157 Commits

Author SHA1 Message Date
Mike Aizatsky
668a12461d [sancov] do not instrument nodes that are full pre-dominators
Summary:
Without tree pruning clang has 2,667,552 points.
Wiht only dominators pruning: 1,515,586.
With both dominators & predominators pruning: 1,340,534.

Resubmit of r262103.

Differential Revision: http://reviews.llvm.org/D18341

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@264003 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-21 23:08:16 +00:00
Mike Aizatsky
dc0299a744 [sancov] clang-formatting SanitizerCoverage.cpp and fully pleasing clang-tidy.
Differential Revision: http://reviews.llvm.org/D18288

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263852 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 23:29:29 +00:00
Chandler Carruth
07cfdc8cd0 Revert "Revert "[sancov] specifying sanitizer coverage dependencies.""
This reverts commit r263825, re-instating r263797.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263847 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 22:43:42 +00:00
Chandler Carruth
6b13fc7693 [sancov] Fix the sancov pass to initialize itself inside its
constructor. This should fix the recent crashes on certain
architectures.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263845 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 22:35:58 +00:00
Mike Aizatsky
643e47a345 Revert "[sancov] specifying sanitizer coverage dependencies."
This fails on arm.

This reverts commit 52c8e0f7119d1ea1050c0708565a8c92b73386d2.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263825 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 20:34:58 +00:00
Mike Aizatsky
645ba4e0b9 [sancov] specifying sanitizer coverage dependencies.
Summary:
These dependencies would be used in the future to reduce the number
of instrumented blocks(http://reviews.llvm.org/rL262103)

This is submitted as a separate CL because of previous problems with
ARM.

Subscribers: aemerson

Differential Revision: http://reviews.llvm.org/D18227

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263797 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 17:33:21 +00:00
Pete Cooper
1ac3fbac0f Remove llvm::getDISubprogram in favor of Function::getSubprogram
llvm::getDISubprogram walks the instructions in a function, looking for one in the scope of the current function, so that it can find the !dbg entry for the subprogram itself.

Now that !dbg is attached to functions, this should not be necessary. This patch changes all uses to just query the subprogram directly on the function.

Ideally this should be NFC, but in reality its possible that a function:

has no !dbg (in which case there's likely a bug somewhere in an opt pass), or
that none of the instructions had a scope referencing the function, so we used to not find the !dbg on the function but now we will

Reviewed by Duncan Exon Smith.

Differential Revision: http://reviews.llvm.org/D18074

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263184 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-11 02:14:16 +00:00
Renato Golin
751381e387 Revert "[sancov] do not instrument nodes that are full pre-dominators"
This reverts commit r262103, as it broke all ARM and AArch64 bots.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@262139 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-27 14:19:19 +00:00
Mike Aizatsky
fd676b1823 [sancov] properly initializing pass.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@262111 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-27 05:50:40 +00:00
Kostya Serebryany
e01ce57c55 [libFuzzer] don't emit callbacks to sanitizer run-time in -fsanitize-coverage=trace-pc mode; update libFuzzer doc for previous commit
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@262110 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-27 05:45:12 +00:00
Mike Aizatsky
9672e363ba [sancov] do not instrument nodes that are full pre-dominators
Summary:
Without tree pruning clang has 2,667,552 points.
Wiht only dominators pruning: 1,515,586.
With both dominators & predominators pruning: 1,340,534.

Differential Revision: http://reviews.llvm.org/D17671

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@262103 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-27 02:10:27 +00:00
Mike Aizatsky
5e86c5c682 [sancov] Pruning full dominator blocks from instrumentation.
Summary:
This is the first simple attempt to reduce number of coverage-
instrumented blocks.

If a basic block dominates all its successors, then its coverage
information is useless to us. Ingore such blocks if
santizer-coverage-prune-tree option is set.

