[part 1] sancov/inline-bool-flag instrumentation.

[pratyai]

Summary

New SanitizerCoverage feature inline-bool-flag which inserts an atomic store of 1 to a boolean (which is an 8bit integer in practice) flag on every instrumented edge.

Implementation-wise it's very similar to inline-8bit-counters features. So, much of wiring and test just follows the same pattern.

Tested with cmake --build . -- check-llvm.

[pratyai]

Removed some unintentional diffs.

Removed some unintentional diffs from clang/lib/Frontend/CompilerInvocation.cpp.

[pratyai]

Still had a couple of lines of diff left :(

[vitalybuka]

LGTM
would it be possible to split into 3 patches

1. Instrumentation
2. clang flags stuff
3. compiler-rt test

Btw. is this clang formated?

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

484

Int1PtrT?

922

Unordered or even NotAtomic is good enough here

[pratyai]

• Switched to Int1Ty.
• Switched Atomic::NonAtomic (same as just dropping the two lines?)
• C++ files were clang-formatted, but arc lint couldn't find clang-format-diff before. Now it seems to have formatted the lit tests.
• Will split the patch later (i.e. remove all non-instrumentation stuff from this patch, then move flags & compiler-rt tests into two other patches).

[vitalybuka]

clang/test/Driver/autocomplete.c

49 ↗

(On Diff #254418)

probably you didn't add "--style=file"
this dir should not enforce line length

[pratyai]

Undid the arc lint on autocomplete.c.
arc lint does not seem to have an option --style, but it's just one line diff anyway.

[pratyai]

Did the same for fsanitize-coverage.c.

[pratyai]

fsanitize-coverage.c undo was incorrect the first time :(

[pratyai]

And missed a space.
Sorry, I'm just not very familiar with this kind of test, and cannot spot the mistakes before going to the web UI.

[pratyai]

It looks like I broke the tests after the i8 -> i1 switch.

I think it's because of an existing bug. From https://llvm.org/docs/LangRef.html

i1:8:8 - i1 is 8-bit (byte) aligned

OTOH, in SanitizerCoverage.cpp, we have in CreateFunctionLocalArrayInSection():

Array->setAlignment(Align(Ty->isPointerTy()
                             ? DL->getPointerSize()
                             : Ty->getPrimitiveSizeInBits() / 8));

IIUC getPrimitiveSizeInBits() / 8 would be 1 / 8 => 0 for i1 type (it works for other int types which have multiple-of-8 bits.

PLMK if my assessment is correct, and if so if I should fix it in a separate patch, or just keep that in here.

I'll leave this patch "un-split" for now.

Thanks!

[pratyai]

Added the alignment for i1 as a special case.

Also the inline-bool-flag.ll test had to be changed with it. PTAL if I am missing something; I did not expect it to be much diffrerent than inline-8bit-counters.ll, but evidently it is now.

[pratyai]

Added the alignment for i1 as a special case.

Also the inline-bool-flag.ll test had to be changed with it. PTAL if I am missing something; I did not expect it to be much diffrerent than inline-8bit-counters.ll, but evidently it is now.

[pratyai]

Dropped files from outside llvm/.../Instrumentation* as suggested.
The clang flags & compiler-rt tests will be added in future diffs.

[vitalybuka]

In D77244#1956805, @pratyai wrote:

Undid the arc lint on autocomplete.c.
arc lint does not seem to have an option --style, but it's just one line diff anyway.

yep. it had --style LLVM by mistake. I guess it's fixed now.

[vitalybuka]

In D77244#1956930, @pratyai wrote:

It looks like I broke the tests after the i8 -> i1 switch.

I think it's because of an existing bug. From https://llvm.org/docs/LangRef.html

i1:8:8 - i1 is 8-bit (byte) aligned

OTOH, in SanitizerCoverage.cpp, we have in CreateFunctionLocalArrayInSection():

Array->setAlignment(Align(Ty->isPointerTy()
                             ? DL->getPointerSize()
                             : Ty->getPrimitiveSizeInBits() / 8));

IIUC getPrimitiveSizeInBits() / 8 would be 1 / 8 => 0 for i1 type (it works for other int types which have multiple-of-8 bits.

