summaryrefslogtreecommitdiffstats
path: root/llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp
Commit message (Collapse)AuthorAgeFilesLines
* Instrumentation: Remove ilist iterator implicit conversions, NFCDuncan P. N. Exon Smith2015-10-131-4/+4
| | | | llvm-svn: 250186
* [sancov] Disable sanitizer coverage on functions using SEHReid Kleckner2015-09-031-0/+7
| | | | | | | Splitting basic blocks really messes up WinEHPrepare. We can remove this change when SEH uses the new EH IR. llvm-svn: 246799
* [sancov] Fix an unused variable warning introduced in r245067Justin Bogner2015-08-141-1/+1
| | | | llvm-svn: 245072
* [sancov] Leave llvm.localescape in the entry blockReid Kleckner2015-08-141-8/+4
| | | | | | | | | | | | Summary: Similar to the change we applied to ASan. The same test case works. Reviewers: samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D11961 llvm-svn: 245067
* [libFuzzer] don't crash if the condition in a switch has unusual type (e.g. i72)Kostya Serebryany2015-08-111-0/+3
| | | | llvm-svn: 244544
* [libFuzzer] trace switch statements and apply mutations based on the ↵Kostya Serebryany2015-07-311-4/+55
| | | | | | expected case values llvm-svn: 243726
* [SanitizerCoverage] Don't add instrumentation to unreachable blocks.Alexey Samsonov2015-06-301-0/+7
| | | | llvm-svn: 241127
* [SanitizerCoverage] Use llvm::getDISubprogram() to get location of the entry ↵Alexey Samsonov2015-06-121-3/+9
| | | | | | | | | | | basic block. DebugLoc::getFnDebugLoc() should soon be removed. Also, getDISubprogram() might become more effective soon and wouldn't need to scan debug locations at all, if function-level metadata would be emitted by Clang. llvm-svn: 239586
* Simplify IRBuilder::CreateCall* by using ArrayRef+initializer_list/braced ↵David Blaikie2015-05-181-8/+8
| | | | | | init only llvm-svn: 237624
* SanitizerCoverage: Use `createSanitizerCtor` to create ctor and call initIsmail Pazarbasi2015-05-101-20/+13
| | | | | | | | | | | | | | Second attempt; instead of using a named local variable, passing arguments directly to `createSanitizerCtorAndInitFunctions` worked on Windows. Reviewers: kcc, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D8780 llvm-svn: 236951
* Delete unused createSanitizerCoverageModulePass overload.Alexey Samsonov2015-05-071-3/+0
| | | | llvm-svn: 236791
* Revert "SanitizerCoverage: Use `createSanitizerCtor` to create ctor and call ↵Ismail Pazarbasi2015-05-071-11/+16
| | | | | | | | init" Will fix tomorrow. Unbreak build bots now. llvm-svn: 236786
* SanitizerCoverage: Use `createSanitizerCtor` to create ctor and call initIsmail Pazarbasi2015-05-071-16/+11
| | | | | | | | | | Reviewers: kcc, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D8780 llvm-svn: 236780
* [SanitizerCoverage] Introduce SanitizerCoverageOptions struct.Alexey Samsonov2015-05-071-30/+68
| | | | | | | | | | | | | | | | | | | Summary: This gives frontend more precise control over collected coverage information. User can still override these options by passing -mllvm flags. No functionality change. Test Plan: regression test suite. Reviewers: kcc Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D9539 llvm-svn: 236687
* [SanitizerCoverage] Fix a couple of typos. NFC.Alexey Samsonov2015-05-061-7/+7
| | | | llvm-svn: 236643
* Reduce dyn_cast<> to isa<> or cast<> where possible.Benjamin Kramer2015-04-101-1/+1
| | | | | | No functional change intended. llvm-svn: 234586
* Move `checkInterfaceFunction` to ModuleUtilsIsmail Pazarbasi2015-04-061-20/+12
| | | | | | | | | | | | | | Summary: Instead of making a local copy of `checkInterfaceFunction` for each sanitizer, move the function in a common place. Reviewers: kcc, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D8775 llvm-svn: 234220
