Bug Summary

File:projects/compiler-rt/lib/fuzzer/FuzzerTracePC.h
Warning:line 70, column 7
Excessive padding in 'class fuzzer::TracePC' (987 padding bytes, where 475 is optimal). Optimal fields order: ValueProfileMap, NumPrintNewFuncs, NumModules, NumGuards, NumModulesWithInline8bitCounters, NumInline8bitCounters, NumPCTables, NumPCsInPCTables, InitialStack, ObservedPCs, ObservedFuncs, TORC8, Modules, ModuleCounters, ModulePCTable, TORC4, UseCounters, UseValueProfile, UseClangCoverage, DoPrintNewPCs, TORCW, MMT, consider reordering the fields or adding explicit padding members

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -triple x86_64-pc-linux-gnu -analyze -disable-free -disable-llvm-verifier -discard-value-names -main-file-name FuzzerMutate.cpp -analyzer-store=region -analyzer-opt-analyze-nested-blocks -analyzer-eagerly-assume -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=cplusplus -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -mrelocation-model pic -pic-level 2 -mthread-model posix -mdisable-fp-elim -fmath-errno -masm-verbose -mconstructor-aliases -munwind-tables -fuse-init-array -target-cpu x86-64 -dwarf-column-info -debugger-tuning=gdb -momit-leaf-frame-pointer -ffunction-sections -fdata-sections -resource-dir /usr/lib/llvm-7/lib/clang/7.0.0 -D _DEBUG -D _GNU_SOURCE -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -I /build/llvm-toolchain-snapshot-7~svn329677/build-llvm/projects/compiler-rt/lib/fuzzer -I /build/llvm-toolchain-snapshot-7~svn329677/projects/compiler-rt/lib/fuzzer -I /build/llvm-toolchain-snapshot-7~svn329677/build-llvm/include -I /build/llvm-toolchain-snapshot-7~svn329677/include -U NDEBUG -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/c++/7.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/x86_64-linux-gnu/c++/7.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/x86_64-linux-gnu/c++/7.3.0 -internal-isystem /usr/lib/gcc/x86_64-linux-gnu/7.3.0/../../../../include/c++/7.3.0/backward -internal-isystem /usr/include/clang/7.0.0/include/ -internal-isystem /usr/local/include -internal-isystem /usr/lib/llvm-7/lib/clang/7.0.0/include -internal-externc-isystem /usr/include/x86_64-linux-gnu -internal-externc-isystem /include -internal-externc-isystem /usr/include -O3 -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-comment -Wno-unused-parameter -Wno-unused-parameter -Wwrite-strings -Wno-missing-field-initializers -Wno-long-long -Wno-maybe-uninitialized -Wno-comment -Wno-unused-parameter -Wno-variadic-macros -Wno-non-virtual-dtor -std=c++11 -fdeprecated-macro -fdebug-compilation-dir /build/llvm-toolchain-snapshot-7~svn329677/build-llvm/projects/compiler-rt/lib/fuzzer -ferror-limit 19 -fmessage-length 0 -fvisibility hidden -fvisibility-inlines-hidden -fno-builtin -fobjc-runtime=gcc -fdiagnostics-show-option -vectorize-loops -vectorize-slp -analyzer-checker optin.performance.Padding -analyzer-output=html -analyzer-config stable-report-filename=true -o /tmp/scan-build-2018-04-11-031539-24776-1 -x c++ /build/llvm-toolchain-snapshot-7~svn329677/projects/compiler-rt/lib/fuzzer/FuzzerMutate.cpp
1//===- FuzzerTracePC.h - Internal header for the Fuzzer ---------*- C++ -* ===//
2//
3// The LLVM Compiler Infrastructure
4//
5// This file is distributed under the University of Illinois Open Source
6// License. See LICENSE.TXT for details.
7//
8//===----------------------------------------------------------------------===//
9// fuzzer::TracePC
10//===----------------------------------------------------------------------===//
11
12#ifndef LLVM_FUZZER_TRACE_PC
13#define LLVM_FUZZER_TRACE_PC
14
15#include "FuzzerDefs.h"
16#include "FuzzerDictionary.h"
17#include "FuzzerValueBitMap.h"
18
19#include <set>
20
21namespace fuzzer {
22
23// TableOfRecentCompares (TORC) remembers the most recently performed
24// comparisons of type T.
