1 // Tests -fsanitize-coverage-allowlist=allowlist.txt and
2 // -fsanitize-coverage-ignorelist=ignorelist.txt with libFuzzer-like coverage
3 // options
4 
5 // REQUIRES: has_sancovcc,stable-runtime
6 // UNSUPPORTED: darwin
7 // XFAIL: ubsan,tsan
8 // XFAIL: android && asan
9 
10 // RUN: DIR=%t_workdir
11 // RUN: rm -rf $DIR
12 // RUN: mkdir -p $DIR
13 // RUN: cd $DIR
14 
15 // RUN: echo -e "src:*\nfun:*"     > al_all.txt
16 // RUN: echo -e ""                 > al_none.txt
17 // RUN: echo -e "src:%s\nfun:*"    > al_file.txt
18 // RUN: echo -e "src:*\nfun:*bar*" > al_bar.txt
19 // RUN: echo -e "src:*\nfun:*foo*" > al_foo.txt
20 // RUN: echo -e "src:*"            > bl_all.txt
21 // RUN: echo -e ""                 > bl_none.txt
22 // RUN: echo -e "src:%s"           > bl_file.txt
23 // RUN: echo -e "fun:*foo*"        > bl_foo.txt
24 // RUN: echo -e "fun:*bar*"        > bl_bar.txt
25 
26 // Check inline-8bit-counters
27 // RUN: echo 'section "__sancov_cntrs"'                                                                             >  patterns.txt
28 // RUN: echo '%[0-9]\+ = load i8, i8\* getelementptr inbounds (\[[0-9]\+ x i8\], \[[0-9]\+ x i8\]\* @__sancov_gen_' >> patterns.txt
29 // RUN: echo 'store i8 %[0-9]\+, i8\* getelementptr inbounds (\[[0-9]\+ x i8\], \[[0-9]\+ x i8\]\* @__sancov_gen_'  >> patterns.txt
30 
31 // Check indirect-calls
32 // RUN: echo 'call void @__sanitizer_cov_trace_pc_indir'                                                            >> patterns.txt
33 
34 // Check trace-cmp
35 // RUN: echo 'call void @__sanitizer_cov_trace_cmp4'                                                                >> patterns.txt
36 
37 // Check pc-table
38 // RUN: echo 'section "__sancov_pcs"'                                                                               >> patterns.txt
39 
40 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table                                                                                      2>&1 |     grep -f patterns.txt | count 14
41 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_all.txt                                             2>&1 |     grep -f patterns.txt | count 14
42 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_none.txt                                            2>&1 | not grep -f patterns.txt
43 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_file.txt                                            2>&1 |     grep -f patterns.txt | count 14
44 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_foo.txt                                             2>&1 |     grep -f patterns.txt | count 9
45 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_bar.txt                                             2>&1 |     grep -f patterns.txt | count 5
46 
47 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table                                           -fsanitize-coverage-ignorelist=bl_all.txt   2>&1 | not grep -f patterns.txt
48 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_all.txt  -fsanitize-coverage-ignorelist=bl_all.txt   2>&1 | not grep -f patterns.txt
49 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_none.txt -fsanitize-coverage-ignorelist=bl_all.txt   2>&1 | not grep -f patterns.txt
50 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_file.txt -fsanitize-coverage-ignorelist=bl_all.txt   2>&1 | not grep -f patterns.txt
51 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_foo.txt  -fsanitize-coverage-ignorelist=bl_all.txt   2>&1 | not grep -f patterns.txt
52 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_bar.txt  -fsanitize-coverage-ignorelist=bl_all.txt   2>&1 | not grep -f patterns.txt
53 
54 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table                                           -fsanitize-coverage-ignorelist=bl_none.txt  2>&1 |     grep -f patterns.txt | count 14
55 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_all.txt  -fsanitize-coverage-ignorelist=bl_none.txt  2>&1 |     grep -f patterns.txt | count 14
56 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_none.txt -fsanitize-coverage-ignorelist=bl_none.txt  2>&1 | not grep -f patterns.txt
57 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_file.txt -fsanitize-coverage-ignorelist=bl_none.txt  2>&1 |     grep -f patterns.txt | count 14
58 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_foo.txt  -fsanitize-coverage-ignorelist=bl_none.txt  2>&1 |     grep -f patterns.txt | count 9
59 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_bar.txt  -fsanitize-coverage-ignorelist=bl_none.txt  2>&1 |     grep -f patterns.txt | count 5
60 
61 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table                                           -fsanitize-coverage-ignorelist=bl_file.txt  2>&1 | not grep -f patterns.txt
62 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_all.txt  -fsanitize-coverage-ignorelist=bl_file.txt  2>&1 | not grep -f patterns.txt