PLMK if my assessment is correct, and if so if I should fix it in a separate patch, or just keep that in here.

I'll leave this patch "un-split" for now.

Thanks!

Looks like a bug.
Separate patch would be nice. If it goes before this one we can expect NOP.
However, if you don't have committer access, I am going to submit this for you, and I can split the patch myself.

[vitalybuka]

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

922

Store->setAtomic(AtomicOrdering::NotAtomic); should be defaul

923

isn't alignment is always 1 which is already default?

[pratyai]

In D77244#1970820, @vitalybuka wrote:

In D77244#1956930, @pratyai wrote:

It looks like I broke the tests after the i8 -> i1 switch.

I think it's because of an existing bug. From https://llvm.org/docs/LangRef.html

i1:8:8 - i1 is 8-bit (byte) aligned

OTOH, in SanitizerCoverage.cpp, we have in CreateFunctionLocalArrayInSection():

Array->setAlignment(Align(Ty->isPointerTy()
                             ? DL->getPointerSize()
                             : Ty->getPrimitiveSizeInBits() / 8));

IIUC getPrimitiveSizeInBits() / 8 would be 1 / 8 => 0 for i1 type (it works for other int types which have multiple-of-8 bits.

PLMK if my assessment is correct, and if so if I should fix it in a separate patch, or just keep that in here.

I'll leave this patch "un-split" for now.

Thanks!

Looks like a bug.
Separate patch would be nice. If it goes before this one we can expect NOP.
However, if you don't have committer access, I am going to submit this for you, and I can split the patch myself.

That'd be cool, thanks!

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

922

Right; dropping.

923

Right; the default is NoneType::None, which is already 1. Dropping.

[pratyai]

oops; forgot that dropping the alignment == 1 ? 1 : alignment / 8 bit off this diff wouldn't work with build.

(running a --check-llvm, but it's a bit slow; if things break I'll update again)

[pratyai]

Adjusted the diff in the change (align 1 is dropped from the llvm instruction of the CHECK). The reason is that it does not get set until setAlignment is explicitly called (ref: https://llvm.org/doxygen/Instructions_8cpp_source.html#l01421). From https://llvm.org/docs/LangRef.html#global-variables

If not present, or if the alignment is set to zero, the alignment of the global is set by the target to whatever it feels convenient. If an explicit alignment is specified, the global is forced to have exactly that alignment.

llvm/include/llvm/Transforms/Instrumentation.h

struct SanitizerCoverageOptions {
   bool TraceBB = false;
   bool TraceCmp = false;
   bool TraceDiv = false;
   bool TraceGep = false;
   bool Use8bitCounters = false;
   bool TracePC = false;
   bool TracePCGuard = false;
   bool Inline8bitCounters = false;
+  bool InlineBoolFlag = false;
   bool PCTable = false;
   bool NoPrune = false;
   bool StackDepth = false;
 
   SanitizerCoverageOptions() = default;
 };
 
 /// Calculate what to divide by to scale counts.

llvm/lib/Transforms/Instrumentation/SanitizerCoverage.cpp

 static const char *const SanCovTraceDiv4 = "__sanitizer_cov_trace_div4";
 static const char *const SanCovTraceDiv8 = "__sanitizer_cov_trace_div8";
 static const char *const SanCovTraceGep = "__sanitizer_cov_trace_gep";
 static const char *const SanCovTraceSwitchName = "__sanitizer_cov_trace_switch";
 static const char *const SanCovModuleCtorTracePcGuardName =
     "sancov.module_ctor_trace_pc_guard";
 static const char *const SanCovModuleCtor8bitCountersName =
     "sancov.module_ctor_8bit_counters";
+static const char *const SanCovModuleCtorBoolFlagName =
+    "sancov.module_ctor_bool_flag";
 static const uint64_t SanCtorAndDtorPriority = 2;
 
