n###############################################################################\n# Minimum CMake version and policies\n###############################################################################\ncmake_minimum_required(VERSION 2.8.12)\nif (POLICY CMP0054)\n # FIXME: This is horrible. With the old behaviour,\n # quoted strings like \"MSVC\" in if() conditionals\n # get implicitly dereferenced. The NEW behaviour\n # doesn't do this but CMP0054 was only introduced\n # in CMake 3.1 and we support lower versions as the\n # minimum. We could set NEW here but it would be very\n # confusing to use NEW for some builds and OLD for others\n # which could lead to some subtle bugs. Instead when the\n # minimum version is 3.1 change this policy to NEW and remove\n # the hacks in place to work around it.\n cmake_policy(SET CMP0054 OLD)\nendif()\n\nif (POLICY CMP0042)\n # Enable `MACOSX_RPATH` by default.\n cmake_policy(SET CMP0042 NEW)\nendif()\n\nif (POLICY CMP0037)\n # Disallow reserved target names\n cmake_policy(SET CMP0037 NEW)\nendif()\n\n# This overrides the default flags for the different CMAKE_BUILD_TYPEs\nset(CMAKE_USER_MAKE_RULES_OVERRIDE_C\n \"${CMAKE_CURRENT_SOURCE_DIR}/cmake/c_flags_override.cmake\")\nset(CMAKE_USER_MAKE_RULES_OVERRIDE_CXX\n \"${CMAKE_CURRENT_SOURCE_DIR}/cmake/cxx_flags_override.cmake\")\nproject(JFS CXX C)\n\n###############################################################################\n# Project version\n###############################################################################\nset(JFS_VERSION_MAJOR 0)\nset(JFS_VERSION_MINOR 0)\nset(JFS_VERSION_PATCH 0)\nset(JFS_VERSION_TWEAK 0)\nset(JFS_VERSION \"${JFS_VERSION_MAJOR}.${JFS_VERSION_MINOR}.${JFS_VERSION_PATCH}.${JFS_VERSION_TWEAK}\")\nmessage(STATUS \"JFS version ${JFS_VERSION}\")\n\n################################################################################\n# Set various useful variables depending on CMake version\n################################################################################\nif ((\"${CMAKE_VERSION}\" VERSION_EQUAL \"3.2\") OR (\"${CMAKE_VERSION}\" VERSION_GREATER \"3.2\"))\n # In CMake >= 3.2 add_custom_command() supports a ``USES_TERMINAL`` argument\n set(ADD_CUSTOM_COMMAND_USES_TERMINAL_ARG \"USES_TERMINAL\")\nelse()\n set(ADD_CUSTOM_COMMAND_USES_TERMINAL_ARG \"\")\nendif()\n\nif ((\"${CMAKE_VERSION}\" VERSION_EQUAL \"3.4\") OR (\"${CMAKE_VERSION}\" VERSION_GREATER \"3.4\"))\n # In CMake >= 3.4 ExternalProject_Add_Step() supports a `USES_TERMINAL` argument\n set(EXTERNAL_PROJECT_ADD_STEP_USES_TERMINAL_ARG \"USES_TERMINAL\" \"1\")\nelse()\n set(EXTERNAL_PROJECT_ADD_STEP_USES_TERMINAL_ARG \"\")\nendif()\n\n################################################################################\n# Sanity check - Disallow building in source.\n################################################################################\nif (\"${CMAKE_SOURCE_DIR}\" STREQUAL \"${CMAKE_BINARY_DIR}\")\n message(FATAL_ERROR \"In source builds are not allowed. You should invoke \"\n \"CMake from a different directory.\")\nendif()\n\n################################################################################\n# Build type\n################################################################################\nmessage(STATUS \"CMake generator: ${CMAKE_GENERATOR}\")\nif (DEFINED CMAKE_CONFIGURATION_TYPES)\n # Multi-configuration build (e.g. Xcode). Here\n # CMAKE_BUILD_TYPE doesn't matter\n message(STATUS \"Available configurations: ${CMAKE_CONFIGURATION_TYPES}\")\nelse()\n # Single configuration generator (e.g. Unix Makefiles, Ninja)\n set(available_build_types Debug Release RelWithDebInfo MinSizeRel)\n if(NOT CMAKE_BUILD_TYPE)\n message(STATUS \"CMAKE_BUILD_TYPE is not set. Setting default\")\n message(STATUS \"The available build types are: ${available_build_types}\")\n set(CMAKE_BUILD_TYPE RelWithDebInfo CACHE String\n \"Options are ${available_build_types}\"\n FORCE)\n # Provide drop down menu options in cmake-gui\n set_property(CACHE CMAKE_BUILD_TYPE PROPERTY STRINGS ${available_build_types})\n endif()\n message(STATUS \"Build type: ${CMAKE_BUILD_TYPE}\")\n\n # Check the selected build type is valid\n list(FIND available_build_types \"${CMAKE_BUILD_TYPE}\" _build_type_index)\n if (\"${_build_type_index}\" EQUAL \"-1\")\n message(FATAL_ERROR \"\\\"${CMAKE_BUILD_TYPE}\\\" is an invalid build type.\\n\"\n \"Use one of the following build types ${available_build_types}\")\n endif()\nendif()\n\n################################################################################\n# Add our CMake module directory to the list of module search directories\n################################################################################\nlist(APPEND CMAKE_MODULE_PATH \"${CMAKE_SOURCE_DIR}/cmake/modules\")\n\n################################################################################\n# Compiler flags for JFS components\n# Subsequent commands will append to these. These are used instead of\n# directly modifying CMAKE_CXX_FLAGS so that other code can be easily built with\n# different flags.\n################################################################################\nset(JFS_COMPONENT_EXTRA_INCLUDE_DIRS \"\")\nset(JFS_COMPONENT_CXX_DEFINES \"\")\nset(JFS_COMPONENT_CXX_FLAGS \"\")\nset(JFS_SOLVER_LIBRARIES \"\")\nset(JFS_COMPONENT_EXTRA_LIBRARIES \"\")\ninclude(\"${CMAKE_SOURCE_DIR}/cmake/jfs_component_add_cxx_flag.cmake\")\n\n################################################################################\n# JFS include directories\n################################################################################\nlist(APPEND JFS_COMPONENT_EXTRA_INCLUDE_DIRS\n \"${CMAKE_BINARY_DIR}/include\"\n \"${CMAKE_SOURCE_DIR}/include\"\n)\n\n################################################################################\n# Assertions\n################################################################################\noption(ENABLE_JFS_ASSERTS \"Enable JFS assertions\" ON)\nif (ENABLE_JFS_ASSERTS)\n message(STATUS \"JFS assertions enabled\")\n # Assume that -DNDEBUG isn't set.\nelse()\n message(STATUS \"JFS assertions disabled\")\n list(APPEND JFS_COMPONENT_CXX_DEFINES \"NDEBUG\")\nendif()\n\n################################################################################\n# Find LLVM\n################################################################################\nfind_package(LLVM 6.0.0\n CONFIG\n)\nset(NEEDED_LLVM_VARS\n LLVM_PACKAGE_VERSION\n LLVM_VERSION_MAJOR\n LLVM_VERSION_MINOR\n LLVM_VERSION_PATCH\n LLVM_DEFINITIONS\n LLVM_ENABLE_ASSERTIONS\n LLVM_ENABLE_EH\n LLVM_ENABLE_RTTI\n LLVM_INCLUDE_DIRS\n LLVM_LIBRARY_DIRS\n LLVM_TOOLS_BINARY_DIR\n)\n\nforeach (vname ${NEEDED_LLVM_VARS})\n message(STATUS \"${vname}: \\\"${${vname}}\\\"\")\n if (NOT (DEFINED \"${vname}\"))\n message(FATAL_ERROR \"${vname} was not defined\")\n endif()\nendforeach()\nmessage(STATUS \"LLVM_DIR: \\\"${LLVM_DIR}\\\"\")\n\n# Find Clang\n# FIXME: This won't work if LLVM was built with a multi-configuration generator.\nset(LLVM_CLANG_CXX_TOOL \"${LLVM_TOOLS_BINARY_DIR}/clang++\")\nif (NOT EXISTS \"${LLVM_CLANG_CXX_TOOL}\")\n message(FATAL_ERROR \"Failed to find clang++ at \\\"${LLVM_CLANG_CXX_TOOL}\\\"\")\nelse()\n message(STATUS \"Found clang++ at \\\"${LLVM_CLANG_CXX_TOOL}\\\"\")\nendif()\n\nif (LLVM_ENABLE_ASSERTIONS)\n # Certain LLVM debugging macros only work when LLVM was built with asserts\n set(ENABLE_JFS_DEBUG 1) # for config.h\nelse()\n unset(ENABLE_JFS_DEBUG) # for config.h\nendif()\n\n# LLVM_DEFINITIONS aren't lists. Instead they are space separated\nstring(REPLACE \" \" \";\" LLVM_DEFINITIONS_AS_LIST \"${LLVM_DEFINITIONS}\")\nlist(APPEND JFS_COMPONENT_CXX_DEFINES ${LLVM_DEFINITIONS_AS_LIST})\n\n# LLVM_INCLUDE_DIRS aren't lists. Instead they are space separated\nstring(REPLACE \" \" \";\" LLVM_INCLUDE_DIRS_AS_LIST \"${LLVM_INCLUDE_DIRS}\")\nlist(APPEND JFS_COMPONENT_EXTRA_INCLUDE_DIRS ${LLVM_INCLUDE_DIRS_AS_LIST})\n\nif (NOT LLVM_ENABLE_EH)\n if ((\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"Clang\") OR (\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"GNU\"))\n jfs_component_add_cxx_flag(\"-fno-exceptions\" REQUIRED)\n else()\n message(FATAL_ERROR \"${CMAKE_CXX_COMPILER_ID} not supported\")\n endif()\nendif()\n\nif (NOT LLVM_ENABLE_RTTI)\n if ((\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"Clang\") OR (\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"GNU\"))\n jfs_component_add_cxx_flag(\"-fno-rtti\" REQUIRED)\n else()\n message(FATAL_ERROR \"${CMAKE_CXX_COMPILER_ID} not supported\")\n endif()\nendif()\ninclude(\"${CMAKE_SOURCE_DIR}/cmake/jfs_get_llvm_components.cmake\")\n\n################################################################################\n# Find Z3\n################################################################################\n# FIXME: Specify version. Need to upstream support for config setting version.\nfind_package(Z3 CONFIG)\nset(NEEDED_Z3_VARS\n Z3_VERSION_MAJOR\n Z3_VERSION_MINOR\n Z3_VERSION_PATCH\n Z3_VERSION_TWEAK\n Z3_VERSION_STRING\n Z3_C_INCLUDE_DIRS\n Z3_LIBRARIES\n)\nforeach (vname ${NEEDED_Z3_VARS})\n message(STATUS \"${vname}: \\\"${${vname}}\\\"\")\n if (NOT (DEFINED \"${vname}\"))\n message(FATAL_ERROR \"${vname} was not defined\")\n endif()\nendforeach()\nif (\"${Z3_VERSION_STRING}\" VERSION_LESS \"4.6\")\n message(FATAL_ERROR \"Need Z3 4.6 or newer\")\nendif()\n\nlist(APPEND JFS_COMPONENT_EXTRA_INCLUDE_DIRS ${Z3_C_INCLUDE_DIRS})\n\n################################################################################\n# C++ version\n################################################################################\n# FIXME: Use CMake's support for this\nif ((\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"Clang\") OR (\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"GNU\"))\n set(JFS_USE_CXX_FLAG \"-std=c++11\")\n jfs_component_add_cxx_flag(\"${JFS_USE_CXX_FLAG}\" REQUIRED)\nelse()\n set(JFS_USE_CXX_FLAG \"\")\nendif()\n\n################################################################################\n# Warnings\n################################################################################\ninclude(\"${CMAKE_SOURCE_DIR}/cmake/compiler_warnings.cmake\")\n\n################################################################################\n# Report flags\n################################################################################\nmessage(STATUS \"JFS_COMPONENT_CXX_DEFINES: \\\"${JFS_COMPONENT_CXX_DEFINES}\\\"\")\nmessage(STATUS \"JFS_COMPONENT_EXTRA_INCLUDE_DIRS: \\\"${JFS_COMPONENT_EXTRA_INCLUDE_DIRS}\\\"\")\nmessage(STATUS \"JFS_COMPONENT_CXX_FLAGS: \\\"${JFS_COMPONENT_CXX_FLAGS}\\\"\")\nmessage(STATUS \"JFS_COMPONENT_EXTRA_LIBRARIES: \\\"${JFS_COMPONENT_EXTRA_LIBRARIES}\\\"\")\n\n################################################################################\n# Report default CMake flags\n################################################################################\n# This is mainly for debugging.\nmessage(STATUS \"CMAKE_CXX_FLAGS: \\\"${CMAKE_CXX_FLAGS}\\\"\")\nmessage(STATUS \"CMAKE_EXE_LINKER_FLAGS: \\\"${CMAKE_EXE_LINKER_FLAGS}\\\"\")\nmessage(STATUS \"CMAKE_STATIC_LINKER_FLAGS: \\\"${CMAKE_STATIC_LINKER_FLAGS}\\\"\")\nmessage(STATUS \"CMAKE_SHARED_LINKER_FLAGS: \\\"${CMAKE_SHARED_LINKER_FLAGS}\\\"\")\nif (DEFINED CMAKE_CONFIGURATION_TYPES)\n # Multi configuration generator\n string(TOUPPER \"${available_build_types}\" build_types_to_report)\nelse()\n # Single configuration generator\n string(TOUPPER \"${CMAKE_BUILD_TYPE}\" build_types_to_report)\nendif()\nforeach (_build_type ${build_types_to_report})\n message(STATUS \"CMAKE_CXX_FLAGS_${_build_type}: \\\"${CMAKE_CXX_FLAGS_${_build_type}}\\\"\")\n message(STATUS \"CMAKE_EXE_LINKER_FLAGS_${_build_type}: \\\"${CMAKE_EXE_LINKER_FLAGS_${_build_type}}\\\"\")\n message(STATUS \"CMAKE_SHARED_LINKER_FLAGS_${_build_type}: \\\"${CMAKE_SHARED_LINKER_FLAGS_${_build_type}}\\\"\")\n message(STATUS \"CMAKE_STATIC_LINKER_FLAGS_${_build_type}: \\\"${CMAKE_STATIC_LINKER_FLAGS_${_build_type}}\\\"\")\nendforeach()\n\n################################################################################\n# Handle git hash and description\n################################################################################\ninclude(${CMAKE_SOURCE_DIR}/cmake/git_utils.cmake)\nmacro(disable_git_describe)\n message(WARNING \"Disabling INCLUDE_GIT_DESCRIBE\")\n set(INCLUDE_GIT_DESCRIBE OFF CACHE BOOL \"Include git describe output in version output\" FORCE)\nendmacro()\nmacro(disable_git_hash)\n message(WARNING \"Disabling INCLUDE_GIT_HASH\")\n set(INCLUDE_GIT_HASH OFF CACHE BOOL \"Include git hash in version output\" FORCE)\n unset(Z3GITHASH) # Used in configure_file()\nendmacro()\noption(INCLUDE_GIT_HASH \"Include git hash in version output\" ON)\noption(INCLUDE_GIT_DESCRIBE \"Include git describe output in version output\" ON)\n\nset(GIT_DIR \"${CMAKE_SOURCE_DIR}/.git\")\nif (EXISTS \"${GIT_DIR}\")\n # Try to make CMake configure depend on the current git HEAD so that\n # a re-configure is triggered when the HEAD changes.\n add_git_dir_dependency(\"${GIT_DIR}\" ADD_GIT_DEP_SUCCESS)\n if (ADD_GIT_DEP_SUCCESS)\n if (INCLUDE_GIT_HASH)\n get_git_head_hash(\"${GIT_DIR}\" JFS_GIT_HASH)\n if (NOT JFS_GIT_HASH)\n message(WARNING \"Failed to get Git hash\")\n disable_git_hash()\n endif()\n message(STATUS \"Using Git hash in version output: ${JFS_GIT_HASH}\")\n else()\n message(STATUS \"Not using Git hash in version output\")\n unset(JFS_GIT_HASH) # Used in configure_file()\n endif()\n if (INCLUDE_GIT_DESCRIBE)\n get_git_head_describe(\"${GIT_DIR}\" JFS_GIT_DESCRIPTION)\n if (NOT Z3_GIT_DESCRIPTION)\n message(WARNING \"Failed to get Git description\")\n disable_git_describe()\n endif()\n message(STATUS \"Using Git description in version output: ${JFS_GIT_DESCRIPTION}\")\n else()\n message(STATUS \"Not including git descrption in version\")\n endif()\n else()\n message(WARNING \"Failed to add git dependency.\")\n disable_git_describe()\n disable_git_hash()\n endif()\nelse()\n message(STATUS \"Failed to find git directory.\")\n disable_git_describe()\n disable_git_hash()\nendif()\n\n################################################################################\n# Generate configuration header files\n################################################################################\nset(AUTO_GEN_MSG \"Automatically generated. DO NOT EDIT\")\nset(configuration_files \"version.h\" \"depsVersion.h\" \"config.h\")\nforeach (configuration_file ${configuration_files})\n configure_file(\n \"${CMAKE_SOURCE_DIR}/include/jfs/Config/${configuration_file}.in\"\n \"${CMAKE_BINARY_DIR}/include/jfs/Config/${configuration_file}\"\n )\nendforeach()\n\n################################################################################\n# Set default location for targets in the build directory\n################################################################################\nset(CMAKE_ARCHIVE_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib)\nset(CMAKE_LIBRARY_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/lib)\nset(CMAKE_RUNTIME_OUTPUT_DIRECTORY ${CMAKE_BINARY_DIR}/bin)\n\n\n################################################################################\n# Top level unit test target\n################################################################################\n# This is top level because there are multiple unit test suites to run\nadd_custom_target(unittests)\n\n################################################################################\n# Detect lit tool\n################################################################################\n# This can't belong in `tests/` because `runtime/` needs to run its own tests.\noption(ENABLE_SYSTEM_TESTS \"Enable system tests\" ON)\noption(ENABLE_UNIT_TESTS \"Enable unit tests\" ON)\nif (ENABLE_SYSTEM_TESTS OR ENABLE_UNIT_TESTS)\n # Find lit\n set(LIT_TOOL_NAMES \"llvm-lit\" \"lit\")\n find_program(\n LIT_TOOL\n NAMES ${LIT_TOOL_NAMES}\n HINTS \"${LLVM_TOOLS_BINARY_DIR}\"\n DOC \"Path to lit tool\"\n )\n\n set(LIT_ARGS\n \"-v;-s\"\n CACHE\n STRING\n \"Lit arguments\"\n )\n\n if ((NOT LIT_TOOL) OR (NOT EXISTS \"${LIT_TOOL}\"))\n message(FATAL_ERROR \"The lit tool is required for testing.\")\n else()\n message(STATUS \"Using lit: ${LIT_TOOL}\")\n endif()\nendif()\n\n################################################################################\n# Utilities\n################################################################################\nset(GTEST_SRC_DIR \"${CMAKE_SOURCE_DIR}/utils/googletest/googletest\")\nadd_subdirectory(utils)\n\n################################################################################\n# Runtime\n################################################################################\nadd_subdirectory(runtime)\n# Sanity checks\nif (\"${JFS_LLVM_CLANG_CXX_TOOL}\" STREQUAL \"\")\n message(FATAL_ERROR \"JFS_LLVM_CLANG_CXX_TOOL not set\")\nendif()\nif (NOT (EXISTS \"${JFS_LLVM_CLANG_CXX_TOOL}\"))\n message(FATAL_ERROR \"JFS_LLVM_CLANG_CXX_TOOL (\\\"${JFS_LLVM_CLANG_CXX_TOOL}\\\") doest not exist\")\nendif()\nmessage(STATUS \"JFS_LLVM_CLANG_CXX_TOOL: ${JFS_LLVM_CLANG_CXX_TOOL}\")\n\n################################################################################\n# Libraries\n################################################################################\ninclude(\"${CMAKE_SOURCE_DIR}/cmake/jfs_add_component.cmake\")\nadd_subdirectory(lib)\n\n################################################################################\n# Tools\n################################################################################\nadd_subdirectory(tools)\n\n################################################################################\n# Tests\n################################################################################\nadd_subdirectory(tests)\n"
},
{
"path": "LICENSE.txt",
