Commit 6f3e9939d0389539570d4a7cad95b1e96bc8f0d4 | zig

lib/fuzzer.zig created+62

...	...	@@ -0,0 +1,62 @@
	1	const std = @import("std");
	2
	3	export threadlocal var __sancov_lowest_stack: usize = 0;
	4
	5	export fn __sanitizer_cov_8bit_counters_init(start: []u8, stop: []u8) void {
	6	std.debug.print("__sanitizer_cov_8bit_counters_init start={}, stop={}\n", .{ start, stop });
	7	}
	8
	9	export fn __sanitizer_cov_pcs_init(pcs_beg: []const usize, pcs_end: []const usize) void {
	10	std.debug.print("__sanitizer_cov_pcs_init pcs_beg={}, pcs_end={}\n", .{ pcs_beg, pcs_end });
	11	}
	12
	13	export fn __sanitizer_cov_trace_const_cmp1(arg1: u8, arg2: u8) void {
	14	handleCmp(@returnAddress(), arg1, arg2);
	15	}
	16
	17	export fn __sanitizer_cov_trace_cmp1(arg1: u8, arg2: u8) void {
	18	handleCmp(@returnAddress(), arg1, arg2);
	19	}
	20
	21	export fn __sanitizer_cov_trace_const_cmp2(arg1: u16, arg2: u16) void {
	22	handleCmp(@returnAddress(), arg1, arg2);
	23	}
	24
	25	export fn __sanitizer_cov_trace_cmp2(arg1: u16, arg2: u16) void {
	26	handleCmp(@returnAddress(), arg1, arg2);
	27	}
	28
	29	export fn __sanitizer_cov_trace_const_cmp4(arg1: u32, arg2: u32) void {
	30	handleCmp(@returnAddress(), arg1, arg2);
	31	}
	32
	33	export fn __sanitizer_cov_trace_cmp4(arg1: u32, arg2: u32) void {
	34	handleCmp(@returnAddress(), arg1, arg2);
	35	}
	36
	37	export fn __sanitizer_cov_trace_const_cmp8(arg1: u64, arg2: u64) void {
	38	handleCmp(@returnAddress(), arg1, arg2);
	39	}
	40
	41	export fn __sanitizer_cov_trace_cmp8(arg1: u64, arg2: u64) void {
	42	handleCmp(@returnAddress(), arg1, arg2);
	43	}
	44
	45	export fn __sanitizer_cov_trace_switch(val: u64, cases_ptr: [*]u64) void {
	46	const pc = @returnAddress();
	47	const len = cases_ptr[0];
	48	const val_size_in_bits = cases_ptr[1];
	49	const cases = cases_ptr[2..][0..len];
	50	std.debug.print("0x{x}: switch on value {d} ({d} bits) with {d} cases\n", .{
	51	pc, val, val_size_in_bits, cases.len,
	52	});
	53	}
	54
	55	export fn __sanitizer_cov_trace_pc_indir(callee: usize) void {
	56	const pc = @returnAddress();
	57	std.debug.print("0x{x}: indirect call to 0x{x}\n", .{ pc, callee });
	58	}
	59
	60	fn handleCmp(pc: usize, arg1: u64, arg2: u64) void {
	61	std.debug.print("0x{x}: comparison of {d} and {d}\n", .{ pc, arg1, arg2 });
	62	}

lib/std/Build/Module.zig+4

...	...	@@ -28,6 +28,7 @@ stack_protector: ?bool,
28	28	stack_check: ?bool,
29	29	sanitize_c: ?bool,
30	30	sanitize_thread: ?bool,
	31	fuzz: ?bool,
31	32	code_model: std.builtin.CodeModel,
32	33	valgrind: ?bool,
33	34	pic: ?bool,
...	...	@@ -186,6 +187,7 @@ pub const CreateOptions = struct {
186	187	stack_check: ?bool = null,
187	188	sanitize_c: ?bool = null,
188	189	sanitize_thread: ?bool = null,
	190	fuzz: ?bool = null,
189	191	/// Whether to emit machine code that integrates with Valgrind.
190	192	valgrind: ?bool = null,
191	193	/// Position Independent Code
...	...	@@ -228,6 +230,7 @@ pub fn init(m: Module, owner: std.Build, options: CreateOptions, compile: ?*St
228	230	.stack_check = options.stack_check,
229	231	.sanitize_c = options.sanitize_c,
230	232	.sanitize_thread = options.sanitize_thread,
	233	.fuzz = options.fuzz,
231	234	.code_model = options.code_model,
232	235	.valgrind = options.valgrind,
233	236	.pic = options.pic,
...	...	@@ -642,6 +645,7 @@ pub fn appendZigProcessFlags(
642	645	try addFlag(zig_args, m.error_tracing, "-ferror-tracing", "-fno-error-tracing");
643	646	try addFlag(zig_args, m.sanitize_c, "-fsanitize-c", "-fno-sanitize-c");
644	647	try addFlag(zig_args, m.sanitize_thread, "-fsanitize-thread", "-fno-sanitize-thread");
	648	try addFlag(zig_args, m.fuzz, "-ffuzz", "-fno-fuzz");
645	649	try addFlag(zig_args, m.valgrind, "-fvalgrind", "-fno-valgrind");
646	650	try addFlag(zig_args, m.pic, "-fPIC", "-fno-PIC");
647	651	try addFlag(zig_args, m.red_zone, "-mred-zone", "-mno-red-zone");

lib/std/mem.zig+6-6

...	...	@@ -636,18 +636,20 @@ test lessThan {
636	636	try testing.expect(lessThan(u8, "", "a"));
637	637	}
638	638
639		const backend_can_use_eql_bytes = switch (builtin.zig_backend) {
	639	const eqlBytes_allowed = switch (builtin.zig_backend) {
640	640	// The SPIR-V backend does not support the optimized path yet.
641	641	.stage2_spirv64 => false,
642	642	// The RISC-V does not support vectors.
643	643	.stage2_riscv64 => false,
644		else => true,
	644	// The naive memory comparison implementation is more useful for fuzzers to
	645	// find interesting inputs.
	646	else => !builtin.fuzz,
645	647	};
646	648
647	649	/// Compares two slices and returns whether they are equal.
648	650	pub fn eql(comptime T: type, a: []const T, b: []const T) bool {
649	651	if (@sizeOf(T) == 0) return true;
650		if (!@inComptime() and std.meta.hasUniqueRepresentation(T) and backend_can_use_eql_bytes) return eqlBytes(sliceAsBytes(a), sliceAsBytes(b));
	652	if (!@inComptime() and std.meta.hasUniqueRepresentation(T) and eqlBytes_allowed) return eqlBytes(sliceAsBytes(a), sliceAsBytes(b));
651	653
652	654	if (a.len != b.len) return false;
653	655	if (a.len == 0 or a.ptr == b.ptr) return true;
...	...	@@ -660,9 +662,7 @@ pub fn eql(comptime T: type, a: []const T, b: []const T) bool {
660	662
661	663	/// std.mem.eql heavily optimized for slices of bytes.
662	664	fn eqlBytes(a: []const u8, b: []const u8) bool {
663		if (!backend_can_use_eql_bytes) {
664		return eql(u8, a, b);
665		}
	665	comptime assert(eqlBytes_allowed);
666	666
667	667	if (a.len != b.len) return false;
668	668	if (a.len == 0 or a.ptr == b.ptr) return true;

lib/std/os/linux/start_pie.zig+1

...	...	@@ -71,6 +71,7 @@ fn getDynamicSymbol() [*]elf.Dyn {
71	71
72	72	pub fn relocate(phdrs: []elf.Phdr) void {
73	73	@setRuntimeSafety(false);
	74	@disableInstrumentation();
74	75
75	76	const dynv = getDynamicSymbol();
76	77	// Recover the delta applied by the loader by comparing the effective and

