authorgravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2024-08-28 14:36:28-07:00
committergravatar for andrew@ziglang.orgAndrew Kelley <andrew@ziglang.org> 2024-08-28 18:07:13-07:00
log88bba4c15463796c0b89a4d097366b11bdb7679c
tree7d2ce0cb17531525470f110fc6a5516ea1da65a3
parentb8d99a332395ec0a1b9ed1a8e18f0db8db131b3c

LLVM: enable sancov pass partially

It's useful to have TraceCmp based on the results of LLVM optimizations, while the code coverage bits were emitted by Zig manually, allowing more careful correlation to points of interest in the source code. This re-enables the sancov pass in `-ffuzz` mode, but only TraceCmp. Notably, IndirectCalls is off, which needs to be implemented manually in the LLVM backend, and StackDepth remains off, because it is not used by libfuzzer or AFL either. If stack depth is re-introduced, it can be done with better performance characteristics by being function call graph aware, and only lowered in call graph cycles, where its heuristic properties come in useful. Fixes the fuzzing regression.

1 files changed, 7 insertions(+), 6 deletions(-)

src/codegen/llvm.zig+7-6
...@@ -1275,7 +1275,7 @@ pub const Object = struct {...@@ -1275,7 +1275,7 @@ pub const Object = struct {
1275 .is_small = options.is_small,1275 .is_small = options.is_small,
1276 .time_report = options.time_report,1276 .time_report = options.time_report,
1277 .tsan = options.sanitize_thread,1277 .tsan = options.sanitize_thread,
1278 .sancov = sanCovPassEnabled(comp.config.san_cov_trace_pc_guard),1278 .sancov = options.fuzz,
1279 .lto = options.lto,1279 .lto = options.lto,
1280 .asm_filename = null,1280 .asm_filename = null,
1281 .bin_filename = options.bin_path,1281 .bin_filename = options.bin_path,
...@@ -1283,16 +1283,21 @@ pub const Object = struct {...@@ -1283,16 +1283,21 @@ pub const Object = struct {
1283 .bitcode_filename = null,1283 .bitcode_filename = null,
1284 .coverage = .{1284 .coverage = .{
1285 .CoverageType = .Edge,1285 .CoverageType = .Edge,
1286 // Works in tandem with Inline8bitCounters or InlineBoolFlag.
1287 // Zig does not yet implement its own version of this but it
1288 // needs to for better fuzzing logic.
1286 .IndirectCalls = false,1289 .IndirectCalls = false,
1287 .TraceBB = false,1290 .TraceBB = false,
1288 .TraceCmp = false,1291 .TraceCmp = true,
1289 .TraceDiv = false,1292 .TraceDiv = false,
1290 .TraceGep = false,1293 .TraceGep = false,
1291 .Use8bitCounters = false,1294 .Use8bitCounters = false,
1292 .TracePC = false,1295 .TracePC = false,
1293 .TracePCGuard = comp.config.san_cov_trace_pc_guard,1296 .TracePCGuard = comp.config.san_cov_trace_pc_guard,
1297 // Zig emits its own inline 8-bit counters instrumentation.
1294 .Inline8bitCounters = false,1298 .Inline8bitCounters = false,
1295 .InlineBoolFlag = false,1299 .InlineBoolFlag = false,
1300 // Zig emits its own PC table instrumentation.
1296 .PCTable = false,1301 .PCTable = false,
1297 .NoPrune = false,1302 .NoPrune = false,
1298 .StackDepth = false,1303 .StackDepth = false,
...@@ -12273,7 +12278,3 @@ pub fn initializeLLVMTarget(arch: std.Target.Cpu.Arch) void {...@@ -12273,7 +12278,3 @@ pub fn initializeLLVMTarget(arch: std.Target.Cpu.Arch) void {
12273 => unreachable,12278 => unreachable,
12274 }12279 }
12275}12280}
12276
12277fn sanCovPassEnabled(trace_pc_guard: bool) bool {
12278 return trace_pc_guard;
12279}