[SanitizerCoverage] Add instrumentation callbacks for FP cmp instructions

[shouc]

Summary

Fuzzers need to add branch instrumentation. Current callbacks only consider integer instrumentation (i.e., integer related branches). This commit adds similar sancov trace callback funcs for floating point (half, float, and double) comparisons:

+  void __sanitizer_cov_trace_cmp_fp2(half Arg1, half Arg2);
+  void __sanitizer_cov_trace_cmp_fp4(float Arg1, float Arg2);
+  void __sanitizer_cov_trace_cmp_fp8(double Arg1, double Arg2);
+  void __sanitizer_cov_trace_const_cmp_fp2(half Arg1, half Arg2);
+  void __sanitizer_cov_trace_const_cmp_fp4(float Arg1, float Arg2);
+  void __sanitizer_cov_trace_const_cmp_fp8(double Arg1, double Arg2);

[shouc]

Add support for dfsan

[vitalybuka]

compiler-rt/lib/sanitizer_common/sanitizer_interface_internal.h

91 ↗

(On Diff #408214)

please rebase and clang-format the patch

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

967–983

Can you please, in a separate patch, extract utility method:
void InsertCallbackForTraceForCmp(CallbackIdx, CallbackArgsTy, A0, A1...

And than in the D119621
you can do

if (isa<ICmpInst>(I)) {
  ...
  InsertCallbackForTraceForCmp
} else if isa<FCmpInst>(I)) {
  ...
  InsertCallbackForTraceForCmp
}

Please link them into stack using "edit related revisions" in the top of the review

[browneee]

compiler-rt/lib/dfsan/dfsan_custom.cpp

2515–2540 ↗

(On Diff #408214)

This (including the existing code) wouldn't work if dfsan-track-origins=1.

I guess this is something no one has tried, so probably not important? I'm also unsure where dfsan + sancov is used?

compiler-rt/lib/fuzzer/dataflow/DataFlowCallbacks.cpp

92 ↗

(On Diff #408214)

Note that many of the lib/fuzzer/dataflow/ tests were disabled, as no one was using this... and I think they are still disabled.

[vitalybuka]

Please update if it's still relevant

clang/docs/SanitizerCoverage.rst

 .. code-block:: c++
 
   // Called before a comparison instruction.
   // Arg1 and Arg2 are arguments of the comparison.
   void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2);
   void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2);
   void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2);
   void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2);
+  void __sanitizer_cov_trace_cmp_fp2(half Arg1, half Arg2);
+  void __sanitizer_cov_trace_cmp_fp4(float Arg1, float Arg2);
+  void __sanitizer_cov_trace_cmp_fp8(double Arg1, double Arg2);
 
   // Called before a comparison instruction if exactly one of the arguments is constant.
   // Arg1 and Arg2 are arguments of the comparison, Arg1 is a compile-time constant.
   // These callbacks are emitted by -fsanitize-coverage=trace-cmp since 2017-08-11
   void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2);
   void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2);
   void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2);
   void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2);
+  void __sanitizer_cov_trace_const_cmp_fp2(half Arg1, half Arg2);
+  void __sanitizer_cov_trace_const_cmp_fp4(float Arg1, float Arg2);
+  void __sanitizer_cov_trace_const_cmp_fp8(double Arg1, double Arg2);
 
   // Called before a switch statement.
   // Val is the switch operand.
   // Cases[0] is the number of case constants.
   // Cases[1] is the size of Val in bits.
   // Cases[2:] are the case constants.
   void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases);
 

