[libFuzzer] Port to Windows

[metzman]

Summary

Port libFuzzer to windows-msvc.
This patch allows libFuzzer targets to be built and run on Windows, using -fsanitize=fuzzer and/or fsanitize=fuzzer-no-link. It allows these forms of coverage instrumentation to work on Windows as well.
It does not fix all issues, such as those with -fsanitize-coverage=stack-depth, which is not usable on Windows as of this patch.
It also does not fix any libFuzzer integration tests. Nearly all of them fail to compile, fixing them will come in a later patch, so libFuzzer tests are disabled on Windows until them.

[metzman]

Run clang-format

[metzman]

@morehouse Can you please take a look?

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

1 ↗

(On Diff #161783)

@kcc I wrote a lit test for a basic sanity check.
I think the instrumentation on windows is also worth testing in check-fuzzer, but I didn't add a test there because check-fuzzer is still broken on Windows.
I will add the test there with my patch fixing check-fuzzer.

[morehouse]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

815 ↗

(On Diff #161797)

Nit: else is unnecessary.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

35 ↗

(On Diff #161797)

Can we make an OS-specific macro for __attribute__((tls_model("initial-exec"))) and/or thread_local instead?

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23 ↗

(On Diff #161797)

What happens without align(1) and uint64_t?

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

23 ↗

(On Diff #161797)

Does body of foo matter for this test? Can it just return?

[metzman]

Fix nit (remove unnecessary else) and minimize integration test.

[metzman]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

35 ↗

(On Diff #161797)

I'm looking into this, but it looks a bit complicated to get this working, as there are two problems here:

1. How to share the symbol with sanitizer_coverage_libcdep_new.cc (I assume techniques from sanitizer_win_defs.h can work).
2. How to combine thread_local with ATTRIBUTE_INTERFACE (__declspec(dllexport)) on windows since this isn't allowed (I think solution will be not using dllexport for __sancov_lowest_stack).

Will investigate this further.

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23 ↗

(On Diff #161797)

Without align(1) the arrays get aligned so that in between __start___sancov_cntrs and __stop___sancov_cntrs and in between __start___sancov_pcs and __stop___sancov_pcs there are padding bytes, causing libFuzzer to think there is an incorrect number of PCs and counters, which causes an early exit.
Without uint64_t (but with align(1)) sancov_pcs gets word aligned (ie: there is a 4 byte gap between __start_sancov_pcs and the first element in the array), causing the same issue.

tl;dr without either (or without incremental:no) I get:

ERROR: The size of coverage PC tables does not match the
number of instrumented PCs. This might be a compiler bug,
please contact the libFuzzer developers.
Also check https://bugs.llvm.org/show_bug.cgi?id=34636
for possible workarounds (tl;dr: don't use the old GNU ld)

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

815 ↗

(On Diff #161797)

Done.

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

23 ↗

(On Diff #161797)

No. Yes it can return.
Good catch, I've fixed this.

[morehouse]

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

23 ↗

(On Diff #161797)

Can it be simplified more? For example, inline-8bit-counters.ll does:

define void @foo() {
entry:
  ret void
}

[metzman]

Make lit test minimal

[metzman]

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

23 ↗

(On Diff #161797)

Ah my bad. I think it is minimal now.

[metzman]

Replace solution for stack-depth with a prettier one.

[morehouse]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

519 ↗

(On Diff #161987)

Rather than having these ifdefs, can we adjust the parameters passed to these init functions (i.e. modify SecStart and SecEnd in SanitizerCoverage.cpp)?

Then users of SanCov won't have to do this manual adjustment for Windows either.

[metzman]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

519 ↗

(On Diff #161987)

I don't think we can adjust the parameters using the current approach.
Under the current approach __start___sancov_pcs (pcs_beg) doesnt point to the start of the pc array on windows, it points to data that comes before the array.
I'm pretty sure this was an issue with the initial port that used guards (ie: it should have added to the parameters), just no one noticed because there was no check to tell if the array size was correct.

[metzman]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

519 ↗

(On Diff #161987)

Actually, I have an idea for how to do this. I'll get back to you.

[metzman]

Use less #ifdefs and fix issue with guards (because of failing lit test)

[metzman]

Update comments

[metzman]

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

519 ↗

(On Diff #161987)

I now do this addition in SanitizerCoverage.cpp as you suggested. There are no more #ifdefs in this file.