 static const char *const SanCovTracePCGuardName =
     "__sanitizer_cov_trace_pc_guard";
 static const char *const SanCovTracePCGuardInitName =
     "__sanitizer_cov_trace_pc_guard_init";
 static const char *const SanCov8bitCountersInitName =
     "__sanitizer_cov_8bit_counters_init";
+static const char *const SanCovBoolFlagInitName =
+    "__sanitizer_cov_bool_flag_init";
 static const char *const SanCovPCsInitName = "__sanitizer_cov_pcs_init";
 
 static const char *const SanCovGuardsSectionName = "sancov_guards";
 static const char *const SanCovCountersSectionName = "sancov_cntrs";
+static const char *const SanCovBoolFlagSectionName = "sancov_bool_flag";
 static const char *const SanCovPCsSectionName = "sancov_pcs";
 
 static const char *const SanCovLowestStackName = "__sancov_lowest_stack";
 
 static cl::opt<int> ClCoverageLevel(
     "sanitizer-coverage-level",
     cl::desc("Sanitizer Coverage. 0: none, 1: entry block, 2: all blocks, "
              "3: all blocks and critical edges"),
     cl::Hidden, cl::init(0));
 
 static cl::opt<bool> ClTracePC("sanitizer-coverage-trace-pc",
                                cl::desc("Experimental pc tracing"), cl::Hidden,
                                cl::init(false));
 
 static cl::opt<bool> ClTracePCGuard("sanitizer-coverage-trace-pc-guard",
                                     cl::desc("pc tracing with a guard"),
                                     cl::Hidden, cl::init(false));
 
 // If true, we create a global variable that contains PCs of all instrumented
 // BBs, put this global into a named section, and pass this section's bounds
 // to __sanitizer_cov_pcs_init.
 // This way the coverage instrumentation does not need to acquire the PCs
-// at run-time. Works with trace-pc-guard and inline-8bit-counters.
+// at run-time. Works with trace-pc-guard, inline-8bit-counters, and
+// inline-bool-flag.
 static cl::opt<bool> ClCreatePCTable("sanitizer-coverage-pc-table",
                                      cl::desc("create a static PC table"),
                                      cl::Hidden, cl::init(false));
 
 static cl::opt<bool>
     ClInline8bitCounters("sanitizer-coverage-inline-8bit-counters",
                          cl::desc("increments 8-bit counter for every edge"),
                          cl::Hidden, cl::init(false));
 
 static cl::opt<bool>
+    ClInlineBoolFlag("sanitizer-coverage-inline-bool-flag",
+                     cl::desc("sets a boolean flag for every edge"), cl::Hidden,
+                     cl::init(false));
+
+static cl::opt<bool>
     ClCMPTracing("sanitizer-coverage-trace-compares",
                  cl::desc("Tracing of CMP and similar instructions"),
                  cl::Hidden, cl::init(false));
 
 static cl::opt<bool> ClDIVTracing("sanitizer-coverage-trace-divs",
                                   cl::desc("Tracing of DIV instructions"),
                                   cl::Hidden, cl::init(false));
 
SanitizerCoverageOptions OverrideFromCL(SanitizerCoverageOptions Options) {
   Options.CoverageType = std::max(Options.CoverageType, CLOpts.CoverageType);
   Options.IndirectCalls |= CLOpts.IndirectCalls;
   Options.TraceCmp |= ClCMPTracing;
   Options.TraceDiv |= ClDIVTracing;
   Options.TraceGep |= ClGEPTracing;
   Options.TracePC |= ClTracePC;
   Options.TracePCGuard |= ClTracePCGuard;
   Options.Inline8bitCounters |= ClInline8bitCounters;
+  Options.InlineBoolFlag |= ClInlineBoolFlag;
   Options.PCTable |= ClCreatePCTable;
   Options.NoPrune |= !ClPruneBlocks;
   Options.StackDepth |= ClStackDepth;
   if (!Options.TracePCGuard && !Options.TracePC &&
-      !Options.Inline8bitCounters && !Options.StackDepth)
+      !Options.Inline8bitCounters && !Options.StackDepth &&
+      !Options.InlineBoolFlag)
     Options.TracePCGuard = true; // TracePCGuard is default.
   return Options;
 }
 
