89 Commits

Author SHA1 Message Date
Diana Picus
1d02724c71 Revert "Turn some C-style vararg into variadic templates"
This reverts commit r299925 because it broke the buildbots. See e.g.
http://lab.llvm.org:8011/builders/clang-cmake-armv7-a15/builds/6008

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299928 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-11 10:07:12 +00:00
Serge Guelton
ec124b3a6f Turn some C-style vararg into variadic templates
Module::getOrInsertFunction is using C-style vararg instead of
variadic templates.

From a user prospective, it forces the use of an annoying nullptr
to mark the end of the vararg, and there's not type checking on the
arguments. The variadic template is an obvious solution to both
issues.



git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299925 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-11 08:36:52 +00:00
Mehdi Amini
8701bbc75d Revert "Turn some C-style vararg into variadic templates"
This reverts commit r299699, the examples needs to be updated.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299702 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-06 20:23:57 +00:00
Mehdi Amini
753bd2a772 Turn some C-style vararg into variadic templates
Module::getOrInsertFunction is using C-style vararg instead of
variadic templates.

From a user prospective, it forces the use of an annoying nullptr
to mark the end of the vararg, and there's not type checking on the
arguments. The variadic template is an obvious solution to both
issues.

Patch by: Serge Guelton <serge.guelton@telecom-bretagne.eu>

Differential Revision: https://reviews.llvm.org/D31070

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@299699 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-06 20:09:31 +00:00
Reid Kleckner
bef4d671d9 [sancov] Don't instrument blocks with no insertion point
This prevents crashes when attempting to instrument functions containing
C++ try.

Sanitizer coverage will still fail at runtime when an exception is
thrown through a sancov instrumented function, but that seems marginally
better than what we have now. The full solution is to color the blocks
in LLVM IR and only instrument blocks that have an unambiguous color,
using the appropriate token.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298662 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-23 23:30:41 +00:00
Mike Aizatsky
9cf01663e3 [sancov] using comdat only when it is enabled
Differential Revision: https://reviews.llvm.org/D29733

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@294529 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-08 23:12:46 +00:00
Mike Aizatsky
884f3fe80d [sancov] specifying comdat for sancov constructors
Differential Revision: https://reviews.llvm.org/D29662

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@294517 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-08 21:20:33 +00:00
Marcos Pividori
045de6fddb [sanitizer coverage] Fix Instrumentation to work on Windows.
On Windows, the symbols "___stop___sancov_guards" and "___start___sancov_guards"
are not defined automatically. So, we need to take a different approach.
We define 3 sections:

 Section ".SCOV$A" will only hold a variable ___start___sancov_guard.
 Section ".SCOV$M" will hold the main data.
 Section ".SCOV$Z" will only hold a variable ___stop___sancov_guards.

When linking, they will be merged sorted by the characters after the $, so we
can use the pointers of the variables ___[start|stop]___sancov_guard to know the
actual range of addresses of that section.

In this diff, I updated instrumentation to include all the guard arrays in
section ".SCOV$M".

Differential Revision: https://reviews.llvm.org/D28434

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293987 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-03 01:08:06 +00:00
Justin Bogner
770cb8b1b5 SanitizerCoverage: Support sanitizer guard section on darwin
MachO's sections need a segment as well as a section name, and the
section start and end symbols are spelled differently than on ELF.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293733 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-01 02:38:39 +00:00
Kostya Serebryany
42d07d086c [sanitizer-coverage] emit __sanitizer_cov_trace_pc_guard w/o a preceding 'if' by default. Update the docs, also add deprecation notes around other parts of sanitizer coverage
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292862 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-24 00:57:31 +00:00
Kostya Serebryany
834b93c09f [sanitizer-coverage] sort the switch cases
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290628 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-27 21:20:06 +00:00
Kostya Serebryany
4732785cea [sanitizer-coverage] use IRB.SetCurrentDebugLocation after IRB.SetInsertPoint
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@288568 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-03 01:43:30 +00:00
Reid Kleckner
195a4bc96d [sancov] Name the global containing the main source file name
If the global name doesn't start with __sancov_gen, ASan will insert
unecessary red zones around it.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@287117 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-16 16:50:43 +00:00
Kostya Serebryany
dd850be3cf [sanitizer-coverage] make sure asan does not instrument coverage guards (reported in https://github.com/google/oss-fuzz/issues/84)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@287030 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-15 21:12:50 +00:00
Reid Kleckner
d758cd3129 [sancov] Don't instrument MSVC CRT stdio config helpers
They get called before initialization, which is a problem for winasan.