Differential Revision: http://reviews.llvm.org/D17626

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@261949 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-26 01:17:22 +00:00
Kostya Serebryany
d016c6f389 [sanitizer-coverage] implement -fsanitize-coverage=trace-pc. This is similar to trace-bb, but has a different API. We already use the equivalent flag in GCC for Linux kernel fuzzing. We may be able to use this flag with AFL too
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@261159 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-17 21:34:43 +00:00
Rui Ueyama
3edb0ec229 Update to use new name alignTo().
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@257804 91177308-0d34-0410-b5e6-96231b3b80d8
2016-01-14 21:06:47 +00:00
Sanjay Patel
59dc7be11d getParent() ^ 3 == getModule() ; NFCI
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@255511 91177308-0d34-0410-b5e6-96231b3b80d8
2015-12-14 17:24:23 +00:00
David Majnemer
1114aa2fc6 Move EH-specific helper functions to a more appropriate place
No functionality change is intended.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@254562 91177308-0d34-0410-b5e6-96231b3b80d8
2015-12-02 23:06:39 +00:00
Kostya Serebryany
0445c4d68b [sanitizer coverage] when adding a bb trace instrumentation, do it instead, not in addition to, regular coverage. Do the regular coverage in the run-time instead
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@254482 91177308-0d34-0410-b5e6-96231b3b80d8
2015-12-02 02:37:13 +00:00
Duncan P. N. Exon Smith
210a154346 Instrumentation: Remove ilist iterator implicit conversions, NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@250186 91177308-0d34-0410-b5e6-96231b3b80d8
2015-10-13 17:39:10 +00:00
Reid Kleckner
388c85b18f [sancov] Disable sanitizer coverage on functions using SEH
Splitting basic blocks really messes up WinEHPrepare. We can remove this
change when SEH uses the new EH IR.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@246799 91177308-0d34-0410-b5e6-96231b3b80d8
2015-09-03 20:18:29 +00:00
Justin Bogner
afc9925923 [sancov] Fix an unused variable warning introduced in r245067
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@245072 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-14 17:03:45 +00:00
Reid Kleckner
458a50de93 [sancov] Leave llvm.localescape in the entry block
Summary: Similar to the change we applied to ASan. The same test case works.

Reviewers: samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D11961

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@245067 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-14 16:45:42 +00:00
Kostya Serebryany
0e2c9c8c4a [libFuzzer] don't crash if the condition in a switch has unusual type (e.g. i72)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@244544 91177308-0d34-0410-b5e6-96231b3b80d8
2015-08-11 00:24:39 +00:00
Kostya Serebryany
02c18f4db9 [libFuzzer] trace switch statements and apply mutations based on the expected case values
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@243726 91177308-0d34-0410-b5e6-96231b3b80d8
2015-07-31 01:33:06 +00:00
Alexey Samsonov
327cfdf4fe [SanitizerCoverage] Don't add instrumentation to unreachable blocks.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@241127 91177308-0d34-0410-b5e6-96231b3b80d8
2015-06-30 23:11:45 +00:00
Alexey Samsonov
0fd41495ef [SanitizerCoverage] Use llvm::getDISubprogram() to get location of the entry basic block.
DebugLoc::getFnDebugLoc() should soon be removed. Also,
getDISubprogram() might become more effective soon and wouldn't need to
scan debug locations at all, if function-level metadata would be emitted
by Clang.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@239586 91177308-0d34-0410-b5e6-96231b3b80d8
2015-06-12 01:48:47 +00:00
David Blaikie
042dd34f9c Simplify IRBuilder::CreateCall* by using ArrayRef+initializer_list/braced init only
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237624 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-18 22:13:54 +00:00
Ismail Pazarbasi
6c318f59b1 SanitizerCoverage: Use createSanitizerCtor to create ctor and call init
Second attempt; instead of using a named local variable, passing
arguments directly to `createSanitizerCtorAndInitFunctions` worked
on Windows.

Reviewers: kcc, samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D8780

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236951 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-10 13:45:05 +00:00
Alexey Samsonov
8404686a68 Delete unused createSanitizerCoverageModulePass overload.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236791 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-07 22:46:06 +00:00
Ismail Pazarbasi
f31b4e9690 Revert "SanitizerCoverage: Use createSanitizerCtor to create ctor and call init"
Will fix tomorrow. Unbreak build bots now.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236786 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-07 22:17:48 +00:00
Ismail Pazarbasi
57d28fee47 SanitizerCoverage: Use createSanitizerCtor to create ctor and call init
Reviewers: kcc, samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D8780

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236780 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-07 21:43:28 +00:00
Alexey Samsonov
cddf82ae35 [SanitizerCoverage] Introduce SanitizerCoverageOptions struct.
Summary:
This gives frontend more precise control over collected coverage
information. User can still override these options by passing
-mllvm flags.

No functionality change.

Test Plan: regression test suite.

Reviewers: kcc

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9539

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236687 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-07 01:00:31 +00:00
Alexey Samsonov
d71e55b97f [SanitizerCoverage] Fix a couple of typos. NFC.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236643 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-06 21:35:25 +00:00
Benjamin Kramer
0973b7ddb8 Reduce dyn_cast<> to isa<> or cast<> where possible.
No functional change intended.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234586 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-10 11:24:51 +00:00
Ismail Pazarbasi
aa5880df12 Move checkInterfaceFunction to ModuleUtils
Summary:
Instead of making a local copy of `checkInterfaceFunction` for each
sanitizer, move the function in a common place.