Thank you for helping me figure out how to do this offline.

[metzman]

Reid could you please take a look.
This patch gets libFuzzer working on Windows.
Most functionality seems to work, a few features are not yet supported and the tests don't yet work. I plan on fixing these issues soon.

[rnk]

compiler-rt/lib/fuzzer/tests/FuzzerUnittest.cpp

33–38 ↗

(On Diff #162054)

Basename should be fixed to handle / and \ on windows.

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23 ↗

(On Diff #161797)

I'm not sure align(1) really addresses this problem. The Microsoft linker will add padding either way for incremental links. For ASan global metadata registration, we had to teach the runtime to tolerate zero padding.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

276–281 ↗

(On Diff #162054)

I kind of prefer ifdefs in runtime C code over platform-specific instrumentation. @morehouse, wdyt?

826 ↗

(On Diff #162054)

I would recommend naming your sections:
.SCOV$CM
.SCOV$PM
.SCOV$GM

Your start markers and end markers will work just the same as .SCOV$[CPG][AZ].

You should also add a /merge:.SCOV=.data flag with #pragma comment linker in the sanitizer coverage runtime. That way the final PE file won't have a .SCOV section, it'll all be in .data, laid out the way you want.

[metzman]

@rnk thank you for the feedback.
I will fix the issues you have raised shortly, but I have some questions on the feedback you left.

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23 ↗

(On Diff #161797)

Ouch.
Wouldn't incremental:no (which I set in MSVC.cpp) prevent incremental links?
Or is this insufficient since people should be able to link outside of clang?
(I assume it is not sufficient, since I got that idea from ASan).

I will take a look at what ASAN does to handle padding and try to implement something similar.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

826 ↗

(On Diff #162054)

Can the PCTable which is constant go into .data?
Initially I tried having one section but if I recall correctly PCTable being constant caused issues.
I can look into this further though, maybe the solution is to make PCTable non-constant on windows

[metzman]

Fix BaseName to handle '/' and '\' on Windows.

[morehouse]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

276–281 ↗

(On Diff #162054)

Why would you prefer that way?

My reasoning is that its better to fix this in one place rather than expect every client of SanCov to place ifdefs for Windows in their code.

[metzman]

Undo unnecessary change to unittests.

[metzman]

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23 ↗

(On Diff #161797)

@rnk and @kcc (assuming we can't prevent incremental links and need to deal with padding):
Does searching for a magic string at runtime (and adding one during instrumentation) seem like a good way to determine the start and end of the array in spite of padding?
I don't think I can simply skip over zero bytes because of the PC Table. The PC Table can legitimately start with zeros since each entry in the table starts with an address.
The end of the PCTable can be determined without a magic string but the end of the guard and counter arrays cannot, unless they are initialized to something other than 0, so I think using magic strings to determine start and end of all arrays makes most sense.

[rnk]

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23 ↗

(On Diff #161797)

I'm not sure we can. I think if your approach works, we might want to commit it and then debug the problems in alternative VC link configurations. It might be OK if libfuzzer only works on windows with lld.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

826 ↗

(On Diff #162054)

I see, I checked and I thought I didn't see any constant data. That should use a separate section, maybe .SCOVP$M as originally designed. The important thing isn't having less COFF sections, it's having fewer PE sections. You can check that they get eliminated with dumpbin /summary on a libfuzzer exe.

[metzman]

Merge guard and counter sections with .data section.
Also add better comments.

[metzman]

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23 ↗

(On Diff #161797)

I've merged the guard and counter array with the .data section.
The PCTable which is constant, is in its own section.

I think if your approach works, we might want to commit it and then debug the problems in alternative VC link configurations

My approach works with a decent amount of examples I've tried (both with use-ld=lld and without). I suppose we will learn more once we start using it in Chrome.

Have you seem the linker adding padding in spite of /incremental:no being used in ASAN builds?

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

276–281 ↗

(On Diff #162054)

@rnk do you still want me to change this?

[metzman]

run clang format.

[rnk]

One last thing and I think we can merge this.

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

23 ↗

(On Diff #161797)

Any reason not to do add this?

#pragma comment(linker, "/MERGE:.SCOVP=.rdata")

It should get the readonly behavior you want without making an extra PE section.

