prog: mutate length of output buffers

Update #480

2 files changed, 76 insertions, 12 deletions

diff --git a/prog/mutation.go b/prog/mutation.go
index 8e59880a5..3f5129f4d 100644
--- a/prog/mutation.go
+++ b/prog/mutation.go
@@ -306,19 +306,22 @@ func (t *ProcType) mutate(r *randGen, s *state, arg Arg, ctx ArgCtx) (calls []*C
 }
 
 func (t *BufferType) mutate(r *randGen, s *state, arg Arg, ctx ArgCtx) (calls []*Call, retry, preserve bool) {
+	minLen, maxLen := uint64(0), maxBlobLen
+	if t.Kind == BufferBlobRange {
+		minLen, maxLen = t.RangeBegin, t.RangeEnd
+	}
 	a := arg.(*DataArg)
+	if t.Dir() == DirOut {
+		mutateBufferSize(r, a, minLen, maxLen)
+		return
+	}
 	switch t.Kind {
 	case BufferBlobRand, BufferBlobRange:
 		data := append([]byte{}, a.Data()...)
-		minLen, maxLen := uint64(0), maxBlobLen
-		if t.Kind == BufferBlobRange {
-			minLen, maxLen = t.RangeBegin, t.RangeEnd
-		}
 		a.data = mutateData(r, data, minLen, maxLen)
 	case BufferString:
 		data := append([]byte{}, a.Data()...)
 		if r.bin() {
-			minLen, maxLen := uint64(0), maxBlobLen
 			if t.TypeSize != 0 {
 				minLen, maxLen = t.TypeSize, t.TypeSize
 			}
@@ -337,6 +340,18 @@ func (t *BufferType) mutate(r *randGen, s *state, arg Arg, ctx ArgCtx) (calls []
 	return
 }
 
+func mutateBufferSize(r *randGen, arg *DataArg, minLen, maxLen uint64) {
+	for oldSize := arg.Size(); oldSize == arg.Size(); {
+		arg.size += uint64(r.Intn(33)) - 16
+		if arg.size < minLen {
+			arg.size = minLen
+		}
+		if arg.size > maxLen {
+			arg.size = maxLen
+		}
+	}
+}
+
 func (t *ArrayType) mutate(r *randGen, s *state, arg Arg, ctx ArgCtx) (calls []*Call, retry, preserve bool) {
 	// TODO: swap elements of the array
 	a := arg.(*GroupArg)
@@ -464,7 +479,9 @@ func (ma *mutationArgs) collectArg(arg Arg, ctx *ArgCtx) {
 		return
 	}
 
-	if typ.Dir() == DirOut || !typ.Varlen() && typ.Size() == 0 {
+	_, isArrayTyp := typ.(*ArrayType)
+	_, isBufferTyp := typ.(*BufferType)
+	if !isBufferTyp && !isArrayTyp && typ.Dir() == DirOut || !typ.Varlen() && typ.Size() == 0 {
 		return
 	}
 
@@ -577,6 +594,9 @@ func (t *LenType) getMutationPrio(target *Target, arg Arg, ignoreSpecial bool) (
 }
 
 func (t *BufferType) getMutationPrio(target *Target, arg Arg, ignoreSpecial bool) (prio float64, stopRecursion bool) {
+	if t.Dir() == DirOut && !t.Varlen() {
+		return dontMutate, false
+	}
 	return 0.8 * maxPriority, false
 }
 
diff --git a/prog/mutation_test.go b/prog/mutation_test.go
index 6d19300b4..76812df2a 100644
--- a/prog/mutation_test.go
+++ b/prog/mutation_test.go
@@ -33,7 +33,7 @@ func TestMutationFlags(t *testing.T) {
 			`r0 = mutate$flags3(&(0x7f0000000000)="2e2f66696c653000", 0xaaaaaaaaaaaaaaaa)`,
 		},
 	}
-	runMutationTests(t, tests)
+	runMutationTests(t, tests, true)
 }
 
 func TestChooseCall(t *testing.T) {
@@ -79,7 +79,7 @@ test$array0(&(0x7f0000001000)={0x1, [@f0=0x2, @f1=0x3], 0x4})
 mutate$integer(0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x0, 0x0, 0x1)`,
 		},
 	}
-	runMutationTests(t, tests)
+	runMutationTests(t, tests, true)
 }
 
 func TestMutateArgument(t *testing.T) {
@@ -359,9 +359,44 @@ mutate8(0x2)
 `, `
 mutate8(0xffffffffffffffff)
 `},
+		// Increase buffer length
+		{`
+mutate$buffer(&(0x7f0000000000)=""/100)
+`, `
+mutate$buffer(&(0x7f0000000000)=""/200)
+`},
+		// Decrease buffer length
+		{`
+mutate$buffer(&(0x7f0000000000)=""/800)
+`, `
+mutate$buffer(&(0x7f0000000000)=""/4)
+`},
+		// Mutate a ranged buffer
+		{`
+mutate$rangedbuffer(&(0x7f00000000c0)=""/10)
+`, `
+mutate$rangedbuffer(&(0x7f00000000c0)=""/7)
+`},
 	}
 
-	runMutationTests(t, tests)
+	runMutationTests(t, tests, true)
+}
+
+func TestNegativeMutations(t *testing.T) {
+	tests := [][2]string{
+		// Mutate buffer size outside the range limits
+		{`
+mutate$rangedbuffer(&(0x7f00000000c0)=""/7)
+`, `
+mutate$rangedbuffer(&(0x7f00000000c0)=""/4)
+`},
+		{`
+mutate$rangedbuffer(&(0x7f00000000c0)=""/7)
+`, `
+mutate$rangedbuffer(&(0x7f00000000c0)=""/11)
+`},
+	}
+	runMutationTests(t, tests, false)
 }
 
 func BenchmarkMutate(b *testing.B) {
@@ -405,7 +440,7 @@ func linuxAmd64ChoiceTable(target *Target) *ChoiceTable {
 	return linuxCT
 }
 
-func runMutationTests(t *testing.T, tests [][2]string) {
+func runMutationTests(t *testing.T, tests [][2]string, valid bool) {
 	target := initTargetTest(t, "test", "64")
 	for ti, test := range tests {
 		test := test
@@ -416,16 +451,25 @@ func runMutationTests(t *testing.T, tests [][2]string) {
 				t.Fatalf("failed to deserialize the program: %v", err)
 			}
 			want := goal.Serialize()
-			for i := 0; i < 1e5; i++ {
+			iters := int(1e5)
+			if !valid {
+				iters /= 10
+			}
+			for i := 0; i < iters; i++ {
 				p1 := p.Clone()
 				p1.Mutate(rs, len(goal.Calls), ct, nil)
 				data1 := p1.Serialize()
 				if bytes.Equal(want, data1) {
+					if !valid {
+						t.Fatalf("failed on iter %v", i)
+					}
 					t.Logf("success on iter %v", i)
 					return
 				}
 			}
-			t.Fatalf("failed to achieve goal, original:%s\ngoal:%s", test[0], test[1])
+			if valid {
+				t.Fatalf("failed to achieve goal, original:%s\ngoal:%s", test[0], test[1])
+			}
 		})
 	}
 }