 using DomTreeCallback = function_ref<const DominatorTree *(Function &F)>;
 using PostDomTreeCallback =
     function_ref<const PostDominatorTree *(Function &F)>;
 
private:
   FunctionCallee SanCovTraceCmpFunction[4];
   FunctionCallee SanCovTraceConstCmpFunction[4];
   FunctionCallee SanCovTraceDivFunction[2];
   FunctionCallee SanCovTraceGepFunction;
   FunctionCallee SanCovTraceSwitchFunction;
   GlobalVariable *SanCovLowestStack;
   InlineAsm *EmptyAsm;
   Type *IntptrTy, *IntptrPtrTy, *Int64Ty, *Int64PtrTy, *Int32Ty, *Int32PtrTy,
-      *Int16Ty, *Int8Ty, *Int8PtrTy;
+      *Int16Ty, *Int8Ty, *Int8PtrTy, *Int1Ty, *Int1PtrTy;
   Module *CurModule;
   std::string CurModuleUniqueId;
   Triple TargetTriple;
   LLVMContext *C;
   const DataLayout *DL;
 
   GlobalVariable *FunctionGuardArray;  // for trace-pc-guard.
   GlobalVariable *Function8bitCounterArray;  // for inline-8bit-counters.
+  GlobalVariable *FunctionBoolArray;         // for inline-bool-flag.
   GlobalVariable *FunctionPCsArray;  // for pc-table.
   SmallVector<GlobalValue *, 20> GlobalsToAppendToUsed;
   SmallVector<GlobalValue *, 20> GlobalsToAppendToCompilerUsed;
 
   SanitizerCoverageOptions Options;
 };
 
 class ModuleSanitizerCoverageLegacyPass : public ModulePass {
if (Options.CoverageType == SanitizerCoverageOptions::SCK_None)
     return false;
   C = &(M.getContext());
   DL = &M.getDataLayout();
   CurModule = &M;
   CurModuleUniqueId = getUniqueModuleId(CurModule);
   TargetTriple = Triple(M.getTargetTriple());
   FunctionGuardArray = nullptr;
   Function8bitCounterArray = nullptr;
+  FunctionBoolArray = nullptr;
   FunctionPCsArray = nullptr;
   IntptrTy = Type::getIntNTy(*C, DL->getPointerSizeInBits());
   IntptrPtrTy = PointerType::getUnqual(IntptrTy);
   Type *VoidTy = Type::getVoidTy(*C);
   IRBuilder<> IRB(*C);
   Int64PtrTy = PointerType::getUnqual(IRB.getInt64Ty());
   Int32PtrTy = PointerType::getUnqual(IRB.getInt32Ty());
   Int8PtrTy = PointerType::getUnqual(IRB.getInt8Ty());
+  Int1PtrTy = PointerType::getUnqual(IRB.getInt1Ty());
   Int64Ty = IRB.getInt64Ty();
   Int32Ty = IRB.getInt32Ty();
   Int16Ty = IRB.getInt16Ty();
   Int8Ty = IRB.getInt8Ty();
+  Int1Ty = IRB.getInt1Ty();
 