Have you seem the linker adding padding in spite of /incremental:no being used in ASAN builds?

No, in a non-incremental build, MSVC will only add padding to satisfy the alignment of each entry.

I guess I see why you downgrade the uin64_t's to one byte alignment, it's mainly to avoid the zero entry at the end of the array.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

276–281 ↗

(On Diff #162054)

Normally we follow the principle that the more complexity we can move from instrumentation to runtime code, the better. If there are multiple clients, then keeping it here makes sense.

[metzman]

Merge SCOVP section with .rdata

[rnk]

lgtm

[metzman]

Thank you @rnk and @morehouse for your reviews.

This can't be landed if it causes ninja check-all to fail right?
This is happening on Windows now because of fuzzer test failures (check-all is passing on Linux and check-llvm check-clang and check-asan are passing on Windows).
If it can't be landed because of this then I guess I will disable libFuzzer on Windows from being built (or maybe just all of the fuzzer tests if possible).

Also, could one of you please commit this patch for me? I'm not an LLVM committer so I'm unable to do this myself.
(If it can't be landed then I'll just ping whoever volunteers)

Thanks!

[rnk]

In D51022#1215212, @metzman wrote:

Thank you @rnk and @morehouse for your reviews.

This can't be landed if it causes ninja check-all to fail right?
This is happening on Windows now because of fuzzer test failures (check-all is passing on Linux and check-llvm check-clang and check-asan are passing on Windows).
If it can't be landed because of this then I guess I will disable libFuzzer on Windows from being built (or maybe just all of the fuzzer tests if possible).

I thought we removed libfuzzer from check-all. I'll check the situation.

Also, could one of you please commit this patch for me? I'm not an LLVM committer so I'm unable to do this myself.
(If it can't be landed then I'll just ping whoever volunteers)

Thanks!

[morehouse]

We will need to disable failing tests for Windows. libFuzzer does run as part of check-all now.

[metzman]

Disable libFuzzer tests on Windows.

[metzman]

In D51022#1215225, @morehouse wrote:

We will need to disable failing tests for Windows. libFuzzer does run as part of check-all now.

Pretty much all lit tests are failing.

I've disabled all libFuzzer tests on Windows. check-all passes on Windows now.

[metzman]

Improve comment

[metzman]

Improve comments.

[metzman]

Fix failing assertions by using CreateGEP instead of CreateAdd to add to a pointer.

[metzman]

Trivial NFC to use local variable instead of accessing attribute twice.

[metzman]

• Port libFuzzer to Windows

cfe/trunk/lib/Driver/ToolChains/MSVC.cpp

void visualstudio::Linker::ConstructJob(Compilation &C, const JobAction &JA,
   if (DLL) {
     CmdArgs.push_back(Args.MakeArgString("-dll"));
 
     SmallString<128> ImplibName(Output.getFilename());
     llvm::sys::path::replace_extension(ImplibName, "lib");
     CmdArgs.push_back(Args.MakeArgString(std::string("-implib:") + ImplibName));
   }
 
+  if (TC.getSanitizerArgs().needsFuzzer()) {
+    if (!Args.hasArg(options::OPT_shared))
+      CmdArgs.push_back(
+          Args.MakeArgString(std::string("-wholearchive:") +
+                             TC.getCompilerRTArgString(Args, "fuzzer", false)));
+    CmdArgs.push_back(Args.MakeArgString("-debug"));
+    // Prevent the linker from padding sections we use for instrumentation
+    // arrays.
+    CmdArgs.push_back(Args.MakeArgString("-incremental:no"));
+  }
+
   if (TC.getSanitizerArgs().needsAsanRt()) {
     CmdArgs.push_back(Args.MakeArgString("-debug"));
     CmdArgs.push_back(Args.MakeArgString("-incremental:no"));
     if (TC.getSanitizerArgs().needsSharedRt() ||
         Args.hasArg(options::OPT__SLASH_MD, options::OPT__SLASH_MDd)) {
       for (const auto &Lib : {"asan_dynamic", "asan_dynamic_runtime_thunk"})
         CmdArgs.push_back(TC.getCompilerRTArgString(Args, Lib));
       // Make sure the dynamic runtime thunk is not optimized out at link time
else
           (Twine("msvc") + MSVT.getAsString() + Twine('-') + ObjFmt).str());
   }
   return Triple.getTriple();
 }
 