lib/std/os/linux/tls.zig+60-12

...	...	@@ -110,6 +110,8 @@ const TLSImage = struct {
110	110	pub var tls_image: TLSImage = undefined;
111	111
112	112	pub fn setThreadPointer(addr: usize) void {
	113	@setRuntimeSafety(false);
	114	@disableInstrumentation();
113	115	switch (native_arch) {
114	116	.x86 => {
115	117	var user_desc: linux.user_desc = .{
...	...	@@ -125,7 +127,7 @@ pub fn setThreadPointer(addr: usize) void {
125	127	.useable = 1,
126	128	},
127	129	};
128		const rc = linux.syscall1(.set_thread_area, @intFromPtr(&user_desc));
	130	const rc = @call(.always_inline, linux.syscall1, .{ .set_thread_area, @intFromPtr(&user_desc) });
129	131	assert(rc == 0);
130	132
131	133	const gdt_entry_number = user_desc.entry_number;
...	...	@@ -138,7 +140,7 @@ pub fn setThreadPointer(addr: usize) void {
138	140	);
139	141	},
140	142	.x86_64 => {
141		const rc = linux.syscall2(.arch_prctl, linux.ARCH.SET_FS, addr);
	143	const rc = @call(.always_inline, linux.syscall2, .{ .arch_prctl, linux.ARCH.SET_FS, addr });
142	144	assert(rc == 0);
143	145	},
144	146	.aarch64, .aarch64_be => {
...	...	@@ -149,7 +151,7 @@ pub fn setThreadPointer(addr: usize) void {
149	151	);
150	152	},
151	153	.arm, .thumb => {
152		const rc = linux.syscall1(.set_tls, addr);
	154	const rc = @call(.always_inline, linux.syscall1, .{ .set_tls, addr });
153	155	assert(rc == 0);
154	156	},
155	157	.riscv64 => {
...	...	@@ -160,7 +162,7 @@ pub fn setThreadPointer(addr: usize) void {
160	162	);
161	163	},
162	164	.mips, .mipsel, .mips64, .mips64el => {
163		const rc = linux.syscall1(.set_thread_area, addr);
	165	const rc = @call(.always_inline, linux.syscall1, .{ .set_thread_area, addr });
164	166	assert(rc == 0);
165	167	},
166	168	.powerpc, .powerpcle => {
...	...	@@ -189,6 +191,9 @@ pub fn setThreadPointer(addr: usize) void {
189	191	}
190	192
191	193	fn initTLS(phdrs: []elf.Phdr) void {
	194	@setRuntimeSafety(false);
	195	@disableInstrumentation();
	196
192	197	var tls_phdr: ?*elf.Phdr = null;
193	198	var img_base: usize = 0;
194	199
...	...	@@ -236,7 +241,7 @@ fn initTLS(phdrs: []elf.Phdr) void {
236	241	l += tls_align_factor - delta;
237	242	l += @sizeOf(CustomData);
238	243	tcb_offset = l;
239		l += mem.alignForward(usize, tls_tcb_size, tls_align_factor);
	244	l += alignForward(tls_tcb_size, tls_align_factor);
240	245	data_offset = l;
241	246	l += tls_data_alloc_size;
242	247	break :blk l;
...	...	@@ -244,14 +249,14 @@ fn initTLS(phdrs: []elf.Phdr) void {
244	249	.VariantII => blk: {
245	250	var l: usize = 0;
246	251	data_offset = l;
247		l += mem.alignForward(usize, tls_data_alloc_size, tls_align_factor);
	252	l += alignForward(tls_data_alloc_size, tls_align_factor);
248	253	// The thread pointer is aligned to p_align
249	254	tcb_offset = l;
250	255	l += tls_tcb_size;
251	256	// The CustomData structure is right after the TCB with no padding
252	257	// in between so it can be easily found
253	258	l += @sizeOf(CustomData);
254		l = mem.alignForward(usize, l, @alignOf(DTV));
	259	l = alignForward(l, @alignOf(DTV));
255	260	dtv_offset = l;
256	261	l += @sizeOf(DTV);
257	262	break :blk l;
...	...	@@ -270,13 +275,28 @@ fn initTLS(phdrs: []elf.Phdr) void {
270	275	};
271	276	}
272	277
	278	/// Inline because TLS is not set up yet.
	279	inline fn alignForward(addr: usize, alignment: usize) usize {
	280	return alignBackward(addr + (alignment - 1), alignment);
	281	}
	282
	283	/// Inline because TLS is not set up yet.
	284	inline fn alignBackward(addr: usize, alignment: usize) usize {
	285	return addr & ~(alignment - 1);
	286	}
	287
	288	/// Inline because TLS is not set up yet.
273	289	inline fn alignPtrCast(comptime T: type, ptr: []u8) T {
274	290	return @ptrCast(@alignCast(ptr));
275	291	}
276	292
277	293	/// Initializes all the fields of the static TLS area and returns the computed
278	294	/// architecture-specific value of the thread-pointer register
	295	///
	296	/// This function is inline because thread local storage is not set up yet.
279	297	pub fn prepareTLS(area: []u8) usize {
	298	@setRuntimeSafety(false);
	299	@disableInstrumentation();
280	300	// Clear the area we're going to use, just to be safe
281	301	@memset(area, 0);
282	302	// Prepare the DTV
...	...	@@ -310,6 +330,9 @@ pub fn prepareTLS(area: []u8) usize {
310	330	var main_thread_tls_buffer: [0x2100]u8 align(mem.page_size) = undefined;
311	331
312	332	pub fn initStaticTLS(phdrs: []elf.Phdr) void {
	333	@setRuntimeSafety(false);
	334	@disableInstrumentation();
	335
313	336	initTLS(phdrs);
314	337
315	338	const tls_area = blk: {
...	...	@@ -321,22 +344,47 @@ pub fn initStaticTLS(phdrs: []elf.Phdr) void {
321	344	break :blk main_thread_tls_buffer[0..tls_image.alloc_size];
322	345	}
323	346
324		const alloc_tls_area = posix.mmap(
	347	const begin_addr = mmap(
325	348	null,
326	349	tls_image.alloc_size + tls_image.alloc_align - 1,
327	350	posix.PROT.READ \| posix.PROT.WRITE,
328	351	.{ .TYPE = .PRIVATE, .ANONYMOUS = true },
329	352	-1,
330	353	0,
331		) catch posix.abort();
	354	);
	355	if (@as(isize, @bitCast(begin_addr)) < 0) @trap();
	356	const alloc_tls_area: [*]align(mem.page_size) u8 = @ptrFromInt(begin_addr);
332	357
333	358	// Make sure the slice is correctly aligned.
334		const begin_addr = @intFromPtr(alloc_tls_area.ptr);
335		const begin_aligned_addr = mem.alignForward(usize, begin_addr, tls_image.alloc_align);
	359	const begin_aligned_addr = alignForward(begin_addr, tls_image.alloc_align);
336	360	const start = begin_aligned_addr - begin_addr;
337		break :blk alloc_tls_area[start .. start + tls_image.alloc_size];
	361	break :blk alloc_tls_area[start..][0..tls_image.alloc_size];
338	362	};
339	363
340	364	const tp_value = prepareTLS(tls_area);
341	365	setThreadPointer(tp_value);
342	366	}
	367
	368	inline fn mmap(address: ?[*]u8, length: usize, prot: usize, flags: linux.MAP, fd: i32, offset: i64) usize {
	369	if (@hasField(linux.SYS, "mmap2")) {
	370	return @call(.always_inline, linux.syscall6, .{
	371	.mmap2,
	372	@intFromPtr(address),
	373	length,
	374	prot,
	375	@as(u32, @bitCast(flags)),
	376	@as(usize, @bitCast(@as(isize, fd))),
	377	@as(usize, @truncate(@as(u64, @bitCast(offset)) / linux.MMAP2_UNIT)),
	378	});
	379	} else {
	380	return @call(.always_inline, linux.syscall6, .{
	381	.mmap,
	382	@intFromPtr(address),
	383	length,
	384	prot,
	385	@as(u32, @bitCast(flags)),
	386	@as(usize, @bitCast(@as(isize, fd))),
	387	@as(u64, @bitCast(offset)),
	388	});
	389	}
	390	}

