Commit Graph

87 Commits

Author SHA1 Message Date
Kostya Serebryany dcf0b3b7b3 [sanitizer-coverage] don't instrument a function if it's entry block ends with 'unreachable'
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@332072 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-11 01:09:39 +00:00
Shiva Chen a8a13bc662 [DebugInfo] Add DILabel metadata and intrinsic llvm.dbg.label.
In order to set breakpoints on labels and list source code around
labels, we need collect debug information for labels, i.e., label
name, the function label belong, line number in the file, and the
address label located. In order to keep these information in LLVM
IR and to allow backend to generate debug information correctly.
We create a new kind of metadata for labels, DILabel. The format
of DILabel is

!DILabel(scope: !1, name: "foo", file: !2, line: 3)

We hope to keep debug information as much as possible even the
code is optimized. So, we create a new kind of intrinsic for label
metadata to avoid the metadata is eliminated with basic block.
The intrinsic will keep existing if we keep it from optimized out.
The format of the intrinsic is

llvm.dbg.label(metadata !1)

It has only one argument, that is the DILabel metadata. The
intrinsic will follow the label immediately. Backend could get the
label metadata through the intrinsic's parameter.

We also create DIBuilder API for labels to be used by Frontend.
Frontend could use createLabel() to allocate DILabel objects, and use
insertLabel() to insert llvm.dbg.label intrinsic in LLVM IR.

Differential Revision: https://reviews.llvm.org/D45024

Patch by Hsiangkai Wang.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@331841 91177308-0d34-0410-b5e6-96231b3b80d8
2018-05-09 02:40:45 +00:00
Matt Morehouse ac2dfaf387 [SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer
Summary:
- Don't sanitize __sancov_lowest_stack.
- Don't instrument leaf functions.
- Add CoverageStackDepth to Fuzzer and FuzzerNoLink.
- Only enable on Linux.

Reviewers: vitalybuka, kcc, george.karpenkov

Reviewed By: kcc

Subscribers: kubamracek, cfe-commits, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D37156

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@312185 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-30 22:49:31 +00:00
Matt Morehouse 4e044bff90 Revert "[SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer"
This reverts r312026 due to bot breakage.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@312047 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-29 21:56:56 +00:00
Matt Morehouse 50a94860c3 [SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer
Summary:
- Don't sanitize __sancov_lowest_stack.
- Don't instrument leaf functions.
- Add CoverageStackDepth to Fuzzer and FuzzerNoLink.
- Disable stack depth tracking on Mac.

Reviewers: vitalybuka, kcc, george.karpenkov

Reviewed By: kcc

Subscribers: kubamracek, cfe-commits, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D37156

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@312026 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-29 19:48:12 +00:00
Matt Morehouse cd698b8c34 Revert "[SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer"
This reverts r311801 due to a bot failure.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311803 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-25 22:01:21 +00:00
Matt Morehouse 8d5696051c [SanitizeCoverage] Enable stack-depth coverage for -fsanitize=fuzzer
Summary:
- Don't sanitize __sancov_lowest_stack.
- Don't instrument leaf functions.
- Add CoverageStackDepth to Fuzzer and FuzzerNoLink.

Reviewers: vitalybuka, kcc

Reviewed By: kcc

Subscribers: cfe-commits, llvm-commits, hiraditya

Differential Revision: https://reviews.llvm.org/D37156

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311801 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-25 21:18:29 +00:00
Kostya Serebryany df54667cf4 [sanitizer-coverage] extend fsanitize-coverage=pc-table with flags for every PC
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311794 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-25 19:29:47 +00:00
Matt Morehouse 6008ca211c [SanitizerCoverage] Optimize stack-depth instrumentation.
Summary:
Use the initialexec TLS type and eliminate calls to the TLS
wrapper.  Fixes the sanitizer-x86_64-linux-fuzzer bot failure.