compiler-rt/lib/dfsan/done_abilist.txt

 fun:__sanitizer_cov_trace_cmp1=custom
 fun:__sanitizer_cov_trace_cmp1=uninstrumented
 fun:__sanitizer_cov_trace_cmp2=custom
 fun:__sanitizer_cov_trace_cmp2=uninstrumented
 fun:__sanitizer_cov_trace_cmp4=custom
 fun:__sanitizer_cov_trace_cmp4=uninstrumented
 fun:__sanitizer_cov_trace_cmp8=custom
 fun:__sanitizer_cov_trace_cmp8=uninstrumented
+fun:__sanitizer_cov_trace_cmp_fp2=custom
+fun:__sanitizer_cov_trace_cmp_fp2=uninstrumented
+fun:__sanitizer_cov_trace_cmp_fp4=custom
+fun:__sanitizer_cov_trace_cmp_fp4=uninstrumented
+fun:__sanitizer_cov_trace_cmp_fp8=custom
+fun:__sanitizer_cov_trace_cmp_fp8=uninstrumented
 fun:__sanitizer_cov_trace_const_cmp1=custom
 fun:__sanitizer_cov_trace_const_cmp1=uninstrumented
 fun:__sanitizer_cov_trace_const_cmp2=custom
 fun:__sanitizer_cov_trace_const_cmp2=uninstrumented
 fun:__sanitizer_cov_trace_const_cmp4=custom
 fun:__sanitizer_cov_trace_const_cmp4=uninstrumented
 fun:__sanitizer_cov_trace_const_cmp8=custom
 fun:__sanitizer_cov_trace_const_cmp8=uninstrumented
+fun:__sanitizer_cov_trace_const_cmp_fp2=custom
+fun:__sanitizer_cov_trace_const_cmp_fp2=uninstrumented
+fun:__sanitizer_cov_trace_const_cmp_fp4=custom
+fun:__sanitizer_cov_trace_const_cmp_fp4=uninstrumented
+fun:__sanitizer_cov_trace_const_cmp_fp8=custom
+fun:__sanitizer_cov_trace_const_cmp_fp8=uninstrumented
 # Similar for __sanitizer_cov_trace_switch
 fun:__sanitizer_cov_trace_switch=custom
 fun:__sanitizer_cov_trace_switch=uninstrumented
 
 # Ignores all other __sanitizer callbacks.
 fun:__sanitizer_cov=uninstrumented
 fun:__sanitizer_cov=discard
 fun:__sanitizer_cov_module_init=uninstrumented

compiler-rt/lib/sanitizer_common/sanitizer_coverage_fuchsia.cpp

SANITIZER_INTERFACE_ATTRIBUTE void __sanitizer_cov_dump() {
   __sanitizer_dump_trace_pc_guard_coverage();
 }
 // Default empty implementations (weak). Users should redefine them.
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp1, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp2, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp4, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp8, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp_fp2, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp_fp4, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp_fp8, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp1, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp2, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp4, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp8, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp_fp2, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp_fp4, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp_fp8, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_switch, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div4, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div8, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_gep, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_indir, void) {}
 }  // extern "C"
 
 #endif  // !SANITIZER_FUCHSIA

compiler-rt/lib/sanitizer_common/sanitizer_coverage_interface.inc

 INTERFACE_FUNCTION(__sanitizer_dump_coverage)
 INTERFACE_FUNCTION(__sanitizer_dump_trace_pc_guard_coverage)
 INTERFACE_WEAK_FUNCTION(__sancov_default_options)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_cmp)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_cmp1)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_cmp2)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_cmp4)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_cmp8)
+INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_cmp_fp2)
+INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_cmp_fp4)
+INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_cmp_fp8)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_const_cmp1)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_const_cmp2)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_const_cmp4)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_const_cmp8)
+INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_const_cmp_fp2)
+INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_const_cmp_fp4)
+INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_const_cmp_fp8)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_div4)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_div8)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_gep)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_pc_guard)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_pc_guard_init)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_pc_indir)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_trace_switch)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_8bit_counters_init)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_bool_flag_init)
 INTERFACE_WEAK_FUNCTION(__sanitizer_cov_pcs_init)

compiler-rt/lib/sanitizer_common/sanitizer_coverage_libcdep_new.cpp

 // Default implementations (weak).
 // Either empty or very simple.
 // Most users should redefine them.
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp1, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp2, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp4, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp8, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp_fp2, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp_fp4, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_cmp_fp8, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp1, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp2, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp4, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp8, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp_fp2, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp_fp4, void) {}
+SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_const_cmp_fp8, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_switch, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div4, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_div8, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_gep, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_trace_pc_indir, void) {}
 SANITIZER_INTERFACE_WEAK_DEF(void, __sanitizer_cov_8bit_counters_init,
                              char* start, char* end) {
   __sancov::SingletonCounterCoverage::Cov8bitCountersInit(start, end);