lib/std/start.zig+6-2

...	...	@@ -411,6 +411,10 @@ fn wWinMainCRTStartup() callconv(std.os.windows.WINAPI) noreturn {
411	411	}
412	412
413	413	fn posixCallMainAndExit(argc_argv_ptr: [*]usize) callconv(.C) noreturn {
	414	// We're not ready to panic until thread local storage is initialized.
	415	@setRuntimeSafety(false);
	416	// Code coverage instrumentation might try to use thread local variables.
	417	@disableInstrumentation();
414	418	const argc = argc_argv_ptr[0];
415	419	const argv = @as([][:0]u8, @ptrCast(argc_argv_ptr + 1));
416	420
...	...	@@ -453,9 +457,9 @@ fn posixCallMainAndExit(argc_argv_ptr: [*]usize) callconv(.C) noreturn {
453	457	if (comptime native_arch.isARM()) {
454	458	if (at_hwcap & std.os.linux.HWCAP.TLS == 0) {
455	459	// FIXME: Make __aeabi_read_tp call the kernel helper kuser_get_tls
456		// For the time being use a simple abort instead of a @panic call to
	460	// For the time being use a simple trap instead of a @panic call to
457	461	// keep the binary bloat under control.
458		std.posix.abort();
	462	@trap();
459	463	}
460	464	}
461	465

lib/std/zig/AstGen.zig+8-6

...	...	@@ -2817,6 +2817,7 @@ fn addEnsureResult(gz: *GenZir, maybe_unused_result: Zir.Inst.Ref, statement: As
2817	2817
2818	2818	.extended => switch (gz.astgen.instructions.items(.data)[@intFromEnum(inst)].extended.opcode) {
2819	2819	.breakpoint,
	2820	.disable_instrumentation,
2820	2821	.fence,
2821	2822	.set_float_mode,
2822	2823	.set_align_stack,
...	...	@@ -9305,12 +9306,13 @@ fn builtinCall(
9305	9306	},
9306	9307
9307	9308	// zig fmt: off
9308		.This => return rvalue(gz, ri, try gz.addNodeExtended(.this, node), node),
9309		.return_address => return rvalue(gz, ri, try gz.addNodeExtended(.ret_addr, node), node),
9310		.error_return_trace => return rvalue(gz, ri, try gz.addNodeExtended(.error_return_trace, node), node),
9311		.frame => return rvalue(gz, ri, try gz.addNodeExtended(.frame, node), node),
9312		.frame_address => return rvalue(gz, ri, try gz.addNodeExtended(.frame_address, node), node),
9313		.breakpoint => return rvalue(gz, ri, try gz.addNodeExtended(.breakpoint, node), node),
	9309	.This => return rvalue(gz, ri, try gz.addNodeExtended(.this, node), node),
	9310	.return_address => return rvalue(gz, ri, try gz.addNodeExtended(.ret_addr, node), node),
	9311	.error_return_trace => return rvalue(gz, ri, try gz.addNodeExtended(.error_return_trace, node), node),
	9312	.frame => return rvalue(gz, ri, try gz.addNodeExtended(.frame, node), node),
	9313	.frame_address => return rvalue(gz, ri, try gz.addNodeExtended(.frame_address, node), node),
	9314	.breakpoint => return rvalue(gz, ri, try gz.addNodeExtended(.breakpoint, node), node),
	9315	.disable_instrumentation => return rvalue(gz, ri, try gz.addNodeExtended(.disable_instrumentation, node), node),
9314	9316
9315	9317	.type_info => return simpleUnOpType(gz, scope, ri, node, params[0], .type_info),
9316	9318	.size_of => return simpleUnOpType(gz, scope, ri, node, params[0], .size_of),

lib/std/zig/AstRlAnnotate.zig+1

...	...	@@ -877,6 +877,7 @@ fn builtinCall(astrl: AstRlAnnotate, block: ?Block, ri: ResultInfo, node: Ast.
877	877	.error_return_trace,
878	878	.frame,
879	879	.breakpoint,
	880	.disable_instrumentation,
880	881	.in_comptime,
881	882	.panic,
882	883	.trap,

lib/std/zig/BuiltinFn.zig+9

...	...	@@ -15,6 +15,7 @@ pub const Tag = enum {
15	15	int_from_bool,
16	16	bit_size_of,
17	17	breakpoint,
	18	disable_instrumentation,
18	19	mul_add,
19	20	byte_swap,
20	21	bit_reverse,
...	...	@@ -263,6 +264,14 @@ pub const list = list: {
263	264	.illegal_outside_function = true,
264	265	},
265	266	},
	267	.{
	268	"@disableInstrumentation",
	269	.{
	270	.tag = .disable_instrumentation,
	271	.param_count = 0,
	272	.illegal_outside_function = true,
	273	},
	274	},
266	275	.{
267	276	"@mulAdd",
268	277	.{

lib/std/zig/Zir.zig+3-1

...	...	@@ -1553,7 +1553,7 @@ pub const Inst = struct {
1553	1553	=> false,
1554	1554
1555	1555	.extended => switch (data.extended.opcode) {
1556		.fence, .set_cold, .breakpoint => true,
	1556	.fence, .set_cold, .breakpoint, .disable_instrumentation => true,
1557	1557	else => false,
1558	1558	},
1559	1559	};
...	...	@@ -1973,6 +1973,8 @@ pub const Inst = struct {
1973	1973	/// Implements `@breakpoint`.
1974	1974	/// `operand` is `src_node: i32`.
1975	1975	breakpoint,
	1976	/// Implement builtin `@disableInstrumentation`. `operand` is `src_node: i32`.
	1977	disable_instrumentation,
1976	1978	/// Implements the `@select` builtin.
1977	1979	/// `operand` is payload index to `Select`.
1978	1980	select,

src/Builtin.zig+3

...	...	@@ -10,6 +10,7 @@ optimize_mode: std.builtin.OptimizeMode,
10	10	error_tracing: bool,
11	11	valgrind: bool,
12	12	sanitize_thread: bool,
	13	fuzz: bool,
13	14	pic: bool,
14	15	pie: bool,
15	16	strip: bool,
...	...	@@ -185,6 +186,7 @@ pub fn append(opts: @This(), buffer: *std.ArrayList(u8)) Allocator.Error!void {
185	186	\\pub const have_error_return_tracing = {};
186	187	\\pub const valgrind_support = {};
187	188	\\pub const sanitize_thread = {};
	189	\\pub const fuzz = {};
188	190	\\pub const position_independent_code = {};
189	191	\\pub const position_independent_executable = {};
190	192	\\pub const strip_debug_info = {};
...	...	@@ -199,6 +201,7 @@ pub fn append(opts: @This(), buffer: *std.ArrayList(u8)) Allocator.Error!void {
199	201	opts.error_tracing,
200	202	opts.valgrind,
201	203	opts.sanitize_thread,
	204	opts.fuzz,
202	205	opts.pic,
203	206	opts.pie,
204	207	opts.strip,

