From 1bec824cadba7870d6e2b52588d782f32be44866 Mon Sep 17 00:00:00 2001 From: Andrew Kelley Date: Wed, 28 Aug 2024 14:52:57 -0700 Subject: [PATCH] LLVM: disable inline 8-bit counters when using trace pc guard --- lib/std/Build/Step/Compile.zig | 16 +++++++++++----- src/codegen/llvm.zig | 1 + 2 files changed, 12 insertions(+), 5 deletions(-) diff --git a/lib/std/Build/Step/Compile.zig b/lib/std/Build/Step/Compile.zig index 1aeebbb55b812451f60f882f067d4977585dd152..922d64c728c5215ea7f56e2acaf7802e19b3791e 100644 --- a/lib/std/Build/Step/Compile.zig +++ b/lib/std/Build/Step/Compile.zig @@ -218,12 +218,18 @@ no_builtin: bool = false, /// Managed by the build runner, not user build script. zig_process: ?*Step.ZigProcess, -/// Enables deprecated coverage instrumentation that is only useful if you -/// are using third party fuzzers that depend on it. Otherwise, slows down -/// the instrumented binary with unnecessary function calls. +/// Enables coverage instrumentation that is only useful if you are using third +/// party fuzzers that depend on it. Otherwise, slows down the instrumented +/// binary with unnecessary function calls. /// -/// To enable fuzz testing instrumentation on a compilation, see the `fuzz` -/// flag in `Module`. +/// This kind of coverage instrumentation is used by AFLplusplus v4.21c, +/// however, modern fuzzers - including Zig - have switched to using "inline +/// 8-bit counters" or "inline bool flag" which incurs only a single +/// instruction for coverage, along with "trace cmp" which instruments +/// comparisons and reports the operands. +/// +/// To instead enable fuzz testing instrumentation on a compilation using Zig's +/// builtin fuzzer, see the `fuzz` flag in `Module`. sanitize_coverage_trace_pc_guard: ?bool = null, pub const ExpectedCompileErrors = union(enum) { diff --git a/src/codegen/llvm.zig b/src/codegen/llvm.zig index f99018310a2ec06834f28cfe0443929cfaa7ce33..d59fdd42a3242346e62284fc34dcf447efe9c68f 100644 --- a/src/codegen/llvm.zig +++ b/src/codegen/llvm.zig @@ -1664,6 +1664,7 @@ pub const Object = struct { if (!owner_mod.fuzz) break :f null; if (func_analysis.disable_instrumentation) break :f null; if (is_naked) break :f null; + if (comp.config.san_cov_trace_pc_guard) break :f null; // The void type used here is a placeholder to be replaced with an // array of the appropriate size after the POI count is known. -- 2.54.0