 SanitizerMask MSVCToolChain::getSupportedSanitizers() const {
   SanitizerMask Res = ToolChain::getSupportedSanitizers();
   Res |= SanitizerKind::Address;
+  Res |= SanitizerKind::Fuzzer;
+  Res |= SanitizerKind::FuzzerNoLink;
   Res &= ~SanitizerKind::CFIMFCall;
   return Res;
 }
 
 static void TranslateOptArg(Arg *A, llvm::opt::DerivedArgList &DAL,
                             bool SupportsForcingFramePointer,
                             const char *ExpandChar, const OptTable &Opts) {
   assert(A->getOption().matches(options::OPT__SLASH_O));

compiler-rt/trunk/cmake/config-ix.cmake

 if (COMPILER_RT_HAS_SANITIZER_COMMON AND XRAY_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Darwin|Linux|FreeBSD|NetBSD|OpenBSD")
   set(COMPILER_RT_HAS_XRAY TRUE)
 else()
   set(COMPILER_RT_HAS_XRAY FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND FUZZER_SUPPORTED_ARCH AND
-    OS_NAME MATCHES "Android|Darwin|Linux|NetBSD|FreeBSD|OpenBSD|Fuchsia")
+    OS_NAME MATCHES "Android|Darwin|Linux|NetBSD|FreeBSD|OpenBSD|Fuchsia|Windows")
   set(COMPILER_RT_HAS_FUZZER TRUE)
 else()
   set(COMPILER_RT_HAS_FUZZER FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND SHADOWCALLSTACK_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Linux|Android")
   set(COMPILER_RT_HAS_SHADOWCALLSTACK TRUE)
 else()
   set(COMPILER_RT_HAS_SHADOWCALLSTACK FALSE)
 endif()

compiler-rt/trunk/lib/fuzzer/FuzzerDefs.h

 #    define ATTRIBUTE_NO_SANITIZE_ALL
 #  endif
 #else
 #  define ATTRIBUTE_NO_SANITIZE_ALL
 #endif
 
 #if LIBFUZZER_WINDOWS
 #define ATTRIBUTE_INTERFACE __declspec(dllexport)
+// This is used for __sancov_lowest_stack which is needed for
+// -fsanitize-coverage=stack-depth. That feature is not yet available on
+// Windows, so make the symbol static to avoid linking errors.
+#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC \
+  __attribute__((tls_model("initial-exec"))) thread_local static
 #else
 #define ATTRIBUTE_INTERFACE __attribute__((visibility("default")))
+#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC \
+  ATTRIBUTE_INTERFACE __attribute__((tls_model("initial-exec"))) thread_local
 #endif
 
 namespace fuzzer {
 
 template <class T> T Min(T a, T b) { return a < b ? a : b; }
 template <class T> T Max(T a, T b) { return a > b ? a : b; }
 
 class Random;

compiler-rt/trunk/lib/fuzzer/FuzzerIO.h

struct SizedFile {
   size_t Size;
   bool operator<(const SizedFile &B) const { return Size < B.Size; }
 };
 
 void GetSizedFilesFromDir(const std::string &Dir, Vector<SizedFile> *V);
 
 char GetSeparator();
 // Similar to the basename utility: returns the file name w/o the dir prefix.
-std::string Basename(const std::string &Path, char Separator = GetSeparator());
+std::string Basename(const std::string &Path);
 
 FILE* OpenFile(int Fd, const char *Mode);
 
 int CloseFile(int Fd);
 
 int DuplicateFile(int Fd);
 
 void RemoveFile(const std::string &Path);
 
 void DiscardOutput(int Fd);
 
 intptr_t GetHandleFromFd(int fd);
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_IO_H

compiler-rt/trunk/lib/fuzzer/FuzzerIO.cpp

if (size_t Size = FileSize(File))
       V->push_back({File, Size});
 }
 
 std::string DirPlusFile(const std::string &DirPath,
                         const std::string &FileName) {
   return DirPath + GetSeparator() + FileName;
 }
 