src/Compilation.zig+67-33

...	...	@@ -191,6 +191,7 @@ debug_compile_errors: bool,
191	191	incremental: bool,
192	192	job_queued_compiler_rt_lib: bool = false,
193	193	job_queued_compiler_rt_obj: bool = false,
	194	job_queued_fuzzer_lib: bool = false,
194	195	job_queued_update_builtin_zig: bool,
195	196	alloc_failure_occurred: bool = false,
196	197	formatted_panics: bool = false,
...	...	@@ -232,6 +233,10 @@ compiler_rt_lib: ?CRTFile = null,
232	233	/// Populated when we build the compiler_rt_obj object. A Job to build this is indicated
233	234	/// by setting `job_queued_compiler_rt_obj` and resolved before calling linker.flush().
234	235	compiler_rt_obj: ?CRTFile = null,
	236	/// Populated when we build the libfuzzer static library. A Job to build this
	237	/// is indicated by setting `job_queued_fuzzer_lib` and resolved before
	238	/// calling linker.flush().
	239	fuzzer_lib: ?CRTFile = null,
235	240
236	241	glibc_so_files: ?glibc.BuiltSharedObjects = null,
237	242	wasi_emulated_libs: []const wasi_libc.CRTFile,
...	...	@@ -800,6 +805,7 @@ pub const MiscTask = enum {
800	805	libcxx,
801	806	libcxxabi,
802	807	libtsan,
	808	libfuzzer,
803	809	wasi_libc_crt_file,
804	810	compiler_rt,
805	811	zig_libc,
...	...	@@ -888,6 +894,7 @@ pub const cache_helpers = struct {
888	894	hh.add(mod.red_zone);
889	895	hh.add(mod.sanitize_c);
890	896	hh.add(mod.sanitize_thread);
	897	hh.add(mod.fuzz);
891	898	hh.add(mod.unwind_tables);
892	899	hh.add(mod.structured_cfg);
893	900	hh.addListOfBytes(mod.cc_argv);
...	...	@@ -1303,6 +1310,7 @@ pub fn create(gpa: Allocator, arena: Allocator, options: CreateOptions) !*Compil
1303	1310	const any_unwind_tables = options.config.any_unwind_tables or options.root_mod.unwind_tables;
1304	1311	const any_non_single_threaded = options.config.any_non_single_threaded or !options.root_mod.single_threaded;
1305	1312	const any_sanitize_thread = options.config.any_sanitize_thread or options.root_mod.sanitize_thread;
	1313	const any_fuzz = options.config.any_fuzz or options.root_mod.fuzz;
1306	1314
1307	1315	const link_eh_frame_hdr = options.link_eh_frame_hdr or any_unwind_tables;
1308	1316	const build_id = options.build_id orelse .none;
...	...	@@ -1564,6 +1572,7 @@ pub fn create(gpa: Allocator, arena: Allocator, options: CreateOptions) !*Compil
1564	1572	comp.config.any_unwind_tables = any_unwind_tables;
1565	1573	comp.config.any_non_single_threaded = any_non_single_threaded;
1566	1574	comp.config.any_sanitize_thread = any_sanitize_thread;
	1575	comp.config.any_fuzz = any_fuzz;
1567	1576
1568	1577	const lf_open_opts: link.File.OpenOptions = .{
1569	1578	.linker_script = options.linker_script,
...	...	@@ -1909,6 +1918,13 @@ pub fn create(gpa: Allocator, arena: Allocator, options: CreateOptions) !*Compil
1909	1918	}
1910	1919	}
1911	1920
	1921	if (comp.config.any_fuzz and capable_of_building_compiler_rt) {
	1922	if (is_exe_or_dyn_lib) {
	1923	log.debug("queuing a job to build libfuzzer", .{});
	1924	comp.job_queued_fuzzer_lib = true;
	1925	}
	1926	}
	1927
1912	1928	if (!comp.skip_linker_dependencies and is_exe_or_dyn_lib and
1913	1929	!comp.config.link_libc and capable_of_building_zig_libc)
1914	1930	{
...	...	@@ -1957,6 +1973,9 @@ pub fn destroy(comp: *Compilation) void {
1957	1973	if (comp.compiler_rt_obj) \|*crt_file\| {
1958	1974	crt_file.deinit(gpa);
1959	1975	}
	1976	if (comp.fuzzer_lib) \|*crt_file\| {
	1977	crt_file.deinit(gpa);
	1978	}
1960	1979	if (comp.libc_static_lib) \|*crt_file\| {
1961	1980	crt_file.deinit(gpa);
1962	1981	}
...	...	@@ -2722,6 +2741,7 @@ pub fn emitLlvmObject(
2722	2741	.is_small = comp.root_mod.optimize_mode == .ReleaseSmall,
2723	2742	.time_report = comp.time_report,
2724	2743	.sanitize_thread = comp.config.any_sanitize_thread,
	2744	.fuzz = comp.config.any_fuzz,
2725	2745	.lto = comp.config.lto,
2726	2746	});
2727	2747	}
...	...	@@ -3641,15 +3661,9 @@ fn performAllTheWorkInner(
3641	3661	break;
3642	3662	}
3643	3663
3644		if (comp.job_queued_compiler_rt_lib) {
3645		comp.job_queued_compiler_rt_lib = false;
3646		buildCompilerRtOneShot(comp, .Lib, &comp.compiler_rt_lib, main_progress_node);
3647		}
3648
3649		if (comp.job_queued_compiler_rt_obj) {
3650		comp.job_queued_compiler_rt_obj = false;
3651		buildCompilerRtOneShot(comp, .Obj, &comp.compiler_rt_obj, main_progress_node);
3652		}
	3664	buildCompilerRtOneShot(comp, &comp.job_queued_compiler_rt_lib, "compiler_rt.zig", .compiler_rt, .Lib, &comp.compiler_rt_lib, main_progress_node);
	3665	buildCompilerRtOneShot(comp, &comp.job_queued_compiler_rt_obj, "compiler_rt.zig", .compiler_rt, .Obj, &comp.compiler_rt_obj, main_progress_node);
	3666	buildCompilerRtOneShot(comp, &comp.job_queued_fuzzer_lib, "fuzzer.zig", .libfuzzer, .Lib, &comp.fuzzer_lib, main_progress_node);
3653	3667	}
3654	3668
3655	3669	const JobError = Allocator.Error;
...	...	@@ -4655,23 +4669,27 @@ fn workerUpdateWin32Resource(
4655	4669
4656	4670	fn buildCompilerRtOneShot(
4657	4671	comp: *Compilation,
	4672	job_queued: *bool,
	4673	root_source_name: []const u8,
	4674	misc_task: MiscTask,
4658	4675	output_mode: std.builtin.OutputMode,
4659	4676	out: *?CRTFile,
4660	4677	prog_node: std.Progress.Node,
4661	4678	) void {
	4679	if (!job_queued.*) return;
	4680	job_queued.* = false;
	4681
4662	4682	comp.buildOutputFromZig(
4663		"compiler_rt.zig",
	4683	root_source_name,
4664	4684	output_mode,
4665	4685	out,
4666		.compiler_rt,
	4686	misc_task,
4667	4687	prog_node,
4668	4688	) catch \|err\| switch (err) {
4669	4689	error.SubCompilationFailed => return, // error reported already
4670		else => comp.lockAndSetMiscFailure(
4671		.compiler_rt,
4672		"unable to build compiler_rt: {s}",
4673		.{@errorName(err)},
4674		),
	4690	else => comp.lockAndSetMiscFailure(misc_task, "unable to build {s}: {s}", .{
	4691	@tagName(misc_task), @errorName(err),
	4692	}),
4675	4693	};
4676	4694	}
4677	4695
...	...	@@ -5602,23 +5620,39 @@ pub fn addCCArgs(
5602	5620	try argv.append("-mthumb");
5603	5621	}
5604	5622
5605		if (mod.sanitize_c and !mod.sanitize_thread) {
5606		try argv.append("-fsanitize=undefined");
5607		try argv.append("-fsanitize-trap=undefined");
5608		// It is very common, and well-defined, for a pointer on one side of a C ABI
5609		// to have a different but compatible element type. Examples include:
5610		// `char` vs `uint8_t` on a system with 8-bit bytes
5611		// `const char` vs `char`
5612		// `char` vs `unsigned char`
5613		// Without this flag, Clang would invoke UBSAN when such an extern
5614		// function was called.
5615		try argv.append("-fno-sanitize=function");
5616		} else if (mod.sanitize_c and mod.sanitize_thread) {
5617		try argv.append("-fsanitize=undefined,thread");
5618		try argv.append("-fsanitize-trap=undefined");
5619		try argv.append("-fno-sanitize=function");
5620		} else if (!mod.sanitize_c and mod.sanitize_thread) {
5621		try argv.append("-fsanitize=thread");
	5623	{
	5624	var san_arg: std.ArrayListUnmanaged(u8) = .{};
	5625	const prefix = "-fsanitize=";
	5626	if (mod.sanitize_c) {
	5627	if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix);
	5628	try san_arg.appendSlice(arena, "undefined,");
	5629	}
	5630	if (mod.sanitize_thread) {
	5631	if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix);
	5632	try san_arg.appendSlice(arena, "thread,");
	5633	}
	5634	if (mod.fuzz) {
	5635	if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix);
	5636	try san_arg.appendSlice(arena, "fuzzer-no-link,");
	5637	}
	5638	// Chop off the trailing comma and append to argv.
	5639	if (san_arg.popOrNull()) \|_\| {
	5640	try argv.append(san_arg.items);
	5641
	5642	// These args have to be added after the `-fsanitize` arg or
	5643	// they won't take effect.
	5644	if (mod.sanitize_c) {
	5645	try argv.append("-fsanitize-trap=undefined");
	5646	// It is very common, and well-defined, for a pointer on one side of a C ABI
	5647	// to have a different but compatible element type. Examples include:
	5648	// `char` vs `uint8_t` on a system with 8-bit bytes
	5649	// `const char` vs `char`
	5650	// `char` vs `unsigned char`
	5651	// Without this flag, Clang would invoke UBSAN when such an extern
	5652	// function was called.
	5653	try argv.append("-fno-sanitize=function");
	5654	}
	5655	}
5622	5656	}
5623	5657
5624	5658	if (mod.red_zone) {