"content": "Copyright 2017 Daniel Liew\n\nPermission is hereby granted, free of charge, to any person obtaining a copy of\nthis software and associated documentation files (the \"Software\"), to deal in\nthe Software without restriction, including without limitation the rights to\nuse, copy, modify, merge, publish, distribute, sublicense, and/or sell copies\nof the Software, and to permit persons to whom the Software is furnished to do\nso, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE.\n"
},
{
"path": "README.md",
"content": "# JFS\n\nJFS (Just Fuzz it Solver) (originally JIT Fuzzing Solver) is an experimental\nconstraint solver designed to investigate using __coverage guided fuzzing__ as\nan incomplete strategy for solving boolean, BitVector, and floating-point\nconstraints.\n\nJFS supports constraints in the [SMT-LIBv2][1] constraint langauge in the\n`QF_BV`, `QF_BVFP`, and `QF_FP` logics. JFS's primary purpose however is\nsolve floating-point constraints.\n\nJFS is built on top of the following projects\n\n* [LLVM](https://llvm.org/)\n* [Clang](http://clang.llvm.org/)\n* [Z3](https://github.com/Z3Prover/z3)\n* [LibFuzzer](https://llvm.org/docs/LibFuzzer.html)\n\n[1]: http://smtlib.cs.uiowa.edu/\n\n## FSE 2019 paper\n\n[A paper on JFS](https://srg.doc.ic.ac.uk/files/papers/jfs-esecfse-19.pdf) was presented and published at ESEC/FSE 2019.\n\nAdditional resources:\n\n* [artifact](https://github.com/mc-imperial/jfs-fse-2019-artifact)\n* [slides](https://docs.google.com/presentation/d/1wPxNJ3rXVqLRCm9jRMZTsL5sEW5aW9WZ583TPpb2Ffo/edit?usp=sharing)\n\nThe [Docker image](https://cloud.docker.com/u/delcypher/repository/docker/delcypher/jfs_build) with the tag `fse_2019`\n\n## Using JFS Docker image\n\nIf you want to get started with JFS with minimal effort the easiest thing to do\nis download the latest Docker image for JFS. Note this image may not be up-to-date\nso you might not the latest changes.\n\nTo obtain the image run (replace `fse_2019` with the tag you wish to use).\n\n```\ndocker pull delcypher/jfs_build:fse_2019\n```\n\nThe simplest invocation is something like this which will show JFS's help output.\n\n```\ndocker run --user 1000 --rm -t delcypher/jfs_build:fse_2019 /home/user/jfs/build/bin/jfs --help\n```\n\nTo run JFS on a SMT-LIBv2 file that exists outside the container (`/path/to/simple.smt2` in this example) run this command below.\n\n```\ndocker run --rm -t -v /path/to/simple.smt2:/tmp/simple.smt2 delcypher/jfs_build:fse_2019 /home/user/jfs/build/bin/jfs /tmp/simple.smt2\n```\n\nNote that the `docker run` command creates a new container and destroys it\nafterwards which has notable overhead. For better performance consider running\nJFS outside of a docker container or creating a single container and spawning a\nshell inside it and then launch JFS from there.\n\n## Building JFS\n\nJFS has been tested on Linux and macOS.\nWindows support would likely require a lot more work and is dependent on getting\nLibFuzzer to work on Windows.\n\n### Using Docker (the easy way)\n\nThe easiest way is just to use our Dockerfile. To do this simply run\n\n```\nscripts/Dockerfiles/build.sh\n```\n\nonce the script completes you will have a Docker image on your system\nnamed `jfs_build:ubuntu1604`. In this image you will find the JFS binaries\nin the `/home/user/jfs/build/bin` directory.\n\n## From source (the hard way)\n\nJFS has the following build dependencies:\n\n* LLVM/Clang/compiler-rt 6.0\n* Z3 4.6.0\n* CMake\n* Ninja\n\n\nHere are the steps to build JFS.\n\n1. Build Z3 4.6.0. Note you must build this using Z3's CMake build system\nand not its legacy build system because JFS's build system depends on files\nemitted by Z3's CMake build system.\n\nA convenience script is provided for this\n\n```bash\nexport Z3_SRC_DIR=/home/user/z3/src\nexport Z3_BUILD_DIR=/home/user/z3/build\nexport Z3_BUILD_TYPE=Release\nscripts/dist/build_z3.sh\n```\n\nSet the `Z3_SRC_DIR`, `Z3_BUILD_DIR` to paths to empty or non-existant\ndirectories. The `Z3_BUILD_TYPE` can be set to `Release`, `RelWithDebInfo`,\nor `Debug`.\n\n2. Build or install LLVM, Clang, and compiler-rt 6.0\n\n\nA convenience script is provided to build LLVM.\n\n```bash\nexport LLVM_SRC_DIR=/home/user/llvm/src\nexport LLVM_BUILD_DIR=/home/user/llvm/src\nexport LLVM_BUILD_TYPE=Release\nscripts/dist/build_llvm.sh\n```\n\nSet the `LLVM_SRC_DIR`, `LLVM_BUILD_DIR` to paths to empty or non-existant\ndirectories. The `LLVM_BUILD_TYPE` can be set to `Release`, `RelWithDebInfo`,\nor `Debug`.\n\n3. Build JFS\n\nA convenience script is provided to build JFS.\n\n```bash\nexport JFS_SRC_DIR=/home/user/jfs/src\nexport JFS_BUILD_DIR=/home/user/jfs/build\nexport JFS_BUILD_TYPE=Release\nscripts/dist/build_jfs.sh\n```\n\n`JFS_SRC_DIR` should be the absolute path to an already cloned copy of the JFS\nrepo. `JFS_BUILD_DIR` should be a path to an empty or non-existant directory.\nThe `JFS_BUILD_TYPE` can be set to `Release`, `RelWithDebInfo`, or `Debug`.\n\nNote that `Z3_BUILD_DIR` and `LLVM_BUILD_DIR` must also be set.\n\n4. Test JFS\n\n```\ncd ${JFS_BUILD_DIR}\nninja check\n```\n\n\n## FAQs\n\n### Aren't there already a bunch of search based floating-point constraint solvers?\n\nYes. However as far as we're aware, JFS is the first to try to use an\n\"off the shelf\" coverage guided fuzzer as a search strategy.\n\nHere's a non-exhaustive list:\n\n* [coral][2] is a constraint solver that\n supports various search strategies over floating point constraints. It uses\n its own constraint language which is only partially overlaps with `QF_FP`\n constraints in the SMT-LIBv2 language. The [smt2coral][3] tool provides a way\n to run coral on SMT-LIBv2 constraints.\n\n* [XSat][4] transform constraints into a mathematical global optimization\n problem. Unfortunately this tool is not open source.\n\n* [goSAT][5] takes the ideas behind XSat but\n uses different optimization libraries and uses LLVM's JIT to generate code.\n\nWe are currently in the process of performing an evaluation of JFS against\nthese solvers and we will report these results in the not to distant future.\n\n[2]: http://pan.cin.ufpe.br/coral/index.html\n[3]: https://github.com/delcypher/smt2coral\n[4]: https://www.researchgate.net/publication/305252908_XSat_A_Fast_Floating-Point_Satisfiability_Solver\n[5]: https://github.com/abenkhadra/gosat\n\n### How does JFS work?\n\nTo see how JFS works let's walk through a small example.\n\n1. Parse SMT-LIB constraints using Z3.\n\n```\n(declare-fun a () (_ FloatingPoint 11 53))\n(declare-fun b () (_ FloatingPoint 11 53))\n(define-fun a_b_rne () (_ FloatingPoint 11 53) (fp.div RNE a b))\n(define-fun a_b_rtp () (_ FloatingPoint 11 53) (fp.div RTP a b))\n(assert (not (fp.isNaN a)))\n(assert (not (fp.isNaN b)))\n(assert (not (fp.eq a_b_rne a_b_rtp)))\n(assert (not (fp.isNaN a_b_rne)))\n(assert (not (fp.isNaN a_b_rtp)))\n(check-sat)\n```\n\n2. Perform some simplifications on the constraints (e.g. constant folding).\n\n**NOTE: You can use the jfs-opt tool to experiment with these simplifications.**\n\n3. Generate a C++ program where the reachability of an `abort()` statement is\nequivalent to finding a satisfying assignment to the constraints.\n\n**NOTE: You can use the `jfs-smt2cxx` tool to convert SMT-LIBv2 constraints\ninto a program.**\n\n```c++\nextern \"C\" int LLVMFuzzerTestOneInput(const uint8_t *data, size_t size) {\n if (size < 16) {\n return 0;\n }\n BufferRef jfs_buffer_ref =\n BufferRef(data, size);\n const Float<11, 53> a = makeFloatFrom<11, 53>(jfs_buffer_ref, 0, 63);\n const Float<11, 53> b = makeFloatFrom<11, 53>(jfs_buffer_ref, 64, 127);\n const bool jfs_ssa_0 = a.isNaN();\n const bool jfs_ssa_1 = !(jfs_ssa_0);\n if (jfs_ssa_1) {\n } else {\n return 0;\n }\n const bool jfs_ssa_2 = b.isNaN();\n const bool jfs_ssa_3 = !(jfs_ssa_2);\n if (jfs_ssa_3) {\n } else {\n return 0;\n }\n const Float<11, 53> jfs_ssa_4 = a.div(JFS_RM_RNE, b);\n const Float<11, 53> jfs_ssa_5 = a.div(JFS_RM_RTP, b);\n const bool jfs_ssa_6 = jfs_ssa_4.ieeeEquals(jfs_ssa_5);\n const bool jfs_ssa_7 = !(jfs_ssa_6);\n if (jfs_ssa_7) {\n } else {\n return 0;\n }\n const bool jfs_ssa_8 = jfs_ssa_4.isNaN();\n const bool jfs_ssa_9 = !(jfs_ssa_8);\n if (jfs_ssa_9) {\n } else {\n return 0;\n }\n const bool jfs_ssa_10 = jfs_ssa_5.isNaN();\n const bool jfs_ssa_11 = !(jfs_ssa_10);\n if (jfs_ssa_11) {\n } else {\n return 0;\n }\n // Fuzzing target\n abort();\n}\n```\n\n4. This program is then compiled by Clang with coverage instrumentation\n and linked against LibFuzzer and a small runtime library. The runtime\n library implements the `Float` and `BitVector` SMT-LIBv2 types.\n\n5. A set of seeds are generated for the fuzzer.\n\n6. The compiled binary is invoked with the given seeds.\n If the fuzzer generates an input that reaches the `abort()` a satisfying\n assignment has been found and JFS terminates reporting `sat`.\n\nNote this strategy will never find a satisfying assignment if one does not exist\n(i.e. the constraints are unsatisfiable). This is why we say JFS is \"incomplete\"\nbecause it cannot show that unsatisfiable constraints are unsatisfiable.\n\nThere is one exception to this. JFS can show unsatisfiable constraints to be\nunsatisfiable if its simplications show one or more constraints to be `false`\n(i.e. trivially unsatisfiable).\n"
},
{
"path": "cmake/add_jfs_unit_test.cmake",
"content": "#===------------------------------------------------------------------------===#\n#\n# JFS\n#\n# Copyright 2017-2018 Daniel Liew\n#\n# This file is distributed under the MIT license.\n# See LICENSE.txt for details.\n#\n#===------------------------------------------------------------------------===#\nif (NOT DEFINED GTEST_SRC_DIR)\n message(FATAL_ERROR \"GTEST_SRC_DIR must be defined\")\nendif()\nif (NOT EXISTS \"${GTEST_SRC_DIR}\")\n message(FATAL_ERROR \"GTEST_SRC_DIR (${GTEST_SRC_DIR}) must exist\")\nendif()\n\n# This keeps track of all the unit test\n# targets so we can ensure they are built\n# before trying to run them.\ndefine_property(GLOBAL\n PROPERTY JFS_UNIT_TEST_TARGETS\n BRIEF_DOCS \"JFS unit tests\"\n FULL_DOCS \"JFS unit tests\"\n)\n\nset(GTEST_INCLUDE_DIR \"${GTEST_SRC_DIR}/include\")\n\nif (NOT IS_DIRECTORY \"${GTEST_INCLUDE_DIR}\")\n message(FATAL_ERROR\n \"Cannot find GTest include directory \\\"${GTEST_INCLUDE_DIR}\\\"\")\nendif()\n\nset (UNIT_TEST_EXE_SUFFIX \"Test\")\nfunction(add_jfs_unit_test target_name)\n add_executable(${target_name}${UNIT_TEST_EXE_SUFFIX} ${ARGN})\n target_link_libraries(${target_name}${UNIT_TEST_EXE_SUFFIX} PRIVATE jfs_gtest_main)\n target_include_directories(${target_name}${UNIT_TEST_EXE_SUFFIX} BEFORE PRIVATE \"${GTEST_INCLUDE_DIR}\")\n set_target_properties(${target_name}${UNIT_TEST_EXE_SUFFIX}\n PROPERTIES\n RUNTIME_OUTPUT_DIRECTORY \"${CMAKE_CURRENT_BINARY_DIR}\"\n )\n set_property(GLOBAL\n APPEND\n PROPERTY JFS_UNIT_TEST_TARGETS\n ${target_name}${UNIT_TEST_EXE_SUFFIX}\n )\nendfunction()\n"
},
{
"path": "cmake/c_flags_override.cmake",
"content": "#===------------------------------------------------------------------------===#\n#\n# JFS\n#\n# Copyright 2017-2018 Daniel Liew\n#\n# This file is distributed under the MIT license.\n# See LICENSE.txt for details.\n#\n#===------------------------------------------------------------------------===#\n#\n# This file overrides the default compiler flags for CMake's built-in\n# configurations (CMAKE_BUILD_TYPE). Most compiler flags should not be set\n# here. The main purpose is to make sure ``-DNDEBUG`` is never set by default.\n#\n#===------------------------------------------------------------------------===#\nif ((\"${CMAKE_C_COMPILER_ID}\" MATCHES \"Clang\") OR (\"${CMAKE_C_COMPILER_ID}\" MATCHES \"GNU\"))\n # Taken from Modules/Compiler/GNU.cmake but -DNDEBUG is removed\n set(CMAKE_C_FLAGS_INIT \"\")\n set(CMAKE_C_FLAGS_DEBUG_INIT \"-O0 -g\")\n set(CMAKE_C_FLAGS_MINSIZEREL_INIT \"-Os\")\n set(CMAKE_C_FLAGS_RELEASE_INIT \"-O3\")\n set(CMAKE_C_FLAGS_RELWITHDEBINFO_INIT \"-O2 -g\")\nelse()\n message(FATAL_ERROR \"Overrides not set for compiler ${CMAKE_C_COMPILER_ID}\")\nendif()\n"
},
{
"path": "cmake/compiler_warnings.cmake",
"content": "set(GCC_AND_CLANG_WARNINGS\n \"-Wall\"\n)\nset(GCC_ONLY_WARNINGS \"\")\nset(CLANG_ONLY_WARNINGS \"\")\nset(MSVC_WARNINGS \"/W3\")\n\nset(WARNING_FLAGS_TO_CHECK \"\")\nif (\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"GNU\")\n list(APPEND WARNING_FLAGS_TO_CHECK ${GCC_AND_CLANG_WARNINGS})\n list(APPEND WARNING_FLAGS_TO_CHECK ${GCC_ONLY_WARNINGS})\nelseif (\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"Clang\")\n list(APPEND WARNING_FLAGS_TO_CHECK ${GCC_AND_CLANG_WARNINGS})\n list(APPEND WARNING_FLAGS_TO_CHECK ${CLANG_ONLY_WARNINGS})\n # FIXME: Remove \"x..\" when CMP0054 is set to NEW\nelseif (\"x${CMAKE_CXX_COMPILER_ID}\" STREQUAL \"xMSVC\")\n list(APPEND WARNING_FLAGS_TO_CHECK ${MSVC_WARNINGS})\n\n # CMake's default flags include /W3 already so remove them if\n # they already exist.\n if (\"${CMAKE_CXX_FLAGS}\" MATCHES \"/W3\")\n string(REPLACE \"/W3\" \"\" _cmake_cxx_flags_remove_w3 \"${CMAKE_CXX_FLAGS}\")\n set(CMAKE_CXX_FLAGS \"${_cmake_cxx_flags_remove_w3}\" CACHE STRING \"\" FORCE)\n endif()\nelse()\n message(AUTHOR_WARNING \"Unknown compiler\")\nendif()\n\n# Loop through flags and use the ones which the compiler supports\nforeach (flag ${WARNING_FLAGS_TO_CHECK})\n jfs_component_add_cxx_flag(\"${flag}\")\nendforeach()\n"
},
{
"path": "cmake/cxx_flags_override.cmake",
"content": "#===------------------------------------------------------------------------===#\n#\n# JFS\n#\n# Copyright 2017-2018 Daniel Liew\n#\n# This file is distributed under the MIT license.\n# See LICENSE.txt for details.\n#\n#===------------------------------------------------------------------------===#\n#\n# This file overrides the default compiler flags for CMake's built-in\n# configurations (CMAKE_BUILD_TYPE). Most compiler flags should not be set\n# here. The main purpose is to make sure ``-DNDEBUG`` is never set by default.\n#\n#===------------------------------------------------------------------------===#\n\nif ((\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"Clang\") OR (\"${CMAKE_CXX_COMPILER_ID}\" MATCHES \"GNU\"))\n # Taken from Modules/Compiler/GNU.cmake but -DNDEBUG is removed\n set(CMAKE_CXX_FLAGS_INIT \"\")\n set(CMAKE_CXX_FLAGS_DEBUG_INIT \"-O0 -g\")\n set(CMAKE_CXX_FLAGS_MINSIZEREL_INIT \"-Os\")\n set(CMAKE_CXX_FLAGS_RELEASE_INIT \"-O3\")\n set(CMAKE_CXX_FLAGS_RELWITHDEBINFO_INIT \"-O2 -g\")\nelse()\n message(FATAL_ERROR \"Overrides not set for compiler ${CMAKE_CXX_COMPILER_ID}\")\nendif()\n"
},
{
"path": "cmake/git_utils.cmake",
"content": "#===------------------------------------------------------------------------===#\n#\n# JFS\n#\n# Copyright 2017-2018 Daniel Liew\n#\n# This file is distributed under the MIT license.\n# See LICENSE.txt for details.\n#\n#===------------------------------------------------------------------------===#\n\n# add_git_dir_dependency(GIT_DIR SUCCESS_VAR)\n#\n# Adds a configure time dependency on the git directory such that if the HEAD\n# of the git directory changes CMake will be forced to re-run. This useful\n# for fetching the current git hash and including it in the build.\n#\n# `GIT_DIR` is the path to the git directory (i.e. the `.git` directory)\n# `SUCCESS_VAR` is the name of the variable to set. It will be set to TRUE\n# if the dependency was successfully added and FALSE otherwise.\nfunction(add_git_dir_dependency GIT_DIR SUCCESS_VAR)\n if (NOT \"${ARGC}\" EQUAL 2)\n message(FATAL_ERROR \"Invalid number (${ARGC}) of arguments\")\n endif()\n\n if (NOT IS_ABSOLUTE \"${GIT_DIR}\")\n message(FATAL_ERROR \"GIT_DIR (\\\"${GIT_DIR}\\\") is not an absolute path\")\n endif()\n\n if (NOT IS_DIRECTORY \"${GIT_DIR}\")\n message(FATAL_ERROR \"GIT_DIR (\\\"${GIT_DIR}\\\") is not a directory\")\n endif()\n\n set(GIT_HEAD_FILE \"${GIT_DIR}/HEAD\")\n if (NOT EXISTS \"${GIT_HEAD_FILE}\")\n message(AUTHOR_WARNING \"Git head file \\\"${GIT_HEAD_FILE}\\\" cannot be found\")\n set(${SUCCESS_VAR} FALSE PARENT_SCOPE)\n return()\n endif()\n\n # List of files in the git tree that CMake configuration should depend on\n set(GIT_FILE_DEPS \"${GIT_HEAD_FILE}\")\n\n # Examine the HEAD and workout what additional dependencies there are.\n file(READ \"${GIT_HEAD_FILE}\" GIT_HEAD_DATA LIMIT 128)\n string(STRIP \"${GIT_HEAD_DATA}\" GIT_HEAD_DATA_STRIPPED)\n\n if (\"${GIT_HEAD_DATA_STRIPPED}\" MATCHES \"^ref:[ ]*(.+)$\")\n # HEAD points at a reference.\n set(GIT_REF \"${CMAKE_MATCH_1}\")\n if (EXISTS \"${GIT_DIR}/${GIT_REF}\")\n # Unpacked reference. The file contains the commit hash\n # so add a dependency on this file so that if we stay on this\n # reference (i.e. branch) but change commit CMake will be forced\n # to reconfigure.\n list(APPEND GIT_FILE_DEPS \"${GIT_DIR}/${GIT_REF}\")\n elseif(EXISTS \"${GIT_DIR}/packed-refs\")\n # The ref must be packed (see `man git-pack-refs`).\n list(APPEND GIT_FILE_DEPS \"${GIT_DIR}/packed-refs\")\n else()\n # Fail\n message(AUTHOR_WARNING \"Unhandled git reference\")\n set(${SUCCESS_VAR} FALSE PARENT_SCOPE)\n return()\n endif()\n else()\n # Detached HEAD.\n # No other dependencies needed\n endif()\n\n # FIXME:\n # This is the directory we will copy (via `configure_file()`) git files\n # into. This is a hack. It would be better to use the\n # `CMAKE_CONFIGURE_DEPENDS` directory property but that feature is not\n # available in CMake 2.8.12. So we use `configure_file()` to effectively\n # do the same thing. When the source file to `configure_file()` changes\n # it will trigger a re-run of CMake.