RPCS3/llvm-mirror
1
0
Fork 0
mirror of https://github.com/RPCS3/llvm-mirror.git synced 2024-11-22 18:54:02 +01:00
Code Issues Projects Releases Wiki Activity
master3
llvm-mirror/test/Instrumentation/SanitizerCoverage/tracing.ll

86 lines
3.9 KiB
LLVM
Raw Permalink Normal View History

[asan] add experimental basic-block tracing to asan-coverage; also fix -fsanitize-coverage=3 which was broken by r221718 llvm-svn: 222290
2014-11-19 01:22:58 +01:00
; Test -sanitizer-coverage-experimental-tracing
[sanitizer-coverage] implement -fsanitize-coverage=trace-pc. This is similar to trace-bb, but has a different API. We already use the equivalent flag in GCC for Linux kernel fuzzing. We may be able to use this flag with AFL too llvm-svn: 261159
2016-02-17 22:34:43 +01:00
; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-trace-pc -S | FileCheck %s --check-prefix=CHECK_PC
[sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. LLVM part llvm-svn: 281431
2016-09-14 03:39:35 +02:00
; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-trace-pc-guard -S | FileCheck %s --check-prefix=CHECK_PC_GUARD
SanitizerCoverage: Support sanitizer guard section on darwin MachO's sections need a segment as well as a section name, and the section start and end symbols are spelled differently than on ELF. llvm-svn: 293733
2017-02-01 03:38:39 +01:00
; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-trace-pc-guard -S -mtriple=x86_64-apple-macosx | FileCheck %s --check-prefix=CHECK_PC_GUARD_DARWIN
Reland the "[NewPM] Port Sancov" patch from rL365838. No functional changes were made to the patch since then. -------- [NewPM] Port Sancov This patch contains a port of SanitizerCoverage to the new pass manager. This one's a bit hefty. Changes: - Split SanitizerCoverageModule into 2 SanitizerCoverage for passing over functions and ModuleSanitizerCoverage for passing over modules. - ModuleSanitizerCoverage exists for adding 2 module level calls to initialization functions but only if there's a function that was instrumented by sancov. - Added legacy and new PM wrapper classes that own instances of the 2 new classes. - Update llvm tests and add clang tests. llvm-svn: 367053
2019-07-25 22:53:15 +02:00
[NewPM][Sancov] Make Sancov a Module Pass instead of 2 Passes This patch merges the sancov module and funciton passes into one module pass. The reason for this is because we ran into an out of memory error when attempting to run asan fuzzer on some protobufs (pc.cc files). I traced the OOM error to the destructor of SanitizerCoverage where we only call appendTo[Compiler]Used which calls appendToUsedList. I'm not sure where precisely in appendToUsedList causes the OOM, but I am able to confirm that it's calling this function *repeatedly* that causes the OOM. (I hacked sancov a bit such that I can still create and destroy a new sancov on every function run, but only call appendToUsedList after all functions in the module have finished. This passes, but when I make it such that appendToUsedList is called on every sancov destruction, we hit OOM.) I don't think the OOM is from just adding to the SmallSet and SmallVector inside appendToUsedList since in either case for a given module, they'll have the same max size. I suspect that when the existing llvm.compiler.used global is erased, the memory behind it isn't freed. I could be wrong on this though. This patch works around the OOM issue by just calling appendToUsedList at the end of every module run instead of function run. The same amount of constants still get added to llvm.compiler.used, abd we make the pass usage and logic simpler by not having any inter-pass dependencies. Differential Revision: https://reviews.llvm.org/D66988 llvm-svn: 370971