-std::string Basename(const std::string &Path, char Separator) {
-  size_t Pos = Path.rfind(Separator);
-  if (Pos == std::string::npos)
-    return Path;
-  assert(Pos < Path.size());
-  return Path.substr(Pos + 1);
-}
-
 void DupAndCloseStderr() {
   int OutputFd = DuplicateFile(2);
   if (OutputFd > 0) {
     FILE *NewOutputFile = OpenFile(OutputFd, "w");
     if (NewOutputFile) {
       OutputFile = NewOutputFile;
       if (EF->__sanitizer_set_report_fd)
         EF->__sanitizer_set_report_fd(

compiler-rt/trunk/lib/fuzzer/FuzzerIOPosix.cpp

 
 size_t FileSize(const std::string &Path) {
   struct stat St;
   if (stat(Path.c_str(), &St))
     return 0;
   return St.st_size;
 }
 
+std::string Basename(const std::string &Path) {
+  size_t Pos = Path.rfind(GetSeparator());
+  if (Pos == std::string::npos) return Path;
+  assert(Pos < Path.size());
+  return Path.substr(Pos + 1);
+}
+
 void ListFilesInDirRecursive(const std::string &Dir, long *Epoch,
                              Vector<std::string> *V, bool TopDir) {
   auto E = GetEpoch(Dir);
   if (Epoch)
     if (E && *Epoch >= E) return;
 
   DIR *D = opendir(Dir.c_str());
   if (!D) {

compiler-rt/trunk/lib/fuzzer/FuzzerIOWindows.cpp

if (Att == INVALID_FILE_ATTRIBUTES) {
     Printf("GetFileAttributesA() failed for \"%s\" (Error code: %lu).\n",
         Path.c_str(), GetLastError());
     return false;
   }
 
   return IsFile(Path, Att);
 }
 
+std::string Basename(const std::string &Path) {
+  size_t Pos = Path.find_last_of("/\\");
+  if (Pos == std::string::npos) return Path;
+  assert(Pos < Path.size());
+  return Path.substr(Pos + 1);
+}
+
+size_t FileSize(const std::string &Path) {
+  WIN32_FILE_ATTRIBUTE_DATA attr;
+  if (!GetFileAttributesExA(Path.c_str(), GetFileExInfoStandard, &attr)) {
+    Printf("GetFileAttributesExA() failed for \"%s\" (Error code: %lu).\n",
+           Path.c_str(), GetLastError());
+    return 0;
+  }
+  ULARGE_INTEGER size;
+  size.HighPart = attr.nFileSizeHigh;
+  size.LowPart = attr.nFileSizeLow;
+  return size.QuadPart;
+}
+
 void ListFilesInDirRecursive(const std::string &Dir, long *Epoch,
                              Vector<std::string> *V, bool TopDir) {
   auto E = GetEpoch(Dir);
   if (Epoch)
     if (E && *Epoch >= E) return;
 
   std::string Path(Dir);
   assert(!Path.empty());

compiler-rt/trunk/lib/fuzzer/FuzzerTracePC.cpp

 // experiments with inlined instrumentation.
 alignas(64) ATTRIBUTE_INTERFACE
 uint8_t __sancov_trace_pc_guard_8bit_counters[fuzzer::TracePC::kNumPCs];
 
 ATTRIBUTE_INTERFACE
 uintptr_t __sancov_trace_pc_pcs[fuzzer::TracePC::kNumPCs];
 
 // Used by -fsanitize-coverage=stack-depth to track stack depth
-ATTRIBUTE_INTERFACE __attribute__((tls_model("initial-exec")))
-thread_local uintptr_t __sancov_lowest_stack;
+ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC uintptr_t __sancov_lowest_stack;
 
 namespace fuzzer {
 
 TracePC TPC;
 
 uint8_t *TracePC::Counters() const {
   return __sancov_trace_pc_guard_8bit_counters;
 }

compiler-rt/trunk/lib/fuzzer/FuzzerUtilWindows.cpp

const void *SearchMemory(const void *Data, size_t DataLen, const void *Patt,
   for (const char *It = Cdata; It < End; ++It)
     if (It[0] == Cpatt[0] && memcmp(It, Cpatt, PattLen) == 0)
       return It;
 
   return NULL;
 }
 
 std::string DisassembleCmd(const std::string &FileName) {
-  if (ExecuteCommand("dumpbin /summary > nul") == 0)
+  Vector<std::string> command_vector;
+  command_vector.push_back("dumpbin /summary > nul");
+  if (ExecuteCommand(Command(command_vector)) == 0)
     return "dumpbin /disasm " + FileName;
   Printf("libFuzzer: couldn't find tool to disassemble (dumpbin)\n");
   exit(1);
 }
 
 std::string SearchRegexCmd(const std::string &Regex) {
   return "findstr /r \"" + Regex + "\"";
 }
 