\n set(GIT_CMAKE_FILES_DIR \"${CMAKE_CURRENT_BINARY_DIR}/git_cmake_files\")\n file(MAKE_DIRECTORY \"${GIT_CMAKE_FILES_DIR}\")\n\n foreach (git_dependency ${GIT_FILE_DEPS})\n message(STATUS \"Adding git dependency \\\"${git_dependency}\\\"\")\n configure_file(\n \"${git_dependency}\"\n \"${GIT_CMAKE_FILES_DIR}\"\n COPYONLY\n )\n endforeach()\n\n set(${SUCCESS_VAR} TRUE PARENT_SCOPE)\nendfunction()\n\n# get_git_head_hash(GIT_DIR OUTPUT_VAR)\n#\n# Retrieve the current commit hash for a git working directory where `GIT_DIR`\n# is the `.git` directory in the root of the git working directory.\n#\n# `OUTPUT_VAR` should be the name of the variable to put the result in. If this\n# function fails then either a fatal error will be raised or `OUTPUT_VAR` will\n# contain a string with the suffix `NOTFOUND` which can be used in CMake `if()`\n# commands.\nfunction(get_git_head_hash GIT_DIR OUTPUT_VAR)\n if (NOT \"${ARGC}\" EQUAL 2)\n message(FATAL_ERROR \"Invalid number of arguments\")\n endif()\n if (NOT IS_DIRECTORY \"${GIT_DIR}\")\n message(FATAL_ERROR \"\\\"${GIT_DIR}\\\" is not a directory\")\n endif()\n if (NOT IS_ABSOLUTE \"${GIT_DIR}\")\n message(FATAL_ERROR \\\"\"${GIT_DIR}\\\" is not an absolute path\")\n endif()\n find_package(Git)\n if (NOT Git_FOUND)\n set(${OUTPUT_VAR} \"GIT-NOTFOUND\" PARENT_SCOPE)\n return()\n endif()\n get_filename_component(GIT_WORKING_DIR \"${GIT_DIR}\" DIRECTORY)\n execute_process(\n COMMAND\n \"${GIT_EXECUTABLE}\"\n \"rev-parse\"\n \"-q\" # Quiet\n \"HEAD\"\n WORKING_DIRECTORY\n \"${GIT_WORKING_DIR}\"\n RESULT_VARIABLE\n GIT_EXIT_CODE\n OUTPUT_VARIABLE\n Z3_GIT_HASH\n OUTPUT_STRIP_TRAILING_WHITESPACE\n )\n if (NOT \"${GIT_EXIT_CODE}\" EQUAL 0)\n message(WARNING \"Failed to execute git\")\n set(${OUTPUT_VAR} NOTFOUND PARENT_SCOPE)\n return()\n endif()\n set(${OUTPUT_VAR} \"${Z3_GIT_HASH}\" PARENT_SCOPE)\nendfunction()\n\n# get_git_head_describe(GIT_DIR OUTPUT_VAR)\n#\n# Retrieve the output of `git describe` for a git working directory where\n# `GIT_DIR` is the `.git` directory in the root of the git working directory.\n#\n# `OUTPUT_VAR` should be the name of the variable to put the result in. If this\n# function fails then either a fatal error will be raised or `OUTPUT_VAR` will\n# contain a string with the suffix `NOTFOUND` which can be used in CMake `if()`\n# commands.\nfunction(get_git_head_describe GIT_DIR OUTPUT_VAR)\n if (NOT \"${ARGC}\" EQUAL 2)\n message(FATAL_ERROR \"Invalid number of arguments\")\n endif()\n if (NOT IS_DIRECTORY \"${GIT_DIR}\")\n message(FATAL_ERROR \"\\\"${GIT_DIR}\\\" is not a directory\")\n endif()\n if (NOT IS_ABSOLUTE \"${GIT_DIR}\")\n message(FATAL_ERROR \\\"\"${GIT_DIR}\\\" is not an absolute path\")\n endif()\n find_package(Git)\n if (NOT Git_FOUND)\n set(${OUTPUT_VAR} \"GIT-NOTFOUND\" PARENT_SCOPE)\n return()\n endif()\n get_filename_component(GIT_WORKING_DIR \"${GIT_DIR}\" DIRECTORY)\n execute_process(\n COMMAND\n \"${GIT_EXECUTABLE}\"\n \"describe\"\n \"--long\"\n WORKING_DIRECTORY\n \"${GIT_WORKING_DIR}\"\n RESULT_VARIABLE\n GIT_EXIT_CODE\n OUTPUT_VARIABLE\n Z3_GIT_DESCRIPTION\n OUTPUT_STRIP_TRAILING_WHITESPACE\n )\n if (NOT \"${GIT_EXIT_CODE}\" EQUAL 0)\n message(WARNING \"Failed to execute git\")\n set(${OUTPUT_VAR} NOTFOUND PARENT_SCOPE)\n return()\n endif()\n set(${OUTPUT_VAR} \"${Z3_GIT_DESCRIPTION}\" PARENT_SCOPE)\nendfunction()\n"
},
{
"path": "cmake/jfs_add_component.cmake",
"content": "#===------------------------------------------------------------------------===#\n#\n# JFS\n#\n# Copyright 2017-2018 Daniel Liew\n#\n# This file is distributed under the MIT license.\n# See LICENSE.txt for details.\n#\n#===------------------------------------------------------------------------===#\n\nfunction(jfs_add_component target_name)\n # Components are explicitly STATIC because we don't support building them\n # as shared libraries.\n add_library(${target_name} STATIC ${ARGN})\n # Use of `PUBLIC` means these will propagate to targets that use this component.\n if ((\"${CMAKE_VERSION}\" VERSION_EQUAL \"3.3\") OR (\"${CMAKE_VERSION}\" VERSION_GREATER \"3.3\"))\n # In newer CMakes we can make sure that the flags are only used when compiling C++\n target_compile_options(${target_name} PUBLIC\n $<$:${JFS_COMPONENT_CXX_FLAGS}>)\n else()\n # For older CMakes just live with the warnings we get for passing C++ only flags\n # to the C compiler.\n target_compile_options(${target_name} PUBLIC ${JFS_COMPONENT_CXX_FLAGS})\n endif()\n target_include_directories(${target_name} PUBLIC ${JFS_COMPONENT_EXTRA_INCLUDE_DIRS})\n target_compile_definitions(${target_name} PUBLIC ${JFS_COMPONENT_CXX_DEFINES})\n target_link_libraries(${target_name} PUBLIC ${JFS_COMPONENT_EXTRA_LIBRARIES})\nendfunction()\n"
},
{
"path": "cmake/jfs_component_add_cxx_flag.cmake",
"content": "#===------------------------------------------------------------------------===#\n#\n# JFS\n#\n# Copyright 2017-2018 Daniel Liew\n#\n# This file is distributed under the MIT license.\n# See LICENSE.txt for details.\n#\n#===------------------------------------------------------------------------===#\ninclude(CheckCXXCompilerFlag)\ninclude(CMakeParseArguments)\n\nfunction(jfs_component_add_cxx_flag flag)\n CMAKE_PARSE_ARGUMENTS(jfs_component_add_cxx_flag \"REQUIRED\" \"\" \"\" ${ARGN})\n string(REPLACE \"-\" \"_\" SANITIZED_FLAG_NAME \"${flag}\")\n string(REPLACE \"/\" \"_\" SANITIZED_FLAG_NAME \"${SANITIZED_FLAG_NAME}\")\n string(REPLACE \"=\" \"_\" SANITIZED_FLAG_NAME \"${SANITIZED_FLAG_NAME}\")\n string(REPLACE \" \" \"_\" SANITIZED_FLAG_NAME \"${SANITIZED_FLAG_NAME}\")\n string(REPLACE \"+\" \"_\" SANITIZED_FLAG_NAME \"${SANITIZED_FLAG_NAME}\")\n unset(HAS_${SANITIZED_FLAG_NAME})\n CHECK_CXX_COMPILER_FLAG(\"${flag}\" HAS_${SANITIZED_FLAG_NAME})\n if (jfs_component_add_cxx_flag_REQUIRED AND NOT HAS_${SANITIZED_FLAG_NAME})\n message(FATAL_ERROR \"The flag \\\"${flag}\\\" is required but your C++ compiler doesn't support it\")\n endif()\n if (HAS_${SANITIZED_FLAG_NAME})\n message(STATUS \"C++ compiler supports ${flag}\")\n list(APPEND JFS_COMPONENT_CXX_FLAGS \"${flag}\")\n set(JFS_COMPONENT_CXX_FLAGS ${JFS_COMPONENT_CXX_FLAGS} PARENT_SCOPE)\n else()\n message(STATUS \"C++ compiler does not support ${flag}\")\n endif()\nendfunction()\n"
},
{
"path": "cmake/jfs_external_project_utils.cmake",
"content": "#===------------------------------------------------------------------------===#\n#\n# JFS\n#\n# Copyright 2017-2018 Daniel Liew\n#\n# This file is distributed under the MIT license.\n# See LICENSE.txt for details.\n#\n#===------------------------------------------------------------------------===#\nfunction(jfs_get_external_project_build_command OUTPUT_VAR BUILD_DIR)\n if (\"${CMAKE_GENERATOR}\" STREQUAL \"Unix Makefiles\")\n # HACK: This hack means that if the build generator for JFS\n # is Make then `-j` value will passed through to make run\n # to build the external project.\n # See\n # http://cmake.3232098.n2.nabble.com/How-would-I-use-parallel-make-on-ExternalProjects-td5609078.html\n #\n set(JFS_EXTERNAL_PROJECT_BUILD_COMMAND \"BUILD_COMMAND\" \"$(MAKE)\")\n else()\n include(ProcessorCount)\n ProcessorCount(NUM_CPUS)\n message(STATUS \"Detected ${NUM_CPUS} CPUS. Will run this many jobs when building runtime tests\")\n set(JFS_EXTERNAL_PROJECT_BUILD_COMMAND\n \"BUILD_COMMAND\" \"${CMAKE_COMMAND}\" \"--build\" \"${BUILD_DIR}\" \"--\" \"-j${NUM_CPUS}\")\n endif()\n set(${OUTPUT_VAR} ${JFS_EXTERNAL_PROJECT_BUILD_COMMAND} PARENT_SCOPE)\nendfunction()\n"
},
{
"path": "cmake/jfs_get_llvm_components.cmake",
"content": "#===------------------------------------------------------------------------===#\n#\n# JFS\n#\n# Copyright 2017-2018 Daniel Liew\n#\n# This file is distributed under the MIT license.\n# See LICENSE.txt for details.\n#\n#===------------------------------------------------------------------------===#\n\nfunction(jfs_get_llvm_components DESTVAR)\n if (${ARGC} LESS 2)\n message(FATAL_ERROR \"Insufficent number of argument\")\n endif()\n llvm_map_components_to_libnames(llvm_components ${ARGN})\n set(${DESTVAR} ${llvm_components} PARENT_SCOPE)\nendfunction()\n"
},
{
"path": "docs/tutorial/0-basics-example.smt2",
"content": "(declare-fun a () (_ FloatingPoint 11 53))\n(declare-fun b () (_ FloatingPoint 11 53))\n(define-fun a_b_rne () (_ FloatingPoint 11 53) (fp.div RNE a b))\n(define-fun a_b_rtp () (_ FloatingPoint 11 53) (fp.div RTP a b))\n(assert (not (fp.isNaN a)))\n(assert (not (fp.isNaN b)))\n(assert (not (fp.eq a_b_rne a_b_rtp)))\n(assert (not (fp.isNaN a_b_rne)))\n(assert (not (fp.isNaN a_b_rtp)))\n(check-sat)\n"
},
{
"path": "docs/tutorial/0-basics.md",
"content": "# JFS basics\n\nThis tutorial will walk you through the basics of using JFS.\n\nJFS is designed to solve constraints in the [SMT-LIBv2.6 format](http://smtlib.cs.uiowa.edu/).\nMore specifically it is designed to solve constraints that\nuse any combination of Booleans, BitVectors, and floating-point\ntypes.\n\nLet's walk through running JFS on the constraints in the [0-basics-example.smt2](0-basics-example.smt2) file.\n\nTry running the following. **NOTE the $ symbol indicates a shell\nprompt and it should not be typed.**\n\n```\n$ jfs 0-basics-example.smt2\nsat\n```\n\nWe can see that the tool responded with `sat` meaning that JFS found\na satisfying assignment to the constraints in `0-basics-example.smt2`.\n\n## Verbose output\n\nHow do we see what happened? We can use the `-v=1` to see more information. The `-v` sets the verbosity level.\n\n```\n$ jfs -v=1 -keep-output-dir 0-basics-example.smt2\n(WorkingDirectoryManager \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2\", deleteOnDestruction: 1)\npathToBinary: \"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/bin/clang++\"\npathToRuntimeIncludeDir: \"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/include\"\npathToLibFuzzerLib: \"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/LibFuzzer_RelWithDebInfo/Fuzzer/libLLVMFuzzer.a\"\noptimizationLevel: O0\ndebug symbols:false\nuseASan: false\nuseUBSan: false\nsanitizerCoverageOptions: TRACE_PC_GUARD\n(Parser starting)\n(Parser finished)\n(QueryPassManager starting)\n(QueryPassManager \"AndHoisting\")\n(QueryPassManager \"Simplification\")\n(QueryPassManager \"AndHoisting\")\n(QueryPassManager \"Simplification\")\n(QueryPassManager \"ConstantPropagation\")\n(QueryPassManager \"AndHoisting\")\n(QueryPassManager \"Simplification\")\n(QueryPassManager \"ConstantPropagation\")\n(QueryPassManager \"Simplification\")\n(QueryPassManager \"AndHoisting\")\n(QueryPassManager \"DuplicateConstraintElimination\")\n(QueryPassManager \"TrueConstraintElimination\")\n(QueryPassManager \"SimpleContradictionsToFalse\")\n(QueryPassManager \"DuplicateConstraintElimination\")\n(QueryPassManager finished)\n(using solver \"CXXFuzzingSolver\")\n(QueryPassManager starting)\n(QueryPassManager \"EqualityExtractionPass\")\n(QueryPassManager \"FreeVariableToBufferAssignmentPass\")\n(QueryPassManager finished)\n(QueryPassManager starting)\n(QueryPassManager \"SortConformanceCheckPass\")\n(QueryPassManager finished)\n(QueryPassManager starting)\n(QueryPassManager \"CXXProgramBuilder\")\n(QueryPassManager finished)\n(ClangInvocationManager\n [\"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/bin/clang++\", \"-std=c++11\", \"-I\", \"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/include\", \"-O0\", \"-fno-omit-frame-pointer\", \"-fsanitize-coverage=trace-pc-guard\", \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/program.cpp\", \"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/SMTLIB/SMTLIB__DebugSymbols_Optimized_TracePCGuard/libJFSSMTLIBRuntime.a\", \"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/LibFuzzer_RelWithDebInfo/Fuzzer/libLLVMFuzzer.a\", \"-o\", \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/fuzzer\", ]\n)\n(SeedManager effectiveBound:18446744073709551615)\n(SeedManager creating seed \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/corpus/zeros_0\")\n(SeedManager creating seed \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/corpus/ones_0\")\n(SeedManager active generators exhausted)\n(SeedManager wrote 2 seeds (16 bytes each))\n(LibFuzzerInvocationManager\n[\"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/fuzzer\", \"-runs=-1\", \"-seed=1\", \"-mutate_depth=5\", \"-cross_over=1\", \"-max_len=16\", \"-use_cmp=0\", \"-print_final_stats=1\", \"-reduce_inputs=0\", \"-default_mutators_resize_input=0\", \"-handle_abrt=1\", \"-handle_bus=0\", \"-handle_fpe=0\", \"-handle_ill=0\", \"-handle_int=1\", \"-handle_segv=0\", \"-handle_term=1\", \"-handle_xfsz=1\", \"-artifact_prefix=/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/artifacts/\", \"-error_exitcode=77\", \"-timeout_exitcode=88\", \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/corpus\", ]\n)\nINFO: Seed: 1\nINFO: HACK: Mutators that resize input DISABLED!\nINFO: Loaded 1 modules (443 guards): 443 [0x677fd0, 0x6786bc),\nINFO: 2 files found in /home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/corpus\nJFS WARNING: Wrong sized input tried.\nINFO: seed corpus: files: 2 min: 16b max: 16b total: 32b rss: 33Mb\n#3 INITED cov: 23 ft: 23 corp: 2/32b exec/s: 0 rss: 33Mb\n#6 NEW cov: 24 ft: 26 corp: 3/48b exec/s: 0 rss: 33Mb L: 16/16 MS: 3 CopyPart-CopyPart-ChangeBinInt-\n#9 NEW cov: 25 ft: 27 corp: 4/64b exec/s: 0 rss: 33Mb L: 16/16 MS: 3 CrossOver-CopyPart-CrossOver-\n==24758== ERROR: libFuzzer: deadly signal\n #0 0x42bcd3 in __sanitizer_print_stack_trace /home/user/dev/jfs/llvm6/src/projects/compiler-rt/lib/ubsan/ubsan_diag_standalone.cc:29\n #1 0x43e811 in fuzzer::Fuzzer::CrashCallback() /home/user/dev/jfs/jfs/src/runtime/LibFuzzer/Fuzzer/FuzzerLoop.cpp:233:5\n #2 0x43e7df in fuzzer::Fuzzer::StaticCrashSignalCallback() /home/user/dev/jfs/jfs/src/runtime/LibFuzzer/Fuzzer/FuzzerLoop.cpp:206:6\n #3 0x151b23c44b8f (/usr/lib/libpthread.so.0+0x11b8f)\n #4 0x151b23289efa in __GI_raise (/usr/lib/libc.so.6+0x34efa)\n #5 0x151b2328b2c0 in __GI_abort (/usr/lib/libc.so.6+0x362c0)\n #6 0x42e4a5 in LLVMFuzzerTestOneInput (/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/fuzzer+0x42e4a5)\n #7 0x43fa13 in fuzzer::Fuzzer::ExecuteCallback(unsigned char const*, unsigned long) /home/user/dev/jfs/jfs/src/runtime/LibFuzzer/Fuzzer/FuzzerLoop.cpp:524:13\n #8 0x43f2ab in fuzzer::Fuzzer::RunOne(unsigned char const*, unsigned long, bool, fuzzer::InputInfo*, bool*) /home/user/dev/jfs/jfs/src/runtime/LibFuzzer/Fuzzer/FuzzerLoop.cpp:449:3\n #9 0x44043d in fuzzer::Fuzzer::MutateAndTestOne() /home/user/dev/jfs/jfs/src/runtime/LibFuzzer/Fuzzer/FuzzerLoop.cpp:657:19\n #10 0x440c75 in fuzzer::Fuzzer::Loop(std::vector, std::allocator >, fuzzer::fuzzer_allocator, std::allocator > > > const&) /home/user/dev/jfs/jfs/src/runtime/LibFuzzer/Fuzzer/FuzzerLoop.cpp:784:5\n #11 0x437a6b in fuzzer::FuzzerDriver(int*, char***, int (*)(unsigned char const*, unsigned long)) /home/user/dev/jfs/jfs/src/runtime/LibFuzzer/Fuzzer/FuzzerDriver.cpp:755:6\n #12 0x4331a0 in main /home/user/dev/jfs/jfs/src/runtime/LibFuzzer/Fuzzer/FuzzerMain.cpp:20:10\n #13 0x151b232769a6 in __libc_start_main (/usr/lib/libc.so.6+0x219a6)\n #14 0x406af9 in _start (/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/fuzzer+0x406af9)\n\nNOTE: libFuzzer has rudimentary signal handlers.\n Combine libFuzzer with AddressSanitizer or similar for better crash reports.\nSUMMARY: libFuzzer: deadly signal\nMS: 1 CopyPart-; base unit: 1519e74668a11df04e90de531274a5929990d1fa\n0x0,0xff,0xff,0xff,0xff,0xff,0xff,0x0,0x0,0x0,0x0,0x0,0xff,0xff,0xff,0x0,\n\\x00\\xff\\xff\\xff\\xff\\xff\\xff\\x00\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\x00\nartifact_prefix='/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/artifacts/'; Test unit written to /home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/artifacts/crash-26f92ccb5076c2b6534271d13d4ac70dc5c26f2f\nBase64: AP///////wAAAAAA////AA==\nstat::number_of_executed_units: 25\nstat::average_exec_per_sec: 0\nstat::new_units_added: 2\nstat::slowest_unit_time_sec: 0\nstat::peak_rss_mb: 38\nsat\n```\n\nThe verbose output shows a lot of internal implementation details of JFS.\nWe'll now highlight some of the important information.\n\nThe line below informs us where JFS's temporary working directory will be\nlocated (note this can be set by using the `-output-dir` option).\nNote that `deleteOnDestruction` is set to 1 which means the temporary working\ndirectory will be deleted when JFS exits. To prevent this use the `-keep-output-dir` command line option.\n\n```\n(WorkingDirectoryManager \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2\", deleteOnDestruction: 1)\n```\n\nThe following lines indicate that the SMT-LIB parser is running.\n\n```\n(Parser starting)\n(Parser finished)\n```\n\nAfter parsing the next step is to run a set of simplification passes\non the constraints. We can see this in the `(QueryPassManager ...)` lines.\n\nAfter this we see the line `(using solver \"CXXFuzzingSolver\")`. This informs\nus that the CXXFuzzingSolver back-end is being used. Note this can be changed\non the command line. See `--help`, e.g. `-z3` causes Z3 to be used to solve the simplified constraints.\n\nAfter this we see the `QueryPassManager` running again. This is running\nsome passes that are specific to the CXXFuzzingSolver backend. Notice that\na pass named `CXXProgramBuilder` is executed. This pass reads the constraints\nand constructs a C++ program that encodes the constraints as a path\nreachability problem.\n\nAfter this we see the following.\n\n```\n(ClangInvocationManager\n [\"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/bin/clang++\", \"-std=c++11\", \"-I\", \"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/include\", \"-O0\", \"-fno-omit-frame-pointer\", \"-fsanitize-coverage=trace-pc-guard\", \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/program.cpp\", \"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/SMTLIB/SMTLIB__DebugSymbols_Optimized_TracePCGuard/libJFSSMTLIBRuntime.a\",\n \"/home/user/dev/jfs/jfs/builds/upgrades/gcc_rel/runtime/LibFuzzer_RelWithDebInfo/Fuzzer/libLLVMFuzzer.a\", \"-o\", \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/fuzzer\", ]\n)\n```\n\nThis shows us how the Clang compiler is invoked to take the generated C++ programs and generate native code that is linked with [LibFuzzer](https://llvm.org/docs/LibFuzzer.html).