63 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_none.txt -fsanitize-coverage-ignorelist=bl_file.txt  2>&1 | not grep -f patterns.txt
64 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_file.txt -fsanitize-coverage-ignorelist=bl_file.txt  2>&1 | not grep -f patterns.txt
65 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_foo.txt  -fsanitize-coverage-ignorelist=bl_file.txt  2>&1 | not grep -f patterns.txt
66 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_bar.txt  -fsanitize-coverage-ignorelist=bl_file.txt  2>&1 | not grep -f patterns.txt
67 
68 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table                                           -fsanitize-coverage-ignorelist=bl_foo.txt   2>&1 |     grep -f patterns.txt | count 5
69 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_all.txt  -fsanitize-coverage-ignorelist=bl_foo.txt   2>&1 |     grep -f patterns.txt | count 5
70 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_none.txt -fsanitize-coverage-ignorelist=bl_foo.txt   2>&1 | not grep -f patterns.txt
71 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_file.txt -fsanitize-coverage-ignorelist=bl_foo.txt   2>&1 |     grep -f patterns.txt | count 5
72 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_foo.txt  -fsanitize-coverage-ignorelist=bl_foo.txt   2>&1 | not grep -f patterns.txt
73 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_bar.txt  -fsanitize-coverage-ignorelist=bl_foo.txt   2>&1 |     grep -f patterns.txt | count 5
74 
75 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table                                           -fsanitize-coverage-ignorelist=bl_bar.txt   2>&1 |     grep -f patterns.txt | count 9
76 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_all.txt  -fsanitize-coverage-ignorelist=bl_bar.txt   2>&1 |     grep -f patterns.txt | count 9
77 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_none.txt -fsanitize-coverage-ignorelist=bl_bar.txt   2>&1 | not grep -f patterns.txt
78 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_file.txt -fsanitize-coverage-ignorelist=bl_bar.txt   2>&1 |     grep -f patterns.txt | count 9
79 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_foo.txt  -fsanitize-coverage-ignorelist=bl_bar.txt   2>&1 |     grep -f patterns.txt | count 9
80 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-allowlist=al_bar.txt  -fsanitize-coverage-ignorelist=bl_bar.txt   2>&1 | not grep -f patterns.txt
81 
82 /// The options below are deprecated and will be removed.
83 // RUN: %clangxx -O0 %s -S -o - -emit-llvm -Xclang -no-opaque-pointers -fsanitize-coverage=inline-8bit-counters,indirect-calls,trace-cmp,pc-table -fsanitize-coverage-whitelist=al_bar.txt  -fsanitize-coverage-ignorelist=bl_bar.txt   2>&1 | not grep -f patterns.txt
84 
85 // RUN: cd -
86 // RUN: rm -rf $DIR
87 
88 // foo has 3 instrumentation points, 0 indirect call, 1 comparison point
89 
90 // Expected results with patterns.txt when foo gets instrumentation with
91 // libFuzzer-like coverage options: 9 lines
92 //   inline-8bit-counters ->
93 //     @__sancov_gen_XX = private global [3 x i8] zeroinitializer, section "__sancov_cntrs"...
94 //     %XX = load i8, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @__sancov_gen_, i64 0, i64 0)...
95 //     %XX = load i8, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @__sancov_gen_, i64 0, i64 1)...
96 //     %XX = load i8, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @__sancov_gen_, i64 0, i64 2)...
97 //     store i8 %XX, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @__sancov_gen_, i64 0, i64 0)...
98 //     store i8 %XX, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @__sancov_gen_, i64 0, i64 1)...
99 //     store i8 %XX, i8* getelementptr inbounds ([3 x i8], [3 x i8]* @__sancov_gen_, i64 0, i64 2)...
100 //   trace-cmp ->
101 //     call void @__sanitizer_cov_trace_cmp4(i32 %XX, i32 %XX)
102 //   pc-table ->
103 //     @__sancov_gen_XX = private constant [6 x i64*] ..., section "__sancov_pcs"...
104 
foo(int * a,int * b)105 bool foo(int *a, int *b) {
106   if (*a == *b) {
107     return true;
108   }
109   return false;
110 }
111 
112 // bar has 1 instrumentation point, 1 indirect call, 0 comparison point
113 
114 // Expected results with patterns.txt when bar gets instrumentation with
115 // libFuzzer-like coverage options: 5 lines
116 //   inline-8bit-counters ->
117 //     @__sancov_gen_XX = private global [1 x i8] zeroinitializer, section "__sancov_cntrs"...
118 //     %XX = load i8, i8* getelementptr inbounds ([1 x i8], [1 x i8]* @__sancov_gen_.2, i64 0, i64 0), ...
119 //     store i8 %XX, i8* getelementptr inbounds ([1 x i8], [1 x i8]* @__sancov_gen_.2, i64 0, i64 0), ...
120 //   indirect-calls ->
121 //     call void @__sanitizer_cov_trace_pc_indir(i64 %XX)
122 //   pc-table ->
123 //     @__sancov_gen_XX = private constant [2 x i64*] ..., section "__sancov_pcs"...
124 
bar(void (* f)())125 void bar(void (*f)()) { f(); }
126