 } // namespace fuzzer
 
 #endif // LIBFUZZER_WINDOWS

compiler-rt/trunk/lib/fuzzer/tests/CMakeLists.txt

 add_custom_target(FuzzerUnitTests)
 set_target_properties(FuzzerUnitTests PROPERTIES FOLDER "Compiler-RT Tests")
 
 set(LIBFUZZER_UNITTEST_LINK_FLAGS ${COMPILER_RT_UNITTEST_LINK_FLAGS})
 list(APPEND LIBFUZZER_UNITTEST_LINK_FLAGS --driver-mode=g++)
 
 if(APPLE OR CMAKE_SYSTEM_NAME STREQUAL "FreeBSD")
   list(APPEND LIBFUZZER_UNITTEST_LINK_FLAGS -lc++ -lpthread)
+elseif(WIN32)
+  list(APPEND LIBFUZZER_UNITTEST_LINK_FLAGS -lstdc++)
 else()
   list(APPEND LIBFUZZER_UNITTEST_LINK_FLAGS -lstdc++ -lpthread)
 endif()
 
 if("${CMAKE_SYSTEM_NAME}" STREQUAL "Linux" AND COMPILER_RT_LIBCXX_PATH)
   list(APPEND LIBFUZZER_UNITTEST_CFLAGS -nostdinc++ -D_LIBCPP_ABI_VERSION=Fuzzer)
 endif()
 

compiler-rt/trunk/lib/fuzzer/tests/FuzzerUnittest.cpp

 }
 
 TEST(Fuzzer, Basename) {
   EXPECT_EQ(Basename("foo/bar"), "bar");
   EXPECT_EQ(Basename("bar"), "bar");
   EXPECT_EQ(Basename("/bar"), "bar");
   EXPECT_EQ(Basename("foo/x"), "x");
   EXPECT_EQ(Basename("foo/"), "");
+#if LIBFUZZER_WINDOWS
+  EXPECT_EQ(Basename("foo\\bar"), "bar");
+  EXPECT_EQ(Basename("foo\\bar/baz"), "baz");
+  EXPECT_EQ(Basename("\\bar"), "bar");
+  EXPECT_EQ(Basename("foo\\x"), "x");
+  EXPECT_EQ(Basename("foo\\"), "");
+#endif
 }
 
 TEST(Fuzzer, CrossOver) {
   std::unique_ptr<ExternalFunctions> t(new ExternalFunctions());
   fuzzer::EF = t.get();
   Random Rand(0);
   std::unique_ptr<MutationDispatcher> MD(new MutationDispatcher(Rand, {}));
   Unit A({0, 1, 2}), B({5, 6, 7});

compiler-rt/trunk/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

 //===-- sanitizer_coverage_win_sections.cc --------------------------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
-// This file defines delimiters for Sanitizer Coverage's section.
+// This file defines delimiters for Sanitizer Coverage's section. It contains
+// Windows specific tricks to coax the linker into giving us the start and stop
+// addresses of a section, as ELF linkers can do, to get the size of certain
+// arrays. According to https://msdn.microsoft.com/en-us/library/7977wcck.aspx
+// sections with the same name before "$" are sorted alphabetically by the
+// string that comes after "$" and merged into one section. We take advantage
+// of this by putting data we want the size of into the middle (M) of a section,
+// by using the letter "M" after "$". We get the start of this data (ie:
+// __start_section_name) by making the start variable come at the start of the
+// section (using the letter A after "$"). We do the same to get the end of the
+// data by using the letter "Z" after "$" to make the end variable come after
+// the data. Note that because of our technique the address of the start
+// variable is actually the address of data that comes before our middle
+// section. We also need to prevent the linker from adding any padding. Each
+// technique we use for this is explained in the comments below.
 //===----------------------------------------------------------------------===//
 
