[sanitizer-coverage/libFuzzer] instrument comparisons with __sanitizer_cov_trace_cmp[1248] instead of __sanitizer_cov_trace_cmp, don't pass the comparison type to save a bit performance. Use these new callbacks in libFuzzer

llvm-svn: 279027

2 files changed, 50 insertions, 3 deletions

diff --git a/llvm/lib/Fuzzer/FuzzerTraceState.cpp b/llvm/lib/Fuzzer/FuzzerTraceState.cpp
index 963480e2282..71ff499d4d3 100644
--- a/llvm/lib/Fuzzer/FuzzerTraceState.cpp
+++ b/llvm/lib/Fuzzer/FuzzerTraceState.cpp
@@ -575,7 +575,8 @@ static void AddValueForStrcmp(void *caller_pc, const char *s1, const char *s2,
 }
 
 __attribute__((target("popcnt")))
-static void AddValueForCmp(uintptr_t PC, uint64_t Arg1, uint64_t Arg2) {
+static void AddValueForCmp(void *PCptr, uint64_t Arg1, uint64_t Arg2) {
+  uintptr_t PC = reinterpret_cast<uintptr_t>(PCptr);
   VP.AddValue((PC & 4095) | (__builtin_popcountl(Arg1 ^ Arg2) << 12));
 }
 
@@ -598,6 +599,21 @@ void __dfsw___sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
   TS->DFSanCmpCallback(PC, CmpSize, Type, Arg1, Arg2, L1, L2);
 }
 
+#define DFSAN_CMP_CALLBACK(N)                                                  \
+  void __dfsw___sanitizer_cov_trace_cmp##N(uint64_t Arg1, uint64_t Arg2,       \
+                                           dfsan_label L1, dfsan_label L2) {   \
+    if (RecordingTraces)                                                       \
+      TS->DFSanCmpCallback(                                                    \
+          reinterpret_cast<uintptr_t>(__builtin_return_address(0)), N,         \
+          fuzzer::ICMP_EQ, Arg1, Arg2, L1, L2);                                \
+  }
+
+DFSAN_CMP_CALLBACK(1)
+DFSAN_CMP_CALLBACK(2)
+DFSAN_CMP_CALLBACK(4)
+DFSAN_CMP_CALLBACK(8)
+#undef DFSAN_CMP_CALLBACK
+
 void __dfsw___sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases,
                                          dfsan_label L1, dfsan_label L2) {
   if (!RecordingTraces) return;
@@ -710,6 +726,7 @@ void __sanitizer_weak_hook_memmem(void *called_pc, const void *s1, size_t len1,
 
 #endif  // LLVM_FUZZER_DEFINES_SANITIZER_WEAK_HOOOKS
 
+// TODO: this one will not be used with the newest clang. Remove it.
 __attribute__((visibility("default")))
 void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
                                uint64_t Arg2) {
@@ -720,8 +737,36 @@ void __sanitizer_cov_trace_cmp(uint64_t SizeAndType, uint64_t Arg1,
     TS->TraceCmpCallback(PC, CmpSize, Type, Arg1, Arg2);
   }
   if (RecordingValueProfile)
-    fuzzer::AddValueForCmp(
-        reinterpret_cast<uintptr_t>(__builtin_return_address(0)), Arg1, Arg2);
+    fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+}
+
+// Adding if(RecordingTraces){...} slows down the VP callbacks.
+// Once we prove that VP is as strong as traces, delete this.
+#define MAYBE_RECORD_TRACE(N)                                                  \
+  if (RecordingTraces) {                                                       \
+    uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));   \
+    TS->TraceCmpCallback(PC, N, fuzzer::ICMP_EQ, Arg1, Arg2);                  \
+  }
+
+__attribute__((visibility("default")))
+void __sanitizer_cov_trace_cmp8(uint64_t Arg1, int64_t Arg2) {
+  fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+  MAYBE_RECORD_TRACE(8);
+}
+__attribute__((visibility("default")))
+void __sanitizer_cov_trace_cmp4(uint32_t Arg1, int32_t Arg2) {
+  fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+  MAYBE_RECORD_TRACE(4);
+}
+__attribute__((visibility("default")))
+void __sanitizer_cov_trace_cmp2(uint16_t Arg1, int16_t Arg2) {
+  fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+  MAYBE_RECORD_TRACE(2);
+}
+__attribute__((visibility("default")))
+void __sanitizer_cov_trace_cmp1(uint8_t Arg1, int8_t Arg2) {
+  fuzzer::AddValueForCmp(__builtin_return_address(0), Arg1, Arg2);
+  MAYBE_RECORD_TRACE(1);
 }
 
 __attribute__((visibility("default")))
diff --git a/llvm/lib/Fuzzer/test/value-profile-cmp.test b/llvm/lib/Fuzzer/test/value-profile-cmp.test
index e4059cd82ee..3567edca5f8 100644
--- a/llvm/lib/Fuzzer/test/value-profile-cmp.test
+++ b/llvm/lib/Fuzzer/test/value-profile-cmp.test
@@ -1,3 +1,5 @@
 CHECK: BINGO
 RUN: not LLVMFuzzer-SimpleCmpTest -use_value_profile=1 -runs=100000000 2>&1 | FileCheck %s
+RUN: not LLVMFuzzer-SimpleHashTest -use_value_profile=1 -runs=100000000 2>&1 | FileCheck %s
+