Test coming in compiler-rt.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@286615 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-11 19:18:45 +00:00
Kostya Serebryany
21fcbebddd [sanitizer-coverage] use private linkage for coverage guards, delete old commented-out code.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283924 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-11 19:36:50 +00:00
Mehdi Amini
67f335d992 Use StringRef in Pass/PassManager APIs (NFC)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283004 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-01 02:56:57 +00:00
Kostya Serebryany
efa54824a3 [sanitizer-coverage/libFuzzer] make the guards for trace-pc 32-bit; create one array of guards per function, instead of one guard per BB. reorganize the code so that trace-pc-guard does not create unneeded globals
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282735 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-29 17:43:24 +00:00
Kostya Serebryany
30eb92316c [sanitizer-coverage] fix a bug in trace-gep
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282467 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-27 01:55:08 +00:00
Kostya Serebryany
dbadbd797d [sanitizer-coverage] don't emit the CTOR function if nothing has been instrumented
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282465 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-27 01:08:33 +00:00
Kostya Serebryany
18f63e47d8 [sanitizer-coverage] add comdat to coverage guards if needed
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281952 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-20 00:16:54 +00:00
Kostya Serebryany
2bed90363f [libFuzzer] use 'if guard' instead of 'if guard >= 0' with trace-pc; change the guard type to intptr_t; use separate array for 8-bit counters
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281845 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-18 04:52:23 +00:00
Kostya Serebryany
16197d80b6 [sanitizer-coverage] change trace-pc to use 8-byte guards
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281809 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-17 05:03:05 +00:00
Kostya Serebryany
31daa34b7b [sanitizer-coverage] make trace-pc-guard and indirect-call work together
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281665 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 22:11:08 +00:00
Kostya Serebryany
8ea4234809 [sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. LLVM part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281431 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-14 01:39:35 +00:00
Kostya Serebryany
8c23b334cd [sanitizer-coverage] add two more modes of instrumentation: trace-div and trace-gep, mostly usaful for value-profile-based fuzzing; llvm part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280043 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-30 01:12:10 +00:00
Kostya Serebryany
aa4e23e1bb [sanitizer-coverage/libFuzzer] instrument comparisons with __sanitizer_cov_trace_cmp[1248] instead of __sanitizer_cov_trace_cmp, don't pass the comparison type to save a bit performance. Use these new callbacks in libFuzzer
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279027 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-18 01:25:28 +00:00
Kostya Serebryany
ec8a2f2059 [sanitizer-coverage] make sure that calls to __sanitizer_cov_trace_pc are not merged (otherwise different calls get the same PC and confuse fuzzers)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@275449 91177308-0d34-0410-b5e6-96231b3b80d8
2016-07-14 17:59:01 +00:00
Mike Aizatsky
f593646d9a [sancov] enabling coverage edge pruning by default.
Differential Revision: http://reviews.llvm.org/D18844

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@265615 91177308-0d34-0410-b5e6-96231b3b80d8
2016-04-06 23:24:37 +00:00
JF Bastien
b36d1a86f1 NFC: make AtomicOrdering an enum class
Summary:
In the context of http://wg21.link/lwg2445 C++ uses the concept of
'stronger' ordering but doesn't define it properly. This should be fixed
in C++17 barring a small question that's still open.

The code currently plays fast and loose with the AtomicOrdering
enum. Using an enum class is one step towards tightening things. I later
also want to tighten related enums, such as clang's
AtomicOrderingKind (which should be shared with LLVM as a 'C++ ABI'
enum).

This change touches a few lines of code which can be improved later, I'd
like to keep it as NFC for now as it's already quite complex. I have
related changes for clang.

As a follow-up I'll add:
  bool operator<(AtomicOrdering, AtomicOrdering) = delete;
  bool operator>(AtomicOrdering, AtomicOrdering) = delete;
  bool operator<=(AtomicOrdering, AtomicOrdering) = delete;
  bool operator>=(AtomicOrdering, AtomicOrdering) = delete;
This is separate so that clang and LLVM changes don't need to be in sync.

Reviewers: jyknight, reames

Subscribers: jyknight, llvm-commits

Differential Revision: http://reviews.llvm.org/D18775

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@265602 91177308-0d34-0410-b5e6-96231b3b80d8
2016-04-06 21:19:33 +00:00
Mike Aizatsky
1ec923a9c5 [sancov] save entry block from pruning (it is always full dominator)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@265168 91177308-0d34-0410-b5e6-96231b3b80d8
2016-04-01 18:13:19 +00:00
Mike Aizatsky
bbc99ea0f8 [sancov] code readability improvement.
Summary: Reply to http://reviews.llvm.org/D18341

Differential Revision: http://reviews.llvm.org/D18406

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@264213 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-23 23:15:03 +00:00
Mike Aizatsky
668a12461d [sancov] do not instrument nodes that are full pre-dominators
Summary:
Without tree pruning clang has 2,667,552 points.
Wiht only dominators pruning: 1,515,586.
With both dominators & predominators pruning: 1,340,534.

Resubmit of r262103.