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

 #define DEBUG_TYPE "sancov"
 
 const char SanCovTracePCIndirName[] = "__sanitizer_cov_trace_pc_indir";
 const char SanCovTracePCName[] = "__sanitizer_cov_trace_pc";
 const char SanCovTraceCmp1[] = "__sanitizer_cov_trace_cmp1";
 const char SanCovTraceCmp2[] = "__sanitizer_cov_trace_cmp2";
 const char SanCovTraceCmp4[] = "__sanitizer_cov_trace_cmp4";
 const char SanCovTraceCmp8[] = "__sanitizer_cov_trace_cmp8";
+const char SanCovTraceCmpF2[] = "__sanitizer_cov_trace_cmp_fp2";
+const char SanCovTraceCmpF4[] = "__sanitizer_cov_trace_cmp_fp4";
+const char SanCovTraceCmpF8[] = "__sanitizer_cov_trace_cmp_fp8";
 const char SanCovTraceConstCmp1[] = "__sanitizer_cov_trace_const_cmp1";
 const char SanCovTraceConstCmp2[] = "__sanitizer_cov_trace_const_cmp2";
 const char SanCovTraceConstCmp4[] = "__sanitizer_cov_trace_const_cmp4";
 const char SanCovTraceConstCmp8[] = "__sanitizer_cov_trace_const_cmp8";
+const char SanCovTraceConstCmpF2[] = "__sanitizer_cov_trace_const_cmp_fp2";
+const char SanCovTraceConstCmpF4[] = "__sanitizer_cov_trace_const_cmp_fp4";
+const char SanCovTraceConstCmpF8[] = "__sanitizer_cov_trace_const_cmp_fp8";
 const char SanCovLoad1[] = "__sanitizer_cov_load1";
 const char SanCovLoad2[] = "__sanitizer_cov_load2";
 const char SanCovLoad4[] = "__sanitizer_cov_load4";
 const char SanCovLoad8[] = "__sanitizer_cov_load8";
 const char SanCovLoad16[] = "__sanitizer_cov_load16";
 const char SanCovStore1[] = "__sanitizer_cov_store1";
 const char SanCovStore2[] = "__sanitizer_cov_store2";
 const char SanCovStore4[] = "__sanitizer_cov_store4";
I->setMetadata(I->getModule()->getMDKindID("nosanitize"),
                    MDNode::get(*C, None));
   }
 
   std::string getSectionName(const std::string &Section) const;
   std::string getSectionStart(const std::string &Section) const;
   std::string getSectionEnd(const std::string &Section) const;
   FunctionCallee SanCovTracePCIndir;
   FunctionCallee SanCovTracePC, SanCovTracePCGuard;
-  std::array<FunctionCallee, 4> SanCovTraceCmpFunction;
-  std::array<FunctionCallee, 4> SanCovTraceConstCmpFunction;
+  std::array<FunctionCallee, 7> SanCovTraceCmpFunction;
+  std::array<FunctionCallee, 7> SanCovTraceConstCmpFunction;
   std::array<FunctionCallee, 5> SanCovLoadFunction;
   std::array<FunctionCallee, 5> SanCovStoreFunction;
   std::array<FunctionCallee, 2> SanCovTraceDivFunction;
   FunctionCallee SanCovTraceGepFunction;
   FunctionCallee SanCovTraceSwitchFunction;
   GlobalVariable *SanCovLowestStack;
   Type *Int128PtrTy, *IntptrTy, *IntptrPtrTy, *Int64Ty, *Int64PtrTy, *Int32Ty,
       *Int32PtrTy, *Int16PtrTy, *Int16Ty, *Int8Ty, *Int8PtrTy, *Int1Ty,
-      *Int1PtrTy;
+      *Int1PtrTy,
+      *Fp16Ty, *Fp16PtrTy, *Fp32Ty, *Fp32PtrTy, *Fp64Ty, *Fp64PtrTy;
   Module *CurModule;
   std::string CurModuleUniqueId;
   Triple TargetTriple;
   LLVMContext *C;
   const DataLayout *DL;
 