\n\nAfter this we then see the following.\n\n```\n(SeedManager effectiveBound:18446744073709551615)\n(SeedManager creating seed \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/corpus/zeros_0\")\n(SeedManager creating seed \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/corpus/ones_0\")\n(SeedManager active generators exhausted)\n(SeedManager wrote 2 seeds (16 bytes each))\n```\n\nThis is informing us that JFS has created two seeds to fuzz the generated\nprograms and that each seed is 16 bytes.\n\nAfter this we see then the following.\n\n```\n(LibFuzzerInvocationManager\n[\"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/fuzzer\", \"-runs=-1\", \"-seed=1\", \"-mutate_depth=5\", \"-cross_over=1\", \"-max_len=16\", \"-use_cmp=0\", \"-print_final_stats=1\", \"-reduce_inputs=0\", \"-default_mutators_resize_input=0\", \"-handle_abrt=1\", \"-handle_bus=0\", \"-handle_fpe=0\", \"-handle_ill=0\", \"-handle_int=1\", \"-handle_segv=0\", \"-handle_term=1\", \"-handle_xfsz=1\", \"-artifact_prefix=/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/artifacts/\", \"-error_exitcode=77\", \"-timeout_exitcode=88\", \"/home/user/dev/jfs/jfs/src/0-basics-example.smt2-2/corpus\", ]\n)\n```\n\nThis shows us how the generated binary is invoked to run LibFuzzer.\n\nThe output that follows this is [LibFuzzer's output](https://llvm.org/docs/LibFuzzer.html#output). Here we can see that\nLibFuzzer catches a deadly signal.\n\n```\n==24758== ERROR: libFuzzer: deadly signal\n```\n\nDue to the way the generated program is constructed, this indicates that\na satisfying assignment to constraints has been found.\n\n## Working directory\n\nWe can run the example again but this time keeping the working directory and\ngiving it a fixed name.\n\n```\n$ jfs -keep-output-dir -output-dir=wd 0-basics-example.smt2\nsat\n$ cd wd\n$ ls\nartifacts clang.stderr.txt clang.stdout.txt corpus fuzzer libfuzzer.stderr.txt libfuzzer.stdout.txt program.cpp\n```\n\n* `artifacts/` - Contains the input that is a satisfying assignment (if any).\n* `clang.stderr.txt` - Contains any standard error output from the Clang invocation.\n* `clang.stdout.txt` - Contains any standard output from the Clang invocation.\n* `corpus/` - Contains the fuzzing corpus (seeds + found inputs).\n* `fuzzer` - Is the fuzzing binary that is executed by JFS\n* `libfuzzer.stderr.txt` - Contains any standard output from running the `fuzzer` binary.\n* `libfuzzer.stderr.txt` - Contains any standard error output from running the `fuzzer` binary.\n* `program.cpp` - The generated C++ program that is compiled using Clang.\n\nNote that the `*.stdout.txt` and `*.stderr.txt` files will not be created\nif JFS is used in verbose mode because the output goes to JFS's standard output and standard error output respectively. This behaviour can be changed\nby using the `-redirect-clang-output` and `-redirect-libfuzzer-output` options.\n"
},
{
"path": "docs/tutorial/1-setting-resource-limits.md",
"content": "# Setting JFS resource limits\n\nTODO\n"
},
{
"path": "docs/tutorial/2-compilation-options-and-runtimes.md",
"content": "# Compilation options and runtimes\n\nTODO\n"
},
{
"path": "docs/tutorial/3-resumming-fuzzing.md",
"content": "# Resumming fuzzing\n\nTODO\n"
},
{
"path": "docs/tutorial/4-getting-models.md",
"content": "# Getting a model from JFS\n\nTODO\n"
},
{
"path": "docs/tutorial/5-jfs-smt2cxx.md",
"content": "# The `jfs-smt2cxx` tool\n\nTODO\n"
},
{
"path": "docs/tutorial/6-jfs-opt.md",
"content": "# The `jfs-opt` tool\n\nTODO\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/CXXFuzzingSolver.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_FUZZING_SOLVER_H\n#define JFS_CXX_FUZZING_BACKEND_FUZZING_SOLVER_H\n#include \"jfs/FuzzingCommon/FuzzingSolver.h\"\n\nnamespace jfs {\nnamespace cxxfb {\n\nclass CXXFuzzingSolverImpl;\nclass CXXFuzzingSolverOptions;\n\n// This solver emits a CXX program and fuzzes it to find a satisfying\n// assignment.\nclass CXXFuzzingSolver : public jfs::fuzzingCommon::FuzzingSolver {\nprivate:\n std::unique_ptr impl;\n\nprotected:\n std::unique_ptr\n fuzz(jfs::core::Query& q, bool produceModel,\n std::shared_ptr info) override;\n\npublic:\n CXXFuzzingSolver(\n std::unique_ptr options,\n std::unique_ptr wdm,\n jfs::core::JFSContext& ctx);\n ~CXXFuzzingSolver();\n llvm::StringRef getName() const override;\n void cancel() override;\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/CXXFuzzingSolverOptions.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_FUZZING_SOLVER_OPTIONS_H\n#define JFS_CXX_FUZZING_BACKEND_FUZZING_SOLVER_OPTIONS_H\n#include \"jfs/CXXFuzzingBackend/CXXProgramBuilderOptions.h\"\n#include \"jfs/CXXFuzzingBackend/ClangOptions.h\"\n#include \"jfs/Core/SolverOptions.h\"\n#include \"jfs/FuzzingCommon/FuzzingSolverOptions.h\"\n#include \"jfs/FuzzingCommon/LibFuzzerOptions.h\"\n#include \"jfs/FuzzingCommon/SeedManagerOptions.h\"\n#include \n\nnamespace jfs {\nnamespace cxxfb {\n\nclass CXXFuzzingSolver;\nclass CXXFuzzingSolverImpl;\n\nclass CXXFuzzingSolverOptions\n : public jfs::fuzzingCommon::FuzzingSolverOptions {\nprivate:\n // Options\n std::unique_ptr clangOpt;\n std::unique_ptr libFuzzerOpt;\n std::unique_ptr cxxProgramBuilderOpt;\n std::unique_ptr seedManagerOpt;\n\npublic:\n CXXFuzzingSolverOptions(\n std::unique_ptr<\n jfs::fuzzingCommon::FreeVariableToBufferAssignmentPassOptions>\n fvtbapOptions,\n std::unique_ptr clangOpt,\n std::unique_ptr libFuzzerOpt,\n std::unique_ptr cxxProgramBuilderOpt,\n std::unique_ptr seedManagerOpt,\n bool debugSaveModel);\n static bool classof(const SolverOptions* so) {\n return so->getKind() == CXX_FUZZING_SOLVER_KIND;\n }\n const ClangOptions* getClangOptions() const { return clangOpt.get(); }\n // FIXME: This needs rethinking. This isn't const because the options\n // need to be populated with internal implementation details before being\n // used.\n jfs::fuzzingCommon::LibFuzzerOptions* getLibFuzzerOptions() {\n return libFuzzerOpt.get();\n }\n const CXXProgramBuilderOptions* getCXXProgramBuilderOptions() const {\n return cxxProgramBuilderOpt.get();\n }\n friend class CXXFuzzingSolver;\n friend class CXXFuzzingSolverImpl;\n\n // public for convenience.\n bool redirectClangOutput;\n bool redirectLibFuzzerOutput;\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/CXXProgram.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_CXX_PROGRAM\n#define JFS_CXX_FUZZING_BACKEND_CXX_PROGRAM\n#include \"llvm/Support/raw_ostream.h\"\n#include \n#include \n#include \n#include \n\nnamespace jfs {\nnamespace cxxfb {\n\nclass CXXDecl;\nclass CXXCodeBlock;\nclass CXXType;\nclass CXXFunctionArgument;\nclass CXXFunctionDecl;\nclass CXXStatement;\nusing CXXDeclRef = std::shared_ptr;\nusing CXXCodeBlockRef = std::shared_ptr;\nusing CXXTypeRef = std::shared_ptr;\nusing CXXFunctionArgumentRef = std::shared_ptr;\nusing CXXStatementRef = std::shared_ptr;\nusing CXXFunctionDeclRef = std::shared_ptr;\n\n// Base class for all declarations\nclass CXXDecl {\nprotected:\n // CXXDecl's form a tree with parents owning the children.\n // Therefore we don't need to partcipate in ownership (like\n // CXXDeclRef would) and raw pointers are fine.\n CXXDecl* parent;\n\npublic:\n CXXDecl(CXXDecl* parent);\n virtual ~CXXDecl();\n virtual void print(llvm::raw_ostream&) const = 0;\n CXXDecl* getParent() const;\n void dump() const;\n};\n\n// Include\nclass CXXIncludeDecl : public CXXDecl {\nprivate:\n std::string path;\n bool isSystemInclude;\n\npublic:\n CXXIncludeDecl(CXXDecl* parent, llvm::StringRef path, bool systemHeader);\n ~CXXIncludeDecl() {}\n void print(llvm::raw_ostream&) const override;\n const std::string& getPath() const { return path; }\n};\n\n// Statement (for use inside code blocks)\nclass CXXStatement : public CXXDecl {\npublic:\n CXXStatement(CXXDecl* parent) : CXXDecl(parent) {}\n ~CXXStatement();\n};\n\n// Comment block\nclass CXXCommentBlock : public CXXStatement {\nprivate:\n std::string comment;\n\npublic:\n CXXCommentBlock(CXXDecl* parent, llvm::StringRef comment)\n : CXXStatement(parent), comment(comment) {}\n void print(llvm::raw_ostream&) const override;\n const std::string& getComment() const { return comment; }\n};\n\nclass CXXCodeBlock;\nclass CXXType;\nclass CXXFunctionArgument;\n// Function definition\nclass CXXFunctionDecl : public CXXDecl {\nprivate:\n std::string name;\n CXXTypeRef returnTy;\n std::vector arguments;\n bool hasCVisibility;\n\npublic:\n // FIXME: shouldn't be public\n CXXCodeBlockRef defn;\n // Declaration\n CXXFunctionDecl(CXXDecl* parent, llvm::StringRef name, CXXTypeRef returnTy,\n std::vector& arguments,\n bool hasCVisibility);\n // Definition\n ~CXXFunctionDecl();\n void print(llvm::raw_ostream&) const override;\n bool isDecl() const { return defn.get() == nullptr; }\n bool isDefn() const { return !isDecl(); }\n};\n\n// CXXType\nclass CXXType : public CXXDecl {\nprivate:\n std::string name;\n bool isConst;\n\npublic:\n CXXType(CXXDecl* parent, llvm::StringRef name, bool isConst);\n CXXType(CXXDecl* parent, llvm::StringRef name);\n ~CXXType();\n void print(llvm::raw_ostream&) const override;\n llvm::StringRef getName() const { return name; }\n};\n\n// CXXFunctionArgument\nclass CXXFunctionArgument : public CXXDecl {\nprivate:\n std::string name;\n CXXTypeRef argType;\n\npublic:\n CXXFunctionArgument(CXXDecl* parent, llvm::StringRef name,\n CXXTypeRef argType);\n ~CXXFunctionArgument();\n void print(llvm::raw_ostream&) const override;\n};\n\n// CXXCodeBlock\nclass CXXCodeBlock : public CXXDecl {\npublic:\n // FIXME: shouldn't be public but its easier to just write to this\n std::list statements;\n CXXCodeBlock(CXXDecl* parent);\n ~CXXCodeBlock();\n void print(llvm::raw_ostream&) const override;\n};\n\n// CXXIfStatement\nclass CXXIfStatement : public CXXStatement {\nprivate:\n std::string condition;\n\npublic:\n CXXIfStatement(CXXCodeBlock* parent, llvm::StringRef condition);\n void print(llvm::raw_ostream&) const override;\n // FIXME: shouldn't be public\n CXXCodeBlockRef trueBlock;\n CXXCodeBlockRef falseBlock;\n};\n\n// CXXReturnIntStatement\nclass CXXReturnIntStatement : public CXXStatement {\nprivate:\n int returnValue;\n\npublic:\n CXXReturnIntStatement(CXXCodeBlock* parent, int returnValue);\n void print(llvm::raw_ostream&) const override;\n};\n\n// CXXDeclAndDefnVarStatement\nclass CXXDeclAndDefnVarStatement : public CXXStatement {\nprivate:\n CXXTypeRef ty;\n std::string name;\n std::string valueExpr;\n\npublic:\n CXXDeclAndDefnVarStatement(CXXDecl* parent, CXXTypeRef ty,\n llvm::StringRef name, llvm::StringRef valueExpr);\n llvm::StringRef getName() const { return valueExpr; }\n void print(llvm::raw_ostream&) const override;\n};\n\n// This is a hack\n// CXXGenericStatement\nclass CXXGenericStatement : public CXXStatement {\nprivate:\n std::string statement;\n\npublic:\n CXXGenericStatement(CXXDecl* parent, llvm::StringRef statement);\n void print(llvm::raw_ostream&) const override;\n};\n\nclass CXXProgram : public CXXDecl {\nprivate:\n typedef std::vector declStorageTy;\n declStorageTy decls;\n // FIXME: This should really be a set but we want the order that libraries\n // are requested to be preserved.\n typedef std::vector libNameStoreageTy;\n libNameStoreageTy requiredLibs;\n bool recordsRuntimeStats;\n\npublic:\n CXXProgram() : CXXDecl(nullptr), recordsRuntimeStats(false) {}\n void print(llvm::raw_ostream&) const override;\n void appendDecl(CXXDeclRef);\n void addRequiredLibrary(llvm::StringRef name); // FIXME: Remove unused feature\n bool\n libraryIsRequired(llvm::StringRef name) const; // FIXME: Remove unused feature\n bool getRecordsRuntimeStats() const { return recordsRuntimeStats; }\n void setRecordsRuntimeStats(bool v) { recordsRuntimeStats = v; }\n // Iterators\n declStorageTy::const_iterator cbegin() const { return decls.cbegin(); }\n declStorageTy::const_iterator cend() const { return decls.cend(); }\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/CXXProgramBuilderOptions.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_CXX_PROGRAM_BUILDER_OPTIONS_H\n#define JFS_CXX_FUZZING_BACKEND_CXX_PROGRAM_BUILDER_OPTIONS_H\n#include \n\nnamespace jfs {\nnamespace cxxfb {\n\nclass CXXProgramBuilderOptions {\nprivate:\n bool recordMaxNumSatisifiedConstraints = false;\n bool recordNumberOfInputs = false;\n bool recordNumberOfWrongSizedInputs = false;\n bool traceIncreaseMaxNumSatisfiedConstraints = false;\n bool traceWrongSizedInputs = false;\n\npublic:\n CXXProgramBuilderOptions();\n bool getRecordMaxNumSatisfiedConstraints() const {\n return recordMaxNumSatisifiedConstraints;\n }\n void setRecordMaxNumSatisfiedConstraints(bool v) {\n recordMaxNumSatisifiedConstraints = v;\n }\n\n bool getRecordNumberOfInputs() const { return recordNumberOfInputs; }\n void setRecordNumberOfInputs(bool v) { recordNumberOfInputs = v; }\n\n bool getRecordNumberOfWrongSizedInputs() const {\n return recordNumberOfWrongSizedInputs;\n }\n void setRecordNumberOfWrongSizedInputs(bool v) {\n recordNumberOfWrongSizedInputs = v;\n }\n\n bool getTraceIncreaseMaxNumSatisfiedConstraints() const {\n return traceIncreaseMaxNumSatisfiedConstraints;\n }\n void setTraceIncreaseMaxNumSatisfiedConstraints(bool v) {\n traceIncreaseMaxNumSatisfiedConstraints = v;\n }\n\n bool getTraceWrongSizedInputs() const { return traceWrongSizedInputs; }\n void setTraceWrongSizedInputs(bool v) { traceWrongSizedInputs = v; }\n\n enum class BranchEncodingTy {\n // Fail fast encoding\n //\n // If a constraint is found to be unsatisfiable fuzzing\n // the current input is immediately halted without checking\n // the remaining constraints.\n //\n // There are several problems with this encoding.\n //\n // * It is sensitive to the order constraints are checked.\n // * Potentially prevents partially satisfying inputs from\n // being observed which then prevents the input corpus\n // from growing.\n //\n // In essence the encoding forces constraints to be solved\n // in particular order.\n FAIL_FAST,\n // Try all encoding\n //\n // This is the \"Serebryany encoding\", named after\n // Kostya Serebryany who proposed this.\n //\n // This encoding evaluates all constraints. This encoding\n // addresses problems from the `TRY_ALL` encoding because\n // this approach means that the order that constraints are\n // checked do not matter.\n //\n // However it introduces a new problem in that in some cases\n // inputs that increase the number of satisfied constraints\n // are not added to the input corpus.\n //\n // For example. Let's say there are three constraints C0, C1, C2, C3.\n // Let's say that Input A satisfies {C0, C1} and Input B satisfies {C2}. So\n // Inputs A and B get added to the corpus. Then we try Input C which\n // satisfies {C0, C1, C2}. This input will not be added to the input corpus\n // because the branches for C0, C1, and C2 were already covered.\n TRY_ALL,\n // Try all IMNCSF\n //\n // IMNCSF - Increase in Maximum Number of Constraints Solved is a Feature\n //\n // This is the \"Cadar encoding\", named after Cristian Cadar\n // who proposed this.\n //\n // This is an enhancement to the `TRY_ALL` encoding that addresses\n // the issue where some inputs that increase the number of solved\n // constraints\n // might not be added to the corpus.\n //\n // This relies on an experimental LibFuzzer feature to treat an increase in\n // the number of solved constraints as a \"feature\".\n //\n // At the time of writing this feature on works on Linux.\n //\n // FIXME: We should guard this so it is only available on Linux.\n TRY_ALL_IMNCSF,\n };\n\nprivate:\n BranchEncodingTy branchEncoding = BranchEncodingTy::FAIL_FAST;\n\npublic:\n BranchEncodingTy getBranchEncoding() const { return branchEncoding; }\n void setBranchEncoding(BranchEncodingTy ty) { branchEncoding = ty; }\n};\n} // namespace cxxfb\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/CXXProgramBuilderPass.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_CXX_PROGRAM_BUILDER_PASS_H\n#define JFS_CXX_FUZZING_BACKEND_CXX_PROGRAM_BUILDER_PASS_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/FuzzingCommon/FuzzingAnalysisInfo.h\"\n#include \"jfs/Transform/QueryPass.h\"\n\nnamespace jfs {\nnamespace cxxfb {\n\nclass CXXProgram;\nclass CXXProgramBuilderPassImpl;\nclass CXXProgramBuilderOptions;\n\nclass CXXProgramBuilderPass : public jfs::transform::QueryPass {\nprivate:\n std::unique_ptr impl;\n\npublic:\n CXXProgramBuilderPass(\n std::shared_ptr info,\n const CXXProgramBuilderOptions* options, jfs::core::JFSContext& ctx);\n ~CXXProgramBuilderPass();\n bool run(jfs::core::Query& q) override;\n virtual llvm::StringRef getName() override;\n // FIXME: Should be a const CXXProgram\n std::shared_ptr getProgram();\n virtual bool convertModel(jfs::core::Model* m) override;\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/ClangInvocationManager.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_CLANG_INVOCATION_MANAGER_H\n#define JFS_CXX_FUZZING_BACKEND_CLANG_INVOCATION_MANAGER_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/Support/ICancellable.h\"\n#include \n\nnamespace jfs {\nnamespace cxxfb {\n\n// Forward declarations\nstruct ClangOptions;\nclass ClangInvocationManagerImpl;\nclass CXXProgram;\n\nclass ClangInvocationManager : public jfs::support::ICancellable {\nprivate:\n std::unique_ptr impl;\n\npublic:\n ClangInvocationManager(jfs::core::JFSContext& ctx);\n virtual ~ClangInvocationManager();\n // Compile `program`. If `sourceFile` is non-empty the source file\n // will be written to disk before being read by Clang. If `sourceFile`\n // is empty the implementation is allowed to pipe the program directly\n // to Clang.