Differential Revision: http://reviews.llvm.org/D18341

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@264003 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-21 23:08:16 +00:00
Mike Aizatsky
dc0299a744 [sancov] clang-formatting SanitizerCoverage.cpp and fully pleasing clang-tidy.
Differential Revision: http://reviews.llvm.org/D18288

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263852 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 23:29:29 +00:00
Chandler Carruth
07cfdc8cd0 Revert "Revert "[sancov] specifying sanitizer coverage dependencies.""
This reverts commit r263825, re-instating r263797.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263847 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 22:43:42 +00:00
Chandler Carruth
6b13fc7693 [sancov] Fix the sancov pass to initialize itself inside its
constructor. This should fix the recent crashes on certain
architectures.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263845 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 22:35:58 +00:00
Mike Aizatsky
643e47a345 Revert "[sancov] specifying sanitizer coverage dependencies."
This fails on arm.

This reverts commit 52c8e0f7119d1ea1050c0708565a8c92b73386d2.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263825 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 20:34:58 +00:00
Mike Aizatsky
645ba4e0b9 [sancov] specifying sanitizer coverage dependencies.
Summary:
These dependencies would be used in the future to reduce the number
of instrumented blocks(http://reviews.llvm.org/rL262103)

This is submitted as a separate CL because of previous problems with
ARM.

Subscribers: aemerson

Differential Revision: http://reviews.llvm.org/D18227

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263797 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-18 17:33:21 +00:00
Pete Cooper
1ac3fbac0f Remove llvm::getDISubprogram in favor of Function::getSubprogram
llvm::getDISubprogram walks the instructions in a function, looking for one in the scope of the current function, so that it can find the !dbg entry for the subprogram itself.

Now that !dbg is attached to functions, this should not be necessary. This patch changes all uses to just query the subprogram directly on the function.

Ideally this should be NFC, but in reality its possible that a function:

has no !dbg (in which case there's likely a bug somewhere in an opt pass), or
that none of the instructions had a scope referencing the function, so we used to not find the !dbg on the function but now we will

Reviewed by Duncan Exon Smith.

Differential Revision: http://reviews.llvm.org/D18074

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@263184 91177308-0d34-0410-b5e6-96231b3b80d8
2016-03-11 02:14:16 +00:00
Renato Golin
751381e387 Revert "[sancov] do not instrument nodes that are full pre-dominators"
This reverts commit r262103, as it broke all ARM and AArch64 bots.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@262139 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-27 14:19:19 +00:00
Mike Aizatsky
fd676b1823 [sancov] properly initializing pass.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@262111 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-27 05:50:40 +00:00
Kostya Serebryany
e01ce57c55 [libFuzzer] don't emit callbacks to sanitizer run-time in -fsanitize-coverage=trace-pc mode; update libFuzzer doc for previous commit
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@262110 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-27 05:45:12 +00:00
Mike Aizatsky
9672e363ba [sancov] do not instrument nodes that are full pre-dominators
Summary:
Without tree pruning clang has 2,667,552 points.
Wiht only dominators pruning: 1,515,586.
With both dominators & predominators pruning: 1,340,534.

Differential Revision: http://reviews.llvm.org/D17671

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@262103 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-27 02:10:27 +00:00
Mike Aizatsky
5e86c5c682 [sancov] Pruning full dominator blocks from instrumentation.
Summary:
This is the first simple attempt to reduce number of coverage-
instrumented blocks.

If a basic block dominates all its successors, then its coverage
information is useless to us. Ingore such blocks if
santizer-coverage-prune-tree option is set.

Differential Revision: http://reviews.llvm.org/D17626

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@261949 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-26 01:17:22 +00:00
Kostya Serebryany
d016c6f389 [sanitizer-coverage] implement -fsanitize-coverage=trace-pc. This is similar to trace-bb, but has a different API. We already use the equivalent flag in GCC for Linux kernel fuzzing. We may be able to use this flag with AFL too
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@261159 91177308-0d34-0410-b5e6-96231b3b80d8
2016-02-17 21:34:43 +00:00
Rui Ueyama
3edb0ec229 Update to use new name alignTo().
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@257804 91177308-0d34-0410-b5e6-96231b3b80d8
2016-01-14 21:06:47 +00:00
Sanjay Patel
59dc7be11d getParent() ^ 3 == getModule() ; NFCI
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@255511 91177308-0d34-0410-b5e6-96231b3b80d8
2015-12-14 17:24:23 +00:00
David Majnemer
1114aa2fc6 Move EH-specific helper functions to a more appropriate place
No functionality change is intended.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@254562 91177308-0d34-0410-b5e6-96231b3b80d8
2015-12-02 23:06:39 +00:00
Kostya Serebryany
0445c4d68b [sanitizer coverage] when adding a bb trace instrumentation, do it instead, not in addition to, regular coverage. Do the regular coverage in the run-time instead
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@254482 91177308-0d34-0410-b5e6-96231b3b80d8
2015-12-02 02:37:13 +00:00
Duncan P. N. Exon Smith
210a154346 Instrumentation: Remove ilist iterator implicit conversions, NFC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@250186 91177308-0d34-0410-b5e6-96231b3b80d8
2015-10-13 17:39:10 +00:00