   GlobalVariable *FunctionGuardArray;  // for trace-pc-guard.
   GlobalVariable *Function8bitCounterArray;  // for inline-8bit-counters.
bool ModuleSanitizerCoverage::instrumentModule(
   Type *VoidTy = Type::getVoidTy(*C);
   IRBuilder<> IRB(*C);
   Int128PtrTy = PointerType::getUnqual(IRB.getInt128Ty());
   Int64PtrTy = PointerType::getUnqual(IRB.getInt64Ty());
   Int16PtrTy = PointerType::getUnqual(IRB.getInt16Ty());
   Int32PtrTy = PointerType::getUnqual(IRB.getInt32Ty());
   Int8PtrTy = PointerType::getUnqual(IRB.getInt8Ty());
   Int1PtrTy = PointerType::getUnqual(IRB.getInt1Ty());
+  Fp16PtrTy = PointerType::getUnqual(IRB.getHalfTy());
+  Fp32PtrTy = PointerType::getUnqual(IRB.getFloatTy());
+  Fp64PtrTy = PointerType::getUnqual(IRB.getDoubleTy());
   Int64Ty = IRB.getInt64Ty();
   Int32Ty = IRB.getInt32Ty();
   Int16Ty = IRB.getInt16Ty();
   Int8Ty = IRB.getInt8Ty();
   Int1Ty = IRB.getInt1Ty();
+  Fp16Ty = IRB.getHalfTy();
+  Fp32Ty = IRB.getFloatTy();
+  Fp64Ty = IRB.getDoubleTy();
 
   SanCovTracePCIndir =
       M.getOrInsertFunction(SanCovTracePCIndirName, VoidTy, IntptrTy);
   // Make sure smaller parameters are zero-extended to i64 if required by the
   // target ABI.
   AttributeList SanCovTraceCmpZeroExtAL;
   SanCovTraceCmpZeroExtAL =
       SanCovTraceCmpZeroExtAL.addParamAttribute(*C, 0, Attribute::ZExt);
   SanCovTraceCmpZeroExtAL =
       SanCovTraceCmpZeroExtAL.addParamAttribute(*C, 1, Attribute::ZExt);
 
   SanCovTraceCmpFunction[0] =
       M.getOrInsertFunction(SanCovTraceCmp1, SanCovTraceCmpZeroExtAL, VoidTy,
                             IRB.getInt8Ty(), IRB.getInt8Ty());
   SanCovTraceCmpFunction[1] =
       M.getOrInsertFunction(SanCovTraceCmp2, SanCovTraceCmpZeroExtAL, VoidTy,
                             IRB.getInt16Ty(), IRB.getInt16Ty());
   SanCovTraceCmpFunction[2] =
       M.getOrInsertFunction(SanCovTraceCmp4, SanCovTraceCmpZeroExtAL, VoidTy,
                             IRB.getInt32Ty(), IRB.getInt32Ty());
   SanCovTraceCmpFunction[3] =
       M.getOrInsertFunction(SanCovTraceCmp8, VoidTy, Int64Ty, Int64Ty);
+  SanCovTraceCmpFunction[4] = M.getOrInsertFunction(SanCovTraceCmpF2, VoidTy, Fp16Ty, Fp16Ty);
+  SanCovTraceCmpFunction[5] = M.getOrInsertFunction(SanCovTraceCmpF4, VoidTy, Fp32Ty, Fp32Ty);
+  SanCovTraceCmpFunction[6] = M.getOrInsertFunction(SanCovTraceCmpF8, VoidTy, Fp64Ty, Fp64Ty);
 
