Commit Graph

34 Commits

Author SHA1 Message Date
Alexey Samsonov
327cfdf4fe [SanitizerCoverage] Don't add instrumentation to unreachable blocks.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@241127 91177308-0d34-0410-b5e6-96231b3b80d8
2015-06-30 23:11:45 +00:00
Alexey Samsonov
0fd41495ef [SanitizerCoverage] Use llvm::getDISubprogram() to get location of the entry basic block.
DebugLoc::getFnDebugLoc() should soon be removed. Also,
getDISubprogram() might become more effective soon and wouldn't need to
scan debug locations at all, if function-level metadata would be emitted
by Clang.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@239586 91177308-0d34-0410-b5e6-96231b3b80d8
2015-06-12 01:48:47 +00:00
David Blaikie
042dd34f9c Simplify IRBuilder::CreateCall* by using ArrayRef+initializer_list/braced init only
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@237624 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-18 22:13:54 +00:00
Ismail Pazarbasi
6c318f59b1 SanitizerCoverage: Use createSanitizerCtor to create ctor and call init
Second attempt; instead of using a named local variable, passing
arguments directly to `createSanitizerCtorAndInitFunctions` worked
on Windows.

Reviewers: kcc, samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D8780

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236951 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-10 13:45:05 +00:00
Alexey Samsonov
8404686a68 Delete unused createSanitizerCoverageModulePass overload.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236791 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-07 22:46:06 +00:00
Ismail Pazarbasi
f31b4e9690 Revert "SanitizerCoverage: Use createSanitizerCtor to create ctor and call init"
Will fix tomorrow. Unbreak build bots now.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236786 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-07 22:17:48 +00:00
Ismail Pazarbasi
57d28fee47 SanitizerCoverage: Use createSanitizerCtor to create ctor and call init
Reviewers: kcc, samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D8780

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236780 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-07 21:43:28 +00:00
Alexey Samsonov
cddf82ae35 [SanitizerCoverage] Introduce SanitizerCoverageOptions struct.
Summary:
This gives frontend more precise control over collected coverage
information. User can still override these options by passing
-mllvm flags.

No functionality change.

Test Plan: regression test suite.

Reviewers: kcc

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9539

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236687 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-07 01:00:31 +00:00
Alexey Samsonov
d71e55b97f [SanitizerCoverage] Fix a couple of typos. NFC.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@236643 91177308-0d34-0410-b5e6-96231b3b80d8
2015-05-06 21:35:25 +00:00
Benjamin Kramer
0973b7ddb8 Reduce dyn_cast<> to isa<> or cast<> where possible.
No functional change intended.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234586 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-10 11:24:51 +00:00
Ismail Pazarbasi
aa5880df12 Move checkInterfaceFunction to ModuleUtils
Summary:
Instead of making a local copy of `checkInterfaceFunction` for each
sanitizer, move the function in a common place.

Reviewers: kcc, samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D8775

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@234220 91177308-0d34-0410-b5e6-96231b3b80d8
2015-04-06 21:09:08 +00:00
Duncan P. N. Exon Smith
f175439a2b Transforms: Use the new DebugLoc API, NFC
Update lib/Analysis and lib/Transforms to use the new `DebugLoc` API.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@233587 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-30 19:49:49 +00:00
Kostya Serebryany
a1ea57a185 [sanitizer] experimental tracing for cmp instructions
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@232873 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-21 01:29:36 +00:00
Duncan P. N. Exon Smith
14d8dbd37d SanitizerCoverage: Check for null DebugLocs
After a WIP patch to make `DIDescriptor` accessors more strict, this
started asserting.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@232832 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-20 18:48:45 +00:00
Kostya Serebryany
935a3aa5bc [sanitizer] fix instrumentation with -mllvm -sanitizer-coverage-block-threshold=0 to actually do something useful.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231736 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-10 01:58:27 +00:00
Kostya Serebryany
a7b107bc82 [sanitizer] decrease sanitizer-coverage-block-threshold from 1000 to 500 as another horrible workaround for PR17409
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231733 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-10 01:11:53 +00:00
Kostya Serebryany
c2f4077b88 [sanitizer] add nosanitize metadata to more coverage instrumentation instructions
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231333 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-05 01:20:05 +00:00
Mehdi Amini
c94da20917 Make DataLayout Non-Optional in the Module
Summary:
DataLayout keeps the string used for its creation.