* Transforms: Use the new DebugLoc API, NFCDuncan P. N. Exon Smith2015-03-301-2/+2
| | | | | | Update lib/Analysis and lib/Transforms to use the new `DebugLoc` API. llvm-svn: 233587
* [sanitizer] experimental tracing for cmp instructionsKostya Serebryany2015-03-211-13/+50
| | | | llvm-svn: 232873
* SanitizerCoverage: Check for null DebugLocsDuncan P. N. Exon Smith2015-03-201-2/+3
| | | | | | | After a WIP patch to make `DIDescriptor` accessors more strict, this started asserting. llvm-svn: 232832
* [sanitizer] fix instrumentation with -mllvm ↵Kostya Serebryany2015-03-101-7/+10
| | | | | | -sanitizer-coverage-block-threshold=0 to actually do something useful. llvm-svn: 231736
* [sanitizer] decrease sanitizer-coverage-block-threshold from 1000 to 500 as ↵Kostya Serebryany2015-03-101-1/+1
| | | | | | another horrible workaround for PR17409 llvm-svn: 231733
* [sanitizer] add nosanitize metadata to more coverage instrumentation ↵Kostya Serebryany2015-03-051-4/+12
| | | | | | instructions llvm-svn: 231333
* Make DataLayout Non-Optional in the ModuleMehdi Amini2015-03-041-6/+2
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Summary: DataLayout keeps the string used for its creation. As a side effect it is no longer needed in the Module. This is "almost" NFC, the string is no longer canonicalized, you can't rely on two "equals" DataLayout having the same string returned by getStringRepresentation(). Get rid of DataLayoutPass: the DataLayout is in the Module The DataLayout is "per-module", let's enforce this by not duplicating it more than necessary. One more step toward non-optionality of the DataLayout in the module. Make DataLayout Non-Optional in the Module Module->getDataLayout() will never returns nullptr anymore. Reviewers: echristo Subscribers: resistor, llvm-commits, jholewinski Differential Revision: http://reviews.llvm.org/D7992 From: Mehdi Amini <mehdi.amini@apple.com> llvm-svn: 231270
* [sanitizer/coverage] Add AFL-style coverage counters (search heuristic for ↵Kostya Serebryany2015-03-031-7/+55
| | | | | | | | | | | | | | | | | | | | | | | | | fuzzing). Introduce -mllvm -sanitizer-coverage-8bit-counters=1 which adds imprecise thread-unfriendly 8-bit coverage counters. The run-time library maps these 8-bit counters to 8-bit bitsets in the same way AFL (http://lcamtuf.coredump.cx/afl/technical_details.txt) does: counter values are divided into 8 ranges and based on the counter value one of the bits in the bitset is set. The AFL ranges are used here: 1, 2, 3, 4-7, 8-15, 16-31, 32-127, 128+. These counters provide a search heuristic for single-threaded coverage-guided fuzzers, we do not expect them to be useful for other purposes. Depending on the value of -fsanitize-coverage=[123] flag, these counters will be added to the function entry blocks (=1), every basic block (=2), or every edge (=3). Use these counters as an optional search heuristic in the Fuzzer library. Add a test where this heuristic is critical. llvm-svn: 231166
* [sanitizer] when dumping the basic block trace, also dump the module names. ↵Kostya Serebryany2015-02-201-3/+12
| | | | | | Patch by Laszlo Szekeres llvm-svn: 229940
* [sanitizer] add another workaround for PR 17409: when over a threshold emit ↵Kostya Serebryany2015-02-041-24/+32
| | | | | | coverage instrumentation as calls. llvm-svn: 228102
* [sancov] Fix unspecified constructor order between sancov and asan.Evgeniy Stepanov2015-01-271-1/+1
| | | | | | | Sanitizer coverage constructor must run after asan constructor (for each DSO). Bump constructor priority to guarantee that. llvm-svn: 227195
* [PM] Remove the Pass argument from all of the critical edge splittingChandler Carruth2015-01-191-1/+1