 #include "sanitizer_platform.h"
 #if SANITIZER_WINDOWS
 #include <stdint.h>
-#pragma section(".SCOV$A", read, write)  // NOLINT
-#pragma section(".SCOV$Z", read, write)  // NOLINT
 extern "C" {
-__declspec(allocate(".SCOV$A")) uint32_t __start___sancov_guards = 0;
-__declspec(allocate(".SCOV$Z")) uint32_t __stop___sancov_guards = 0;
+// The Guard array and counter array should both be merged into the .data
+// section to reduce the number of PE sections However, because PCTable is
+// constant it should be merged with the .rdata section.
+#pragma section(".SCOV$GA", read, write)  // NOLINT
+// Use align(1) to avoid adding any padding that will mess up clients trying to
+// determine the start and end of the array.
+__declspec(allocate(".SCOV$GA")) __declspec(align(1)) uint64_t
+    __start___sancov_guards = 0;
+#pragma section(".SCOV$GZ", read, write)  // NOLINT
+__declspec(allocate(".SCOV$GZ")) __declspec(align(1)) uint64_t
+    __stop___sancov_guards = 0;
+
+#pragma section(".SCOV$CA", read, write)  // NOLINT
+__declspec(allocate(".SCOV$CA")) __declspec(align(1)) uint64_t
+    __start___sancov_cntrs = 0;
+#pragma section(".SCOV$CZ", read, write)  // NOLINT
+__declspec(allocate(".SCOV$CZ")) __declspec(align(1)) uint64_t
+    __stop___sancov_cntrs = 0;
+
+#pragma comment(linker, "/MERGE:.SCOV=.data")
+
+// Use uint64_t so there won't be any issues if the linker tries to word align
+// the pc array.
+#pragma section(".SCOVP$A", read)  // NOLINT
+__declspec(allocate(".SCOVP$A")) __declspec(align(1)) uint64_t
+    __start___sancov_pcs = 0;
+#pragma section(".SCOVP$Z", read)  // NOLINT
+__declspec(allocate(".SCOVP$Z")) __declspec(align(1)) uint64_t
+    __stop___sancov_pcs = 0;
+
+#pragma comment(linker, "/MERGE:.SCOVP=.rdata")
 }
-#endif // SANITIZER_WINDOWS
+#endif  // SANITIZER_WINDOWS

compiler-rt/trunk/test/CMakeLists.txt

if(COMPILER_RT_BUILD_SANITIZERS)
     compiler_rt_test_runtime(interception)
 
     compiler_rt_test_runtime(lsan)
     # CFI tests require diagnostic mode, which is implemented in UBSan.
     compiler_rt_test_runtime(ubsan cfi)
     compiler_rt_test_runtime(sanitizer_common)
 
     # OpenBSD not supporting asan, cannot run the tests
-    if(COMPILER_RT_BUILD_LIBFUZZER AND NOT "${CMAKE_SYSTEM_NAME}" STREQUAL "OpenBSD" AND NOT ANDROID)
+    # Tests are broken for now on Windows
+    if(COMPILER_RT_BUILD_LIBFUZZER
+      AND NOT "${CMAKE_SYSTEM_NAME}" STREQUAL "OpenBSD"
+      AND NOT "${CMAKE_SYSTEM_NAME}" STREQUAL "Windows" AND NOT ANDROID)
       compiler_rt_test_runtime(fuzzer)
     endif()
 
     foreach(sanitizer ${COMPILER_RT_SANITIZERS_TO_BUILD})
       # cfi testing is gated on ubsan
       if(NOT ${sanitizer} STREQUAL cfi)
         compiler_rt_test_runtime(${sanitizer})
       endif()

llvm/trunk/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

 Function *SanitizerCoverageModule::CreateInitCallsForSections(
     Module &M, const char *InitFunctionName, Type *Ty,
     const char *Section) {
   IRBuilder<> IRB(M.getContext());
   auto SecStartEnd = CreateSecStartEnd(M, Section, Ty);
   auto SecStart = SecStartEnd.first;
   auto SecEnd = SecStartEnd.second;
   Function *CtorFunc;
+  auto SecStartPtr = IRB.CreatePointerCast(SecStart, Ty);
+  // Account for the fact that on windows-msvc __start_* symbols actually
+  // point to a uint64_t before the start of the array.
+  if (TargetTriple.getObjectFormat() == Triple::COFF)
+    SecStartPtr = IRB.CreateAdd(SecStartPtr,
+                                ConstantInt::get(IntptrTy, sizeof(uint64_t)));
   std::tie(CtorFunc, std::ignore) = createSanitizerCtorAndInitFunctions(
       M, SanCovModuleCtorName, InitFunctionName, {Ty, Ty},
-      {IRB.CreatePointerCast(SecStart, Ty), IRB.CreatePointerCast(SecEnd, Ty)});
+      {SecStartPtr, IRB.CreatePointerCast(SecEnd, Ty)});
 