\n bool compile(const CXXProgram* program, llvm::StringRef sourceFile,\n llvm::StringRef outputFile, const ClangOptions* options,\n llvm::StringRef stdOutFile, llvm::StringRef stdErrFile);\n void cancel() override;\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/ClangOptions.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_CLANG_OPTIONS_H\n#define JFS_CXX_FUZZING_BACKEND_CLANG_OPTIONS_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \"llvm/Support/raw_ostream.h\"\n#include \n#include \n\nnamespace jfs {\nnamespace cxxfb {\n\nstruct ClangOptions {\n // Paths should be absolute\n std::string pathToBinary;\n std::string pathToRuntimeDir;\n std::string pathToRuntimeIncludeDir;\n std::string pathToLibFuzzerLib;\n enum class OptimizationLevel { O0, O1, O2, O3 };\n OptimizationLevel optimizationLevel;\n bool debugSymbols;\n bool useASan;\n bool useUBSan;\n bool useJFSRuntimeAsserts;\n enum class SanitizerCoverageTy {\n TRACE_PC_GUARD,\n TRACE_CMP,\n // TODO: Add more\n };\n std::vector sanitizerCoverageOptions;\n // FIXME: We should populate this enum from the CMake\n // runtime declarations.\n enum class LibFuzzerBuildType {\n REL_WITH_DEB_INFO,\n };\n bool pureRandomFuzzer;\n // If `pathToExecutable` is not empty then paths will be\n // inferred assuming that `pathToExecutable` is the absolute\n // path to the `jfs` binary.\n ClangOptions(llvm::StringRef pathToExecutable, LibFuzzerBuildType lfbt,\n bool pureRandomFuzzer);\n ClangOptions(bool pureRandomFuzzer);\n void appendSanitizerCoverageOption(SanitizerCoverageTy opt);\n void dump() const;\n void print(llvm::raw_ostream& os) const;\n bool checkPaths(jfs::core::JFSContext& ctx) const;\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/CmdLine/CXXProgramBuilderOptionsBuilder.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_CMDLINE_CXX_PROGRAM_BUILDER_OPTIONS_BUILDER\n#define JFS_CXX_FUZZING_BACKEND_CMDLINE_CXX_PROGRAM_BUILDER_OPTIONS_BUILDER\n#include \"jfs/CXXFuzzingBackend/CXXProgramBuilderOptions.h\"\n#include \"jfs/Core/JFSContext.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \n\nnamespace jfs {\nnamespace cxxfb {\nnamespace cl {\n\nstd::unique_ptr\nbuildCXXProgramBuilderOptionsFromCmdLine();\n}\n} // namespace cxxfb\n} // namespace jfs\n\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/CmdLine/ClangOptionsBuilder.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_CMDLINE_CLANG_OPTIONS_BUILDER_H\n#define JFS_CXX_FUZZING_BACKEND_CMDLINE_CLANG_OPTIONS_BUILDER_H\n#include \"jfs/CXXFuzzingBackend/ClangOptions.h\"\n#include \"jfs/Core/JFSContext.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \n\nnamespace jfs {\nnamespace cxxfb {\nnamespace cl {\n\nstd::unique_ptr\nbuildClangOptionsFromCmdLine(llvm::StringRef pathToExecutable);\n}\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/CmdLine/CommandLineCategory.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_CMDLINE_COMMAND_LINE_CATEGORY_H\n#define JFS_CXX_FUZZING_BACKEND_CMDLINE_COMMAND_LINE_CATEGORY_H\n#include \"llvm/Support/CommandLine.h\"\n\nnamespace jfs {\nnamespace cxxfb {\nnamespace cl {\n\nextern llvm::cl::OptionCategory CommandLineCategory;\n}\n}\n}\n#endif\n"
},
{
"path": "include/jfs/CXXFuzzingBackend/JFSCXXProgramStat.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CXX_FUZZING_BACKEND_JFS_CXX_PROGRAM_STAT_H\n#define JFS_CXX_FUZZING_BACKEND_JFS_CXX_PROGRAM_STAT_H\n#endif\n#include \"jfs/Support/JFSStat.h\"\n\nnamespace jfs {\nnamespace cxxfb {\nclass JFSCXXProgramStat : public jfs::support::JFSStat {\npublic:\n JFSCXXProgramStat(llvm::StringRef name);\n virtual ~JFSCXXProgramStat();\n void printYAML(llvm::ScopedPrinter& os) const override;\n static bool classof(const JFSStat* s) { return s->getKind() == CXX_PROGRAM; }\n\n // FIMXE: Should not be public\n uint64_t numConstraints = 0;\n uint64_t numEntryFuncStatements = 0;\n // FIXME: Doesn't really belong here. The FuzzingAnalysisInfo should have its\n // own stat\n uint64_t numFreeVars = 0;\n uint64_t bufferStoredWidth = 0;\n uint64_t bufferTypeWidth = 0; // Sum of the type widths of each BufferElement\n uint64_t numEqualitySets = 0;\n};\n}\n}\n"
},
{
"path": "include/jfs/Config/config.h.in",
"content": "#ifndef JFS_CONFIG_CONFIG_H\n#define JFS_CONFIG_CONFIG_H\n\n// TODO\n\n#endif\n"
},
{
"path": "include/jfs/Config/depsVersion.h.in",
"content": "#ifndef JFS_CONFIG_DEPS_VERSION_H\n#define JFS_CONFIG_DEPS_VERSION_H\n\n/* LLVM major version number */\n#define LLVM_VERSION_MAJOR @LLVM_VERSION_MAJOR@\n\n/* LLVM minor version number */\n#define LLVM_VERSION_MINOR @LLVM_VERSION_MINOR@\n\n/* Z3 major version number */\n#define Z3_VERSION_MAJOR @Z3_VERSION_MAJOR@\n\n/* Z3 minor version number */\n#define Z3_VERSION_MINOR @Z3_VERSION_MINOR@\n\n/* Useful macro to compile code depending on LLVM version */\n#define LLVM_VERSION(major, minor) (((major) << 8) | (minor))\n#define LLVM_VERSION_CODE LLVM_VERSION(LLVM_VERSION_MAJOR, LLVM_VERSION_MINOR)\n\n#endif\n"
},
{
"path": "include/jfs/Config/version.h.in",
"content": "#ifndef JFS_CONFIG_VERSION_H\n#define JFS_CONFIG_VERSION_H\n\n/* JFS major version number */\n#define JFS_VERSION_MAJOR @JFS_VERSION_MAJOR@\n\n/* JFS minor version number */\n#define JFS_VERSION_MINOR @JFS_VERSION_MINOR@\n\n/* JFS patch version number */\n#define JFS_VERSION_PATCH @JFS_VERSION_PATCH@\n\n/* JFS tweak version number */\n#define JFS_VERSION_TWEAK @JFS_VERSION_TWEAK@\n\n/* JFS git description */\n#cmakedefine JFS_GIT_DESCRIPTION @JFS_GIT_DESCRIPTION@\n\n/* JFS git hash */\n#cmakedefine JFS_GIT_HASH @JFS_GIT_HASH@\n\n#endif\n"
},
{
"path": "include/jfs/Core/IfVerbose.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_IF_VERBOSE_H\n#define JFS_CORE_IF_VERBOSE_H\n\n#define IF_VERB_GT(CTX, VALUE, ACTION) \\\n do { \\\n if (CTX.getVerbosity() > VALUE) { \\\n ACTION; \\\n } \\\n } while (0)\n\n#define IF_VERB(CTX, ACTION) IF_VERB_GT(CTX, 0, ACTION)\n\n#endif\n"
},
{
"path": "include/jfs/Core/JFSContext.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_JFSCONTEXT_H\n#define JFS_CORE_JFSCONTEXT_H\n#include \"z3.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \"llvm/Support/raw_ostream.h\"\n\nnamespace jfs {\nnamespace support {\nclass StatisticsManager;\n}\n}\n\nnamespace jfs {\nnamespace core {\nstruct JFSContextConfig {\n unsigned verbosity = 0;\n bool gathericStatistics = false;\n uint64_t seed = 1;\n};\n\nclass JFSContext;\nclass JFSContextErrorHandler {\npublic:\n enum ErrorAction { STOP, CONTINUE };\n virtual ErrorAction handleZ3error(JFSContext& ctx, Z3_error_code ec) = 0;\n virtual ErrorAction handleFatalError(JFSContext& ctx,\n llvm::StringRef msg) = 0;\n virtual ErrorAction handleGenericError(JFSContext& ctx,\n llvm::StringRef msg) = 0;\n JFSContextErrorHandler();\n virtual ~JFSContextErrorHandler();\n};\n\nclass JFSContextImpl;\nclass RNG;\n\nclass JFSContext {\nprivate:\n const std::unique_ptr impl;\n\npublic:\n JFSContext(const JFSContextConfig& ctxCfg);\n ~JFSContext();\n\n // Don't allow copying\n JFSContext(const JFSContext&) = delete;\n JFSContext(const JFSContext&&) = delete;\n JFSContext& operator=(const JFSContext&) = delete;\n\n bool operator==(const JFSContext& other) const;\n\n bool registerErrorHandler(JFSContextErrorHandler* h);\n bool unRegisterErrorHandler(JFSContextErrorHandler* h);\n\n Z3_context getZ3Ctx() const;\n // TODO: Rethink this API.\n unsigned getVerbosity() const;\n // Message streams\n llvm::raw_ostream& getErrorStream();\n llvm::raw_ostream& getWarningStream();\n llvm::raw_ostream& getDebugStream();\n\n // FIXME: Should check compiler supports attribute\n // Unlike Z3 errors it is guaranteed that execution will\n // not leave this function.\n __attribute__((noreturn)) void raiseFatalError(llvm::StringRef msg);\n\n void raiseError(llvm::StringRef msg);\n jfs::support::StatisticsManager* getStats() const;\n const JFSContextConfig& getConfig() const;\n RNG& getRNG() const;\n};\n}\n}\n#endif // JFS_JFSCONTEXT_H\n"
},
{
"path": "include/jfs/Core/JFSTimerMacros.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_JFS_TIMER_MACROS_H\n#define JFS_CORE_JFS_TIMER_MACROS_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/Support/JFSStat.h\"\n#include \"jfs/Support/ScopedJFSTimerStatAppender.h\"\n#include \"jfs/Support/StatisticsManager.h\"\n\n#define JFS_SM_TIMER(NAME, CTX) \\\n jfs::support::ScopedJFSTimerStatAppender \\\n NAME##_timer(((CTX).getConfig().gathericStatistics) ? (CTX.getStats()) \\\n : nullptr, \\\n #NAME)\n\n#define JFS_AG_TIMER(DECL_NAME, NAME, AG, CTX) \\\n jfs::support::ScopedJFSTimerStatAppender< \\\n jfs::support::JFSAggregateTimerStat> \\\n DECL_NAME##_timer( \\\n ((CTX).getConfig().gathericStatistics) ? (AG.stats.get()) : nullptr, \\\n (NAME))\n\n#define JFS_AG_COL(NAME, CTX) \\\n jfs::support::ScopedJFSAggregateTimerStatAppender< \\\n jfs::support::StatisticsManager> \\\n NAME(((CTX).getConfig().gathericStatistics) ? (CTX.getStats()) \\\n : nullptr, \\\n #NAME)\n#endif\n"
},
{
"path": "include/jfs/Core/Model.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_MODEL_H\n#define JFS_CORE_MODEL_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/Core/Z3Node.h\"\n#include \n\nnamespace jfs {\nnamespace core {\n\nstruct ModelPrintOptions {\n bool sortDecls = false;\n bool useModelKeyword = false;\n};\n\nclass Model {\nprotected:\n jfs::core::Z3ModelHandle z3Model;\n JFSContext& ctx;\n Model(JFSContext& ctx);\n\npublic:\n // The idea behind this interface is to allow implementations\n // to defer working with Z3ModelHandle and only forcing use when\n // `getRepr()` is called. At the time of writing no implementations\n // actually do this so perhaps we should remove this complexity?\n virtual Z3ASTHandle getAssignmentFor(Z3FuncDeclHandle);\n virtual bool addAssignmentFor(Z3FuncDeclHandle decl, Z3ASTHandle e,\n bool allowOverwrite = false);\n virtual std::string getSMTLIBString(ModelPrintOptions* opts = nullptr);\n virtual bool hasAssignmentFor(Z3FuncDeclHandle decl);\n virtual Z3ModelHandle getRepr() { return z3Model; }\n virtual bool replaceRepr(Z3ModelHandle replacement);\n virtual Z3ASTHandle evaluate(Z3ASTHandle e, bool modelCompletion);\n\n JFSContext& getContext();\n virtual ~Model();\n\n static Z3ASTHandle getDefaultValueFor(Z3SortHandle sort);\n};\n\n} // namespace core\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/Core/ModelValidator.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Alastair Donaldson\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_MODEL_VALIDATOR_H\n#define JFS_CORE_MODEL_VALIDATOR_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/Core/Model.h\"\n#include \"jfs/Core/Query.h\"\n#include \"jfs/Core/Z3Node.h\"\n#include \n\nnamespace jfs {\nnamespace core {\n\nclass ValidationFailureInfo {\npublic:\n enum ReasonTy {\n NO_REASON,\n EVALUATED_TO_FALSE,\n EVALUATED_TO_NON_CONSTANT,\n EVALUATED_TO_NON_BOOL_SORT,\n };\n ReasonTy reason;\n uint64_t index;\n Z3ASTHandle constraint;\n Model* model;\n // TODO: Add methods to allow further debugging.\n // It would be useful to recursively walk the AST\n // to find which assignments are responsible and\n // which part of the subtree is causing the constraint\n // to evaluate to false.\n ValidationFailureInfo(ReasonTy reason, uint64_t index, Z3ASTHandle constraint,\n Model* model);\n ValidationFailureInfo();\n static const char* reasonAsString(ReasonTy reason);\n};\n\nclass ModelValidationOptions {\npublic:\n bool warnOnVariablesMissingAssignment = true;\n};\n\nclass ModelValidator {\npublic:\n using VFIContainerTy = std::vector;\n\nprivate:\n VFIContainerTy failures;\n\npublic:\n ModelValidator();\n ~ModelValidator();\n VFIContainerTy::const_iterator cbegin() const { return failures.cbegin(); }\n VFIContainerTy::const_iterator cend() const { return failures.cend(); }\n VFIContainerTy::iterator begin() { return failures.begin(); }\n VFIContainerTy::iterator end() { return failures.end(); }\n uint64_t getNumberOfFailures() const { return failures.size(); }\n void reset();\n bool validate(const Query& q, Model* m,\n const ModelValidationOptions* options = nullptr);\n std::string toStr() const;\n};\n} // namespace core\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/Core/Query.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_QUERY_H\n#define JFS_CORE_QUERY_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/Core/Z3Node.h\"\n#include \"jfs/Core/Z3NodeSet.h\"\n#include \"llvm/Support/raw_ostream.h\"\n#include \n\nnamespace jfs {\nnamespace core {\nclass Query {\nprivate:\n JFSContext& ctx;\n\npublic:\n std::vector constraints;\n Query(JFSContext& ctx);\n ~Query();\n Query(const Query& other);\n // In principle there's no reason we can't have these deleted methods.\n // However we don't need them yet and I don't want the implicit declarations\n // to accidently be called.\n Query(const Query&&) = delete;\n Query& operator=(const Query&) = delete;\n Query& operator=(const Query&&) = delete;\n void dump() const;\n void collectFuncDecls(Z3FuncDeclSet& variables) const;\n void print(llvm::raw_ostream& os) const;\n JFSContext& getContext() const { return ctx; }\n\n static bool areSame(std::vector& a, std::vector& b,\n bool ignoreOrder = false);\n};\n\n// Operator overload for easy printing of queries\nllvm::raw_ostream& operator<<(llvm::raw_ostream& os, const Query& q);\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Core/RNG.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2018 J. Ryan Stinnett\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n\n#ifndef JFS_CORE_RNG_H\n#define JFS_CORE_RNG_H\n\n#include \n#include \n\nnamespace jfs {\nnamespace core {\n\nclass RNG {\nprivate:\n std::mt19937_64 generator;\n\npublic:\n RNG(uint64_t seed)\n : generator(seed ? seed : std::mt19937_64::default_seed) {}\n\n // Produce an integer in the range [0, limit).\n uint64_t generate(uint64_t limit);\n};\n\n} // jfs\n} // core\n\n#endif // JFS_CORE_RNG_H"
},
{
"path": "include/jfs/Core/SMTLIB2Parser.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_SMTLIB2PARSER_H\n#define JFS_CORE_SMTLIB2PARSER_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/Core/Query.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \n\nnamespace llvm {\nclass MemoryBuffer;\n}\n\nnamespace jfs {\nnamespace core {\nclass SMTLIB2Parser : public JFSContextErrorHandler {\npublic:\n SMTLIB2Parser(JFSContext& ctx);\n ~SMTLIB2Parser();\n std::shared_ptr parseFile(llvm::StringRef fileName);\n std::shared_ptr parseStr(llvm::StringRef str);\n std::shared_ptr\n parseMemoryBuffer(std::unique_ptr buffer);\n ErrorAction handleZ3error(JFSContext& ctx, Z3_error_code ec) override;\n ErrorAction handleFatalError(JFSContext& ctx, llvm::StringRef msg) override;\n ErrorAction handleGenericError(JFSContext& ctx, llvm::StringRef msg) override;\n unsigned getErrorCount() const;\n void resetErrorCount();\n\nprivate:\n JFSContext& ctx;\n unsigned errorCount;\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Core/ScopedJFSContextErrorHandler.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_SCOPED_JFS_CONTEXT_ERROR_HANDLER_H\n#define JFS_CORE_SCOPED_JFS_CONTEXT_ERROR_HANDLER_H\n#include \"jfs/Core/JFSContext.h\"\nnamespace jfs {\nnamespace core {\nclass ScopedJFSContextErrorHandler {\nprivate:\n JFSContext& ctx;\n JFSContextErrorHandler* handler;\n\npublic:\n ScopedJFSContextErrorHandler(JFSContext& ctx, JFSContextErrorHandler* h)\n : ctx(ctx), handler(h) {\n ctx.registerErrorHandler(handler);\n }\n ~ScopedJFSContextErrorHandler() { ctx.unRegisterErrorHandler(handler); }\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Core/SimpleModel.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Alastair Donaldson\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_SIMPLE_MODEL_H\n#define JFS_CORE_SIMPLE_MODEL_H\n#include \"jfs/Core/Model.h\"\n\nnamespace jfs {\nnamespace core {\n\n// A model that on creation is empty\nclass SimpleModel : public Model {\npublic:\n SimpleModel(JFSContext& ctx);\n};\n\n} // namespace core\n} // namespace jfs\n\n#endif\n"
},
{