As a side effect it is no longer needed in the Module.
This is "almost" NFC, the string is no longer
canonicalized, you can't rely on two "equals" DataLayout
having the same string returned by getStringRepresentation().

Get rid of DataLayoutPass: the DataLayout is in the Module

The DataLayout is "per-module", let's enforce this by not
duplicating it more than necessary.
One more step toward non-optionality of the DataLayout in the
module.

Make DataLayout Non-Optional in the Module

Module->getDataLayout() will never returns nullptr anymore.

Reviewers: echristo

Subscribers: resistor, llvm-commits, jholewinski

Differential Revision: http://reviews.llvm.org/D7992

From: Mehdi Amini <mehdi.amini@apple.com>

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231270 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-04 18:43:29 +00:00
Kostya Serebryany
ae0620c4e9 [sanitizer/coverage] Add AFL-style coverage counters (search heuristic for fuzzing).
Introduce -mllvm -sanitizer-coverage-8bit-counters=1
which adds imprecise thread-unfriendly 8-bit coverage counters.

The run-time library maps these 8-bit counters to 8-bit bitsets in the same way
AFL (http://lcamtuf.coredump.cx/afl/technical_details.txt) does:
counter values are divided into 8 ranges and based on the counter
value one of the bits in the bitset is set.
The AFL ranges are used here: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+.

These counters provide a search heuristic for single-threaded
coverage-guided fuzzers, we do not expect them to be useful for other purposes.

Depending on the value of -fsanitize-coverage=[123] flag,
these counters will be added to the function entry blocks (=1),
every basic block (=2), or every edge (=3).

Use these counters as an optional search heuristic in the Fuzzer library.
Add a test where this heuristic is critical.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@231166 91177308-0d34-0410-b5e6-96231b3b80d8
2015-03-03 23:27:02 +00:00
Kostya Serebryany
727a6ee223 [sanitizer] when dumping the basic block trace, also dump the module names. Patch by Laszlo Szekeres
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@229940 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-20 00:30:44 +00:00
Kostya Serebryany
0013784dd3 [sanitizer] add another workaround for PR 17409: when over a threshold emit coverage instrumentation as calls.
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@228102 91177308-0d34-0410-b5e6-96231b3b80d8
2015-02-04 01:21:45 +00:00
Evgeniy Stepanov
0b2455c374 [sancov] Fix unspecified constructor order between sancov and asan.
Sanitizer coverage constructor must run after asan constructor (for each DSO).
Bump constructor priority to guarantee that.


git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@227195 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-27 15:01:22 +00:00
Chandler Carruth
08962f208b [PM] Remove the Pass argument from all of the critical edge splitting
APIs and replace it and numerous booleans with an option struct.

The critical edge splitting API has a really large surface of flags and
so it seems worth burning a small option struct / builder. This struct
can be constructed with the various preserved analyses and then flags
can be flipped in a builder style.

The various users are now responsible for directly passing along their
analysis information. This should be enough for the critical edge
splitting to work cleanly with the new pass manager as well.