Reviewers: vitalybuka, kcc

Reviewed By: kcc

Subscribers: hiraditya, llvm-commits

Differential Revision: https://reviews.llvm.org/D37026

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311490 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-22 21:28:29 +00:00
Matt Morehouse 6dcfafe8ab [SanitizerCoverage] Add stack depth tracing instrumentation.
Summary:
Augment SanitizerCoverage to insert maximum stack depth tracing for
use by libFuzzer.  The new instrumentation is enabled by the flag
-fsanitize-coverage=stack-depth and is compatible with the existing
trace-pc-guard coverage.  The user must also declare the following
global variable in their code:
  thread_local uintptr_t __sancov_lowest_stack

https://bugs.llvm.org/show_bug.cgi?id=33857

Reviewers: vitalybuka, kcc

Reviewed By: vitalybuka

Subscribers: kubamracek, hiraditya, cfe-commits, llvm-commits

Differential Revision: https://reviews.llvm.org/D36839

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@311186 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-18 18:43:30 +00:00
Alexander Potapenko a8fed47949 [sanitizer-coverage] Change cmp instrumentation to distinguish const operands
This implementation of SanitizerCoverage instrumentation inserts different
callbacks depending on constantness of operands:

  1. If both operands are non-const, then a usual
     __sanitizer_cov_trace_cmp[1248] call is inserted.
  2. If exactly one operand is const, then a
     __sanitizer_cov_trace_const_cmp[1248] call is inserted. The first
     argument of the call is always the constant one.
  3. If both operands are const, then no callback is inserted.

This separation comes useful in fuzzing when tasks like "find one operand
of the comparison in input arguments and replace it with the other one"
have to be done. The new instrumentation allows us to not waste time on
searching the constant operands in the input.

Patch by Victor Chibotaru.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@310600 91177308-0d34-0410-b5e6-96231b3b80d8
2017-08-10 15:00:13 +00:00
Kostya Serebryany 95f83b3c13 [sanitizer-coverage] don't instrument available_externally functions
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@309611 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-31 20:00:22 +00:00
Kostya Serebryany 7569609252 [sanitizer-coverage] ensure minimal alignment for coverage counters and guards
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@309610 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-31 19:49:45 +00:00
Kostya Serebryany be07cfbcbd [sanitizer-coverage] rename sanitizer-coverage-create-pc-table into sanitizer-coverage-pc-table and add plumbing for a clang flag
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@309337 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-28 00:09:29 +00:00
Kostya Serebryany 19b3038223 [sanitizer-coverage] add a feature sanitizer-coverage-create-pc-table=1 (works with trace-pc-guard and inline-8bit-counters) that adds a static table of instrumented PCs to be used at run-time
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@309335 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-27 23:36:49 +00:00
Alexander Potapenko 886a32baf7 [sancov] Fix PR33732
Coverage hooks that take less-than-64-bit-integers as parameters need the
zeroext parameter attribute (http://llvm.org/docs/LangRef.html#paramattrs)
to make sure they are properly extended by the x86_64 ABI.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@308296 91177308-0d34-0410-b5e6-96231b3b80d8
2017-07-18 11:47:56 +00:00
George Karpenkov 4cbdf0eab2 Fixing section name for Darwin platforms for sanitizer coverage
On Darwin, section names have a 16char length limit.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@305429 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-14 23:40:25 +00:00
Kostya Serebryany be95f5eddf [sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet. Reapplying revisions 304630, 304631, 304632, 304673, see PR33308
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@305026 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-08 22:58:19 +00:00
Renato Golin 3b482e4bca Revert "[sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet."
This reverts commit r304630, as it broke ARM/AArch64 bots for 2 days.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@304698 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-05 07:35:52 +00:00
Kostya Serebryany 111f62d417 [sanitizer-coverage] one more flavor of coverage: -fsanitize-coverage=inline-8bit-counters. Experimental so far, not documenting yet.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@304630 91177308-0d34-0410-b5e6-96231b3b80d8
2017-06-03 01:35:47 +00:00
Kostya Serebryany 8ea517852a [sanitizer-coverage] remove stale code (old coverage); llvm part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@304319 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-31 18:27:33 +00:00
George Karpenkov f6cb509385 Fix coverage check for full post-dominator basic blocks.
Coverage instrumentation which does not instrument full post-dominators
and full-dominators may skip valid paths, as the reasoning for skipping
blocks may become circular.
This patch fixes that, by only skipping
full post-dominators with multiple predecessors, as such predecessors by
definition can not be full-dominators.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@303827 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-25 01:41:46 +00:00
George Karpenkov c49b255f5f Revert "Disable coverage opt-out for strong postdominator blocks."
This reverts commit 2ed06f05fc10869dd1239cff96fcdea2ee8bf4ef.
Buildbots do not like this on Linux.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@303710 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-24 00:29:12 +00:00
George Karpenkov 5262071914 Revert "Fixes for tests for r303698"
This reverts commit 69bfaf72e7502eb08bbca88a57925fa31c6295c6.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@303709 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-24 00:29:08 +00:00
George Karpenkov 1f57bbafaf Fixes for tests for r303698
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@303701 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-23 22:42:34 +00:00
George Karpenkov fe601fedc1 Disable coverage opt-out for strong postdominator blocks.
Coverage instrumentation has an optimization not to instrument extra
blocks, if the pass is already "accounted for" by a
successor/predecessor basic block.
However (https://github.com/google/sanitizers/issues/783) this
reasoning may become circular, which stops valid paths from having
coverage.
In the worst case this can cause fuzzing to stop working entirely.

