[cfe-dev] fsanitize-coverage trace-cmp/div/gep don't emit callbacks

[Cornelius Aschermann via cfe-dev]

Hi, I'm trying to use the different trace options for the coverage
sanitizer, but for the cmp/div/gep trace options no callbacks are
emitted. Is this a known bug / is there something I can do to still use
these options?

Surprisingly the trace-pc coverage works as expected and adds the
correct callbacks:

clang -fsanitize-coverage=trace-pc test.c
objdump -DM intel a.out  | grep -n50 '<main>'

[...]
mov        QWORD PTR [rbp-0x10],rsi
cmp        DWORD PTR [rbp-0x8],0x2
je            <main+0x44>
call          <__sanitizer_cov_trace_pc>
mov        DWORD PTR [rbp-0x4],0x0
[...]

(If test.c doesn't include a definition of void
__sanitizer_cov_trace_pc(){}, a link time error is thrown)

However, the following will not introduce any callbacks (there should be
one before the cmp), and missing definitions of the callbacks do not
trigger any errors:

clang -fsanitize-coverage=trace-cmp test.c
objdump -DM intel a.out  | grep -n50 '<main>'

[...]
mov        QWORD PTR [rbp-0x10],rsi
cmp        DWORD PTR [rbp-0x8],0x2
je             <main+0x2c>
mov        DWORD PTR [rbp-0x4],0x0
[...]

I build clang freshly from trunk:

clang --version
clang version 4.0.0 (trunk 284459)
Target: x86_64-unknown-linux-gnu

Cheers
Cornelius

-------------- next part --------------
A non-text attachment was scrubbed...
Name: test.c
Type: text/x-csrc
Size: 891 bytes
Desc: not available
URL: <http://lists.llvm.org/pipermail/cfe-dev/attachments/20161018/3aacdab0/attachment.c>