[SanitizerCoverage] Add associated metadata to pc-tables.

[morehouse]

Summary

Using associated metadata rather than llvm.used allows linkers to
perform dead stripping with -fsanitize-coverage=pc-table. Unfortunately
in my local tests, LLD was the only linker that made use of this metadata.

Partially addresses https://bugs.llvm.org/show_bug.cgi?id=34636 and fixes
https://github.com/google/sanitizers/issues/971.

[morehouse]

• Require LLD for gc-sections.test

[Dor1s]

Nice, thanks for the quick patch, Matt!

[eugenis]

Did you try BFD with more than one function? There was a fun bug where the "first" (for some definition of the word) input section of an output section was treated differently from the rest.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

601–602

I think pctable needs to be in llvm.compiler.used.
!associated alone will not prevent it being thrown away.

[morehouse]

• Add pc-table to llvm.compiler.used.

[morehouse]

Neither BFD (version 2.30) nor gold (version 1.15) do dead stripping on my machine, even with multiple unused functions.

[eugenis]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

408

this is unnecessary, llvm.used is strictly stronger than llvm.compiler.used

[morehouse]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

408

I'm not sure I understand... We're appending different things to each list.

[eugenis]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

408

Right. Sorry.
A different question then: why only MachO?

[morehouse]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

408

Kostya mentioned his reasoning in http://lists.llvm.org/pipermail/llvm-dev/2017-September/117315.html.

[eugenis]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

408

I don't understand that thread :(
What I know is, without compiler.used, neither comdat nor !associated nor a named section would save pctable from the optimizer. Try passing this through opt -O3:

$a = comdat any
@a = global i32 0, align 4, comdat($a)
@b = internal global i32 0, align 4, section "abc", !associated !0, comdat($a)
; @llvm.compiler.used = appending global [1 x i8*] [i8* bitcast (i32* @b to i8*)]
!0 = !{i32 *@a}

[morehouse]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

408

clang++ -fsanitize=fuzzer -O3 -S -emit-llvm -o- shows the pc-tables still there. But if I run the output of that through opt -O3, the pc-tables get stripped.

So maybe running directly through opt performs some stripping that otherwise wouldn't be done?

[eugenis]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

408

Most optimizations are done before fuzzer instrumentation.
Try with MSan, it adds a few more at the end.

[morehouse]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

408

With -fsanitize=fuzzer,memory -O3, the pc-tables are still there.

But either way, I don't think it would hurt to add pc-tables to llvm.compiler.used on all platforms.

[morehouse]

• Add pc-table to llvm.compiler.used on all platforms.

compiler-rt/test/fuzzer/gc-sections.test

 REQUIRES: linux
 
 No gc-sections:
 RUN: %cpp_compiler %S/GcSectionsTest.cpp -o %t
 RUN: nm %t | grep UnusedFunctionShouldBeRemovedByLinker | count 1
 
 With gc-sections. Currently, we can't remove unused code.
-DISABLED: %cpp_compiler %S/GcSectionsTest.cpp -o %t -ffunction-sections -Wl,-gc-sections
-DISABLED: nm %t | grep UnusedFunctionShouldBeRemovedByLinker | count 1
+RUN: %cpp_compiler %S/GcSectionsTest.cpp -o %t -ffunction-sections -Wl,-gc-sections -fuse-ld=lld
+RUN: nm %t | not grep UnusedFunctionShouldBeRemovedByLinker
 
 With gc sections, with trace-pc. Unused code is removed.
 RUN: %cpp_compiler %S/GcSectionsTest.cpp -o %t -fsanitize-coverage=0 -fsanitize-coverage=trace-pc -ffunction-sections -Wl,-gc-sections
 RUN: nm %t | not grep UnusedFunctionShouldBeRemovedByLinker

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

if (Ctor && Options.PCTable) {
     IRBCtor.CreateCall(InitFunction,
                        {IRB.CreatePointerCast(SecStartEnd.first, IntptrPtrTy),
                         IRB.CreatePointerCast(SecStartEnd.second, IntptrPtrTy)});
   }
   // We don't reference these arrays directly in any of our runtime functions,
   // so we need to prevent them from being dead stripped.
   if (TargetTriple.isOSBinFormatMachO())
     appendToUsed(M, GlobalsToAppendToUsed);
   return true;
 }
 
 // True if block has successors and it dominates all of them.
 static bool isFullDominator(const BasicBlock *BB, const DominatorTree *DT) {
   if (succ_begin(BB) == succ_end(BB))
     return false;
 
   for (const BasicBlock *SUCC : make_range(succ_begin(BB), succ_end(BB))) {
void SanitizerCoverageModule::CreateFunctionLocalArrays(
   }
   if (Options.Inline8bitCounters) {
     Function8bitCounterArray = CreateFunctionLocalArrayInSection(
         AllBlocks.size(), F, Int8Ty, SanCovCountersSectionName);
     GlobalsToAppendToUsed.push_back(Function8bitCounterArray);
   }
   if (Options.PCTable) {
     FunctionPCsArray = CreatePCArray(F, AllBlocks);
-    GlobalsToAppendToUsed.push_back(FunctionPCsArray);
+    MDNode *MD = MDNode::get(F.getContext(), ValueAsMetadata::get(&F));
+    FunctionPCsArray->addMetadata(LLVMContext::MD_associated, *MD);
   }
 }
 
 bool SanitizerCoverageModule::InjectCoverage(Function &F,
                                              ArrayRef<BasicBlock *> AllBlocks,
                                              bool IsLeafFunc) {
   if (AllBlocks.empty()) return false;
   CreateFunctionLocalArrays(F, AllBlocks);