This change simplifies logic to something which trivially can not have
such circular reasoning, as losing valid paths does not seem like a
good trade-off for a ~15% decrease in the # of instrumented basic blocks.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@303698 91177308-0d34-0410-b5e6-96231b3b80d8
2017-05-23 21:58:54 +00:00
Kostya Serebryany d89a81f5c9 [sanitizer-coverage] remove some more stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300778 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 22:42:11 +00:00
Kostya Serebryany 06c0527072 [sanitizer-coverage] remove stale code
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@300769 91177308-0d34-0410-b5e6-96231b3b80d8
2017-04-19 21:48:09 +00:00
Reid Kleckner bef4d671d9 [sancov] Don't instrument blocks with no insertion point
This prevents crashes when attempting to instrument functions containing
C++ try.

Sanitizer coverage will still fail at runtime when an exception is
thrown through a sancov instrumented function, but that seems marginally
better than what we have now. The full solution is to color the blocks
in LLVM IR and only instrument blocks that have an unambiguous color,
using the appropriate token.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@298662 91177308-0d34-0410-b5e6-96231b3b80d8
2017-03-23 23:30:41 +00:00
Mike Aizatsky 9cf01663e3 [sancov] using comdat only when it is enabled
Differential Revision: https://reviews.llvm.org/D29733

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@294529 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-08 23:12:46 +00:00
Mike Aizatsky 884f3fe80d [sancov] specifying comdat for sancov constructors
Differential Revision: https://reviews.llvm.org/D29662

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@294517 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-08 21:20:33 +00:00
Justin Bogner 770cb8b1b5 SanitizerCoverage: Support sanitizer guard section on darwin
MachO's sections need a segment as well as a section name, and the
section start and end symbols are spelled differently than on ELF.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@293733 91177308-0d34-0410-b5e6-96231b3b80d8
2017-02-01 02:38:39 +00:00
Kostya Serebryany 42d07d086c [sanitizer-coverage] emit __sanitizer_cov_trace_pc_guard w/o a preceding 'if' by default. Update the docs, also add deprecation notes around other parts of sanitizer coverage
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@292862 91177308-0d34-0410-b5e6-96231b3b80d8
2017-01-24 00:57:31 +00:00
Kostya Serebryany 834b93c09f [sanitizer-coverage] sort the switch cases
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@290628 91177308-0d34-0410-b5e6-96231b3b80d8
2016-12-27 21:20:06 +00:00
Reid Kleckner 195a4bc96d [sancov] Name the global containing the main source file name
If the global name doesn't start with __sancov_gen, ASan will insert
unecessary red zones around it.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@287117 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-16 16:50:43 +00:00
Kostya Serebryany dd850be3cf [sanitizer-coverage] make sure asan does not instrument coverage guards (reported in https://github.com/google/oss-fuzz/issues/84)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@287030 91177308-0d34-0410-b5e6-96231b3b80d8
2016-11-15 21:12:50 +00:00
Kostya Serebryany 21fcbebddd [sanitizer-coverage] use private linkage for coverage guards, delete old commented-out code.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@283924 91177308-0d34-0410-b5e6-96231b3b80d8
2016-10-11 19:36:50 +00:00
Kostya Serebryany efa54824a3 [sanitizer-coverage/libFuzzer] make the guards for trace-pc 32-bit; create one array of guards per function, instead of one guard per BB. reorganize the code so that trace-pc-guard does not create unneeded globals
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282735 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-29 17:43:24 +00:00
Kostya Serebryany 30eb92316c [sanitizer-coverage] fix a bug in trace-gep
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282467 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-27 01:55:08 +00:00
Kostya Serebryany dbadbd797d [sanitizer-coverage] don't emit the CTOR function if nothing has been instrumented
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@282465 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-27 01:08:33 +00:00
Kostya Serebryany 18f63e47d8 [sanitizer-coverage] add comdat to coverage guards if needed
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281952 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-20 00:16:54 +00:00
Kostya Serebryany 16197d80b6 [sanitizer-coverage] change trace-pc to use 8-byte guards
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281809 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-17 05:03:05 +00:00
Kostya Serebryany 31daa34b7b [sanitizer-coverage] make trace-pc-guard and indirect-call work together
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281665 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-15 22:11:08 +00:00
Kostya Serebryany 8ea4234809 [sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. LLVM part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@281431 91177308-0d34-0410-b5e6-96231b3b80d8
2016-09-14 01:39:35 +00:00
Kostya Serebryany 8c23b334cd [sanitizer-coverage] add two more modes of instrumentation: trace-div and trace-gep, mostly usaful for value-profile-based fuzzing; llvm part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@280043 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-30 01:12:10 +00:00
Kostya Serebryany aa4e23e1bb [sanitizer-coverage/libFuzzer] instrument comparisons with __sanitizer_cov_trace_cmp[1248] instead of __sanitizer_cov_trace_cmp, don't pass the comparison type to save a bit performance. Use these new callbacks in libFuzzer
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@279027 91177308-0d34-0410-b5e6-96231b3b80d8
2016-08-18 01:25:28 +00:00
Kostya Serebryany ec8a2f2059 [sanitizer-coverage] make sure that calls to __sanitizer_cov_trace_pc are not merged (otherwise different calls get the same PC and confuse fuzzers)
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@275449 91177308-0d34-0410-b5e6-96231b3b80d8
2016-07-14 17:59:01 +00:00
Duncan P. N. Exon Smith de7484036b DebugInfo: Remove MDString-based type references
Eliminate DITypeIdentifierMap and make DITypeRef a thin wrapper around
DIType*.  It is no longer legal to refer to a DICompositeType by its
'identifier:', and DIBuilder no longer retains all types with an
'identifier:' automatically.