   SanCovTracePCIndir =
       M.getOrInsertFunction(SanCovTracePCIndirName, VoidTy, IntptrTy);
   // Make sure smaller parameters are zero-extended to i64 as required by the
   // x86_64 ABI.
   AttributeList SanCovTraceCmpZeroExtAL;
   if (TargetTriple.getArch() == Triple::x86_64) {
     SanCovTraceCmpZeroExtAL =
bool ModuleSanitizerCoverage::instrumentModule(
   if (FunctionGuardArray)
     Ctor = CreateInitCallsForSections(M, SanCovModuleCtorTracePcGuardName,
                                       SanCovTracePCGuardInitName, Int32PtrTy,
                                       SanCovGuardsSectionName);
   if (Function8bitCounterArray)
     Ctor = CreateInitCallsForSections(M, SanCovModuleCtor8bitCountersName,
                                       SanCov8bitCountersInitName, Int8PtrTy,
                                       SanCovCountersSectionName);
+  if (FunctionBoolArray) {
+    Ctor = CreateInitCallsForSections(M, SanCovModuleCtorBoolFlagName,
+                                      SanCovBoolFlagInitName, Int1PtrTy,
+                                      SanCovBoolFlagSectionName);
+  }
   if (Ctor && Options.PCTable) {
     auto SecStartEnd = CreateSecStartEnd(M, SanCovPCsSectionName, IntptrPtrTy);
     FunctionCallee InitFunction = declareSanitizerInitFunction(
         M, SanCovPCsInitName, {IntptrPtrTy, IntptrPtrTy});
     IRBuilder<> IRBCtor(Ctor->getEntryBlock().getTerminator());
     IRBCtor.CreateCall(InitFunction, {SecStartEnd.first, SecStartEnd.second});
   }
   // We don't reference these arrays directly in any of our runtime functions,
GlobalVariable *ModuleSanitizerCoverage::CreateFunctionLocalArrayInSection(
 
   if (TargetTriple.supportsCOMDAT() && !F.isInterposable())
     if (auto Comdat =
             GetOrCreateFunctionComdat(F, TargetTriple, CurModuleUniqueId))
       Array->setComdat(Comdat);
   Array->setSection(getSectionName(Section));
   Array->setAlignment(Align(Ty->isPointerTy()
                                 ? DL->getPointerSize()
-                                : Ty->getPrimitiveSizeInBits() / 8));
+                                : ((Ty->getPrimitiveSizeInBits() == 1)
+                                       ? 1
+                                       : Ty->getPrimitiveSizeInBits() / 8)));
   GlobalsToAppendToUsed.push_back(Array);
   GlobalsToAppendToCompilerUsed.push_back(Array);
   MDNode *MD = MDNode::get(F.getContext(), ValueAsMetadata::get(&F));
   Array->addMetadata(LLVMContext::MD_associated, *MD);
 
   return Array;
 }
 
void ModuleSanitizerCoverage::CreateFunctionLocalArrays(
     Function &F, ArrayRef<BasicBlock *> AllBlocks) {
   if (Options.TracePCGuard)
     FunctionGuardArray = CreateFunctionLocalArrayInSection(
         AllBlocks.size(), F, Int32Ty, SanCovGuardsSectionName);
 
   if (Options.Inline8bitCounters)
     Function8bitCounterArray = CreateFunctionLocalArrayInSection(
         AllBlocks.size(), F, Int8Ty, SanCovCountersSectionName);
+  if (Options.InlineBoolFlag)
+    FunctionBoolArray = CreateFunctionLocalArrayInSection(
+        AllBlocks.size(), F, Int1Ty, SanCovBoolFlagSectionName);
 
   if (Options.PCTable)
     FunctionPCsArray = CreatePCArray(F, AllBlocks);
 }
 
 bool ModuleSanitizerCoverage::InjectCoverage(Function &F,
                                              ArrayRef<BasicBlock *> AllBlocks,
                                              bool IsLeafFunc) {