   SanCovTraceConstCmpFunction[0] = M.getOrInsertFunction(
       SanCovTraceConstCmp1, SanCovTraceCmpZeroExtAL, VoidTy, Int8Ty, Int8Ty);
   SanCovTraceConstCmpFunction[1] = M.getOrInsertFunction(
       SanCovTraceConstCmp2, SanCovTraceCmpZeroExtAL, VoidTy, Int16Ty, Int16Ty);
   SanCovTraceConstCmpFunction[2] = M.getOrInsertFunction(
       SanCovTraceConstCmp4, SanCovTraceCmpZeroExtAL, VoidTy, Int32Ty, Int32Ty);
   SanCovTraceConstCmpFunction[3] =
       M.getOrInsertFunction(SanCovTraceConstCmp8, VoidTy, Int64Ty, Int64Ty);
+  SanCovTraceConstCmpFunction[4] =
+      M.getOrInsertFunction(SanCovTraceConstCmpF2, VoidTy, Fp16Ty, Fp16Ty);
+  SanCovTraceConstCmpFunction[5] =
+      M.getOrInsertFunction(SanCovTraceConstCmpF4, VoidTy, Fp32Ty, Fp32Ty);
+  SanCovTraceConstCmpFunction[6] =
+      M.getOrInsertFunction(SanCovTraceConstCmpF8, VoidTy, Fp64Ty, Fp64Ty);
 
   // Loads.
   SanCovLoadFunction[0] = M.getOrInsertFunction(SanCovLoad1, VoidTy, Int8PtrTy);
   SanCovLoadFunction[1] =
       M.getOrInsertFunction(SanCovLoad2, VoidTy, Int16PtrTy);
   SanCovLoadFunction[2] =
       M.getOrInsertFunction(SanCovLoad4, VoidTy, Int32PtrTy);
   SanCovLoadFunction[3] =
static bool IsBackEdge(BasicBlock *From, BasicBlock *To,
   return false;
 }
 
 // Prunes uninteresting Cmp instrumentation:
 //   * CMP instructions that feed into loop backedge branch.
 //
 // Note that Cmp pruning is controlled by the same flag as the
 // BB pruning.
-static bool IsInterestingCmp(ICmpInst *CMP, const DominatorTree *DT,
+static bool IsInterestingCmp(Instruction *CMP, const DominatorTree *DT,
                              const SanitizerCoverageOptions &Options) {
   if (!Options.NoPrune)
     if (CMP->hasOneUse())
       if (auto BR = dyn_cast<BranchInst>(CMP->user_back()))
         for (BasicBlock *B : BR->successors())
           if (IsBackEdge(BR->getParent(), B, DT))
             return false;
   return true;
void ModuleSanitizerCoverage::instrumentFunction(
   if (Blocklist && Blocklist->inSection("coverage", "fun", F.getName()))
     return;
   if (F.hasFnAttribute(Attribute::NoSanitizeCoverage))
     return;
   if (Options.CoverageType >= SanitizerCoverageOptions::SCK_Edge)
     SplitAllCriticalEdges(F, CriticalEdgeSplittingOptions().setIgnoreUnreachableDests());
   SmallVector<Instruction *, 8> IndirCalls;
   SmallVector<BasicBlock *, 16> BlocksToInstrument;
-  SmallVector<Instruction *, 8> CmpTraceTargets;
+  SmallVector<Instruction *, 8> ICmpTraceTargets;
+  SmallVector<Instruction *, 8> FCmpTraceTargets;
   SmallVector<Instruction *, 8> SwitchTraceTargets;
   SmallVector<BinaryOperator *, 8> DivTraceTargets;
   SmallVector<GetElementPtrInst *, 8> GepTraceTargets;
   SmallVector<LoadInst *, 8> Loads;
   SmallVector<StoreInst *, 8> Stores;
 
   const DominatorTree *DT = DTCallback(F);
   const PostDominatorTree *PDT = PDTCallback(F);
   bool IsLeafFunc = true;
 