"path": "include/jfs/Core/Solver.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_SOLVER_H\n#define JFS_CORE_SOLVER_H\n#include \"jfs/Core/Query.h\"\n#include \"jfs/Core/SolverOptions.h\"\n#include \"jfs/Support/ICancellable.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \n#include \n\nnamespace jfs {\nnamespace core {\n\nclass Model;\n\nclass SolverResponse {\npublic:\n enum SolverSatisfiability { SAT, UNSAT, UNKNOWN };\n SolverResponse(SolverSatisfiability sat);\n virtual ~SolverResponse();\n const SolverSatisfiability sat;\n virtual Model* getModel() = 0;\n static llvm::StringRef getSatString(SolverSatisfiability);\n};\n\nclass Solver : public jfs::support::ICancellable {\nprotected:\n std::unique_ptr options;\n JFSContext& ctx;\n\npublic:\n Solver(std::unique_ptr options, JFSContext& ctx);\n virtual ~Solver();\n Solver(const Solver&) = delete;\n Solver(const Solver&&) = delete;\n Solver& operator=(const Solver&) = delete;\n // Determine the satisfiability of the query.\n // Iff `produceModel` is false then only satisfiability will\n // be available.\n virtual std::unique_ptr solve(const Query& q,\n bool produceModel) = 0;\n const SolverOptions* getOptions() const;\n virtual llvm::StringRef getName() const = 0;\n JFSContext& getContext() { return ctx; }\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/Core/SolverOptions.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_SOLVER_OPTIONS_H\n#define JFS_CORE_SOLVER_OPTIONS_H\n#include \"llvm/Support/Casting.h\"\n#include \n\nnamespace jfs {\nnamespace core {\n\nclass SolverOptions {\n // START: LLVM RTTI boilerplate code\npublic:\n // NOTE: When updating this enum make sure you update all implementations\n // of `classof(const SolverOptions* so)`.\n enum SolverOptionKind {\n SOLVER_OPTIONS_KIND,\n FUZZING_SOLVER_KIND,\n CXX_FUZZING_SOLVER_KIND,\n LAST_FUZZING_SOLVER_KIND // This is a dummy entry\n };\n\nprivate:\n const SolverOptionKind kind;\n\nprotected:\n SolverOptions(SolverOptionKind kind) : kind(kind) {}\n\npublic:\n SolverOptions() : SolverOptions(SOLVER_OPTIONS_KIND) {}\n virtual ~SolverOptions() {}\n SolverOptionKind getKind() const { return kind; }\n static bool classof(const SolverOptions* so) {\n return so->getKind() == SOLVER_OPTIONS_KIND;\n }\n // END: LLVM RTTI boilerplate code\n // Options common to all solvers\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/Core/ToolErrorHandler.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_TOOL_ERROR_HANDLER_H\n#define JFS_CORE_TOOL_ERROR_HANDLER_H\n#include \"jfs/Core/JFSContext.h\"\n\nnamespace jfs {\nnamespace core {\n\nclass ToolErrorHandler : public JFSContextErrorHandler {\nprivate:\n bool ignoreCanceled;\n\npublic:\n ToolErrorHandler(bool ignoreCanceled) : ignoreCanceled(ignoreCanceled) {}\n\n JFSContextErrorHandler::ErrorAction handleZ3error(JFSContext& ctx,\n Z3_error_code ec) override;\n ErrorAction handleFatalError(JFSContext& ctx, llvm::StringRef msg) override;\n ErrorAction handleGenericError(JFSContext& ctx, llvm::StringRef msg) override;\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Core/Z3ASTCmp.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_Z3_AST_CMP\n#define JFS_CORE_Z3_AST_CMP\n#include \"jfs/Core/Z3Node.h\"\n#include \n\nnamespace jfs {\nnamespace core {\nstruct Z3ASTHashGet {\n size_t operator()(const Z3ASTHandle& h) const {\n return ::Z3_get_ast_hash(h.getContext(), h);\n }\n};\n\nstruct Z3ASTCmp {\n bool operator()(const Z3ASTHandle& a, const Z3ASTHandle b) const {\n assert(a.getContext() == b.getContext() && \"Contexts must be equal\");\n return ::Z3_is_eq_ast(a.getContext(), a, b);\n }\n};\n\nstruct Z3SortHashGet {\n size_t operator()(const Z3SortHandle& h) const {\n return ::Z3_get_ast_hash(h.getContext(), h.asAST());\n }\n};\n\nstruct Z3SortCmp {\n bool operator()(const Z3SortHandle& a, const Z3SortHandle b) const {\n assert(a.getContext() == b.getContext() && \"Contexts must be equal\");\n return ::Z3_is_eq_ast(a.getContext(), a.asAST(), b.asAST());\n }\n};\n\nstruct Z3FuncDeclHashGet {\n size_t operator()(const Z3FuncDeclHandle& h) const {\n return ::Z3_get_ast_hash(h.getContext(),\n ::Z3_func_decl_to_ast(h.getContext(), h));\n }\n};\n\nstruct Z3FuncDeclCmp {\n bool operator()(const Z3FuncDeclHandle& a, const Z3FuncDeclHandle b) const {\n assert(a.getContext() == b.getContext() && \"Contexts must be equal\");\n return ::Z3_is_eq_ast(a.getContext(),\n ::Z3_func_decl_to_ast(a.getContext(), a),\n ::Z3_func_decl_to_ast(b.getContext(), b));\n }\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Core/Z3ASTVisitor.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_Z3_AST_VISITOR_H\n#define JFS_CORE_Z3_AST_VISITOR_H\n#include \"jfs/Core/Z3Node.h\"\n\nnamespace jfs {\nnamespace core {\n\n// FIXME: This design only works for\n// read only traversal. It needs rethinking\n// for Z3AST modification and traversal order\nclass Z3ASTVisitor {\npublic:\n Z3ASTVisitor();\n virtual ~Z3ASTVisitor();\n void visit(Z3ASTHandle e);\n\nprotected:\n // TODO: Add more methods for different Z3 application kinds\n\n // Uninterpreted function\n virtual void visitUninterpretedFunc(Z3AppHandle e) = 0;\n\n // Constants\n virtual void visitBoolConstant(Z3AppHandle e) = 0;\n virtual void visitBitVector(Z3AppHandle e) = 0;\n virtual void visitFloatingPointConstant(Z3AppHandle e) = 0;\n\n // Overloaded operations\n virtual void visitEqual(Z3AppHandle e) = 0;\n virtual void visitDistinct(Z3AppHandle e) = 0;\n virtual void visitIfThenElse(Z3AppHandle e) = 0;\n virtual void visitImplies(Z3AppHandle e) = 0;\n // This isn't part of the core SMT-LIBv2 theory. Is this a Z3 extension?\n virtual void visitIff(Z3AppHandle e) = 0;\n\n // Boolean operations\n virtual void visitAnd(Z3AppHandle e) = 0;\n virtual void visitOr(Z3AppHandle e) = 0;\n virtual void visitXor(Z3AppHandle e) = 0;\n virtual void visitNot(Z3AppHandle e) = 0;\n\n // Arithmetic BitVector operations\n virtual void visitBvNeg(Z3AppHandle e) = 0;\n virtual void visitBvAdd(Z3AppHandle e) = 0;\n virtual void visitBvSub(Z3AppHandle e) = 0;\n virtual void visitBvMul(Z3AppHandle e) = 0;\n virtual void visitBvSDiv(Z3AppHandle e) = 0;\n virtual void visitBvUDiv(Z3AppHandle e) = 0;\n virtual void visitBvSRem(Z3AppHandle e) = 0;\n virtual void visitBvURem(Z3AppHandle e) = 0;\n virtual void visitBvSMod(Z3AppHandle e) = 0;\n\n // Comparison BitVector operations\n virtual void visitBvULE(Z3AppHandle e) = 0;\n virtual void visitBvSLE(Z3AppHandle e) = 0;\n virtual void visitBvUGE(Z3AppHandle e) = 0;\n virtual void visitBvSGE(Z3AppHandle e) = 0;\n virtual void visitBvULT(Z3AppHandle e) = 0;\n virtual void visitBvSLT(Z3AppHandle e) = 0;\n virtual void visitBvUGT(Z3AppHandle e) = 0;\n virtual void visitBvSGT(Z3AppHandle e) = 0;\n virtual void visitBvComp(Z3AppHandle e) = 0;\n\n // Bitwise BitVector operations\n virtual void visitBvAnd(Z3AppHandle e) = 0;\n virtual void visitBvOr(Z3AppHandle e) = 0;\n virtual void visitBvNot(Z3AppHandle e) = 0;\n virtual void visitBvXor(Z3AppHandle e) = 0;\n virtual void visitBvNand(Z3AppHandle e) = 0;\n virtual void visitBvNor(Z3AppHandle e) = 0;\n virtual void visitBvXnor(Z3AppHandle e) = 0;\n\n // Shift and rotation BitVector operations\n virtual void visitBvShl(Z3AppHandle e) = 0;\n virtual void visitBvLShr(Z3AppHandle e) = 0;\n virtual void visitBvAShr(Z3AppHandle e) = 0;\n virtual void visitBvRotateLeft(Z3AppHandle e) = 0;\n virtual void visitBvRotateRight(Z3AppHandle e) = 0;\n\n // Sort changing BitVector operations\n virtual void visitBvConcat(Z3AppHandle e) = 0;\n virtual void visitBvSignExtend(Z3AppHandle e) = 0;\n virtual void visitBvZeroExtend(Z3AppHandle e) = 0;\n virtual void visitBvExtract(Z3AppHandle e) = 0;\n\n // Floating point operations\n virtual void visitFloatingPointFromTriple(Z3AppHandle e) = 0;\n virtual void visitFloatingPointFromIEEEBitVector(Z3AppHandle e) = 0;\n virtual void visitFloatIsNaN(Z3AppHandle e) = 0;\n virtual void visitFloatIsNormal(Z3AppHandle e) = 0;\n virtual void visitFloatIsSubnormal(Z3AppHandle e) = 0;\n virtual void visitFloatIsZero(Z3AppHandle e) = 0;\n virtual void visitFloatIsPositive(Z3AppHandle e) = 0;\n virtual void visitFloatIsNegative(Z3AppHandle e) = 0;\n virtual void visitFloatIsInfinite(Z3AppHandle e) = 0;\n\n virtual void visitFloatIEEEEquals(Z3AppHandle e) = 0;\n virtual void visitFloatLessThan(Z3AppHandle e) = 0;\n virtual void visitFloatLessThanOrEqual(Z3AppHandle e) = 0;\n virtual void visitFloatGreaterThan(Z3AppHandle e) = 0;\n virtual void visitFloatGreaterThanOrEqual(Z3AppHandle e) = 0;\n\n virtual void visitFloatPositiveZero(Z3AppHandle e) = 0;\n virtual void visitFloatNegativeZero(Z3AppHandle e) = 0;\n virtual void visitFloatPositiveInfinity(Z3AppHandle e) = 0;\n virtual void visitFloatNegativeInfinity(Z3AppHandle e) = 0;\n virtual void visitFloatNaN(Z3AppHandle e) = 0;\n\n virtual void visitFloatAbs(Z3AppHandle e) = 0;\n virtual void visitFloatNeg(Z3AppHandle e) = 0;\n virtual void visitFloatMin(Z3AppHandle e) = 0;\n virtual void visitFloatMax(Z3AppHandle e) = 0;\n virtual void visitFloatAdd(Z3AppHandle e) = 0;\n virtual void visitFloatSub(Z3AppHandle e) = 0;\n virtual void visitFloatMul(Z3AppHandle e) = 0;\n virtual void visitFloatDiv(Z3AppHandle e) = 0;\n virtual void visitFloatFMA(Z3AppHandle e) = 0;\n virtual void visitFloatSqrt(Z3AppHandle e) = 0;\n virtual void visitFloatRem(Z3AppHandle e) = 0;\n virtual void visitFloatRoundToIntegral(Z3AppHandle e) = 0;\n virtual void visitConvertToFloatFromFloat(Z3AppHandle e) = 0;\n virtual void visitConvertToFloatFromUnsignedBitVector(Z3AppHandle e) = 0;\n virtual void visitConvertToFloatFromSignedBitVector(Z3AppHandle e) = 0;\n virtual void visitConvertToUnsignedBitVectorFromFloat(Z3AppHandle e) = 0;\n virtual void visitConvertToSignedBitVectorFromFloat(Z3AppHandle e) = 0;\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Core/Z3Node.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_Z3NODE_H\n#define JFS_CORE_Z3NODE_H\n#include \"z3.h\"\n#include \n#include \n#include \n\nnamespace jfs {\nnamespace core {\n\ntemplate class Z3NodeHandle {\n // Internally these Z3 types are pointers\n // so storing these should be cheap.\n // It would be nice if we could infer the Z3_context from the node\n // but I can't see a way to do this from Z3's API.\nprotected:\n T node;\n ::Z3_context context;\n\nprivate:\n // To be specialised\n inline void inc_ref(T node);\n inline void dec_ref(T node);\n\npublic:\n Z3NodeHandle() : node(NULL), context(NULL) {}\n Z3NodeHandle(const T _node, const ::Z3_context _context)\n : node(_node), context(_context) {\n if (node && context) {\n inc_ref(node);\n }\n };\n ~Z3NodeHandle() {\n if (node && context) {\n dec_ref(node);\n }\n }\n Z3NodeHandle(const Z3NodeHandle& b) : node(b.node), context(b.context) {\n if (node && context) {\n inc_ref(node);\n }\n }\n Z3NodeHandle& operator=(const Z3NodeHandle& b) {\n if (node == NULL && context == NULL) {\n // Special case for when this object was constructed\n // using the default constructor. Try to inherit a non null\n // context.\n context = b.context;\n }\n assert(context == b.context && \"Mismatched Z3 contexts!\");\n // node != nullptr ==> context != NULL\n assert((node == NULL || context) &&\n \"Can't have non nullptr node with nullptr context\");\n\n if (node && context) {\n dec_ref(node);\n }\n node = b.node;\n if (node && context) {\n inc_ref(node);\n }\n return *this;\n }\n // To be specialised\n void dump() const;\n std::string toStr() const;\n\n operator T() const { return node; }\n\n Z3_context getContext() const { return context; }\n bool isNull() const { return node == nullptr; }\n};\n\n// Instantiate templates\n\n// Specialise for Z3_sort\ntemplate <> inline void Z3NodeHandle::inc_ref(Z3_sort node) {\n // In Z3 internally this call is just a cast. We could just do that\n // instead to simplify our implementation but this seems cleaner.\n ::Z3_inc_ref(context, ::Z3_sort_to_ast(context, node));\n}\ntemplate <> inline void Z3NodeHandle::dec_ref(Z3_sort node) {\n // In Z3 internally this call is just a cast. We could just do that\n // instead to simplify our implementation but this seems cleaner.\n ::Z3_dec_ref(context, ::Z3_sort_to_ast(context, node));\n}\ntemplate <> void Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\nclass Z3ASTHandle;\n\nclass Z3SortHandle : public Z3NodeHandle {\npublic:\n // Inherit constructors\n using Z3NodeHandle::Z3NodeHandle;\n // Helper methods\n Z3_sort_kind getKind() const;\n bool isBoolTy() const;\n bool isBitVectorTy() const;\n bool isFloatingPointTy() const;\n // Return 0 if not bitvector, floating point, or bool\n unsigned getWidth() const;\n // Return 0 if not a bitvector\n unsigned getBitVectorWidth() const;\n // Return 0 if not floating point\n unsigned getFloatingPointBitWidth() const;\n unsigned getFloatingPointExponentBitWidth() const;\n unsigned getFloatingPointSignificandBitWidth() const; // Includes implicit bit\n Z3ASTHandle asAST() const;\n\n static Z3SortHandle getBoolTy(Z3_context ctx);\n static Z3SortHandle getBitVectorTy(Z3_context, unsigned bitWidth);\n static Z3SortHandle getFloat32Ty(Z3_context ctx);\n static Z3SortHandle getFloat64Ty(Z3_context ctx);\n};\n\n// Specialise for Z3_ast\ntemplate <> inline void Z3NodeHandle::inc_ref(Z3_ast node) {\n ::Z3_inc_ref(context, node);\n}\ntemplate <> inline void Z3NodeHandle::dec_ref(Z3_ast node) {\n ::Z3_dec_ref(context, node);\n}\ntemplate <> void Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\nclass Z3AppHandle;\nclass Z3FuncDeclHandle;\n\n// Provide a class rather than a typedef so we can add\n// additional helper methods.\nclass Z3ASTHandle : public Z3NodeHandle {\npublic:\n // Inherit constructors\n using Z3NodeHandle::Z3NodeHandle;\n\n // Helper methods\n Z3_ast_kind getKind() const;\n bool isApp() const;\n bool isFuncDecl() const;\n bool isSort() const;\n bool isNumeral() const;\n\n bool isTrue() const;\n bool isFalse() const;\n bool isConstant() const;\n // FIXME: Should be renamed isAppOfFreeVariable\n bool isFreeVariable() const;\n bool isAppOf(Z3_decl_kind) const;\n bool isStructurallyEqualTo(Z3ASTHandle other) const;\n Z3SortHandle getSort() const;\n\n Z3AppHandle asApp() const;\n Z3FuncDeclHandle asFuncDecl() const;\n\n static Z3ASTHandle getTrue(Z3_context ctx);\n static Z3ASTHandle getFalse(Z3_context ctx);\n static Z3ASTHandle getBVZero(Z3_context, unsigned width);\n static Z3ASTHandle getBVZero(Z3SortHandle sort);\n static Z3ASTHandle getBV(Z3SortHandle sort, uint64_t value);\n static Z3ASTHandle getFloatAbsoluteSmallestSubnormal(Z3SortHandle sort,\n bool positive);\n static Z3ASTHandle getFloatAbsoluteLargestSubnormal(Z3SortHandle sort,\n bool positive);\n static Z3ASTHandle getFloatAbsoluteSmallestNormal(Z3SortHandle sort,\n bool positive);\n static Z3ASTHandle getFloatAbsoluteLargestNormal(Z3SortHandle sort,\n bool positive);\n static Z3ASTHandle getFloatZero(Z3SortHandle sort, bool positive = true);\n static Z3ASTHandle getFloatInfinity(Z3SortHandle sort, bool positive = true);\n static Z3ASTHandle getFloatNAN(Z3SortHandle sort);\n static Z3ASTHandle getFloatFromInt(Z3SortHandle sort, signed value);\n};\n\n// Specialise for Z3_app\ntemplate <> inline void Z3NodeHandle::inc_ref(Z3_app node) {\n ::Z3_inc_ref(context, ::Z3_app_to_ast(context, node));\n}\ntemplate <> inline void Z3NodeHandle::dec_ref(Z3_app node) {\n ::Z3_dec_ref(context, ::Z3_app_to_ast(context, node));\n}\ntemplate <> void Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\n// FIXME: It's silly that Z3AppHandle does not inherit from Z3ASTHandle\n// to reflect the hierarchy in Z3.\n// Provide a class rather than a typedef so we can add\n// additional helper methods.\nclass Z3AppHandle : public Z3NodeHandle {\npublic:\n // Inherit constructors\n using Z3NodeHandle::Z3NodeHandle;\n\n // Helper methods\n Z3FuncDeclHandle getFuncDecl() const;\n Z3_decl_kind getKind() const;\n unsigned getNumKids() const;\n Z3ASTHandle getKid(unsigned) const;\n\n bool isConstant() const;\n // FIXME: Should be renamed isAppOfFreeVariable\n bool isFreeVariable() const;\n bool isSpecialFPConstant() const;\n Z3ASTHandle asAST() const;\n Z3SortHandle getSort() const;\n\n bool getConstantAsUInt64(uint64_t* out) const;\n};\n\n// Specialise for Z3_func_decl\ntemplate <> inline void Z3NodeHandle::inc_ref(Z3_func_decl node) {\n ::Z3_inc_ref(context, ::Z3_func_decl_to_ast(context, node));\n}\ntemplate <> inline void Z3NodeHandle::dec_ref(Z3_func_decl node) {\n ::Z3_dec_ref(context, ::Z3_func_decl_to_ast(context, node));\n}\ntemplate <> void Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\n// FIXME: It's silly that Z3FuncDeclHandle does not inherit from Z3ASTHandle\n// to reflect the hierarchy in Z3.\n// Provide a class rather than a typedef so we can add\n// additional helper methods.\nclass Z3FuncDeclHandle : public Z3NodeHandle {\n // Inherit constructors\npublic:\n using Z3NodeHandle::Z3NodeHandle;\n Z3_decl_kind getKind() const;\n Z3SortHandle getSort() const;\n std::string getName() const;\n Z3ASTHandle asAST() const;\n\n // Parameters\n unsigned getNumParams() const;\n Z3_parameter_kind getParamKind(unsigned index) const;\n int getIntParam(unsigned index) const;\n};\n\n// Specialise for Z3_solver\ntemplate <> inline void Z3NodeHandle::inc_ref(Z3_solver node) {\n ::Z3_solver_inc_ref(context, node);\n}\ntemplate <> inline void Z3NodeHandle::dec_ref(Z3_solver node) {\n ::Z3_solver_dec_ref(context, node);\n}\ntypedef Z3NodeHandle Z3SolverHandle;\ntemplate <> void Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\n// Specialise for Z3_params\ntemplate <> inline void Z3NodeHandle::inc_ref(Z3_params node) {\n ::Z3_params_inc_ref(context, node);\n}\ntemplate <> inline void Z3NodeHandle::dec_ref(Z3_params node) {\n ::Z3_params_dec_ref(context, node);\n}\ntypedef Z3NodeHandle Z3ParamsHandle;\ntemplate <> void Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\n// Specialise for Z3_model\ntemplate <> inline void Z3NodeHandle::inc_ref(Z3_model node) {\n ::Z3_model_inc_ref(context, node);\n}\ntemplate <> inline void Z3NodeHandle::dec_ref(Z3_model node) {\n ::Z3_model_dec_ref(context, node);\n}\ntemplate <> void Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\nclass Z3ModelHandle : public Z3NodeHandle {\n // Inherit constructors\npublic:\n using Z3NodeHandle::Z3NodeHandle;\n Z3ASTHandle getAssignmentFor(Z3FuncDeclHandle);\n bool hasAssignmentFor(Z3FuncDeclHandle d) const;\n bool addAssignmentFor(Z3FuncDeclHandle decl, Z3ASTHandle e,\n bool allowOverwrite = false);\n uint64_t getNumAssignments() const;\n Z3FuncDeclHandle getVariableDeclForIndex(uint64_t index);\n Z3ASTHandle evaluate(Z3ASTHandle e, bool modelCompletion);\n bool isEmpty() const;\n};\n\n// Specialise for Z3_goal\ntemplate <> inline void Z3NodeHandle::inc_ref(Z3_goal node) {\n ::Z3_goal_inc_ref(context, node);\n}\ntemplate <> inline void Z3NodeHandle::dec_ref(Z3_goal node) {\n ::Z3_goal_dec_ref(context, node);\n}\ntemplate <> void Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\nclass Z3GoalHandle : public Z3NodeHandle {\n // Inherit constructors\npublic:\n using Z3NodeHandle::Z3NodeHandle;\n void addFormula(Z3ASTHandle);\n unsigned getNumFormulas() const;\n Z3ASTHandle getFormula(unsigned index) const;\n};\n\nclass Z3ApplyResultHandle;\n\n// Specialise for Z3_tactic\ntemplate <> inline void Z3NodeHandle::inc_ref(Z3_tactic node) {\n ::Z3_tactic_inc_ref(context, node);\n}\ntemplate <> inline void Z3NodeHandle::dec_ref(Z3_tactic node) {\n ::Z3_tactic_dec_ref(context, node);\n}\ntemplate <> void Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\nclass Z3TacticHandle : public Z3NodeHandle {\n // Inherit constructors\npublic:\n using Z3NodeHandle::Z3NodeHandle;\n Z3ApplyResultHandle apply(Z3GoalHandle goal);\n Z3ApplyResultHandle applyWithParams(Z3GoalHandle goal, Z3ParamsHandle params);\n};\n\n// Specialise for Z3_apply_result\ntemplate <>\ninline void Z3NodeHandle::inc_ref(Z3_apply_result node) {\n ::Z3_apply_result_inc_ref(context, node);\n}\ntemplate <>\ninline void Z3NodeHandle::dec_ref(Z3_apply_result node) {\n ::Z3_apply_result_dec_ref(context, node);\n}\ntemplate <>\nvoid Z3NodeHandle::dump() const __attribute__((used));\ntemplate <>\nstd::string Z3NodeHandle::toStr() const __attribute__((used));\n\nclass Z3ApplyResultHandle : public Z3NodeHandle {\n // Inherit constructors\npublic:\n using Z3NodeHandle::Z3NodeHandle;\n unsigned getNumGoals() const;\n Z3GoalHandle getGoal(unsigned index) const;\n void collectAllFormulas(std::vector&) const;\n Z3ModelHandle convertModelForGoal(unsigned index, Z3ModelHandle toConvert);\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Core/Z3NodeMap.