Commit Graph

103 Commits

Author SHA1 Message Date
George Karpenkov 406c113103 Fixing section name for Darwin platforms for sanitizer coverage
On Darwin, section names have a 16char length limit.

llvm-svn: 305429
2017-06-14 23:40:25 +00:00
Kostya Serebryany 2c2fb8896b [sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet. Reapplying revisions 304630, 304631, 304632, 304673, see PR33308
llvm-svn: 305026
2017-06-08 22:58:19 +00:00
Renato Golin cdf840fd38 Revert "[sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet."
This reverts commit r304630, as it broke ARM/AArch64 bots for 2 days.

llvm-svn: 304698
2017-06-05 07:35:52 +00:00
Kostya Serebryany f7db346cdf [sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet.
llvm-svn: 304630
2017-06-03 01:35:47 +00:00
Kostya Serebryany aed6ba770c [sanitizer-coverage] refactor the code to make it easier to add more sections in future. NFC
llvm-svn: 304610
2017-06-02 23:13:44 +00:00
Kostya Serebryany 53b34c8443 [sanitizer-coverage] remove stale code (old coverage); llvm part
llvm-svn: 304319
2017-05-31 18:27:33 +00:00
George Karpenkov a1c532784d Fix coverage check for full post-dominator basic blocks.
Coverage instrumentation which does not instrument full post-dominators
and full-dominators may skip valid paths, as the reasoning for skipping
blocks may become circular.
This patch fixes that, by only skipping
full post-dominators with multiple predecessors, as such predecessors by
definition can not be full-dominators.

llvm-svn: 303827
2017-05-25 01:41:46 +00:00
George Karpenkov 018472c34a Revert "Disable coverage opt-out for strong postdominator blocks."
This reverts commit 2ed06f05fc10869dd1239cff96fcdea2ee8bf4ef.
Buildbots do not like this on Linux.

llvm-svn: 303710
2017-05-24 00:29:12 +00:00
George Karpenkov 9017ca290a Disable coverage opt-out for strong postdominator blocks.
Coverage instrumentation has an optimization not to instrument extra
blocks, if the pass is already "accounted for" by a
successor/predecessor basic block.
However (https://github.com/google/sanitizers/issues/783) this
reasoning may become circular, which stops valid paths from having
coverage.
In the worst case this can cause fuzzing to stop working entirely.

This change simplifies logic to something which trivially can not have
such circular reasoning, as losing valid paths does not seem like a
good trade-off for a ~15% decrease in the # of instrumented basic blocks.

llvm-svn: 303698
2017-05-23 21:58:54 +00:00
Kostya Serebryany 424bfed693 [sanitizer-coverage] implement -fsanitize-coverage=no-prune,... instead of a hidden -mllvm flag. llvm part.
llvm-svn: 302319
2017-05-05 23:14:40 +00:00
Kostya Serebryany c5d3d49034 [sanitizer-coverage] remove some more stale code
llvm-svn: 300778
2017-04-19 22:42:11 +00:00
Evgeniy Stepanov 7c9b086ef5 Remove two unused variables (-Werror).
llvm-svn: 300777
2017-04-19 22:27:23 +00:00
Kostya Serebryany be87d480ff [sanitizer-coverage] remove stale code
llvm-svn: 300769
2017-04-19 21:48:09 +00:00
Serge Guelton 59a2d7b909 Module::getOrInsertFunction is using C-style vararg instead of variadic templates.
From a user prospective, it forces the use of an annoying nullptr to mark the end of the vararg, and there's not type checking on the arguments.
The variadic template is an obvious solution to both issues.

Differential Revision: https://reviews.llvm.org/D31070

llvm-svn: 299949
2017-04-11 15:01:18 +00:00
Diana Picus b050c7fbe0 Revert "Turn some C-style vararg into variadic templates"
This reverts commit r299925 because it broke the buildbots. See e.g.
http://lab.llvm.org:8011/builders/clang-cmake-armv7-a15/builds/6008

llvm-svn: 299928
2017-04-11 10:07:12 +00:00
Serge Guelton 5fd75fb72e Turn some C-style vararg into variadic templates
Module::getOrInsertFunction is using C-style vararg instead of
variadic templates.

From a user prospective, it forces the use of an annoying nullptr
to mark the end of the vararg, and there's not type checking on the
arguments. The variadic template is an obvious solution to both
issues.

llvm-svn: 299925
2017-04-11 08:36:52 +00:00
Mehdi Amini db11fdfda5 Revert "Turn some C-style vararg into variadic templates"
This reverts commit r299699, the examples needs to be updated.

llvm-svn: 299702
2017-04-06 20:23:57 +00:00
Mehdi Amini 579540a8f7 Turn some C-style vararg into variadic templates
Module::getOrInsertFunction is using C-style vararg instead of
variadic templates.