src/Compilation/Config.zig+3

...	...	@@ -32,6 +32,7 @@ any_non_single_threaded: bool,
32	32	/// per-Module setting.
33	33	any_error_tracing: bool,
34	34	any_sanitize_thread: bool,
	35	any_fuzz: bool,
35	36	pie: bool,
36	37	/// If this is true then linker code is responsible for making an LLVM IR
37	38	/// Module, outputting it to an object file, and then linking that together
...	...	@@ -82,6 +83,7 @@ pub const Options = struct {
82	83	ensure_libcpp_on_non_freestanding: bool = false,
83	84	any_non_single_threaded: bool = false,
84	85	any_sanitize_thread: bool = false,
	86	any_fuzz: bool = false,
85	87	any_unwind_tables: bool = false,
86	88	any_dyn_libs: bool = false,
87	89	any_c_source_files: bool = false,
...	...	@@ -486,6 +488,7 @@ pub fn resolve(options: Options) ResolveError!Config {
486	488	.any_non_single_threaded = options.any_non_single_threaded,
487	489	.any_error_tracing = any_error_tracing,
488	490	.any_sanitize_thread = options.any_sanitize_thread,
	491	.any_fuzz = options.any_fuzz,
489	492	.root_error_tracing = root_error_tracing,
490	493	.pie = pie,
491	494	.lto = lto,

src/InternPool.zig+18-2

...	...	@@ -5184,11 +5184,11 @@ pub const FuncAnalysis = packed struct(u32) {
5184	5184	is_noinline: bool,
5185	5185	calls_or_awaits_errorable_fn: bool,
5186	5186	stack_alignment: Alignment,
5187
5188	5187	/// True if this function has an inferred error set.
5189	5188	inferred_error_set: bool,
	5189	disable_instrumentation: bool,
5190	5190
5191		_: u14 = 0,
	5191	_: u13 = 0,
5192	5192
5193	5193	pub const State = enum(u8) {
5194	5194	/// This function has not yet undergone analysis, because we have not
...	...	@@ -8111,6 +8111,7 @@ pub fn getFuncDecl(
8111	8111	.calls_or_awaits_errorable_fn = false,
8112	8112	.stack_alignment = .none,
8113	8113	.inferred_error_set = false,
	8114	.disable_instrumentation = false,
8114	8115	},
8115	8116	.owner_decl = key.owner_decl,
8116	8117	.ty = key.ty,
...	...	@@ -8214,6 +8215,7 @@ pub fn getFuncDeclIes(
8214	8215	.calls_or_awaits_errorable_fn = false,
8215	8216	.stack_alignment = .none,
8216	8217	.inferred_error_set = true,
	8218	.disable_instrumentation = false,
8217	8219	},
8218	8220	.owner_decl = key.owner_decl,
8219	8221	.ty = func_ty,
...	...	@@ -8405,6 +8407,7 @@ pub fn getFuncInstance(
8405	8407	.calls_or_awaits_errorable_fn = false,
8406	8408	.stack_alignment = .none,
8407	8409	.inferred_error_set = false,
	8410	.disable_instrumentation = false,
8408	8411	},
8409	8412	// This is populated after we create the Decl below. It is not read
8410	8413	// by equality or hashing functions.
...	...	@@ -8504,6 +8507,7 @@ pub fn getFuncInstanceIes(
8504	8507	.calls_or_awaits_errorable_fn = false,
8505	8508	.stack_alignment = .none,
8506	8509	.inferred_error_set = true,
	8510	.disable_instrumentation = false,
8507	8511	},
8508	8512	// This is populated after we create the Decl below. It is not read
8509	8513	// by equality or hashing functions.
...	...	@@ -11225,6 +11229,18 @@ pub fn funcSetCallsOrAwaitsErrorableFn(ip: *InternPool, func: Index) void {
11225	11229	@atomicStore(FuncAnalysis, analysis_ptr, analysis, .release);
11226	11230	}
11227	11231
	11232	pub fn funcSetDisableInstrumentation(ip: *InternPool, func: Index) void {
	11233	const unwrapped_func = func.unwrap(ip);
	11234	const extra_mutex = &ip.getLocal(unwrapped_func.tid).mutate.extra.mutex;
	11235	extra_mutex.lock();
	11236	defer extra_mutex.unlock();
	11237
	11238	const analysis_ptr = ip.funcAnalysisPtr(func);
	11239	var analysis = analysis_ptr.*;
	11240	analysis.disable_instrumentation = true;
	11241	@atomicStore(FuncAnalysis, analysis_ptr, analysis, .release);
	11242	}
	11243
11228	11244	pub fn funcSetCold(ip: *InternPool, func: Index, is_cold: bool) void {
11229	11245	const unwrapped_func = func.unwrap(ip);
11230	11246	const extra_mutex = &ip.getLocal(unwrapped_func.tid).mutate.extra.mutex;