   for (auto &BB : F) {
     if (shouldInstrumentBlock(F, &BB, DT, PDT, Options))
       BlocksToInstrument.push_back(&BB);
     for (auto &Inst : BB) {
       if (Options.IndirectCalls) {
         CallBase *CB = dyn_cast<CallBase>(&Inst);
         if (CB && !CB->getCalledFunction())
           IndirCalls.push_back(&Inst);
       }
       if (Options.TraceCmp) {
         if (ICmpInst *CMP = dyn_cast<ICmpInst>(&Inst))
           if (IsInterestingCmp(CMP, DT, Options))
-            CmpTraceTargets.push_back(&Inst);
+            ICmpTraceTargets.push_back(&Inst);
+        if (FCmpInst *CMP = dyn_cast<FCmpInst>(&Inst))
+          if (IsInterestingCmp(CMP, DT, Options))
+            FCmpTraceTargets.push_back(&Inst);
         if (isa<SwitchInst>(&Inst))
           SwitchTraceTargets.push_back(&Inst);
       }
       if (Options.TraceDiv)
         if (BinaryOperator *BO = dyn_cast<BinaryOperator>(&Inst))
           if (BO->getOpcode() == Instruction::SDiv ||
               BO->getOpcode() == Instruction::UDiv)
             DivTraceTargets.push_back(BO);
for (auto &Inst : BB) {
         if (isa<InvokeInst>(Inst) ||
             (isa<CallInst>(Inst) && !isa<IntrinsicInst>(Inst)))
           IsLeafFunc = false;
     }
   }
 
   InjectCoverage(F, BlocksToInstrument, IsLeafFunc);
   InjectCoverageForIndirectCalls(F, IndirCalls);
-  InjectTraceForCmp(F, CmpTraceTargets);
+  InjectTraceForCmp(F, ICmpTraceTargets);
+  InjectTraceForCmp(F, FCmpTraceTargets);
   InjectTraceForSwitch(F, SwitchTraceTargets);
   InjectTraceForDiv(F, DivTraceTargets);
   InjectTraceForGep(F, GepTraceTargets);
   InjectTraceForLoadsAndStores(F, Loads, Stores);
 }
 
 GlobalVariable *ModuleSanitizerCoverage::CreateFunctionLocalArrayInSection(
     size_t NumElements, Function &F, Type *Ty, const char *Section) {
for (auto SI : Stores) {
     IRB.CreateCall(SanCovStoreFunction[Idx],
                    IRB.CreatePointerCast(Ptr, PointerType[Idx]));
   }
 }
 