   if (TargetTriple.supportsCOMDAT()) {
     // Use comdat to dedup CtorFunc.
     CtorFunc->setComdat(M.getOrInsertComdat(SanCovModuleCtorName));
     appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority, CtorFunc);
   } else {
     appendToGlobalCtors(M, CtorFunc, SanCtorAndDtorPriority);
   }
bool SanitizerCoverageModule::runOnModule(Module &M) {
   if (Function8bitCounterArray)
     Ctor = CreateInitCallsForSections(M, SanCov8bitCountersInitName, Int8PtrTy,
                                       SanCovCountersSectionName);
   if (Ctor && Options.PCTable) {
     auto SecStartEnd = CreateSecStartEnd(M, SanCovPCsSectionName, IntptrPtrTy);
     Function *InitFunction = declareSanitizerInitFunction(
         M, SanCovPCsInitName, {IntptrPtrTy, IntptrPtrTy});
     IRBuilder<> IRBCtor(Ctor->getEntryBlock().getTerminator());
-    IRBCtor.CreateCall(InitFunction,
-                       {IRB.CreatePointerCast(SecStartEnd.first, IntptrPtrTy),
-                        IRB.CreatePointerCast(SecStartEnd.second, IntptrPtrTy)});
+    auto SecStartPtr = IRB.CreatePointerCast(SecStartEnd.first, IntptrPtrTy);
+    // Account for the fact that on windows-msvc __start_pc_table actually
+    // points to a uint64_t before the start of the PC table.
+    if (TargetTriple.getObjectFormat() == Triple::COFF)
+      SecStartPtr = IRB.CreateAdd(SecStartPtr,
+                                  ConstantInt::get(IntptrTy, sizeof(uint64_t)));
+    IRBCtor.CreateCall(
+        InitFunction,
+        {SecStartPtr, IRB.CreatePointerCast(SecStartEnd.second, IntptrPtrTy)});
   }
   // We don't reference these arrays directly in any of our runtime functions,
   // so we need to prevent them from being dead stripped.
   if (TargetTriple.isOSBinFormatMachO())
     appendToUsed(M, GlobalsToAppendToUsed);
   appendToCompilerUsed(M, GlobalsToAppendToCompilerUsed);
   return true;
 }
if (Options.StackDepth && IsEntryBB && !IsLeafFunc) {
     auto Store = ThenIRB.CreateStore(FrameAddrInt, SanCovLowestStack);
     SetNoSanitizeMetadata(LowestStack);
     SetNoSanitizeMetadata(Store);
   }
 }
 
 std::string
 SanitizerCoverageModule::getSectionName(const std::string &Section) const {
-  if (TargetTriple.getObjectFormat() == Triple::COFF)
-    return ".SCOV$M";
+  if (TargetTriple.getObjectFormat() == Triple::COFF) {
+    if (Section == SanCovCountersSectionName)
+      return ".SCOV$CM";
+    if (Section == SanCovPCsSectionName)
+      return ".SCOVP$M";
+    return ".SCOV$GM"; // For SanCovGuardsSectionName.
+  }
   if (TargetTriple.isOSBinFormatMachO())
     return "__DATA,__" + Section;
   return "__" + Section;
 }
 
 std::string
 SanitizerCoverageModule::getSectionStart(const std::string &Section) const {
   if (TargetTriple.isOSBinFormatMachO())

llvm/trunk/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-8bit-counters.ll

+; Checks that the PC and 8-bit Counter Arrays are placed in their own sections in COFF binaries.
+; RUN: opt < %s -sancov -sanitizer-coverage-level=1 -sanitizer-coverage-inline-8bit-counters=1 -sanitizer-coverage-pc-table=1 -S | FileCheck %s
+target datalayout = "e-m:w-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-pc-windows-msvc19.14.26433"
+
+define void @foo() {
+entry:
+  ret void
+}
+
+; CHECK-DAG: section ".SCOV{{\$}}CM",
+; CHECK-DAG: section ".SCOVP{{\$}}M",