Aside from the bitcode upgrade, this is mainly removing logic to resolve
an MDString-based reference to an actualy DIType.  The commits leading
up to this have made the implicit type map in DICompileUnit's
'retainedTypes:' field superfluous.

This does not remove DITypeRef, DIScopeRef, DINodeRef, and
DITypeRefArray, or stop using them in DI-related metadata.  Although as
of this commit they aren't serving a useful purpose, there are patchces
under review to reuse them for CodeView support.

The tests in LLVM were updated with deref-typerefs.sh, which is attached
to the thread "[RFC] Lazy-loading of debug info metadata":

  http://lists.llvm.org/pipermail/llvm-dev/2016-April/098318.html

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@267296 91177308-0d34-0410-b5e6-96231b3b80d8
2016-04-23 21:08:00 +00:00
Mandeep Singh Grang 2599294457 [LLVM] Remove unwanted --check-prefix=CHECK from unit tests. NFC.
Summary: Removed unwanted --check-prefix=CHECK from numerous unit tests.

Reviewers: t.p.northover, dblaikie, uweigand, MatzeB, tstellarAMD, mcrosier

Subscribers: mcrosier, dsanders

Differential Revision: http://reviews.llvm.org/D19279

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@266834 91177308-0d34-0410-b5e6-96231b3b80d8
2016-04-19 23:51:52 +00:00
Adrian Prantl 4eeaa0da04 [PR27284] Reverse the ownership between DICompileUnit and DISubprogram.
Currently each Function points to a DISubprogram and DISubprogram has a
scope field. For member functions the scope is a DICompositeType. DIScopes
point to the DICompileUnit to facilitate type uniquing.

Distinct DISubprograms (with isDefinition: true) are not part of the type
hierarchy and cannot be uniqued. This change removes the subprograms
list from DICompileUnit and instead adds a pointer to the owning compile
unit to distinct DISubprograms. This would make it easy for ThinLTO to
strip unneeded DISubprograms and their transitively referenced debug info.

Motivation
----------

Materializing DISubprograms is currently the most expensive operation when
doing a ThinLTO build of clang.

We want the DISubprogram to be stored in a separate Bitcode block (or the
same block as the function body) so we can avoid having to expensively
deserialize all DISubprograms together with the global metadata. If a
function has been inlined into another subprogram we need to store a
reference the block containing the inlined subprogram.

Attached to https://llvm.org/bugs/show_bug.cgi?id=27284 is a python script
that updates LLVM IR testcases to the new format.

http://reviews.llvm.org/D19034
<rdar://problem/25256815>

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@266446 91177308-0d34-0410-b5e6-96231b3b80d8
2016-04-15 15:57:41 +00:00