From a user prospective, it forces the use of an annoying nullptr
to mark the end of the vararg, and there's not type checking on the
arguments. The variadic template is an obvious solution to both
issues.

Patch by: Serge Guelton <serge.guelton@telecom-bretagne.eu>

Differential Revision: https://reviews.llvm.org/D31070

llvm-svn: 299699
2017-04-06 20:09:31 +00:00
Reid Kleckner 392f062675 [sancov] Don't instrument blocks with no insertion point
This prevents crashes when attempting to instrument functions containing
C++ try.

Sanitizer coverage will still fail at runtime when an exception is
thrown through a sancov instrumented function, but that seems marginally
better than what we have now. The full solution is to color the blocks
in LLVM IR and only instrument blocks that have an unambiguous color,
using the appropriate token.

llvm-svn: 298662
2017-03-23 23:30:41 +00:00
Mike Aizatsky 4705ae936d [sancov] using comdat only when it is enabled
Differential Revision: https://reviews.llvm.org/D29733

llvm-svn: 294529
2017-02-08 23:12:46 +00:00
Mike Aizatsky 401d369328 [sancov] specifying comdat for sancov constructors
Differential Revision: https://reviews.llvm.org/D29662

llvm-svn: 294517
2017-02-08 21:20:33 +00:00
Marcos Pividori db5a565514 [sanitizer coverage] Fix Instrumentation to work on Windows.
On Windows, the symbols "___stop___sancov_guards" and "___start___sancov_guards"
are not defined automatically. So, we need to take a different approach.
We define 3 sections:

 Section ".SCOV$A" will only hold a variable ___start___sancov_guard.
 Section ".SCOV$M" will hold the main data.
 Section ".SCOV$Z" will only hold a variable ___stop___sancov_guards.

When linking, they will be merged sorted by the characters after the $, so we
can use the pointers of the variables ___[start|stop]___sancov_guard to know the
actual range of addresses of that section.

In this diff, I updated instrumentation to include all the guard arrays in
section ".SCOV$M".

Differential Revision: https://reviews.llvm.org/D28434

llvm-svn: 293987
2017-02-03 01:08:06 +00:00
Justin Bogner 41e632bf6b SanitizerCoverage: Support sanitizer guard section on darwin
MachO's sections need a segment as well as a section name, and the
section start and end symbols are spelled differently than on ELF.

llvm-svn: 293733
2017-02-01 02:38:39 +00:00
Kostya Serebryany 4b2ff07c11 [sanitizer-coverage] emit __sanitizer_cov_trace_pc_guard w/o a preceding 'if' by default. Update the docs, also add deprecation notes around other parts of sanitizer coverage
llvm-svn: 292862
2017-01-24 00:57:31 +00:00
Kostya Serebryany f24e52c0c2 [sanitizer-coverage] sort the switch cases
llvm-svn: 290628
2016-12-27 21:20:06 +00:00
Kostya Serebryany 520753a321 [sanitizer-coverage] use IRB.SetCurrentDebugLocation after IRB.SetInsertPoint
llvm-svn: 288568
2016-12-03 01:43:30 +00:00
Reid Kleckner 3a83e76811 [sancov] Name the global containing the main source file name
If the global name doesn't start with __sancov_gen, ASan will insert
unecessary red zones around it.

llvm-svn: 287117
2016-11-16 16:50:43 +00:00
Kostya Serebryany 9d6dc7b164 [sanitizer-coverage] make sure asan does not instrument coverage guards (reported in https://github.com/google/oss-fuzz/issues/84)
llvm-svn: 287030
2016-11-15 21:12:50 +00:00
Reid Kleckner ec80354873 [sancov] Don't instrument MSVC CRT stdio config helpers
They get called before initialization, which is a problem for winasan.

Test coming in compiler-rt.