2019-09-04 22:30:29 +02:00
; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=3 -sanitizer-coverage-trace-pc -S | FileCheck %s --check-prefix=CHECK_PC
; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=3 -sanitizer-coverage-trace-pc-guard -S | FileCheck %s --check-prefix=CHECK_PC_GUARD
; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=3 -sanitizer-coverage-trace-pc-guard -S -mtriple=x86_64-apple-macosx | FileCheck %s --check-prefix=CHECK_PC_GUARD_DARWIN
[asan] add experimental basic-block tracing to asan-coverage; also fix -fsanitize-coverage=3 which was broken by r221718 llvm-svn: 222290
2014-11-19 01:22:58 +01:00
target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
target triple = "x86_64-unknown-linux-gnu"
define void @foo(i32* %a) sanitize_address {
entry:
%tobool = icmp eq i32* %a, null
br i1 %tobool, label %if.end, label %if.then
if.then: ; preds = %entry
store i32 0, i32* %a, align 4
br label %if.end
if.end: ; preds = %entry, %if.then
ret void
}
[sanitizer-coverage] don't instrument available_externally functions llvm-svn: 309611
2017-07-31 22:00:22 +02:00
define available_externally void @external_bar(i32* %a) sanitize_address {
entry:
ret void
}
[sancov] Instrument reachable blocks that end in unreachable Summary: These sorts of blocks often contain calls to noreturn functions, like longjmp, throw, or trap. If they don't end the program, they are "interesting" from the perspective of sanitizer coverage, so we should instrument them. This was discussed in https://reviews.llvm.org/D57982. Reviewers: kcc, vitalybuka Subscribers: llvm-commits, craig.topper, efriedma, morehouse, hiraditya Tags: #llvm Differential Revision: https://reviews.llvm.org/D58740 llvm-svn: 355152
2019-02-28 23:54:30 +01:00
declare void @longjmp(i8*) noreturn
; We expect three coverage points here for each BB.
define void @cond_longjmp(i1 %cond, i8* %jmp_buf) sanitize_address {
entry:
br i1 %cond, label %lj, label %done
done:
ret void
lj:
call void @longjmp(i8* %jmp_buf)
unreachable
}
[sanitizer-coverage] don't instrument available_externally functions llvm-svn: 309611
2017-07-31 22:00:22 +02:00
[sanitizer-coverage] implement -fsanitize-coverage=trace-pc. This is similar to trace-bb, but has a different API. We already use the equivalent flag in GCC for Linux kernel fuzzing. We may be able to use this flag with AFL too llvm-svn: 261159
2016-02-17 22:34:43 +01:00
; CHECK_PC-LABEL: define void @foo
; CHECK_PC: call void @__sanitizer_cov_trace_pc
; CHECK_PC: call void @__sanitizer_cov_trace_pc
; CHECK_PC: call void @__sanitizer_cov_trace_pc
; CHECK_PC-NOT: call void @__sanitizer_cov_trace_pc
; CHECK_PC: ret void
[libFuzzer] don't emit callbacks to sanitizer run-time in -fsanitize-coverage=trace-pc mode; update libFuzzer doc for previous commit llvm-svn: 262110
2016-02-27 06:45:12 +01:00
; CHECK_PC-NOT: call void @__sanitizer_cov_module_init
[sancov] Instrument reachable blocks that end in unreachable Summary: These sorts of blocks often contain calls to noreturn functions, like longjmp, throw, or trap. If they don't end the program, they are "interesting" from the perspective of sanitizer coverage, so we should instrument them. This was discussed in https://reviews.llvm.org/D57982. Reviewers: kcc, vitalybuka Subscribers: llvm-commits, craig.topper, efriedma, morehouse, hiraditya Tags: #llvm Differential Revision: https://reviews.llvm.org/D58740 llvm-svn: 355152
2019-02-28 23:54:30 +01:00
; CHECK_PC-LABEL: @cond_longjmp
; CHECK_PC: call void @__sanitizer_cov_trace_pc
; CHECK_PC: call void @__sanitizer_cov_trace_pc
; CHECK_PC: ret void
; CHECK_PC: call void @__sanitizer_cov_trace_pc
