summaryrefslogtreecommitdiffstats
path: root/llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp
Commit message (Collapse)AuthorAgeFilesLines
* [sancov] enabling coverage edge pruning by default.Mike Aizatsky2016-04-061-4/+4
| | | | | | Differential Revision: http://reviews.llvm.org/D18844 llvm-svn: 265615
* NFC: make AtomicOrdering an enum classJF Bastien2016-04-061-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: In the context of http://wg21.link/lwg2445 C++ uses the concept of 'stronger' ordering but doesn't define it properly. This should be fixed in C++17 barring a small question that's still open. The code currently plays fast and loose with the AtomicOrdering enum. Using an enum class is one step towards tightening things. I later also want to tighten related enums, such as clang's AtomicOrderingKind (which should be shared with LLVM as a 'C++ ABI' enum). This change touches a few lines of code which can be improved later, I'd like to keep it as NFC for now as it's already quite complex. I have related changes for clang. As a follow-up I'll add: bool operator<(AtomicOrdering, AtomicOrdering) = delete; bool operator>(AtomicOrdering, AtomicOrdering) = delete; bool operator<=(AtomicOrdering, AtomicOrdering) = delete; bool operator>=(AtomicOrdering, AtomicOrdering) = delete; This is separate so that clang and LLVM changes don't need to be in sync. Reviewers: jyknight, reames Subscribers: jyknight, llvm-commits Differential Revision: http://reviews.llvm.org/D18775 llvm-svn: 265602
* [sancov] save entry block from pruning (it is always full dominator)Mike Aizatsky2016-04-011-3/+3
| | | | llvm-svn: 265168
* [sancov] code readability improvement.Mike Aizatsky2016-03-231-11/+26
| | | | | | | | Summary: Reply to http://reviews.llvm.org/D18341 Differential Revision: http://reviews.llvm.org/D18406 llvm-svn: 264213
* [sancov] do not instrument nodes that are full pre-dominatorsMike Aizatsky2016-03-211-10/+17
| | | | | | | | | | | | | Summary: Without tree pruning clang has 2,667,552 points. Wiht only dominators pruning: 1,515,586. With both dominators & predominators pruning: 1,340,534. Resubmit of r262103. Differential Revision: http://reviews.llvm.org/D18341 llvm-svn: 264003
* [sancov] clang-formatting SanitizerCoverage.cpp and fully pleasing clang-tidy.Mike Aizatsky2016-03-181-72/+78
| | | | | | Differential Revision: http://reviews.llvm.org/D18288 llvm-svn: 263852
* Revert "Revert "[sancov] specifying sanitizer coverage dependencies.""Chandler Carruth2016-03-181-1/+7
| | | | | | This reverts commit r263825, re-instating r263797. llvm-svn: 263847
* [sancov] Fix the sancov pass to initialize itself inside itsChandler Carruth2016-03-181-1/+3
| | | | | | | constructor. This should fix the recent crashes on certain architectures. llvm-svn: 263845
* Revert "[sancov] specifying sanitizer coverage dependencies."Mike Aizatsky2016-03-181-7/+1
| | | | | | | | This fails on arm. This reverts commit 52c8e0f7119d1ea1050c0708565a8c92b73386d2. llvm-svn: 263825
* [sancov] specifying sanitizer coverage dependencies.Mike Aizatsky2016-03-181-1/+7
| | | | | | | | | | | | | | | Summary: These dependencies would be used in the future to reduce the number of instrumented blocks(http://reviews.llvm.org/rL262103) This is submitted as a separate CL because of previous problems with ARM. Subscribers: aemerson Differential Revision: http://reviews.llvm.org/D18227 llvm-svn: 263797
* Remove llvm::getDISubprogram in favor of Function::getSubprogramPete Cooper2016-03-111-1/+1
| | | | | | | | | | | | | | | | | llvm::getDISubprogram walks the instructions in a function, looking for one in the scope of the current function, so that it can find the !dbg entry for the subprogram itself. Now that !dbg is attached to functions, this should not be necessary. This patch changes all uses to just query the subprogram directly on the function. Ideally this should be NFC, but in reality its possible that a function: has no !dbg (in which case there's likely a bug somewhere in an opt pass), or that none of the instructions had a scope referencing the function, so we used to not find the !dbg on the function but now we will Reviewed by Duncan Exon Smith. Differential Revision: http://reviews.llvm.org/D18074 llvm-svn: 263184
* Revert "[sancov] do not instrument nodes that are full pre-dominators"Renato Golin2016-02-271-22/+11
| | | | | | This reverts commit r262103, as it broke all ARM and AArch64 bots. llvm-svn: 262139
* [sancov] properly initializing pass.Mike Aizatsky2016-02-271-1/+6
| | | | llvm-svn: 262111
* [libFuzzer] don't emit callbacks to sanitizer run-time in ↵Kostya Serebryany2016-02-271-12/+14
| | | | | | -fsanitize-coverage=trace-pc mode; update libFuzzer doc for previous commit llvm-svn: 262110
* [sancov] do not instrument nodes that are full pre-dominatorsMike Aizatsky2016-02-271-11/+22
