diff options
| author | Kostya Serebryany <kcc@google.com> | 2015-03-03 23:27:02 +0000 |
|---|---|---|
| committer | Kostya Serebryany <kcc@google.com> | 2015-03-03 23:27:02 +0000 |
| commit | be5e0ed919e20bf6b1d0c8b7d96188a00f686738 (patch) | |
| tree | 6559b1628040f2a99cd78421dbe65ae26d4f44cc /llvm/test | |
| parent | 6f1e5680f64c3313561128b4f2a24275fa635b9c (diff) | |
| download | bcm5719-llvm-be5e0ed919e20bf6b1d0c8b7d96188a00f686738.tar.gz bcm5719-llvm-be5e0ed919e20bf6b1d0c8b7d96188a00f686738.zip | |
[sanitizer/coverage] Add AFL-style coverage counters (search heuristic for fuzzing).
Introduce -mllvm -sanitizer-coverage-8bit-counters=1
which adds imprecise thread-unfriendly 8-bit coverage counters.
The run-time library maps these 8-bit counters to 8-bit bitsets in the same way
AFL (http://lcamtuf.coredump.cx/afl/technical_details.txt) does:
counter values are divided into 8 ranges and based on the counter
value one of the bits in the bitset is set.
The AFL ranges are used here: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+.
These counters provide a search heuristic for single-threaded
coverage-guided fuzzers, we do not expect them to be useful for other purposes.
Depending on the value of -fsanitize-coverage=[123] flag,
these counters will be added to the function entry blocks (=1),
every basic block (=2), or every edge (=3).
Use these counters as an optional search heuristic in the Fuzzer library.
Add a test where this heuristic is critical.
llvm-svn: 231166
Diffstat (limited to 'llvm/test')
| -rw-r--r-- | llvm/test/Instrumentation/SanitizerCoverage/coverage.ll | 22 |
1 files changed, 19 insertions, 3 deletions
diff --git a/llvm/test/Instrumentation/SanitizerCoverage/coverage.ll b/llvm/test/Instrumentation/SanitizerCoverage/coverage.ll index dd6b8d8dd7c..6c0f31e72e7 100644 --- a/llvm/test/Instrumentation/SanitizerCoverage/coverage.ll +++ b/llvm/test/Instrumentation/SanitizerCoverage/coverage.ll @@ -5,10 +5,8 @@ ; RUN: opt < %s -sancov -sanitizer-coverage-level=2 -sanitizer-coverage-block-threshold=1 -S | FileCheck %s --check-prefix=CHECK_WITH_CHECK ; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-block-threshold=10 -S | FileCheck %s --check-prefix=CHECK3 ; RUN: opt < %s -sancov -sanitizer-coverage-level=4 -S | FileCheck %s --check-prefix=CHECK4 +; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-8bit-counters=1 -S | FileCheck %s --check-prefix=CHECK-8BIT -; RUN: opt < %s -sancov -sanitizer-coverage-level=0 -S | FileCheck %s --check-prefix=CHECK0 -; RUN: opt < %s -sancov -sanitizer-coverage-level=1 -S | FileCheck %s --check-prefix=CHECK1 -; RUN: opt < %s -sancov -sanitizer-coverage-level=2 -S | FileCheck %s --check-prefix=CHECK2 ; RUN: opt < %s -sancov -sanitizer-coverage-level=2 -sanitizer-coverage-block-threshold=10 \ ; RUN: -S | FileCheck %s --check-prefix=CHECK2 ; RUN: opt < %s -sancov -sanitizer-coverage-level=2 -sanitizer-coverage-block-threshold=1 \ @@ -78,6 +76,24 @@ entry: ; CHECK3-NOT: call void @__sanitizer_cov ; CHECK3: ret void +; test -sanitizer-coverage-8bit-counters=1 +; CHECK-8BIT-LABEL: define void @foo + +; CHECK-8BIT: [[V11:%[0-9]*]] = load i8 +; CHECK-8BIT: [[V12:%[0-9]*]] = add i8 [[V11]], 1 +; CHECK-8BIT: store i8 [[V12]] +; CHECK-8BIT: [[V21:%[0-9]*]] = load i8 +; CHECK-8BIT: [[V22:%[0-9]*]] = add i8 [[V21]], 1 +; CHECK-8BIT: store i8 [[V22]] +; CHECK-8BIT: [[V31:%[0-9]*]] = load i8 +; CHECK-8BIT: [[V32:%[0-9]*]] = add i8 [[V31]], 1 +; CHECK-8BIT: store i8 [[V32]] +; CHECK-8BIT: [[V41:%[0-9]*]] = load i8 +; CHECK-8BIT: [[V42:%[0-9]*]] = add i8 [[V41]], 1 +; CHECK-8BIT: store i8 [[V42]] + +; CHECK-8BIT: ret void + %struct.StructWithVptr = type { i32 (...)** } |