 //   - global cache array that contains CacheSize pointers (zero-initialized).
 //     The cache is used to speed up recording the caller-callee pairs.
 // The address of the caller is passed implicitly via caller PC.
 // CacheSize is encoded in the name of the run-time function.
 void ModuleSanitizerCoverage::InjectCoverageForIndirectCalls(
     Function &F, ArrayRef<Instruction *> IndirCalls) {
   if (IndirCalls.empty())
     return;
-  assert(Options.TracePC || Options.TracePCGuard || Options.Inline8bitCounters);
+  assert(Options.TracePC || Options.TracePCGuard ||
+         Options.Inline8bitCounters || Options.InlineBoolFlag);
   for (auto I : IndirCalls) {
     IRBuilder<> IRB(I);
     CallSite CS(I);
     Value *Callee = CS.getCalledValue();
     if (isa<InlineAsm>(Callee))
       continue;
     IRB.CreateCall(SanCovTracePCIndir, IRB.CreatePointerCast(Callee, IntptrTy));
   }
auto CounterPtr = IRB.CreateGEP(
         Function8bitCounterArray->getValueType(), Function8bitCounterArray,
         {ConstantInt::get(IntptrTy, 0), ConstantInt::get(IntptrTy, Idx)});
     auto Load = IRB.CreateLoad(Int8Ty, CounterPtr);
     auto Inc = IRB.CreateAdd(Load, ConstantInt::get(Int8Ty, 1));
     auto Store = IRB.CreateStore(Inc, CounterPtr);
     SetNoSanitizeMetadata(Load);
     SetNoSanitizeMetadata(Store);
   }
+  if (Options.InlineBoolFlag) {
+    auto FlagPtr = IRB.CreateGEP(
+        FunctionBoolArray->getValueType(), FunctionBoolArray,
+        {ConstantInt::get(IntptrTy, 0), ConstantInt::get(IntptrTy, Idx)});
+    auto Store = IRB.CreateStore(ConstantInt::getTrue(Int1Ty), FlagPtr);
+    SetNoSanitizeMetadata(Store);
+  }
   if (Options.StackDepth && IsEntryBB && !IsLeafFunc) {
     // Check stack depth.  If it's the deepest so far, record it.
     Module *M = F.getParent();
     Function *GetFrameAddr = Intrinsic::getDeclaration(
         M, Intrinsic::frameaddress,
         IRB.getInt8PtrTy(M->getDataLayout().getAllocaAddrSpace()));
     auto FrameAddrPtr =
         IRB.CreateCall(GetFrameAddr, {Constant::getNullValue(Int32Ty)});
     auto FrameAddrInt = IRB.CreatePtrToInt(FrameAddrPtr, IntptrTy);
     auto LowestStack = IRB.CreateLoad(IntptrTy, SanCovLowestStack);
     auto IsStackLower = IRB.CreateICmpULT(FrameAddrInt, LowestStack);
     auto ThenTerm = SplitBlockAndInsertIfThen(IsStackLower, &*IP, false);
     IRBuilder<> ThenIRB(ThenTerm);
     auto Store = ThenIRB.CreateStore(FrameAddrInt, SanCovLowestStack);
     SetNoSanitizeMetadata(LowestStack);
     SetNoSanitizeMetadata(Store);
   }
 }
 
 std::string
 ModuleSanitizerCoverage::getSectionName(const std::string &Section) const {
   if (TargetTriple.isOSBinFormatCOFF()) {
     if (Section == SanCovCountersSectionName)
       return ".SCOV$CM";
+    if (Section == SanCovBoolFlagSectionName)
+      return ".SCOV$BM";
     if (Section == SanCovPCsSectionName)
       return ".SCOVP$M";
     return ".SCOV$GM"; // For SanCovGuardsSectionName.
   }
   if (TargetTriple.isOSBinFormatMachO())
     return "__DATA,__" + Section;
   return "__" + Section;
 }