| | | | | | | | | | | Summary: Without tree pruning clang has 2,667,552 points. Wiht only dominators pruning: 1,515,586. With both dominators & predominators pruning: 1,340,534. Differential Revision: http://reviews.llvm.org/D17671 llvm-svn: 262103
* [sancov] Pruning full dominator blocks from instrumentation.Mike Aizatsky2016-02-261-4/+32
| | | | | | | | | | | | | | Summary: This is the first simple attempt to reduce number of coverage- instrumented blocks. If a basic block dominates all its successors, then its coverage information is useless to us. Ingore such blocks if santizer-coverage-prune-tree option is set. Differential Revision: http://reviews.llvm.org/D17626 llvm-svn: 261949
* [sanitizer-coverage] implement -fsanitize-coverage=trace-pc. This is similar ↵Kostya Serebryany2016-02-171-6/+24
| | | | | | to trace-bb, but has a different API. We already use the equivalent flag in GCC for Linux kernel fuzzing. We may be able to use this flag with AFL too llvm-svn: 261159
* Update to use new name alignTo().Rui Ueyama2016-01-141-2/+1
| | | | llvm-svn: 257804
* getParent() ^ 3 == getModule() ; NFCISanjay Patel2015-12-141-2/+1
| | | | llvm-svn: 255511
* Move EH-specific helper functions to a more appropriate placeDavid Majnemer2015-12-021-1/+1
| | | | | | No functionality change is intended. llvm-svn: 254562
* [sanitizer coverage] when adding a bb trace instrumentation, do it instead, ↵Kostya Serebryany2015-12-021-15/+10
| | | | | | not in addition to, regular coverage. Do the regular coverage in the run-time instead llvm-svn: 254482
* Instrumentation: Remove ilist iterator implicit conversions, NFCDuncan P. N. Exon Smith2015-10-131-4/+4
| | | | llvm-svn: 250186
* [sancov] Disable sanitizer coverage on functions using SEHReid Kleckner2015-09-031-0/+7
| | | | | | | Splitting basic blocks really messes up WinEHPrepare. We can remove this change when SEH uses the new EH IR. llvm-svn: 246799
* [sancov] Fix an unused variable warning introduced in r245067Justin Bogner2015-08-141-1/+1
| | | | llvm-svn: 245072
* [sancov] Leave llvm.localescape in the entry blockReid Kleckner2015-08-141-8/+4
| | | | | | | | | | | | Summary: Similar to the change we applied to ASan. The same test case works. Reviewers: samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D11961 llvm-svn: 245067
* [libFuzzer] don't crash if the condition in a switch has unusual type (e.g. i72)Kostya Serebryany2015-08-111-0/+3
| | | | llvm-svn: 244544
* [libFuzzer] trace switch statements and apply mutations based on the ↵Kostya Serebryany2015-07-311-4/+55
| | | | | | expected case values llvm-svn: 243726
* [SanitizerCoverage] Don't add instrumentation to unreachable blocks.Alexey Samsonov2015-06-301-0/+7
| | | | llvm-svn: 241127
* [SanitizerCoverage] Use llvm::getDISubprogram() to get location of the entry ↵Alexey Samsonov2015-06-121-3/+9
| | | | | | | | | | | basic block. DebugLoc::getFnDebugLoc() should soon be removed. Also, getDISubprogram() might become more effective soon and wouldn't need to scan debug locations at all, if function-level metadata would be emitted by Clang. llvm-svn: 239586
* Simplify IRBuilder::CreateCall* by using ArrayRef+initializer_list/braced ↵David Blaikie2015-05-181-8/+8
| | | | | | init only llvm-svn: 237624
* SanitizerCoverage: Use `createSanitizerCtor` to create ctor and call initIsmail Pazarbasi2015-05-101-20/+13
| | | | | | | | | | | | | | Second attempt; instead of using a named local variable, passing arguments directly to `createSanitizerCtorAndInitFunctions` worked on Windows. Reviewers: kcc, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D8780 llvm-svn: 236951
* Delete unused createSanitizerCoverageModulePass overload.Alexey Samsonov2015-05-071-3/+0
| | | | llvm-svn: 236791
* Revert "SanitizerCoverage: Use `createSanitizerCtor` to create ctor and call ↵Ismail Pazarbasi2015-05-071-11/+16
| | | | | | | | init" Will fix tomorrow. Unbreak build bots now. llvm-svn: 236786
* SanitizerCoverage: Use `createSanitizerCtor` to create ctor and call initIsmail Pazarbasi2015-05-071-16/+11
| | | | | | | | | | Reviewers: kcc, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D8780 llvm-svn: 236780
* [SanitizerCoverage] Introduce SanitizerCoverageOptions struct.Alexey Samsonov2015-05-071-30/+68
| | | | | | | | | | | | | | | | | | | Summary: This gives frontend more precise control over collected coverage information. User can still override these options by passing -mllvm flags. No functionality change. Test Plan: regression test suite. Reviewers: kcc Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D9539 llvm-svn: 236687
* [SanitizerCoverage] Fix a couple of typos. NFC.Alexey Samsonov2015-05-061-7/+7
| | | | llvm-svn: 236643
* Reduce dyn_cast<> to isa<> or cast<> where possible.Benjamin Kramer2015-04-101-1/+1