src/Package/Module.zig+13

...	...	@@ -26,6 +26,7 @@ stack_protector: u32,
26	26	red_zone: bool,
27	27	sanitize_c: bool,
28	28	sanitize_thread: bool,
	29	fuzz: bool,
29	30	unwind_tables: bool,
30	31	cc_argv: []const []const u8,
31	32	/// (SPIR-V) whether to generate a structured control flow graph or not
...	...	@@ -92,6 +93,7 @@ pub const CreateOptions = struct {
92	93	unwind_tables: ?bool = null,
93	94	sanitize_c: ?bool = null,
94	95	sanitize_thread: ?bool = null,
	96	fuzz: ?bool = null,
95	97	structured_cfg: ?bool = null,
96	98	};
97	99	};
...	...	@@ -106,6 +108,7 @@ pub const ResolvedTarget = struct {
106	108	/// At least one of `parent` and `resolved_target` must be non-null.
107	109	pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
108	110	if (options.inherited.sanitize_thread == true) assert(options.global.any_sanitize_thread);
	111	if (options.inherited.fuzz == true) assert(options.global.any_fuzz);
109	112	if (options.inherited.single_threaded == false) assert(options.global.any_non_single_threaded);
110	113	if (options.inherited.unwind_tables == true) assert(options.global.any_unwind_tables);
111	114	if (options.inherited.error_tracing == true) assert(options.global.any_error_tracing);
...	...	@@ -210,6 +213,12 @@ pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
210	213	break :b false;
211	214	};
212	215
	216	const fuzz = b: {
	217	if (options.inherited.fuzz) \|x\| break :b x;
	218	if (options.parent) \|p\| break :b p.fuzz;
	219	break :b false;
	220	};
	221
213	222	const code_model = b: {
214	223	if (options.inherited.code_model) \|x\| break :b x;
215	224	if (options.parent) \|p\| break :b p.code_model;
...	...	@@ -337,6 +346,7 @@ pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
337	346	.red_zone = red_zone,
338	347	.sanitize_c = sanitize_c,
339	348	.sanitize_thread = sanitize_thread,
	349	.fuzz = fuzz,
340	350	.unwind_tables = unwind_tables,
341	351	.cc_argv = options.cc_argv,
342	352	.structured_cfg = structured_cfg,
...	...	@@ -359,6 +369,7 @@ pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
359	369	.error_tracing = error_tracing,
360	370	.valgrind = valgrind,
361	371	.sanitize_thread = sanitize_thread,
	372	.fuzz = fuzz,
362	373	.pic = pic,
363	374	.pie = options.global.pie,
364	375	.strip = strip,
...	...	@@ -427,6 +438,7 @@ pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
427	438	.red_zone = red_zone,
428	439	.sanitize_c = sanitize_c,
429	440	.sanitize_thread = sanitize_thread,
	441	.fuzz = fuzz,
430	442	.unwind_tables = unwind_tables,
431	443	.cc_argv = &.{},
432	444	.structured_cfg = structured_cfg,
...	...	@@ -485,6 +497,7 @@ pub fn createLimited(gpa: Allocator, options: LimitedOptions) Allocator.Error!*P
485	497	.red_zone = undefined,
486	498	.sanitize_c = undefined,
487	499	.sanitize_thread = undefined,
	500	.fuzz = undefined,
488	501	.unwind_tables = undefined,
489	502	.cc_argv = undefined,
490	503	.structured_cfg = undefined,

src/Sema.zig+13

...	...	@@ -1316,6 +1316,11 @@ fn analyzeBodyInner(
1316	1316	i += 1;
1317	1317	continue;
1318	1318	},
	1319	.disable_instrumentation => {
	1320	try sema.zirDisableInstrumentation();
	1321	i += 1;
	1322	continue;
	1323	},
1319	1324	.restore_err_ret_index => {
1320	1325	try sema.zirRestoreErrRetIndex(block, extended);
1321	1326	i += 1;
...	...	@@ -6576,6 +6581,14 @@ fn zirSetCold(sema: Sema, block: Block, extended: Zir.Inst.Extended.InstData)
6576	6581	ip.funcSetCold(sema.func_index, is_cold);
6577	6582	}
6578	6583
	6584	fn zirDisableInstrumentation(sema: *Sema) CompileError!void {
	6585	const pt = sema.pt;
	6586	const mod = pt.zcu;
	6587	const ip = &mod.intern_pool;
	6588	if (sema.func_index == .none) return; // does nothing outside a function
	6589	ip.funcSetDisableInstrumentation(sema.func_index);
	6590	}
	6591
6579	6592	fn zirSetFloatMode(sema: Sema, block: Block, extended: Zir.Inst.Extended.InstData) CompileError!void {
6580	6593	const extra = sema.code.extraData(Zir.Inst.UnNode, extended.operand).data;
6581	6594	const src = block.builtinCallArgSrc(extra.node, 0);

src/codegen/llvm.zig+22-3

...	...	@@ -1101,6 +1101,7 @@ pub const Object = struct {
1101	1101	is_small: bool,
1102	1102	time_report: bool,
1103	1103	sanitize_thread: bool,
	1104	fuzz: bool,
1104	1105	lto: bool,
1105	1106	};
1106	1107
...	...	@@ -1287,6 +1288,7 @@ pub const Object = struct {
1287	1288	options.is_small,
1288	1289	options.time_report,
1289	1290	options.sanitize_thread,
	1291	options.fuzz,
1290	1292	options.lto,
1291	1293	null,
1292	1294	emit_bin_path,
...	...	@@ -1311,6 +1313,7 @@ pub const Object = struct {
1311	1313	options.is_small,
1312	1314	options.time_report,
1313	1315	options.sanitize_thread,
	1316	options.fuzz,
1314	1317	options.lto,
1315	1318	options.asm_path,
1316	1319	emit_bin_path,
...	...	@@ -1380,6 +1383,25 @@ pub const Object = struct {
1380	1383	_ = try attributes.removeFnAttr(.cold);
1381	1384	}
1382	1385
	1386	if (owner_mod.sanitize_thread and !func_analysis.disable_instrumentation) {
	1387	try attributes.addFnAttr(.sanitize_thread, &o.builder);
	1388	} else {
	1389	_ = try attributes.removeFnAttr(.sanitize_thread);
	1390	}
	1391	if (owner_mod.fuzz and !func_analysis.disable_instrumentation) {
	1392	try attributes.addFnAttr(.optforfuzzing, &o.builder);
	1393	if (comp.config.any_fuzz) {
	1394	_ = try attributes.removeFnAttr(.skipprofile);
	1395	_ = try attributes.removeFnAttr(.nosanitize_coverage);
	1396	}
	1397	} else {
	1398	_ = try attributes.removeFnAttr(.optforfuzzing);
	1399	if (comp.config.any_fuzz) {
	1400	try attributes.addFnAttr(.skipprofile, &o.builder);
	1401	try attributes.addFnAttr(.nosanitize_coverage, &o.builder);
	1402	}
	1403	}
	1404
1383	1405	// TODO: disable this if safety is off for the function scope
1384	1406	const ssp_buf_size = owner_mod.stack_protector;
1385	1407	if (ssp_buf_size != 0) {
...	...	@@ -2979,9 +3001,6 @@ pub const Object = struct {
2979	3001	try attributes.addFnAttr(.minsize, &o.builder);
2980	3002	try attributes.addFnAttr(.optsize, &o.builder);
2981	3003	}
2982		if (owner_mod.sanitize_thread) {
2983		try attributes.addFnAttr(.sanitize_thread, &o.builder);
2984		}
2985	3004	const target = owner_mod.resolved_target.result;
2986	3005	if (target.cpu.model.llvm_name) \|s\| {
2987	3006	try attributes.addFnAttr(.{ .string = .{

src/codegen/llvm/bindings.zig+1

...	...	@@ -93,6 +93,7 @@ pub const TargetMachine = opaque {
93	93	is_small: bool,
94	94	time_report: bool,
95	95	tsan: bool,
	96	sancov: bool,
96	97	lto: bool,
97	98	asm_filename: ?[*:0]const u8,
98	99	bin_filename: ?[*:0]const u8,

src/link/Coff/lld.zig+4

...	...	@@ -460,6 +460,10 @@ pub fn linkWithLLD(self: *Coff, arena: Allocator, tid: Zcu.PerThread.Id, prog_no
460	460	try argv.append(comp.libunwind_static_lib.?.full_object_path);
461	461	}
462	462
	463	if (comp.config.any_fuzz) {
	464	try argv.append(comp.fuzzer_lib.?.full_object_path);
	465	}
	466
463	467	if (is_exe_or_dyn_lib and !comp.skip_linker_dependencies) {
464	468	if (!comp.config.link_libc) {
465	469	if (comp.libc_static_lib) \|lib\| {