This API is still pretty crufty and could be cleaned up a lot, but I've
focused on this change just threading an option struct rather than
a pass through the API.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@226456 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-19 12:09:11 +00:00
Kostya Serebryany
8c6ae1044a [asan] simplify the tracing code, make it use the same guard variables as coverage
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@225103 91177308-0d34-0410-b5e6-96231b3b80d8
2015-01-03 00:54:43 +00:00
Kostya Serebryany
dd890d5c5e [asan] change _sanitizer_cov_module_init to accept int* instead of int**
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224999 91177308-0d34-0410-b5e6-96231b3b80d8
2014-12-30 19:29:28 +00:00
Kostya Serebryany
b69d796590 [asan] change the coverage collection scheme so that we can easily emit coverage for the entire process as a single bit set, and if coverage_bitset=1 actually emit that bitset
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224789 91177308-0d34-0410-b5e6-96231b3b80d8
2014-12-23 22:32:17 +00:00
Kostya Serebryany
1c97c5e8bd [sanitizer] allow -fsanitize-coverage=N w/ -fsanitize=leak, llvm part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224463 91177308-0d34-0410-b5e6-96231b3b80d8
2014-12-17 21:50:04 +00:00
Kostya Serebryany
95aa8cab27 [sanitizer] prevent function call merging for sanitizer-coverage callbacks
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@224372 91177308-0d34-0410-b5e6-96231b3b80d8
2014-12-16 21:24:15 +00:00
Duncan P. N. Exon Smith
dad20b2ae2 IR: Split Metadata from Value
Split `Metadata` away from the `Value` class hierarchy, as part of
PR21532.  Assembly and bitcode changes are in the wings, but this is the
bulk of the change for the IR C++ API.

I have a follow-up patch prepared for `clang`.  If this breaks other
sub-projects, I apologize in advance :(.  Help me compile it on Darwin
I'll try to fix it.  FWIW, the errors should be easy to fix, so it may
be simpler to just fix it yourself.

This breaks the build for all metadata-related code that's out-of-tree.
Rest assured the transition is mechanical and the compiler should catch
almost all of the problems.

Here's a quick guide for updating your code:

  - `Metadata` is the root of a class hierarchy with three main classes:
    `MDNode`, `MDString`, and `ValueAsMetadata`.  It is distinct from
    the `Value` class hierarchy.  It is typeless -- i.e., instances do
    *not* have a `Type`.

  - `MDNode`'s operands are all `Metadata *` (instead of `Value *`).

  - `TrackingVH<MDNode>` and `WeakVH` referring to metadata can be
    replaced with `TrackingMDNodeRef` and `TrackingMDRef`, respectively.

    If you're referring solely to resolved `MDNode`s -- post graph
    construction -- just use `MDNode*`.

  - `MDNode` (and the rest of `Metadata`) have only limited support for
    `replaceAllUsesWith()`.

    As long as an `MDNode` is pointing at a forward declaration -- the
    result of `MDNode::getTemporary()` -- it maintains a side map of its
    uses and can RAUW itself.  Once the forward declarations are fully
    resolved RAUW support is dropped on the ground.  This means that
    uniquing collisions on changing operands cause nodes to become
    "distinct".  (This already happened fairly commonly, whenever an
    operand went to null.)

    If you're constructing complex (non self-reference) `MDNode` cycles,
    you need to call `MDNode::resolveCycles()` on each node (or on a
    top-level node that somehow references all of the nodes).  Also,
    don't do that.  Metadata cycles (and the RAUW machinery needed to
    construct them) are expensive.

  - An `MDNode` can only refer to a `Constant` through a bridge called
    `ConstantAsMetadata` (one of the subclasses of `ValueAsMetadata`).

    As a side effect, accessing an operand of an `MDNode` that is known
    to be, e.g., `ConstantInt`, takes three steps: first, cast from
    `Metadata` to `ConstantAsMetadata`; second, extract the `Constant`;
    third, cast down to `ConstantInt`.

    The eventual goal is to introduce `MDInt`/`MDFloat`/etc. and have
    metadata schema owners transition away from using `Constant`s when
    the type isn't important (and they don't care about referring to
    `GlobalValue`s).