| | | | | | No functional change intended. llvm-svn: 234586
* Move `checkInterfaceFunction` to ModuleUtilsIsmail Pazarbasi2015-04-061-20/+12
| | | | | | | | | | | | | | Summary: Instead of making a local copy of `checkInterfaceFunction` for each sanitizer, move the function in a common place. Reviewers: kcc, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D8775 llvm-svn: 234220
* Transforms: Use the new DebugLoc API, NFCDuncan P. N. Exon Smith2015-03-301-2/+2
| | | | | | Update lib/Analysis and lib/Transforms to use the new `DebugLoc` API. llvm-svn: 233587
* [sanitizer] experimental tracing for cmp instructionsKostya Serebryany2015-03-211-13/+50
| | | | llvm-svn: 232873
* SanitizerCoverage: Check for null DebugLocsDuncan P. N. Exon Smith2015-03-201-2/+3
| | | | | | | After a WIP patch to make `DIDescriptor` accessors more strict, this started asserting. llvm-svn: 232832
* [sanitizer] fix instrumentation with -mllvm ↵Kostya Serebryany2015-03-101-7/+10
| | | | | | -sanitizer-coverage-block-threshold=0 to actually do something useful. llvm-svn: 231736
* [sanitizer] decrease sanitizer-coverage-block-threshold from 1000 to 500 as ↵Kostya Serebryany2015-03-101-1/+1
| | | | | | another horrible workaround for PR17409 llvm-svn: 231733
* [sanitizer] add nosanitize metadata to more coverage instrumentation ↵Kostya Serebryany2015-03-051-4/+12
| | | | | | instructions llvm-svn: 231333
* Make DataLayout Non-Optional in the ModuleMehdi Amini2015-03-041-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: DataLayout keeps the string used for its creation. As a side effect it is no longer needed in the Module. This is "almost" NFC, the string is no longer canonicalized, you can't rely on two "equals" DataLayout having the same string returned by getStringRepresentation(). Get rid of DataLayoutPass: the DataLayout is in the Module The DataLayout is "per-module", let's enforce this by not duplicating it more than necessary. One more step toward non-optionality of the DataLayout in the module. Make DataLayout Non-Optional in the Module Module->getDataLayout() will never returns nullptr anymore. Reviewers: echristo Subscribers: resistor, llvm-commits, jholewinski Differential Revision: http://reviews.llvm.org/D7992 From: Mehdi Amini <mehdi.amini@apple.com> llvm-svn: 231270
* [sanitizer/coverage] Add AFL-style coverage counters (search heuristic for ↵Kostya Serebryany2015-03-031-7/+55
| | | | | | | | | | | | | | | | | | | | | | | | | fuzzing). Introduce -mllvm -sanitizer-coverage-8bit-counters=1 which adds imprecise thread-unfriendly 8-bit coverage counters. The run-time library maps these 8-bit counters to 8-bit bitsets in the same way AFL (http://lcamtuf.coredump.cx/afl/technical_details.txt) does: counter values are divided into 8 ranges and based on the counter value one of the bits in the bitset is set. The AFL ranges are used here: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+. These counters provide a search heuristic for single-threaded coverage-guided fuzzers, we do not expect them to be useful for other purposes. Depending on the value of -fsanitize-coverage=[123] flag, these counters will be added to the function entry blocks (=1), every basic block (=2), or every edge (=3). Use these counters as an optional search heuristic in the Fuzzer library. Add a test where this heuristic is critical. llvm-svn: 231166
* [sanitizer] when dumping the basic block trace, also dump the module names. ↵Kostya Serebryany2015-02-201-3/+12
| | | | | | Patch by Laszlo Szekeres llvm-svn: 229940
* [sanitizer] add another workaround for PR 17409: when over a threshold emit ↵Kostya Serebryany2015-02-041-24/+32
| | | | | | coverage instrumentation as calls. llvm-svn: 228102
* [sancov] Fix unspecified constructor order between sancov and asan.Evgeniy Stepanov2015-01-271-1/+1
| | | | | | | Sanitizer coverage constructor must run after asan constructor (for each DSO). Bump constructor priority to guarantee that. llvm-svn: 227195
* [PM] Remove the Pass argument from all of the critical edge splittingChandler Carruth2015-01-191-1/+1
| | | | | | | | | | | | | | | | | | | APIs and replace it and numerous booleans with an option struct. The critical edge splitting API has a really large surface of flags and so it seems worth burning a small option struct / builder. This struct can be constructed with the various preserved analyses and then flags can be flipped in a builder style. The various users are now responsible for directly passing along their analysis information. This should be enough for the critical edge splitting to work cleanly with the new pass manager as well. This API is still pretty crufty and could be cleaned up a lot, but I've focused on this change just threading an option struct rather than a pass through the API. llvm-svn: 226456
OpenPOWER on IntegriCloud