src/link/Elf.zig+13-1

...	...	@@ -1144,11 +1144,14 @@ pub fn flushModule(self: *Elf, arena: Allocator, tid: Zcu.PerThread.Id, prog_nod
1144	1144	_ = try rpath_table.put(rpath, {});
1145	1145	}
1146	1146
1147		// TSAN
1148	1147	if (comp.config.any_sanitize_thread) {
1149	1148	try positionals.append(.{ .path = comp.tsan_lib.?.full_object_path });
1150	1149	}
1151	1150
	1151	if (comp.config.any_fuzz) {
	1152	try positionals.append(.{ .path = comp.fuzzer_lib.?.full_object_path });
	1153	}
	1154
1152	1155	// libc
1153	1156	if (!comp.skip_linker_dependencies and !comp.config.link_libc) {
1154	1157	if (comp.libc_static_lib) \|lib\| {
...	...	@@ -1607,6 +1610,10 @@ fn dumpArgv(self: Elf, comp: Compilation) !void {
1607	1610	try argv.append(comp.tsan_lib.?.full_object_path);
1608	1611	}
1609	1612
	1613	if (comp.config.any_fuzz) {
	1614	try argv.append(comp.fuzzer_lib.?.full_object_path);
	1615	}
	1616
1610	1617	// libc
1611	1618	if (!comp.skip_linker_dependencies and !comp.config.link_libc) {
1612	1619	if (comp.libc_static_lib) \|lib\| {
...	...	@@ -2272,6 +2279,7 @@ fn linkWithLLD(self: *Elf, arena: Allocator, tid: Zcu.PerThread.Id, prog_node: s
2272	2279	man.hash.add(self.bind_global_refs_locally);
2273	2280	man.hash.add(self.compress_debug_sections);
2274	2281	man.hash.add(comp.config.any_sanitize_thread);
	2282	man.hash.add(comp.config.any_fuzz);
2275	2283	man.hash.addOptionalBytes(comp.sysroot);
2276	2284
2277	2285	// We don't actually care whether it's a cache hit or miss; we just need the digest and the lock.
...	...	@@ -2616,6 +2624,10 @@ fn linkWithLLD(self: *Elf, arena: Allocator, tid: Zcu.PerThread.Id, prog_node: s
2616	2624	try argv.append(comp.tsan_lib.?.full_object_path);
2617	2625	}
2618	2626
	2627	if (comp.config.any_fuzz) {
	2628	try argv.append(comp.fuzzer_lib.?.full_object_path);
	2629	}
	2630
2619	2631	// libc
2620	2632	if (is_exe_or_dyn_lib and
2621	2633	!comp.skip_linker_dependencies and

src/link/MachO.zig+8-1

...	...	@@ -387,11 +387,14 @@ pub fn flushModule(self: *MachO, arena: Allocator, tid: Zcu.PerThread.Id, prog_n
387	387
388	388	if (module_obj_path) \|path\| try positionals.append(.{ .path = path });
389	389
390		// TSAN
391	390	if (comp.config.any_sanitize_thread) {
392	391	try positionals.append(.{ .path = comp.tsan_lib.?.full_object_path });
393	392	}
394	393
	394	if (comp.config.any_fuzz) {
	395	try positionals.append(.{ .path = comp.fuzzer_lib.?.full_object_path });
	396	}
	397
395	398	for (positionals.items) \|obj\| {
396	399	self.classifyInputFile(obj.path, .{ .path = obj.path }, obj.must_link) catch \|err\| switch (err) {
397	400	error.UnknownFileType => try self.reportParseError(obj.path, "unknown file type for an input file", .{}),
...	...	@@ -725,6 +728,10 @@ fn dumpArgv(self: MachO, comp: Compilation) !void {
725	728	try argv.appendSlice(&.{ "-rpath", std.fs.path.dirname(path) orelse "." });
726	729	}
727	730
	731	if (comp.config.any_fuzz) {
	732	try argv.append(comp.fuzzer_lib.?.full_object_path);
	733	}
	734
728	735	for (self.lib_dirs) \|lib_dir\| {
729	736	const arg = try std.fmt.allocPrint(arena, "-L{s}", .{lib_dir});
730	737	try argv.append(arg);

src/main.zig+27-7

...	...	@@ -502,12 +502,14 @@ const usage_build_generic =
502	502	\\ -fno-stack-check Disable stack probing in safe builds
503	503	\\ -fstack-protector Enable stack protection in unsafe builds
504	504	\\ -fno-stack-protector Disable stack protection in safe builds
505		\\ -fsanitize-c Enable C undefined behavior detection in unsafe builds
506		\\ -fno-sanitize-c Disable C undefined behavior detection in safe builds
507	505	\\ -fvalgrind Include valgrind client requests in release builds
508	506	\\ -fno-valgrind Omit valgrind client requests in debug builds
	507	\\ -fsanitize-c Enable C undefined behavior detection in unsafe builds
	508	\\ -fno-sanitize-c Disable C undefined behavior detection in safe builds
509	509	\\ -fsanitize-thread Enable Thread Sanitizer
510	510	\\ -fno-sanitize-thread Disable Thread Sanitizer
	511	\\ -ffuzz Enable fuzz testing instrumentation
	512	\\ -fno-fuzz Disable fuzz testing instrumentation
511	513	\\ -funwind-tables Always produce unwind table entries for all functions
512	514	\\ -fno-unwind-tables Never produce unwind table entries
513	515	\\ -ferror-tracing Enable error tracing in ReleaseFast mode
...	...	@@ -1432,6 +1434,10 @@ fn buildOutputType(
1432	1434	mod_opts.sanitize_thread = true;
1433	1435	} else if (mem.eql(u8, arg, "-fno-sanitize-thread")) {
1434	1436	mod_opts.sanitize_thread = false;
	1437	} else if (mem.eql(u8, arg, "-ffuzz")) {
	1438	mod_opts.fuzz = true;
	1439	} else if (mem.eql(u8, arg, "-fno-fuzz")) {
	1440	mod_opts.fuzz = false;
1435	1441	} else if (mem.eql(u8, arg, "-fllvm")) {
1436	1442	create_module.opts.use_llvm = true;
1437	1443	} else if (mem.eql(u8, arg, "-fno-llvm")) {
...	...	@@ -2063,11 +2069,21 @@ fn buildOutputType(
2063	2069	create_module.opts.debug_format = .{ .dwarf = .@"64" };
2064	2070	},
2065	2071	.sanitize => {
2066		if (mem.eql(u8, it.only_arg, "undefined")) {
2067		mod_opts.sanitize_c = true;
2068		} else if (mem.eql(u8, it.only_arg, "thread")) {
2069		mod_opts.sanitize_thread = true;
2070		} else {
	2072	var san_it = std.mem.splitScalar(u8, it.only_arg, ',');
	2073	var recognized_any = false;
	2074	while (san_it.next()) \|sub_arg\| {
	2075	if (mem.eql(u8, sub_arg, "undefined")) {
	2076	mod_opts.sanitize_c = true;
	2077	recognized_any = true;
	2078	} else if (mem.eql(u8, sub_arg, "thread")) {
	2079	mod_opts.sanitize_thread = true;
	2080	recognized_any = true;
	2081	} else if (mem.eql(u8, sub_arg, "fuzzer") or mem.eql(u8, sub_arg, "fuzzer-no-link")) {
	2082	mod_opts.fuzz = true;
	2083	recognized_any = true;
	2084	}
	2085	}
	2086	if (!recognized_any) {
2071	2087	try cc_argv.appendSlice(arena, it.other_args);
2072	2088	}
2073	2089	},
...	...	@@ -2645,6 +2661,8 @@ fn buildOutputType(
2645	2661	create_module.opts.any_non_single_threaded = true;
2646	2662	if (mod_opts.sanitize_thread == true)
2647	2663	create_module.opts.any_sanitize_thread = true;
	2664	if (mod_opts.fuzz == true)
	2665	create_module.opts.any_fuzz = true;
2648	2666	if (mod_opts.unwind_tables == true)
2649	2667	create_module.opts.any_unwind_tables = true;
2650	2668	if (mod_opts.strip == false)
...	...	@@ -7494,6 +7512,8 @@ fn handleModArg(
7494	7512	create_module.opts.any_non_single_threaded = true;
7495	7513	if (mod_opts.sanitize_thread == true)
7496	7514	create_module.opts.any_sanitize_thread = true;
	7515	if (mod_opts.fuzz == true)
	7516	create_module.opts.any_fuzz = true;
7497	7517	if (mod_opts.unwind_tables == true)
7498	7518	create_module.opts.any_unwind_tables = true;
7499	7519	if (mod_opts.strip == false)