| | | | | | | | | | | | | | | | | | | APIs and replace it and numerous booleans with an option struct. The critical edge splitting API has a really large surface of flags and so it seems worth burning a small option struct / builder. This struct can be constructed with the various preserved analyses and then flags can be flipped in a builder style. The various users are now responsible for directly passing along their analysis information. This should be enough for the critical edge splitting to work cleanly with the new pass manager as well. This API is still pretty crufty and could be cleaned up a lot, but I've focused on this change just threading an option struct rather than a pass through the API. llvm-svn: 226456
* [asan] simplify the tracing code, make it use the same guard variables as ↵Kostya Serebryany2015-01-031-25/+12
| | | | | | coverage llvm-svn: 225103
* [asan] change _sanitizer_cov_module_init to accept int* instead of int**Kostya Serebryany2014-12-301-18/+34
| | | | llvm-svn: 224999
* [asan] change the coverage collection scheme so that we can easily emit ↵Kostya Serebryany2014-12-231-12/+24
| | | | | | coverage for the entire process as a single bit set, and if coverage_bitset=1 actually emit that bitset llvm-svn: 224789
* [sanitizer] allow -fsanitize-coverage=N w/ -fsanitize=leak, llvm partKostya Serebryany2014-12-171-4/+2
| | | | llvm-svn: 224463
* [sanitizer] prevent function call merging for sanitizer-coverage callbacksKostya Serebryany2014-12-161-0/+7
| | | | llvm-svn: 224372
* IR: Split Metadata from ValueDuncan P. N. Exon Smith2014-12-091-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Split `Metadata` away from the `Value` class hierarchy, as part of PR21532. Assembly and bitcode changes are in the wings, but this is the bulk of the change for the IR C++ API. I have a follow-up patch prepared for `clang`. If this breaks other sub-projects, I apologize in advance :(. Help me compile it on Darwin I'll try to fix it. FWIW, the errors should be easy to fix, so it may be simpler to just fix it yourself. This breaks the build for all metadata-related code that's out-of-tree. Rest assured the transition is mechanical and the compiler should catch almost all of the problems. Here's a quick guide for updating your code: - `Metadata` is the root of a class hierarchy with three main classes: `MDNode`, `MDString`, and `ValueAsMetadata`. It is distinct from the `Value` class hierarchy. It is typeless -- i.e., instances do *not* have a `Type`. - `MDNode`'s operands are all `Metadata *` (instead of `Value *`). - `TrackingVH<MDNode>` and `WeakVH` referring to metadata can be replaced with `TrackingMDNodeRef` and `TrackingMDRef`, respectively. If you're referring solely to resolved `MDNode`s -- post graph construction -- just use `MDNode*`. - `MDNode` (and the rest of `Metadata`) have only limited support for `replaceAllUsesWith()`. As long as an `MDNode` is pointing at a forward declaration -- the result of `MDNode::getTemporary()` -- it maintains a side map of its uses and can RAUW itself. Once the forward declarations are fully resolved RAUW support is dropped on the ground. This means that uniquing collisions on changing operands cause nodes to become "distinct". (This already happened fairly commonly, whenever an operand went to null.) If you're constructing complex (non self-reference) `MDNode` cycles, you need to call `MDNode::resolveCycles()` on each node (or on a top-level node that somehow references all of the nodes). Also, don't do that. Metadata cycles (and the RAUW machinery needed to construct them) are expensive. - An `MDNode` can only refer to a `Constant` through a bridge called `ConstantAsMetadata` (one of the subclasses of `ValueAsMetadata`). As a side effect, accessing an operand of an `MDNode` that is known