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_Z3_NODE_MAP_H\n#define JFS_CORE_Z3_NODE_MAP_H\n#include \"jfs/Core/Z3ASTCmp.h\"\n#include \n\nnamespace jfs {\nnamespace core {\n\ntemplate \nusing Z3ASTMap = std::unordered_map;\n\ntemplate \nusing Z3SortMap = std::unordered_map;\n\ntemplate \nusing Z3FuncDeclMap =\n std::unordered_map;\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Core/Z3NodeSet.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_Z3_AST_SET_H\n#define JFS_CORE_Z3_AST_SET_H\n#include \"jfs/Core/Z3ASTCmp.h\"\n#include \"jfs/Core/Z3Node.h\"\n#include \n#include \n\nnamespace jfs {\nnamespace core {\n\n// We don't provide a templated Z3NodeSet because not all Z3Node's are ASTs.\n// For now doing these aliases is simpler.\nusing Z3ASTSet = std::unordered_set;\n\nusing Z3FuncDeclSet =\n std::unordered_set;\n\nusing Z3SortSet = std::unordered_set;\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/Core/Z3NodeUtil.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Alastair Donaldson\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_CORE_Z3NODE_UTIL_H\n#define JFS_CORE_Z3NODE_UTIL_H\n#include \"jfs/Core/Z3Node.h\"\n#include \"jfs/Core/Z3NodeSet.h\"\n#include \n\nnamespace jfs {\nnamespace core {\n\nclass Z3NodeUtil {\npublic:\n static void collectFuncDecls(Z3FuncDeclSet& addTo,\n std::list& workList);\n\n static void collectFuncDecls(Z3FuncDeclSet& addTo, Z3ASTHandle e);\n\n template \n static void collectFuncDecls(Z3FuncDeclSet& addTo, IteratorTy begin,\n IteratorTy end) {\n std::list workList;\n for (IteratorTy b = begin, e = end; b != e; ++b) {\n workList.push_back(*b);\n }\n collectFuncDecls(addTo, workList);\n }\n};\n\n} // namespace core\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/BufferAssignment.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_BUFFER_ASSIGNMENT\n#define JFS_FUZZING_COMMON_BUFFER_ASSIGNMENT\n#include \"jfs/Core/Query.h\"\n#include \"jfs/Core/Z3Node.h\"\n#include \"jfs/Core/Z3NodeMap.h\"\n#include \"jfs/Core/Z3NodeSet.h\"\n#include \"jfs/FuzzingCommon/BufferElement.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass BufferAssignment {\nprivate:\n typedef std::vector ChunksTy;\n ChunksTy chunks;\n uint64_t cachedTypeBitWidth;\n uint64_t cachedStoreBitWidth;\n uint64_t computeTypeBitWidth() const;\n uint64_t computeStoreBitWidth() const;\n\npublic:\n BufferAssignment() : cachedTypeBitWidth(0), cachedStoreBitWidth(0) {}\n ~BufferAssignment() {}\n void appendElement(BufferElement&);\n uint64_t getTypeBitWidth() const { return cachedTypeBitWidth; }\n uint64_t getStoreBitWidth() const { return cachedStoreBitWidth; }\n uint64_t getRequiredStoreBytes() const {\n return (getStoreBitWidth() + 7) / 8;\n }\n ChunksTy::const_iterator cbegin() const { return chunks.begin(); }\n ChunksTy::const_iterator cend() const { return chunks.end(); }\n ChunksTy::const_iterator begin() const { return cbegin(); }\n ChunksTy::const_iterator end() const { return cend(); }\n size_t size() const { return chunks.size(); }\n void print(llvm::raw_ostream&) const;\n void dump() const;\n};\n\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/BufferElement.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_BUFFER_ELEMENT\n#define JFS_FUZZING_COMMON_BUFFER_ELEMENT\n#include \"jfs/Core/Query.h\"\n#include \"jfs/Core/Z3Node.h\"\n#include \"jfs/Core/Z3NodeMap.h\"\n#include \"jfs/Core/Z3NodeSet.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass BufferElement {\nprivate:\n size_t storeBitAlignment;\n\npublic:\n const jfs::core::Z3ASTHandle declApp;\n BufferElement(const jfs::core::Z3ASTHandle declApp,\n size_t storeBitAlignment = 1);\n unsigned getTypeBitWidth() const; // Does not include padding\n unsigned getStoreBitWidth() const; // Includes any required padding\n size_t getStoreBitAlignment() const { return storeBitAlignment; }\n // FIXME: put this behind an interface once we know the requirements\n std::vector equalities;\n void print(llvm::raw_ostream&) const;\n void dump() const;\n jfs::core::Z3FuncDeclHandle getDecl() const;\n std::string getName() const;\n jfs::core::Z3SortHandle getSort() const;\n};\n\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/CmdLine/FreeVariableToBufferAssignmentPassOptionsBuilder.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_CMDLINE_FVTBAPOB_H\n#define JFS_FUZZING_COMMON_CMDLINE_FVTBAPOB_H\n#include \"jfs/FuzzingCommon/FreeVariableToBufferAssignmentPassOptions.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\nnamespace cl {\n\nstd::unique_ptr\nbuildFVTBAPOptionsFromCmdLine();\n}\n} // namespace fuzzingCommon\n} // namespace jfs\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/CmdLine/LibFuzzerOptionsBuilder.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_CMDLINE_LIBFUZZER_OPTIONS_BUILDER_H\n#define JFS_FUZZING_COMMON_CMDLINE_LIBFUZZER_OPTIONS_BUILDER_H\n#include \"jfs/FuzzingCommon/LibFuzzerOptions.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\nnamespace cl {\n\nstd::unique_ptr\nbuildLibFuzzerOptionsFromCmdLine();\n}\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/CmdLine/SeedManagerOptionsBuilder.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_CMDLINE_SEED_MANAGER_OPTIONS_BUILDER_H\n#define JFS_FUZZING_COMMON_CMDLINE_SEED_MANAGER_OPTIONS_BUILDER_H\n#include \"jfs/FuzzingCommon/SeedManager.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\nnamespace cl {\n\nstd::unique_ptr\nbuildSeedManagerOptionsFromCmdLine();\n}\n} // namespace fuzzingCommon\n} // namespace jfs\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/CommandLineCategory.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_COMMAND_LINE_CATEGORY_H\n#define JFS_FUZZING_COMMON_COMMAND_LINE_CATEGORY_H\n#include \"llvm/Support/CommandLine.h\"\n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nextern llvm::cl::OptionCategory CommandLineCategory;\n}\n}\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/DummyFuzzingSolver.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_DUMMY_FUZZING_SOLVER\n#define JFS_FUZZING_COMMON_DUMMY_FUZZING_SOLVER\n#include \"jfs/FuzzingCommon/FuzzingSolver.h\"\n\nnamespace jfs {\nnamespace fuzzingCommon {\n\n// This solver doesn't do any fuzzing so in effect\n// it can only solve trivial constraints\nclass DummyFuzzingSolver : public FuzzingSolver {\nprotected:\n std::unique_ptr\n fuzz(jfs::core::Query& q, bool produceModel,\n std::shared_ptr info) override;\n\npublic:\n DummyFuzzingSolver(std::unique_ptr options,\n std::unique_ptr wdm,\n jfs::core::JFSContext& ctx);\n ~DummyFuzzingSolver();\n llvm::StringRef getName() const override;\n void cancel() override;\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/EqualityExtractionPass.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_EQUALITY_EXTRACTION_PASS_H\n#define JFS_FUZZING_COMMON_EQUALITY_EXTRACTION_PASS_H\n#include \"jfs/Core/Query.h\"\n#include \"jfs/Core/Z3Node.h\"\n#include \"jfs/Core/Z3NodeMap.h\"\n#include \"jfs/Core/Z3NodeSet.h\"\n#include \"jfs/Transform/QueryPass.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\n// This pass looks for simple equalities (e.g. `(= a b)`), removes them from\n// the query and adds them to the known set of equalites. The motivation is\n// that the fuzzer is very unlikely to guess at random to make two expressions\n// equal. Instead of enforcing them as branch conditions we can construct the\n// input program such the equality always holds in some simple cases.\nclass EqualityExtractionPass : public jfs::transform::QueryPass {\nprivate:\n void cleanUp();\n\npublic:\n // TODO: Put this behind an interface once we know what the requirements\n // are.\n jfs::core::Z3ASTMap> mapping;\n std::unordered_set> equalities;\n EqualityExtractionPass();\n ~EqualityExtractionPass() {}\n bool run(jfs::core::Query& q) override;\n virtual llvm::StringRef getName() override;\n virtual bool convertModel(jfs::core::Model* m) override;\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/FileSerializableModel.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Alastair Donaldson\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_FILE_SERIALIZABLE_MODEL_H\n#define JFS_FUZZING_COMMON_FILE_SERIALIZABLE_MODEL_H\n#include \"jfs/Core/Model.h\"\n#include \"jfs/Core/Z3Node.h\"\n#include \"jfs/FuzzingCommon/BufferAssignment.h\"\n#include \"llvm/Support/FileOutputBuffer.h\"\n#include \"llvm/Support/MemoryBuffer.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass FileSerializableModel : public jfs::core::Model {\npublic:\n // Empty model\n FileSerializableModel(jfs::core::JFSContext& ctx);\n\n static std::unique_ptr\n loadFrom(const llvm::MemoryBuffer* buf, const BufferAssignment* ba,\n jfs::core::JFSContext& ctx);\n\n bool saveTo(llvm::FileOutputBuffer* buf, const BufferAssignment* ba,\n jfs::core::JFSContext& ctx);\n};\n\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/FreeVariableToBufferAssignmentPass.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_FREE_VARIABLE_TO_BUFFER_ASSIGNMENT_PASS_H\n#define JFS_FUZZING_COMMON_FREE_VARIABLE_TO_BUFFER_ASSIGNMENT_PASS_H\n#include \"jfs/Core/Query.h\"\n#include \"jfs/Core/Z3Node.h\"\n#include \"jfs/Core/Z3NodeMap.h\"\n#include \"jfs/Core/Z3NodeSet.h\"\n#include \"jfs/FuzzingCommon/BufferAssignment.h\"\n#include \"jfs/FuzzingCommon/EqualityExtractionPass.h\"\n#include \"jfs/FuzzingCommon/FreeVariableToBufferAssignmentPassOptions.h\"\n#include \"jfs/Transform/QueryPass.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass ConstantAssignment {\npublic:\n // TODO: Put this behind an interface\n jfs::core::Z3ASTMap assignments;\n void print(llvm::raw_ostream&) const;\n void dump() const;\n};\n\nclass FreeVariableToBufferAssignmentPass : public jfs::transform::QueryPass {\nprivate:\n const EqualityExtractionPass& eep;\n // raw ptr because we don't own storage\n FreeVariableToBufferAssignmentPassOptions* options;\n std::unique_ptr defaultOptions;\n\npublic:\n FreeVariableToBufferAssignmentPass(\n const EqualityExtractionPass&,\n FreeVariableToBufferAssignmentPassOptions* options);\n ~FreeVariableToBufferAssignmentPass() {}\n bool run(jfs::core::Query& q) override;\n virtual llvm::StringRef getName() override;\n // TODO: Put these behind an interface\n std::shared_ptr bufferAssignment;\n // FIXME: It's debatable whether we actually need this. The\n // ConstantPropagation pass\n // means that equalities like this will already be expanded in constraints.\n // This means\n // the free variables that have constant assignments will never be used once\n // the\n // EqualityExtractionPass has run and so constantAssignment is always empty.\n std::shared_ptr constantAssignments;\n\n virtual bool convertModel(jfs::core::Model* m) override;\n};\n} // namespace fuzzingCommon\n} // namespace jfs\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/FreeVariableToBufferAssignmentPassOptions.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_FREE_VARIABLE_TO_BUFFER_ASSIGNMENT_PASS_OPTIONS_H\n#define JFS_FUZZING_COMMON_FREE_VARIABLE_TO_BUFFER_ASSIGNMENT_PASS_OPTIONS_H\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\nclass FreeVariableToBufferAssignmentPassOptions {\npublic:\n enum class FreeVariableSortStrategyTy {\n ALPHABETICAL,\n FIRST_OBSERVED,\n NONE, // Warning: Will likely be non-deterministic\n };\n size_t bufferElementBitAlignment = 1;\n FreeVariableSortStrategyTy sortStrategy =\n FreeVariableSortStrategyTy::FIRST_OBSERVED;\n FreeVariableToBufferAssignmentPassOptions();\n};\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/FuzzingAnalysisInfo.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_FUZZING_ANALYSIS_INFO_H\n#define JFS_FUZZING_COMMON_FUZZING_ANALYSIS_INFO_H\n#include \"jfs/FuzzingCommon/EqualityExtractionPass.h\"\n#include \"jfs/FuzzingCommon/FreeVariableToBufferAssignmentPass.h\"\n#include \"jfs/Transform/QueryPassManager.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\n// This contains the necessary analysis info\n// that a fuzzing solver needs.\nclass FuzzingAnalysisInfo {\npublic:\n std::shared_ptr equalityExtraction;\n std::shared_ptr freeVariableAssignment;\n void addTo(jfs::transform::QueryPassManager& pm);\n FuzzingAnalysisInfo(FreeVariableToBufferAssignmentPassOptions* fvtbapOptions);\n ~FuzzingAnalysisInfo();\n};\n} // namespace fuzzingCommon\n} // namespace jfs\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/FuzzingSolver.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_FUZZING_SOLVER_H\n#define JFS_FUZZING_COMMON_FUZZING_SOLVER_H\n#include \"jfs/Core/Solver.h\"\n#include \"jfs/FuzzingCommon/WorkingDirectoryManager.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass FuzzingAnalysisInfo;\nclass FuzzingSolverImpl;\nclass FuzzingSolver : public jfs::core::Solver {\nprivate:\n std::unique_ptr impl;\n\nprotected:\n virtual std::unique_ptr\n fuzz(jfs::core::Query& q, bool produceModel,\n std::shared_ptr info) = 0;\n std::unique_ptr wdm;\n\npublic:\n FuzzingSolver(std::unique_ptr options,\n std::unique_ptr wdm,\n jfs::core::JFSContext& ctx);\n ~FuzzingSolver();\n std::unique_ptr solve(const jfs::core::Query& q,\n bool produceModel) override;\n void cancel() override;\n friend class FuzzingSolverImpl;\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/FuzzingSolverOptions.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_FUZZING_SOLVER_OPTIONS_H\n#define JFS_FUZZING_COMMON_FUZZING_SOLVER_OPTIONS_H\n#include \"jfs/Core/SolverOptions.h\"\n#include \"jfs/FuzzingCommon/FreeVariableToBufferAssignmentPassOptions.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\nclass FuzzingSolverOptions : public jfs::core::SolverOptions {\nprivate:\n std::unique_ptr fvtbapOptions;\n\nprotected:\n // For subclasses\n FuzzingSolverOptions(\n std::unique_ptr fvtbapOptions,\n bool debugSaveModel,\n jfs::core::SolverOptions::SolverOptionKind thisKind);\n\npublic:\n bool debugSaveModel;\n FuzzingSolverOptions(\n std::unique_ptr fvtbapOptions,\n bool debugSaveModel);\n static bool classof(const SolverOptions* so) {\n return so->getKind() >= jfs::core::SolverOptions::FUZZING_SOLVER_KIND &&\n so->getKind() < jfs::core::SolverOptions::LAST_FUZZING_SOLVER_KIND;\n }\n FreeVariableToBufferAssignmentPassOptions*\n getFreeVariableToBufferAssignmentOptions() const;\n};\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/JFSRuntimeFuzzingStat.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_JFS_RUNTIME_FUZZING_STAT\n#define JFS_FUZZING_COMMON_JFS_RUNTIME_FUZZING_STAT\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/FuzzingCommon/FuzzingSolver.h\"\n#include \"jfs/Support/JFSStat.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\nstruct JFSRuntimeFuzzingStat : public jfs::support::JFSStat {\n\n uint64_t maxNumConstraintsSatisfied;\n static const char* maxNumConstraintsSatisfiedKeyName;\n\n uint64_t numberOfInputsTried;\n static const char* numberOfInputsTriedKeyName;\n\n uint64_t numberOfWrongSizedInputsTried;\n static const char* numberOfWrongSizedInputsTriedKeyName;\n\n JFSRuntimeFuzzingStat(llvm::StringRef name);\n virtual ~JFSRuntimeFuzzingStat();\n void printYAML(llvm::ScopedPrinter& os) const override;\n static bool classof(const JFSStat* s) { return s->getKind() == RUNTIME; }\n static std::unique_ptr\n LoadFromYAML(llvm::StringRef filePath, llvm::StringRef name,\n jfs::core::JFSContext& ctx);\n};\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/LibFuzzerInvocationManager.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_LIBFUZZER_INVOCATION_MANAGER_H\n#define JFS_FUZZING_COMMON_LIBFUZZER_INVOCATION_MANAGER_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/FuzzingCommon/LibFuzzerOptions.h\"\n#include \"jfs/Support/ICancellable.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \"llvm/Support/MemoryBuffer.h\"\n#include \n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nstruct LibFuzzerResponse {\n enum class ResponseTy {\n TARGET_FOUND,\n SINGLE_RUN_TARGET_NOT_FOUND,\n RUN_BOUND_REACHED,\n CANCELLED,\n UNKNOWN,\n };\n ResponseTy outcome;\n std::string pathToInput;\n LibFuzzerResponse();\n ~LibFuzzerResponse();\n // Returns nullptr if outcome was not `TARGET_FOUND`.\n std::unique_ptr getInputForTarget() const;\n};\n\nclass LibFuzzerInvocationManagerImpl;\n\nclass LibFuzzerInvocationManager : public jfs::support::ICancellable {\nprivate:\n const std::unique_ptr impl;\n\npublic:\n LibFuzzerInvocationManager(jfs::core::JFSContext& ctx);\n ~LibFuzzerInvocationManager();\n void cancel();\n std::unique_ptr fuzz(const LibFuzzerOptions* options,\n llvm::StringRef stdOutFile,\n llvm::StringRef stdErrFile);\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/LibFuzzerOptions.