    In the meantime, I've added transitional API to the `mdconst`
    namespace that matches semantics with the old code, in order to
    avoid adding the error-prone three-step equivalent to every call
    site.  If your old code was:

        MDNode *N = foo();
        bar(isa             <ConstantInt>(N->getOperand(0)));
        baz(cast            <ConstantInt>(N->getOperand(1)));
        bak(cast_or_null    <ConstantInt>(N->getOperand(2)));
        bat(dyn_cast        <ConstantInt>(N->getOperand(3)));
        bay(dyn_cast_or_null<ConstantInt>(N->getOperand(4)));

    you can trivially match its semantics with:

        MDNode *N = foo();
        bar(mdconst::hasa               <ConstantInt>(N->getOperand(0)));
        baz(mdconst::extract            <ConstantInt>(N->getOperand(1)));
        bak(mdconst::extract_or_null    <ConstantInt>(N->getOperand(2)));
        bat(mdconst::dyn_extract        <ConstantInt>(N->getOperand(3)));
        bay(mdconst::dyn_extract_or_null<ConstantInt>(N->getOperand(4)));

    and when you transition your metadata schema to `MDInt`:

        MDNode *N = foo();
        bar(isa             <MDInt>(N->getOperand(0)));
        baz(cast            <MDInt>(N->getOperand(1)));
        bak(cast_or_null    <MDInt>(N->getOperand(2)));
        bat(dyn_cast        <MDInt>(N->getOperand(3)));
        bay(dyn_cast_or_null<MDInt>(N->getOperand(4)));

  - A `CallInst` -- specifically, intrinsic instructions -- can refer to
    metadata through a bridge called `MetadataAsValue`.  This is a
    subclass of `Value` where `getType()->isMetadataTy()`.

    `MetadataAsValue` is the *only* class that can legally refer to a
    `LocalAsMetadata`, which is a bridged form of non-`Constant` values
    like `Argument` and `Instruction`.  It can also refer to any other
    `Metadata` subclass.

(I'll break all your testcases in a follow-up commit, when I propagate
this change to assembly.)

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@223802 91177308-0d34-0410-b5e6-96231b3b80d8
2014-12-09 18:38:53 +00:00
Kostya Serebryany
0fd28b40a4 [msan] allow -fsanitize-coverage=N together with -fsanitize=memory, llvm part
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@223312 91177308-0d34-0410-b5e6-96231b3b80d8
2014-12-03 23:28:26 +00:00
Kostya Serebryany
678af17920 [asan/coverage] change the way asan coverage instrumentation is done: instead of setting the guard to 1 in the generated code, pass the pointer to guard to __sanitizer_cov and set it there. No user-visible functionality change expected
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@222675 91177308-0d34-0410-b5e6-96231b3b80d8
2014-11-24 18:49:53 +00:00
Kostya Serebryany
0dd5e22d89 [asan] add experimental basic-block tracing to asan-coverage; also fix -fsanitize-coverage=3 which was broken by r221718
git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@222290 91177308-0d34-0410-b5e6-96231b3b80d8
2014-11-19 00:22:58 +00:00
Reid Kleckner
e094cca7f0 Use nullptr instead of NULL for variadic sentinels
Windows defines NULL to 0, which when used as an argument to a variadic
function, is not a null pointer constant. As a result, Clang's
-Wsentinel fires on this code. Using '0' would be wrong on most 64-bit
platforms, but both MSVC and Clang make it work on Windows. Sidestep the
issue with nullptr.

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@221940 91177308-0d34-0410-b5e6-96231b3b80d8
2014-11-13 22:55:19 +00:00
Kostya Serebryany
abb3335f6d Move asan-coverage into a separate phase.
Summary:
This change moves asan-coverage instrumentation
into a separate Module pass.
The other part of the change in clang introduces a new flag
-fsanitize-coverage=N.
Another small patch will update tests in compiler-rt.

With this patch no functionality change is expected except for the flag name.
The following changes will make the coverage instrumentation work with tsan/msan

Test Plan: Run regression tests, chromium.

Reviewers: nlewycky, samsonov

Reviewed By: nlewycky, samsonov

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D6152

git-svn-id: https://llvm.org/svn/llvm-project/llvm/trunk@221718 91177308-0d34-0410-b5e6-96231b3b80d8
2014-11-11 22:14:37 +00:00