 void ModuleSanitizerCoverage::InjectTraceForCmp(
     Function &, ArrayRef<Instruction *> CmpTraceTargets) {
   for (auto I : CmpTraceTargets) {
-    if (ICmpInst *ICMP = dyn_cast<ICmpInst>(I)) {
-      IRBuilder<> IRB(ICMP);
-      Value *A0 = ICMP->getOperand(0);
-      Value *A1 = ICMP->getOperand(1);
-      if (!A0->getType()->isIntegerTy())
-        continue;
+    if (isa<ICmpInst>(I) || isa<FCmpInst>(I)) {
+      auto IsIntComparison = isa<ICmpInst>(I);
+      IRBuilder<> IRB(I);
+      Value *A0 = I->getOperand(0);
+      Value *A1 = I->getOperand(1);
+      int CallbackIdx;
+      Type *CallbackArgsTy;
       uint64_t TypeSize = DL->getTypeStoreSizeInBits(A0->getType());
-      int CallbackIdx = TypeSize == 8 ? 0 :
-                        TypeSize == 16 ? 1 :
-                        TypeSize == 32 ? 2 :
-                        TypeSize == 64 ? 3 : -1;
+      CallbackIdx = IsIntComparison ?
+        (TypeSize == 8 ? 0 :
+          TypeSize == 64 ? 3 : -1) :
+        (A0->getType()->isHalfTy() ? 4 :
+         A0->getType()->isFloatTy() ? 5 :
+         A0->getType()->isDoubleTy() ? 6 : -1);
       if (CallbackIdx < 0) continue;
+      if (IsIntComparison) {
+        // integer comparison
+        if (!A0->getType()->isIntegerTy())
+          continue;
+        CallbackArgsTy = Type::getIntNTy(*C, TypeSize);
+      } else {
+        // float comparison
+        if (!A0->getType()->isFloatingPointTy())
+          continue;
+        CallbackArgsTy = (TypeSize == 16 ? Type::getHalfTy(*C) :
+                          TypeSize == 32 ? Type::getFloatTy(*C) :
+                            Type::getDoubleTy(*C));
+      }
       // __sanitizer_cov_trace_cmp((type_size << 32) | predicate, A0, A1);
       auto CallbackFunc = SanCovTraceCmpFunction[CallbackIdx];
-      bool FirstIsConst = isa<ConstantInt>(A0);
-      bool SecondIsConst = isa<ConstantInt>(A1);
+      bool FirstIsConst = isa<ConstantInt>(A0) || isa<ConstantFP>(A0);
+      bool SecondIsConst = isa<ConstantInt>(A1) || isa<ConstantFP>(A1);
       // If both are const, then we don't need such a comparison.
       if (FirstIsConst && SecondIsConst) continue;
       // If only one is const, then make it the first callback argument.
       if (FirstIsConst || SecondIsConst) {
         CallbackFunc = SanCovTraceConstCmpFunction[CallbackIdx];
         if (SecondIsConst)
           std::swap(A0, A1);
       }
-
-      auto Ty = Type::getIntNTy(*C, TypeSize);
-      IRB.CreateCall(CallbackFunc, {IRB.CreateIntCast(A0, Ty, true),
-              IRB.CreateIntCast(A1, Ty, true)});
+      IRB.CreateCall(CallbackFunc, {IRB.CreateIntCast(A0, CallbackArgsTy, true),
+                                   IRB.CreateIntCast(A1, CallbackArgsTy, true)});
     }
   }
 }
 
 void ModuleSanitizerCoverage::InjectCoverageAtBlock(Function &F, BasicBlock &BB,
                                                     size_t Idx,
                                                     bool IsLeafFunc) {
   BasicBlock::iterator IP = BB.getFirstInsertionPt();
   bool IsEntryBB = &BB == &F.getEntryBlock();

llvm/test/Instrumentation/SanitizerCoverage/cmp-tracing-api-x86_32.ll

 ; Test -sanitizer-coverage-trace-compares=1 API declarations on a non-x86_64 arch
 ; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=1 -sanitizer-coverage-trace-compares=1  -S | FileCheck %s
 
 target triple = "i386-unknown-linux-gnu"
 define i32 @foo() #0 {
 entry:
   ret i32 0
 }
 
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_pc_indir(i64)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_cmp1(i8 zeroext, i8 zeroext)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_cmp2(i16 zeroext, i16 zeroext)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_cmp4(i32 zeroext, i32 zeroext)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_cmp8(i64, i64)
+; CHECK-DAG: declare void @__sanitizer_cov_trace_cmp_fp2(half, half)
+; CHECK-DAG: declare void @__sanitizer_cov_trace_cmp_fp4(float, float)
+; CHECK-DAG: declare void @__sanitizer_cov_trace_cmp_fp8(double, double)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_const_cmp1(i8 zeroext, i8 zeroext)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_const_cmp2(i16 zeroext, i16 zeroext)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_const_cmp4(i32 zeroext, i32 zeroext)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_const_cmp8(i64, i64)
+; CHECK-DAG: declare void @__sanitizer_cov_trace_const_cmp_fp2(half, half)
+; CHECK-DAG: declare void @__sanitizer_cov_trace_const_cmp_fp4(float, float)
+; CHECK-DAG: declare void @__sanitizer_cov_trace_const_cmp_fp8(double, double)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_div4(i32 zeroext)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_div8(i64)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_gep(i64)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_switch(i64, i64*)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_pc()
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_pc_guard(i32*)
 ; CHECK-DAG: declare void @__sanitizer_cov_trace_pc_guard_init(i32*, i32*)
 ; CHECK-NOT: declare