llvm-svn: 286615
2016-11-11 19:18:45 +00:00
Kostya Serebryany 4d25ad93f3 [sanitizer-coverage] use private linkage for coverage guards, delete old commented-out code.
llvm-svn: 283924
2016-10-11 19:36:50 +00:00
Mehdi Amini 117296c0a0 Use StringRef in Pass/PassManager APIs (NFC)
llvm-svn: 283004
2016-10-01 02:56:57 +00:00
Kostya Serebryany a9b0dd0e51 [sanitizer-coverage/libFuzzer] make the guards for trace-pc 32-bit; create one array of guards per function, instead of one guard per BB. reorganize the code so that trace-pc-guard does not create unneeded globals
llvm-svn: 282735
2016-09-29 17:43:24 +00:00
Kostya Serebryany 45c144754b [sanitizer-coverage] fix a bug in trace-gep
llvm-svn: 282467
2016-09-27 01:55:08 +00:00
Kostya Serebryany 186d61801c [sanitizer-coverage] don't emit the CTOR function if nothing has been instrumented
llvm-svn: 282465
2016-09-27 01:08:33 +00:00
Kostya Serebryany 06694d0a2f [sanitizer-coverage] add comdat to coverage guards if needed
llvm-svn: 281952
2016-09-20 00:16:54 +00:00
Kostya Serebryany 8e781a888a [libFuzzer] use 'if guard' instead of 'if guard >= 0' with trace-pc; change the guard type to intptr_t; use separate array for 8-bit counters
llvm-svn: 281845
2016-09-18 04:52:23 +00:00
Kostya Serebryany 8ad4155745 [sanitizer-coverage] change trace-pc to use 8-byte guards
llvm-svn: 281809
2016-09-17 05:03:05 +00:00
Kostya Serebryany 66a9c175bf [sanitizer-coverage] make trace-pc-guard and indirect-call work together
llvm-svn: 281665
2016-09-15 22:11:08 +00:00
Kostya Serebryany da718e55cf [sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. LLVM part
llvm-svn: 281431
2016-09-14 01:39:35 +00:00
Kostya Serebryany 5ac427b8e4 [sanitizer-coverage] add two more modes of instrumentation: trace-div and trace-gep, mostly usaful for value-profile-based fuzzing; llvm part
llvm-svn: 280043
2016-08-30 01:12:10 +00:00
Kostya Serebryany 524c3f32e7 [sanitizer-coverage/libFuzzer] instrument comparisons with __sanitizer_cov_trace_cmp[1248] instead of __sanitizer_cov_trace_cmp, don't pass the comparison type to save a bit performance. Use these new callbacks in libFuzzer
llvm-svn: 279027
2016-08-18 01:25:28 +00:00
Kostya Serebryany dd5c7f9313 [sanitizer-coverage] make sure that calls to __sanitizer_cov_trace_pc are not merged (otherwise different calls get the same PC and confuse fuzzers)
llvm-svn: 275449
2016-07-14 17:59:01 +00:00
Mike Aizatsky 70ea45306a [sancov] enabling coverage edge pruning by default.
Differential Revision: http://reviews.llvm.org/D18844

llvm-svn: 265615
2016-04-06 23:24:37 +00:00
JF Bastien 800f87a871 NFC: make AtomicOrdering an enum class
Summary:
In the context of http://wg21.link/lwg2445 C++ uses the concept of
'stronger' ordering but doesn't define it properly. This should be fixed
in C++17 barring a small question that's still open.

The code currently plays fast and loose with the AtomicOrdering
enum. Using an enum class is one step towards tightening things. I later
also want to tighten related enums, such as clang's
AtomicOrderingKind (which should be shared with LLVM as a 'C++ ABI'
enum).

This change touches a few lines of code which can be improved later, I'd
like to keep it as NFC for now as it's already quite complex. I have
related changes for clang.

As a follow-up I'll add:
  bool operator<(AtomicOrdering, AtomicOrdering) = delete;
  bool operator>(AtomicOrdering, AtomicOrdering) = delete;
  bool operator<=(AtomicOrdering, AtomicOrdering) = delete;
  bool operator>=(AtomicOrdering, AtomicOrdering) = delete;
This is separate so that clang and LLVM changes don't need to be in sync.

Reviewers: jyknight, reames

Subscribers: jyknight, llvm-commits

Differential Revision: http://reviews.llvm.org/D18775

llvm-svn: 265602
2016-04-06 21:19:33 +00:00
Mike Aizatsky 01c0f8d8a3 [sancov] save entry block from pruning (it is always full dominator)
llvm-svn: 265168
2016-04-01 18:13:19 +00:00
Mike Aizatsky 9987f43ffa [sancov] code readability improvement.
Summary: Reply to http://reviews.llvm.org/D18341

Differential Revision: http://reviews.llvm.org/D18406

llvm-svn: 264213
2016-03-23 23:15:03 +00:00
Mike Aizatsky 602f79275d [sancov] do not instrument nodes that are full pre-dominators
Summary:
Without tree pruning clang has 2,667,552 points.
Wiht only dominators pruning: 1,515,586.
With both dominators & predominators pruning: 1,340,534.

Resubmit of r262103.

Differential Revision: http://reviews.llvm.org/D18341

llvm-svn: 264003
2016-03-21 23:08:16 +00:00
Mike Aizatsky 759aca01ce [sancov] clang-formatting SanitizerCoverage.cpp and fully pleasing clang-tidy.
Differential Revision: http://reviews.llvm.org/D18288

llvm-svn: 263852
2016-03-18 23:29:29 +00:00
Chandler Carruth 3006115cfe Revert "Revert "[sancov] specifying sanitizer coverage dependencies.""
This reverts commit r263825, re-instating r263797.

llvm-svn: 263847
2016-03-18 22:43:42 +00:00
Chandler Carruth e2b7021a91 [sancov] Fix the sancov pass to initialize itself inside its
constructor. This should fix the recent crashes on certain
architectures.

llvm-svn: 263845
2016-03-18 22:35:58 +00:00