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_LIBFUZZER_OPTIONS_H\n#define JFS_FUZZING_COMMON_LIBFUZZER_OPTIONS_H\n#include \n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\n// FIXME: This design is broken. Some of these options are used internally and\n// will get overwritten and others are public and can be changed. We need\n// to separate these two concerns.\nstruct LibFuzzerOptions {\n // NOTE: `runs` value of `0` means an infinite number of runs.\n size_t runs; // Approximately corresponds to `-runs=` option.\n uint64_t mutationDepth; // Corresponds to `-mutate_depth=`\n bool crossOver; // Corresponds to `-cross_over` option\n uint64_t maxLength; // Corresponds to `-max_len=` option (bytes).\n bool useCmp; // Corresponds to `-use_cmp` option\n bool printFinalStats; // Corresponds to `-print_final_stats=1`\n bool reduceInputs; // Corresponds to `-reduce_inputs=1`\n bool defaultMutationsResizeInput; // Corresponds to `default_mutators_resize_input=1`\n bool handleSIGABRT;\n bool handleSIGBUS;\n bool handleSIGFPE;\n bool handleSIGILL;\n bool handleSIGINT;\n bool handleSIGSEGV;\n bool handleSIGTERM;\n bool handleSIGXFSZ;\n\n std::string targetBinary;\n std::string artifactDir;\n std::string corpusDir;\n std::string jfsRuntimeLogFile;\n\n // TODO: We should support LibFuzzer jobs/workers. This\n // will require a vector of seeds rather than a single seed\n LibFuzzerOptions();\n};\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/SeedGenerator.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_SEED_GENERATOR_H\n#define JFS_FUZZING_COMMON_SEED_GENERATOR_H\n#include \"llvm/ADT/StringRef.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass FuzzingAnalysisInfo;\nclass SeedManager;\n\nclass SeedGenerator {\nprivate:\n std::string name;\n\npublic:\n SeedGenerator(llvm::StringRef name);\n virtual ~SeedGenerator();\n // Called once by the SeedManager before any seeds are requested\n virtual void preGenerationCallBack(SeedManager& sm);\n // Called once by the SeedManager after all seeds are requested\n virtual void postGenerationCallBack(SeedManager& sm);\n // Returns true on success\n virtual bool writeSeed(SeedManager& sm) = 0;\n virtual llvm::StringRef getName() const { return name; }\n virtual bool empty() const = 0;\n};\n\n// A generator that emits a single seed with all bytes set to\n// the supplied byte value.\nclass AllBytesEqualGenerator : public SeedGenerator {\nprivate:\n uint8_t byteValue;\n bool seedWritten;\n\npublic:\n AllBytesEqualGenerator(llvm::StringRef name, uint8_t byteValue);\n void preGenerationCallBack(SeedManager& sm) override {}\n void postGenerationCallBack(SeedManager& sm) override {}\n bool writeSeed(SeedManager& sm) override;\n bool empty() const override;\n};\n\n} // namespace fuzzingCommon\n} // namespace jfs\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/SeedManager.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_SEED_MANAGER_H\n#define JFS_FUZZING_COMMON_SEED_MANAGER_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/Core/Query.h\"\n#include \"jfs/Support/ICancellable.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \"llvm/Support/FileOutputBuffer.h\"\n#include \n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass SeedGenerator;\nclass SeedManagerImpl;\nclass FuzzingAnalysisInfo;\nclass SeedManagerOptions;\n\nclass SeedManager : jfs::support::ICancellable {\nprivate:\n std::unique_ptr impl;\n\npublic:\n SeedManager(llvm::StringRef seedDir, jfs::core::JFSContext& ctx);\n SeedManager(const SeedManager&) = delete;\n ~SeedManager();\n void cancel() override;\n void configureFrom(std::unique_ptr options);\n void addSeedGenerator(std::unique_ptr sg);\n // Returns number of written seeds.\n uint64_t writeSeeds(const FuzzingAnalysisInfo* info,\n const jfs::core::Query* q);\n\n void setSpaceLimit(uint64_t maxSeedSpaceInBytes);\n uint64_t getSpaceLimit() const;\n void setMaxNumSeeds(uint64_t maxNumSeeds);\n uint64_t getMaxNumSeeds() const;\n\n // Create a FileOutputBuffer with the appropriate size and filename for the\n // seed. The caller is responsible for calling commit.\n //\n // This is the preferred method writing a seed\n std::unique_ptr\n getBufferForSeed(llvm::StringRef prefix);\n\n // Get and reserve a seed ID but don't actually create it.\n std::string getAndReserveSeedID(llvm::StringRef prefix);\n std::string getAndReserveSeedID();\n\n jfs::core::JFSContext& getContext() const;\n const FuzzingAnalysisInfo* getCurrentFuzzingAnalysisInfo() const;\n const jfs::core::Query* getCurrentQuery() const;\n};\n\n} // namespace fuzzingCommon\n} // namespace jfs\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/SeedManagerOptions.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_SEED_MANAGER_OPTIONS_H\n#define JFS_FUZZING_COMMON_SEED_MANAGER_OPTIONS_H\n#include \"jfs/FuzzingCommon/SeedGenerator.h\"\n#include \n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass SeedGenerator;\n\nclass SeedManagerOptions {\npublic:\n uint64_t maxSeedSpaceInBytes;\n uint64_t maxNumSeeds;\n std::list> generators;\n};\n\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/SeedManagerStat.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_SEED_MANAGER_STAT_H\n#define JFS_FUZZING_COMMON_SEED_MANAGER_STAT_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/FuzzingCommon/FuzzingSolver.h\"\n#include \"jfs/Support/JFSStat.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\nstruct SeedManagerStat : public jfs::support::JFSStat {\n uint64_t numSeedsGenerated = 0;\n SeedManagerStat(llvm::StringRef name);\n virtual ~SeedManagerStat();\n void printYAML(llvm::ScopedPrinter& os) const override;\n static bool classof(const JFSStat* s) { return s->getKind() == SEED_MANAGER; }\n};\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/SortConformanceCheckPass.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_SORT_CONFORMANCE_PASS_H\n#define JFS_FUZZING_COMMON_SORT_CONFORMANCE_PASS_H\n#include \"jfs/Core/Query.h\"\n#include \"jfs/Transform/QueryPass.h\"\n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\nclass SortConformanceCheckPass : public jfs::transform::QueryPass {\n bool predicateHeld;\n std::function predicate;\n\npublic:\n SortConformanceCheckPass(\n std::function predicate);\n ~SortConformanceCheckPass() {}\n bool run(jfs::core::Query& q) override;\n virtual llvm::StringRef getName() override;\n bool predicateAlwaysHeld() const { return predicateHeld; }\n void reset() { predicateHeld = false; }\n virtual bool convertModel(jfs::core::Model* m) override;\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/SpecialConstantSeedGenerator.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2018 J. Ryan Stinnett\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_SPECIAL_CONSTANT_SEED_GENERATOR_H\n#define JFS_FUZZING_COMMON_SPECIAL_CONSTANT_SEED_GENERATOR_H\n\n#include \"jfs/Core/Z3Node.h\"\n#include \"jfs/Core/Z3NodeMap.h\"\n#include \"jfs/FuzzingCommon/SeedGenerator.h\"\n#include \"jfs/FuzzingCommon/SpecialConstantSeedGeneratorStat.h\"\n#include \n\nnamespace jfs {\nnamespace core {\nclass JFSContext;\nclass Model;\n}\n}\n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass BufferElement;\nclass SeedManager;\n\n// A seed generator that emits special constants based on the sorts used in the\n// constraints of the query.\nclass SpecialConstantSeedGenerator : public SeedGenerator {\n // Inherit constructor\n using SeedGenerator::SeedGenerator;\n\n void preGenerationCallBack(SeedManager& sm) override;\n void postGenerationCallBack(SeedManager& sm) override;\n bool writeSeed(SeedManager& sm) override;\n bool empty() const override;\n\nprivate:\n // Track vectors of constants found in constraints by sort.\n jfs::core::Z3SortMap>\n sortToConstraintConstantMap;\n std::unique_ptr stats;\n\n bool chooseBool(core::JFSContext& ctx, const BufferElement& be,\n core::Model& model);\n bool chooseBitVector(core::JFSContext& ctx, const BufferElement& be,\n core::Model& model);\n bool chooseFloatingPoint(core::JFSContext& ctx, const BufferElement& be,\n core::Model& model);\n};\n\n} // namespace fuzzingCommon\n} // namespace jfs\n\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/SpecialConstantSeedGeneratorStat.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Alastair Donaldson\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_SEED_GENERATOR_STAT_H\n#define JFS_FUZZING_COMMON_SEED_GENERATOR_STAT_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"jfs/Core/Z3NodeMap.h\"\n#include \"jfs/Support/JFSStat.h\"\n\nnamespace jfs {\nnamespace fuzzingCommon {\nstruct SpecialConstantSeedGeneratorStat : public jfs::support::JFSStat {\n jfs::core::Z3SortMap foundConstantsCount;\n uint64_t totalNumBuiltInBVConstants = 0;\n uint64_t numCoveredBVConstants = 0;\n uint64_t totalNumBuiltInFPConstants = 0;\n uint64_t numCoveredFPConstants = 0;\n uint64_t totalNumBuiltInBoolConstants = 0;\n uint64_t numCoveredBoolConstants = 0;\n\n SpecialConstantSeedGeneratorStat(llvm::StringRef name);\n virtual ~SpecialConstantSeedGeneratorStat();\n void printYAML(llvm::ScopedPrinter& os) const override;\n static bool classof(const JFSStat* s) {\n return s->getKind() == SEED_GENERATOR;\n }\n};\n} // namespace fuzzingCommon\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/FuzzingCommon/WorkingDirectoryManager.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_FUZZING_COMMON_WORKING_DIRECTORY_MANAGER_H\n#define JFS_FUZZING_COMMON_WORKING_DIRECTORY_MANAGER_H\n#include \"jfs/Core/JFSContext.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \n#include \n\nnamespace jfs {\nnamespace fuzzingCommon {\n\nclass WorkingDirectoryManager {\nprivate:\n const std::string path;\n jfs::core::JFSContext& ctx;\n const bool deleteOnDestruction;\n WorkingDirectoryManager(llvm::StringRef path, jfs::core::JFSContext& ctx,\n bool deleteOnDestruction);\n\npublic:\n // Don't allow copying\n ~WorkingDirectoryManager();\n WorkingDirectoryManager(const WorkingDirectoryManager&) = delete;\n WorkingDirectoryManager(const WorkingDirectoryManager&&) = delete;\n WorkingDirectoryManager& operator=(const WorkingDirectoryManager&) = delete;\n\n llvm::StringRef getPath() const { return path; }\n std::string getPathToFileInDirectory(llvm::StringRef fileName) const;\n std::string makeNewDirectoryInDirectory(llvm::StringRef dirName);\n\n // Make at `path`. `path` should not already exist, but its\n // parent directory should.\n // If the fails a nullptr will be returned.\n static std::unique_ptr\n makeAtPath(llvm::StringRef path, jfs::core::JFSContext& ctx,\n bool deleteOnDestruction);\n\n // Make at `/-N` where `N` is an integer.\n // This function will start with `N == 0` an keep incrementing\n // `N` until a directory is successfully created `N == maxN`.\n // If the fails a nullptr will be returned.\n static std::unique_ptr\n makeInDirectory(llvm::StringRef directory, llvm::StringRef prefix,\n jfs::core::JFSContext& ctx, bool deleteOnDestruction,\n uint16_t maxN = 100);\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/Support/CancellableProcess.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_SUPPORT_CANCELLABLE_PROCESS_H\n#define JFS_SUPPORT_CANCELLABLE_PROCESS_H\n#include \"jfs/Support/ICancellable.h\"\n#include \"llvm/ADT/StringRef.h\"\n#include \n#include \n#include \n\nnamespace jfs {\n\nnamespace support {\n\nclass CancellableProcessImpl;\n\n// This is a thin wrapper around LLVM's\n// `llvm::sys::ExecuteAndWait()` that supports\n// cancellation.\nclass CancellableProcess : public ICancellable {\nprivate:\n const std::unique_ptr impl;\n\npublic:\n CancellableProcess();\n ~CancellableProcess();\n void cancel() override;\n // Return values >= 0 is program exit code.\n // Negative value indicates failure.\n int execute(llvm::StringRef program, std::vector& args,\n std::vector& redirects,\n const char** envp = nullptr);\n};\n} // namespace support\n} // namespace jfs\n#endif\n"
},
{
"path": "include/jfs/Support/ErrorMessages.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_SUPPORT_ERROR_MESSAGES_H\n#define JFS_SUPPORT_ERROR_MESSAGES_H\n#include \"llvm/ADT/StringRef.h\"\n#include \n#include \n\nnamespace jfs {\n\nnamespace support {\nstd::string getMessageForFailedOpenFileOrSTDIN(llvm::StringRef inputFileName,\n std::error_code ec);\n\nstd::string\ngetMessageForFailedOpenFileForWriting(llvm::StringRef outputFileName,\n std::error_code ec);\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Support/FileUtils.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_SUPPORT_ERROR_MESSAGES_H\n#define JFS_SUPPORT_ERROR_MESSAGES_H\n#include \"llvm/ADT/StringRef.h\"\n#include \n#include \n\nnamespace jfs {\n\nnamespace support {\nstd::error_code recursive_remove(llvm::StringRef path, bool IgnoreNonExisting);\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Support/ICancellable.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_SUPPORT_ICANCELLABLE_H\n#define JFS_SUPPORT_ICANCELLABLE_H\n\nnamespace jfs {\n\nnamespace support {\n// This is a simple interface that classes can implement to cancel their\n// currently assigned work. It is not defined what the state of the instance\n// will be after making this call.\nclass ICancellable {\npublic:\n virtual void cancel() = 0;\n virtual ~ICancellable();\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Support/JFSStat.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_SUPPORT_JFS_STAT_H\n#define JFS_SUPPORT_JFS_STAT_H\n#include \"llvm/ADT/StringRef.h\"\n#include \"llvm/Support/Casting.h\"\n#include \"llvm/Support/ScopedPrinter.h\"\n#include \"llvm/Support/Timer.h\"\n#include \"llvm/Support/raw_ostream.h\"\n#include \n#include \n#include \n\nnamespace jfs {\nnamespace support {\n\nclass JFSStat {\npublic:\n enum JFSStatKind {\n SINGLE_TIMER,\n AGGREGATE_TIMER,\n CXX_PROGRAM,\n RUNTIME,\n SEED_MANAGER,\n SEED_GENERATOR\n };\n\nprivate:\n const JFSStatKind kind;\n std::string name;\n\nprotected:\n JFSStat(JFSStatKind kind, llvm::StringRef name);\n\npublic:\n virtual ~JFSStat();\n JFSStatKind getKind() const { return kind; }\n // FIXME: We should switch to llvm::yaml API.\n virtual void printYAML(llvm::ScopedPrinter& os) const = 0;\n void dump() const;\n llvm::StringRef getName() const;\n};\n\nclass JFSAggregateTimerStat;\nclass JFSTimerStat : public JFSStat {\nprivate:\n using RecordTy = llvm::TimeRecord;\n RecordTy record;\n\npublic:\n friend class JFSAggregateTimerStat;\n JFSTimerStat(RecordTy record, llvm::StringRef name);\n ~JFSTimerStat();\n void printYAML(llvm::ScopedPrinter& os) const override;\n static bool classof(const JFSStat* s) { return s->getKind() == SINGLE_TIMER; }\n};\n\nclass JFSAggregateTimerStat : public JFSStat {\nprivate:\n std::list> timers;\n\npublic:\n JFSAggregateTimerStat(llvm::StringRef name);\n ~JFSAggregateTimerStat();\n void append(std::unique_ptr t);\n void clear();\n void printYAML(llvm::ScopedPrinter& os) const override;\n static bool classof(const JFSStat* s) {\n return s->getKind() == AGGREGATE_TIMER;\n }\n};\n}\n}\n#endif\n"
},
{
"path": "include/jfs/Support/ScopedJFSTimerStatAppender.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_SUPPORT_SCOPED_JFS_TIMER_STAT_APPENDER_H\n#define JFS_SUPPORT_SCOPED_JFS_TIMER_STAT_APPENDER_H\n#include \"jfs/Support/JFSStat.h\"\n#include \"jfs/Support/Timer.h\"\n#include \n\nnamespace jfs {\nnamespace support {\n\ntemplate class ScopedJFSTimerStatAppender {\npublic:\n T* receiver;\n Timer timer;\n llvm::StringRef name;\n std::unique_ptr result;\n ScopedJFSTimerStatAppender(T* receiver, llvm::StringRef name)\n : receiver(receiver), timer(), name(name), result(nullptr) {\n if (receiver == nullptr)\n return;\n // Start timer\n timer.startTimer();\n }\n ~ScopedJFSTimerStatAppender() {\n if (receiver == nullptr)\n return;\n timer.stopTimer();\n result.reset(new JFSTimerStat(timer.getTotalTime(), name));\n receiver->append(std::move(result));\n }\n};\n\ntemplate class ScopedJFSAggregateTimerStatAppender {\npublic:\n T* receiver;\n std::unique_ptr stats;\n ScopedJFSAggregateTimerStatAppender(T* receiver, llvm::StringRef name)\n : receiver(receiver), stats(nullptr) {\n if (receiver == nullptr)\n return;\n stats.reset(new JFSAggregateTimerStat(name));\n }\n ~ScopedJFSAggregateTimerStatAppender() {\n if (receiver == nullptr)\n return;\n receiver->append(std::move(stats));\n }\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/Support/ScopedTimer.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_SUPPORT_SCOPED_TIMER_H\n#define JFS_SUPPORT_SCOPED_TIMER_H\n#include \n#include \n#include \n\nnamespace jfs {\nnamespace support {\n\nclass ScopedTimerImpl;\n\nclass ScopedTimer {\nprivate:\n std::unique_ptr impl;\n\npublic:\n typedef std::function CallBackTy;\n // Will call `callBack` if wall clock time exceeds\n // `maxTime`. If `maxTime` is == 0 then `callBack`\n // will never be called.\n ScopedTimer(uint64_t maxTime, CallBackTy callBack);\n ~ScopedTimer();\n uint64_t getRemainingTime() const;\n uint64_t getMaxTime() const;\n};\n}\n}\n\n#endif\n"
},
{
"path": "include/jfs/Support/StatisticsManager.h",
"content": "//===----------------------------------------------------------------------===//\n//\n// JFS\n//\n// Copyright 2017-2018 Daniel Liew\n//\n// This file is distributed under the MIT license.\n// See LICENSE.txt for details.\n//\n//===----------------------------------------------------------------------===//\n#ifndef JFS_SUPPORT_STATISTICS_MANAGER_H\n#define JFS_SUPPORT_STATISTICS_MANAGER_H\n#include \"llvm/Support/raw_ostream.h\"\n#include \n\nnamespace jfs {\nnamespace support {\n\nclass JFSStat;\nclass StatisticsManagerImpl;\nclass StatisticsManager {\nprivate:\n const std::unique_ptr impl;\n\npublic:\n // FIXME: Figure out how to add iterators without leaking\n // implementation details\n StatisticsManager();\n ~StatisticsManager();\n void append(std::unique_ptr