src/print_zir.zig+1

...	...	@@ -524,6 +524,7 @@ const Writer = struct {
524	524	.frame,
525	525	.frame_address,
526	526	.breakpoint,
	527	.disable_instrumentation,
527	528	.c_va_start,
528	529	.in_comptime,
529	530	.value_placeholder,

src/zig_llvm.cpp+52-30

...	...	@@ -54,6 +54,7 @@
54	54	#include <llvm/Transforms/IPO.h>
55	55	#include <llvm/Transforms/IPO/AlwaysInliner.h>
56	56	#include <llvm/Transforms/Instrumentation/ThreadSanitizer.h>
	57	#include <llvm/Transforms/Instrumentation/SanitizerCoverage.h>
57	58	#include <llvm/Transforms/Scalar.h>
58	59	#include <llvm/Transforms/Utils.h>
59	60	#include <llvm/Transforms/Utils/AddDiscriminators.h>
...	...	@@ -188,9 +189,31 @@ struct TimeTracerRAII {
188	189	};
189	190	} // end anonymous namespace
190	191
	192	static SanitizerCoverageOptions getSanCovOptions(void) {
	193	SanitizerCoverageOptions o;
	194	o.CoverageType = SanitizerCoverageOptions::SCK_Edge;
	195	o.IndirectCalls = true;
	196	o.TraceBB = false;
	197	o.TraceCmp = true;
	198	o.TraceDiv = false;
	199	o.TraceGep = false;
	200	o.Use8bitCounters = false;
	201	o.TracePC = false;
	202	o.TracePCGuard = false;
	203	o.Inline8bitCounters = true;
	204	o.InlineBoolFlag = false;
	205	o.PCTable = true;
	206	o.NoPrune = false;
	207	o.StackDepth = true;
	208	o.TraceLoads = false;
	209	o.TraceStores = false;
	210	o.CollectControlFlow = false;
	211	return o;
	212	}
	213
191	214	bool ZigLLVMTargetMachineEmitToFile(LLVMTargetMachineRef targ_machine_ref, LLVMModuleRef module_ref,
192	215	char **error_message, bool is_debug,
193		bool is_small, bool time_report, bool tsan, bool lto,
	216	bool is_small, bool time_report, bool tsan, bool sancov, bool lto,
194	217	const char asm_filename, const char bin_filename,
195	218	const char llvm_ir_filename, const char bitcode_filename)
196	219	{
...	...	@@ -277,39 +300,38 @@ bool ZigLLVMTargetMachineEmitToFile(LLVMTargetMachineRef targ_machine_ref, LLVMM
277	300	pass_builder.registerCGSCCAnalyses(cgscc_am);
278	301	pass_builder.registerFunctionAnalyses(function_am);
279	302	pass_builder.registerLoopAnalyses(loop_am);
280		pass_builder.crossRegisterProxies(loop_am, function_am,
281		cgscc_am, module_am);
282
283		// IR verification
284		if (assertions_on) {
285		// Verify the input
286		pass_builder.registerPipelineStartEPCallback(
287		[](ModulePassManager &module_pm, OptimizationLevel OL) {
288		module_pm.addPass(VerifierPass());
289		});
290		// Verify the output
291		pass_builder.registerOptimizerLastEPCallback(
292		[](ModulePassManager &module_pm, OptimizationLevel OL) {
293		module_pm.addPass(VerifierPass());
294		});
295		}
	303	pass_builder.crossRegisterProxies(loop_am, function_am, cgscc_am, module_am);
296	304
297		// Passes specific for release build
298		if (!is_debug) {
299		pass_builder.registerPipelineStartEPCallback(
300		[](ModulePassManager &module_pm, OptimizationLevel OL) {
301		module_pm.addPass(
302		createModuleToFunctionPassAdaptor(AddDiscriminatorsPass()));
303		});
304		}
	305	pass_builder.registerPipelineStartEPCallback([&](ModulePassManager &module_pm, OptimizationLevel OL) {
	306	// Verify the input
	307	if (assertions_on) {
	308	module_pm.addPass(VerifierPass());
	309	}
	310
	311	if (!is_debug) {
	312	module_pm.addPass(createModuleToFunctionPassAdaptor(AddDiscriminatorsPass()));
	313	}
	314	});
	315
	316	pass_builder.registerOptimizerEarlyEPCallback([&](ModulePassManager &module_pm, OptimizationLevel OL) {
	317	// Code coverage instrumentation.
	318	if (sancov) {
	319	module_pm.addPass(SanitizerCoveragePass(getSanCovOptions()));
	320	}
305	321
306		// Thread sanitizer
307		if (tsan) {
308		pass_builder.registerOptimizerLastEPCallback([](ModulePassManager &module_pm, OptimizationLevel level) {
	322	// Thread sanitizer
	323	if (tsan) {
309	324	module_pm.addPass(ModuleThreadSanitizerPass());
310	325	module_pm.addPass(createModuleToFunctionPassAdaptor(ThreadSanitizerPass()));
311		});
312		}
	326	}
	327	});
	328
	329	pass_builder.registerOptimizerLastEPCallback([&](ModulePassManager &module_pm, OptimizationLevel level) {
	330	// Verify the output
	331	if (assertions_on) {
	332	module_pm.addPass(VerifierPass());
	333	}
	334	});
313	335
314	336	ModulePassManager module_pm;
315	337	OptimizationLevel opt_level;

src/zig_llvm.h+1-1

...	...	@@ -26,7 +26,7 @@
26	26
27	27	ZIG_EXTERN_C bool ZigLLVMTargetMachineEmitToFile(LLVMTargetMachineRef targ_machine_ref, LLVMModuleRef module_ref,
28	28	char **error_message, bool is_debug,
29		bool is_small, bool time_report, bool tsan, bool lto,
	29	bool is_small, bool time_report, bool tsan, bool sancov, bool lto,
30	30	const char asm_filename, const char bin_filename,
31	31	const char llvm_ir_filename, const char bitcode_filename);
32	32

stage1/zig1.wasm

Binary files a/stage1/zig1.wasm and b/stage1/zig1.wasm differ

author	Andrew Kelley <andrew@ziglang.org> 2024-07-23 11:39:19-07:00
committer	GitHub <noreply@github.com> 2024-07-23 11:39:19-07:00
log	6f3e9939d0389539570d4a7cad95b1e96bc8f0d4
tree	abf951c8dc19393655df93f23a6911ce6fad660d
parent	255547d7a6a1acee9c9b65d251ec4935433b6878
parent	61ad1be6bd7d27f79773e7da891898449a45a80e
signature	Signed by PGP key B5690EEEBB952194

Merge pull request #20725 from ziglang/fuzz