feat: use @valuepool when mutating primitive arrays

Author: oetr

src/main/java/com/code_intelligence/jazzer/mutation/mutator/lang/PrimitiveArrayMutatorFactory.java

@@ -36,15 +36,19 @@
 import com.code_intelligence.jazzer.mutation.support.RangeSupport.FloatRange;
 import com.code_intelligence.jazzer.mutation.support.RangeSupport.LongRange;
 import com.code_intelligence.jazzer.mutation.support.TypeHolder;
+import com.code_intelligence.jazzer.mutation.support.ValuePoolSupport;
+import java.io.ByteArrayInputStream;
 import java.io.DataInputStream;
 import java.io.DataOutputStream;
 import java.io.IOException;
 import java.lang.reflect.AnnotatedArrayType;
 import java.lang.reflect.AnnotatedType;
 import java.nio.ByteBuffer;
+import java.util.Arrays;
 import java.util.Optional;
 import java.util.function.Function;
 import java.util.function.Predicate;
+import java.util.stream.Stream;
 
 final class PrimitiveArrayMutatorFactory implements MutatorFactory {
 
@@ -81,6 +85,7 @@ public static final class PrimitiveArrayMutator<T> extends SerializingMutator<T>
     private final SerializingMutator<byte[]> innerMutator;
     private final Function<byte[], T> toPrimitive;
     private final Function<T, byte[]> toBytes;
+    private final T[] valuePool;
 
     @SuppressWarnings("unchecked")
     public PrimitiveArrayMutator(AnnotatedType type) {
@@ -93,6 +98,56 @@ public PrimitiveArrayMutator(AnnotatedType type) {
           (SerializingMutator<byte[]>) LibFuzzerMutatorFactory.tryCreate(innerByteArray).get();
       toPrimitive = (Function<byte[], T>) makeBytesToPrimitiveArrayConverter(elementType);
       toBytes = (Function<T, byte[]>) makePrimitiveArrayToBytesConverter(elementType);
+      Optional<T[]> valuePool = extractValuePool(type);
+      this.valuePool = valuePool.orElse(null);
+      System.out.println(
+          "Created ValuePool with length: " + (this.valuePool == null ? 0 : this.valuePool.length));
+    }
+
+    public boolean getMutatedType(Object value) {
+      return value.getClass().isArray()
+          && value.getClass().getComponentType().isPrimitive()
+          && value.getClass().getComponentType() == elementType.getType();
+    }
+
+    public Optional<T[]> extractValuePool(AnnotatedType type) {
+      return ValuePoolSupport.extractRawValues(type)
+          .map(
+              stream ->
+                  stream
+                      .flatMap(
+                          o -> {
+                            if (getMutatedType(o)) {
+                              return Stream.of(o);
+                            } else {
+                              return Stream.empty();
+                            }
+                          })
+                      .distinct()
+                      .map(o -> (T) o)
+                      // use a round-trip from the inner mutator to see if length and range
+                      // constraints are met
+                      .filter(
+                          o -> {
+                            try {
+                              byte[] valueBytes = toBytes.apply(o);
+                              byte[] roundTrip =
+                                  toBytes.apply(
+                                      toPrimitive.apply(
+                                          innerMutator.readExclusive(
+                                              new DataInputStream(
+                                                  new ByteArrayInputStream(valueBytes)))));
+                              System.out.println(
+                                  "ValuePool candidate original bytes length: "
+                                      + valueBytes.length
+                                      + ", roundTrip bytes length: "
+                                      + roundTrip.length);
+                              return Arrays.equals(roundTrip, valueBytes);
+                            } catch (IOException e) {
+                              return false;
+                            }
+                          })
+                      .toArray(size -> (T[]) Arrays.copyOf(new Object[0], size)));
     }
 
     @Override
@@ -128,6 +183,15 @@ public T init(PseudoRandom prng) {
 
     @Override
     public T mutate(T value, PseudoRandom prng) {
+      if (valuePool != null && valuePool.length > 0) {
+        if (prng.choice()) {
+          return prng.pickIn(valuePool);
+        } else {
+          // 50% chance to mutate vs picking from the pool
+          return (T)
+              toPrimitive.apply(innerMutator.mutate(toBytes.apply(prng.pickIn(valuePool)), prng));
+        }
+      }
       return (T) toPrimitive.apply(innerMutator.mutate(toBytes.apply(value), prng));
     }