to be, e.g., `ConstantInt`, takes three steps: first, cast from `Metadata` to `ConstantAsMetadata`; second, extract the `Constant`; third, cast down to `ConstantInt`. The eventual goal is to introduce `MDInt`/`MDFloat`/etc. and have metadata schema owners transition away from using `Constant`s when the type isn't important (and they don't care about referring to `GlobalValue`s). In the meantime, I've added transitional API to the `mdconst` namespace that matches semantics with the old code, in order to avoid adding the error-prone three-step equivalent to every call site. If your old code was: MDNode *N = foo(); bar(isa <ConstantInt>(N->getOperand(0))); baz(cast <ConstantInt>(N->getOperand(1))); bak(cast_or_null <ConstantInt>(N->getOperand(2))); bat(dyn_cast <ConstantInt>(N->getOperand(3))); bay(dyn_cast_or_null<ConstantInt>(N->getOperand(4))); you can trivially match its semantics with: MDNode *N = foo(); bar(mdconst::hasa <ConstantInt>(N->getOperand(0))); baz(mdconst::extract <ConstantInt>(N->getOperand(1))); bak(mdconst::extract_or_null <ConstantInt>(N->getOperand(2))); bat(mdconst::dyn_extract <ConstantInt>(N->getOperand(3))); bay(mdconst::dyn_extract_or_null<ConstantInt>(N->getOperand(4))); and when you transition your metadata schema to `MDInt`: MDNode *N = foo(); bar(isa <MDInt>(N->getOperand(0))); baz(cast <MDInt>(N->getOperand(1))); bak(cast_or_null <MDInt>(N->getOperand(2))); bat(dyn_cast <MDInt>(N->getOperand(3))); bay(dyn_cast_or_null<MDInt>(N->getOperand(4))); - A `CallInst` -- specifically, intrinsic instructions -- can refer to metadata through a bridge called `MetadataAsValue`. This is a subclass of `Value` where `getType()->isMetadataTy()`. `MetadataAsValue` is the *only* class that can legally refer to a `LocalAsMetadata`, which is a bridged form of non-`Constant` values like `Argument` and `Instruction`. It can also refer to any other `Metadata` subclass. (I'll break all your testcases in a follow-up commit, when I propagate this change to assembly.) llvm-svn: 223802
* [msan] allow -fsanitize-coverage=N together with -fsanitize=memory, llvm partKostya Serebryany2014-12-031-1/+4
| | | | llvm-svn: 223312
* [asan/coverage] change the way asan coverage instrumentation is done: ↵Kostya Serebryany2014-11-241-10/+7
| | | | | | instead of setting the guard to 1 in the generated code, pass the pointer to guard to __sanitizer_cov and set it there. No user-visible functionality change expected llvm-svn: 222675
* [asan] add experimental basic-block tracing to asan-coverage; also fix ↵Kostya Serebryany2014-11-191-6/+40
| | | | | | -fsanitize-coverage=3 which was broken by r221718 llvm-svn: 222290
* Use nullptr instead of NULL for variadic sentinelsReid Kleckner2014-11-131-3/+3
| | | | | | | | | | Windows defines NULL to 0, which when used as an argument to a variadic function, is not a null pointer constant. As a result, Clang's -Wsentinel fires on this code. Using '0' would be wrong on most 64-bit platforms, but both MSVC and Clang make it work on Windows. Sidestep the issue with nullptr. llvm-svn: 221940
* Move asan-coverage into a separate phase.Kostya Serebryany2014-11-111-0/+260
Summary: This change moves asan-coverage instrumentation into a separate Module pass. The other part of the change in clang introduces a new flag -fsanitize-coverage=N. Another small patch will update tests in compiler-rt. With this patch no functionality change is expected except for the flag name. The following changes will make the coverage instrumentation work with tsan/msan Test Plan: Run regression tests, chromium. Reviewers: nlewycky, samsonov Reviewed By: nlewycky, samsonov Subscribers: llvm-commits Differential Revision: http://reviews.llvm.org/D6152 llvm-svn: 221718
OpenPOWER on IntegriCloud