llvm/test/Instrumentation/SanitizerCoverage/coff-pc-table-inline-bool-flag.ll

+; Checks that the PC and 8-bit Counter Arrays are placed in their own sections in COFF binaries.
+; RUN: opt < %s -sancov -sanitizer-coverage-level=1 -sanitizer-coverage-inline-bool-flag=1 -sanitizer-coverage-pc-table=1 -S | FileCheck %s
+; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=1 -sanitizer-coverage-inline-bool-flag=1 -sanitizer-coverage-pc-table=1 -S | FileCheck %s
+target datalayout = "e-m:w-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-pc-windows-msvc19.14.26433"
+
+define void @foo() {
+entry:
+  ret void
+}
+
+; CHECK-DAG: section ".SCOV{{\$}}BM",
+; CHECK-DAG: section ".SCOVP{{\$}}M",

llvm/test/Instrumentation/SanitizerCoverage/inline-bool-flag.ll

+; Test -sanitizer-coverage-inline-bool-flag=1
+; RUN: opt < %s -sancov -sanitizer-coverage-level=1 -sanitizer-coverage-inline-bool-flag=1  -S | FileCheck %s
+; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=1 -sanitizer-coverage-inline-bool-flag=1  -S | FileCheck %s
+
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
+target triple = "x86_64-unknown-linux-gnu"
+define void @foo() {
+entry:
+; CHECK: @__sancov_gen_ = private global [1 x i1] zeroinitializer, section "__sancov_bool_flag", comdat($foo), align 1, !associated !0
+; CHECK: store i1 true, i1* getelementptr inbounds ([1 x i1], [1 x i1]* @__sancov_gen_, i64 0, i64 0), align 1, !nosanitize !1
+  ret void
+}
+; CHECK: call void @__sanitizer_cov_bool_flag_init(i1* bitcast (i1** @__start___sancov_bool_flag to i1*), i1* bitcast (i1** @__stop___sancov_bool_flag to i1*))

llvm/test/Instrumentation/SanitizerCoverage/pc-table.ll

 ; Test -sanitizer-coverage-pc-table=1
 ; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-trace-pc-guard       -sanitizer-coverage-pc-table=1 -S | FileCheck %s
 ; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-inline-8bit-counters -sanitizer-coverage-pc-table=1 -S | FileCheck %s
+; RUN: opt < %s -sancov -sanitizer-coverage-level=3 -sanitizer-coverage-inline-bool-flag -sanitizer-coverage-pc-table=1 -S | FileCheck %s
 ; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=3 -sanitizer-coverage-trace-pc-guard       -sanitizer-coverage-pc-table=1 -S | FileCheck %s
 ; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=3 -sanitizer-coverage-inline-8bit-counters -sanitizer-coverage-pc-table=1 -S | FileCheck %s
+; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=3 -sanitizer-coverage-inline-bool-flag -sanitizer-coverage-pc-table=1 -S | FileCheck %s
 
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
 target triple = "x86_64-unknown-linux-gnu"
 define void @foo(i32* %a) sanitize_address {
 entry:
   %tobool = icmp eq i32* %a, null
   br i1 %tobool, label %if.end, label %if.then
 

llvm/test/Instrumentation/SanitizerCoverage/trace-pc-guard-inline-bool-flag.ll

+; RUN: opt < %s -sancov -sanitizer-coverage-level=1 -sanitizer-coverage-trace-pc-guard -sanitizer-coverage-inline-bool-flag -S | FileCheck %s
+; RUN: opt < %s -passes='module(sancov-module)' -sanitizer-coverage-level=1 -sanitizer-coverage-trace-pc-guard -sanitizer-coverage-inline-bool-flag -S | FileCheck %s
+
+; Module ctors should have stable names across modules, not something like
+; @sancov.module_ctor.3 that may cause duplicate ctors after linked together.
+
+; CHECK: define internal void @sancov.module_ctor_trace_pc_guard() comdat {
+; CHECK: define internal void @sancov.module_ctor_bool_flag() comdat {
+
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
+target triple = "x86_64-unknown-linux-gnu"
+define void @foo() {
+  ret void
+}