; CHECK_PC: call void @longjmp
; CHECK_PC: unreachable
[sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. LLVM part llvm-svn: 281431
2016-09-14 03:39:35 +02:00
[SanitizerCoverage] Create comdat for global arrays. Summary: Place global arrays in comdat sections with their associated functions. This makes sure they are stripped along with the functions they reference, even on the BFD linker. Reviewers: eugenis Reviewed By: eugenis Subscribers: eraman, hiraditya, llvm-commits Differential Revision: https://reviews.llvm.org/D51902 llvm-svn: 342186
2018-09-13 23:45:55 +02:00
; CHECK_PC_GUARD: section "__sancov_guards", comdat($foo), align 4
[sanitizer-coverage] add yet another flavour of coverage instrumentation: trace-pc-guard. The intent is to eventually replace all of {bool coverage, 8bit-counters, trace-pc} with just this one. LLVM part llvm-svn: 281431
2016-09-14 03:39:35 +02:00
; CHECK_PC_GUARD-LABEL: define void @foo
; CHECK_PC_GUARD: call void @__sanitizer_cov_trace_pc_guard
; CHECK_PC_GUARD: call void @__sanitizer_cov_trace_pc_guard
; CHECK_PC_GUARD: call void @__sanitizer_cov_trace_pc_guard
; CHECK_PC_GUARD-NOT: call void @__sanitizer_cov_trace_pc
; CHECK_PC_GUARD: ret void
[sanitizer-coverage] don't instrument available_externally functions llvm-svn: 309611
2017-07-31 22:00:22 +02:00
; CHECK_PC_GUARD-LABEL: @external_bar
; CHECK_PC_GUARD-NOT: call void @__sanitizer_cov_trace_pc
; CHECK_PC_GUARD: ret void
[sancov] Instrument reachable blocks that end in unreachable Summary: These sorts of blocks often contain calls to noreturn functions, like longjmp, throw, or trap. If they don't end the program, they are "interesting" from the perspective of sanitizer coverage, so we should instrument them. This was discussed in https://reviews.llvm.org/D57982. Reviewers: kcc, vitalybuka Subscribers: llvm-commits, craig.topper, efriedma, morehouse, hiraditya Tags: #llvm Differential Revision: https://reviews.llvm.org/D58740 llvm-svn: 355152
2019-02-28 23:54:30 +01:00
; CHECK_PC_GUARD-LABEL: @cond_longjmp
; CHECK_PC_GUARD: call void @__sanitizer_cov_trace_pc_guard
; CHECK_PC_GUARD: call void @__sanitizer_cov_trace_pc_guard
; CHECK_PC_GUARD: ret void
; CHECK_PC_GUARD: call void @__sanitizer_cov_trace_pc_guard
; CHECK_PC_GUARD: call void @longjmp
; CHECK_PC_GUARD: unreachable
[sanitizer-coverage] don't instrument available_externally functions llvm-svn: 309611
2017-07-31 22:00:22 +02:00
[sanitizer-coverage/libFuzzer] make the guards for trace-pc 32-bit; create one array of guards per function, instead of one guard per BB. reorganize the code so that trace-pc-guard does not create unneeded globals llvm-svn: 282735
2016-09-29 19:43:24 +02:00
; CHECK_PC_GUARD: call void @__sanitizer_cov_trace_pc_guard_init(i32* bitcast (i32** @__start___sancov_guards to i32*), i32* bitcast (i32** @__stop___sancov_guards to i32*))
SanitizerCoverage: Support sanitizer guard section on darwin MachO's sections need a segment as well as a section name, and the section start and end symbols are spelled differently than on ELF. llvm-svn: 293733
2017-02-01 03:38:39 +01:00
; CHECK_PC_GUARD_DARWIN-LABEL: define void @foo
; CHECK_PC_GUARD_DARWIN: call void @__sanitizer_cov_trace_pc_guard
; CHECK_PC_GUARD_DARWIN: call void @__sanitizer_cov_trace_pc_guard
; CHECK_PC_GUARD_DARWIN: call void @__sanitizer_cov_trace_pc_guard
; CHECK_PC_GUARD_DARWIN-NOT: call void @__sanitizer_cov_trace_pc
; CHECK_PC_GUARD_DARWIN: ret void
; CHECK_PC_GUARD_DARWIN: call void @__sanitizer_cov_trace_pc_guard_init(i32* bitcast (i32** @"\01section$start$__DATA$__sancov_guards" to i32*), i32* bitcast (i32** @"\01section$end$__DATA$__sancov_guards" to i32*))
Reference in New Issue Copy Permalink