Reviewers: kcc, samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D8775

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234220 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-06 21:09:08 +00:00
Duncan P. N. Exon Smith
f175439a2b Transforms: Use the new DebugLoc API, NFC
Update lib/Analysis and lib/Transforms to use the new `DebugLoc` API.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@233587 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-30 19:49:49 +00:00
Kostya Serebryany
a1ea57a185 [sanitizer] experimental tracing for cmp instructions
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@232873 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-21 01:29:36 +00:00
Duncan P. N. Exon Smith
14d8dbd37d SanitizerCoverage: Check for null DebugLocs
After a WIP patch to make `DIDescriptor` accessors more strict, this
started asserting.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@232832 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-20 18:48:45 +00:00
Kostya Serebryany
935a3aa5bc [sanitizer] fix instrumentation with -mllvm -sanitizer-coverage-block-threshold=0 to actually do something useful.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231736 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-10 01:58:27 +00:00
Kostya Serebryany
a7b107bc82 [sanitizer] decrease sanitizer-coverage-block-threshold from 1000 to 500 as another horrible workaround for PR17409
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231733 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-10 01:11:53 +00:00
Kostya Serebryany
c2f4077b88 [sanitizer] add nosanitize metadata to more coverage instrumentation instructions
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231333 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-05 01:20:05 +00:00
Mehdi Amini
c94da20917 Make DataLayout Non-Optional in the Module
Summary:
DataLayout keeps the string used for its creation.

As a side effect it is no longer needed in the Module.
This is "almost" NFC, the string is no longer
canonicalized, you can't rely on two "equals" DataLayout
having the same string returned by getStringRepresentation().

Get rid of DataLayoutPass: the DataLayout is in the Module

The DataLayout is "per-module", let's enforce this by not
duplicating it more than necessary.
One more step toward non-optionality of the DataLayout in the
module.

Make DataLayout Non-Optional in the Module

Module->getDataLayout() will never returns nullptr anymore.

Reviewers: echristo

Subscribers: resistor, llvm-commits, jholewinski

Differential Revision: http://reviews.llvm.org/D7992

From: Mehdi Amini <mehdi.amini@apple.com>

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231270 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-04 18:43:29 +00:00
Kostya Serebryany
ae0620c4e9 [sanitizer/coverage] Add AFL-style coverage counters (search heuristic for fuzzing).
Introduce -mllvm -sanitizer-coverage-8bit-counters=1
which adds imprecise thread-unfriendly 8-bit coverage counters.

The run-time library maps these 8-bit counters to 8-bit bitsets in the same way
AFL (http://lcamtuf.coredump.cx/afl/technical_details.txt) does:
counter values are divided into 8 ranges and based on the counter
value one of the bits in the bitset is set.
The AFL ranges are used here: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+.

These counters provide a search heuristic for single-threaded
coverage-guided fuzzers, we do not expect them to be useful for other purposes.

Depending on the value of -fsanitize-coverage=[123] flag,
these counters will be added to the function entry blocks (=1),
every basic block (=2), or every edge (=3).

Use these counters as an optional search heuristic in the Fuzzer library.
Add a test where this heuristic is critical.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231166 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-03 23:27:02 +00:00
Kostya Serebryany
727a6ee223 [sanitizer] when dumping the basic block trace, also dump the module names. Patch by Laszlo Szekeres
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229940 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-20 00:30:44 +00:00
Kostya Serebryany
0013784dd3 [sanitizer] add another workaround for PR 17409: when over a threshold emit coverage instrumentation as calls.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228102 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-04 01:21:45 +00:00
Evgeniy Stepanov
0b2455c374 [sancov] Fix unspecified constructor order between sancov and asan.
Sanitizer coverage constructor must run after asan constructor (for each DSO).
Bump constructor priority to guarantee that.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227195 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-27 15:01:22 +00:00
Chandler Carruth
08962f208b [PM] Remove the Pass argument from all of the critical edge splitting
APIs and replace it and numerous booleans with an option struct.

The critical edge splitting API has a really large surface of flags and
so it seems worth burning a small option struct / builder. This struct
can be constructed with the various preserved analyses and then flags
can be flipped in a builder style.

The various users are now responsible for directly passing along their
analysis information. This should be enough for the critical edge
splitting to work cleanly with the new pass manager as well.

This API is still pretty crufty and could be cleaned up a lot, but I've
focused on this change just threading an option struct rather than
a pass through the API.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@226456 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-19 12:09:11 +00:00
Kostya Serebryany
8c6ae1044a [asan] simplify the tracing code, make it use the same guard variables as coverage
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@225103 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-03 00:54:43 +00:00
Kostya Serebryany
dd890d5c5e [asan] change _sanitizer_cov_module_init to accept int* instead of int**
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224999 91177308-0d34-0410-b5e6-96231b3b80d8
2014-12-30 19:29:28 +00:00
Kostya Serebryany
b69d796590 [asan] change the coverage collection scheme so that we can easily emit coverage for the entire process as a single bit set, and if coverage_bitset=1 actually emit that bitset
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224789 91177308-0d34-0410-b5e6-96231b3b80d8
2014-12-23 22:32:17 +00:00
Kostya Serebryany
1c97c5e8bd [sanitizer] allow -fsanitize-coverage=N w/ -fsanitize=leak, llvm part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224463 91177308-0d34-0410-b5e6-96231b3b80d8
2014-12-17 21:50:04 +00:00