25// We record the arguments of CMP instructions in this table unconditionally
26// because it seems cheaper this way than to compute some expensive
27// conditions inside __sanitizer_cov_trace_cmp*.
28// After the unit has been executed we may decide to use the contents of
29// this table to populate a Dictionary.
30template<class T, size_t kSizeT>
31struct TableOfRecentCompares {
32 static const size_t kSize = kSizeT;
33 struct Pair {
34 T A, B;
35 };
36 ATTRIBUTE_NO_SANITIZE_ALL
37 void Insert(size_t Idx, const T &Arg1, const T &Arg2) {
38 Idx = Idx % kSize;
39 Table[Idx].A = Arg1;
40 Table[Idx].B = Arg2;
41 }
42
43 Pair Get(size_t I) { return Table[I % kSize]; }
44
45 Pair Table[kSize];
46};
47
48template <size_t kSizeT>
49struct MemMemTable {
50 static const size_t kSize = kSizeT;
51 Word MemMemWords[kSize];
52 Word EmptyWord;
53
54 void Add(const uint8_t *Data, size_t Size) {
55 if (Size <= 2) return;
56 Size = std::min(Size, Word::GetMaxSize());
57 size_t Idx = SimpleFastHash(Data, Size) % kSize;
58 MemMemWords[Idx].Set(Data, Size);
59 }
60 const Word &Get(size_t Idx) {
61 for (size_t i = 0; i < kSize; i++) {
62 const Word &W = MemMemWords[(Idx + i) % kSize];
63 if (W.size()) return W;
64 }
65 EmptyWord.Set(nullptr, 0);
66 return EmptyWord;
67 }
68};
69
70class TracePC {
Excessive padding in 'class fuzzer::TracePC' (987 padding bytes, where 475 is optimal). Optimal fields order: ValueProfileMap, NumPrintNewFuncs, NumModules, NumGuards, NumModulesWithInline8bitCounters, NumInline8bitCounters, NumPCTables, NumPCsInPCTables, InitialStack, ObservedPCs, ObservedFuncs, TORC8, Modules, ModuleCounters, ModulePCTable, TORC4, UseCounters, UseValueProfile, UseClangCoverage, DoPrintNewPCs, TORCW, MMT, consider reordering the fields or adding explicit padding members
71 public:
72 static const size_t kNumPCs = 1 << 21;
73 // How many bits of PC are used from __sanitizer_cov_trace_pc.
74 static const size_t kTracePcBits = 18;
75
76 void HandleInit(uint32_t *Start, uint32_t *Stop);
77 void HandleInline8bitCountersInit(uint8_t *Start, uint8_t *Stop);
78 void HandlePCsInit(const uintptr_t *Start, const uintptr_t *Stop);
79 void HandleCallerCallee(uintptr_t Caller, uintptr_t Callee);
80 template <class T> void HandleCmp(uintptr_t PC, T Arg1, T Arg2);
81 size_t GetTotalPCCoverage();
82 void SetUseCounters(bool UC) { UseCounters = UC; }
83 void SetUseClangCoverage(bool UCC) { UseClangCoverage = UCC; }
84 void SetUseValueProfile(bool VP) { UseValueProfile = VP; }
85 void SetPrintNewPCs(bool P) { DoPrintNewPCs = P; }
86 void SetPrintNewFuncs(size_t P) { NumPrintNewFuncs = P; }
87 void UpdateObservedPCs();
88 template <class Callback> void CollectFeatures(Callback CB) const;
89
90 void ResetMaps() {
91 ValueProfileMap.Reset();
92 if (NumModules)
93 memset(Counters(), 0, GetNumPCs());
94 ClearExtraCounters();
95 ClearInlineCounters();
96 if (UseClangCoverage)
97 ClearClangCounters();
98 }
99
100 void ClearInlineCounters();
101
102 void UpdateFeatureSet(size_t CurrentElementIdx, size_t CurrentElementSize);
103 void PrintFeatureSet();
104
105 void PrintModuleInfo();
106
107 void PrintCoverage();
108 void DumpCoverage();
109
110 void AddValueForMemcmp(void *caller_pc, const void *s1, const void *s2,
111 size_t n, bool StopAtZero);
112
113 TableOfRecentCompares<uint32_t, 32> TORC4;
114 TableOfRecentCompares<uint64_t, 32> TORC8;
115 TableOfRecentCompares<Word, 32> TORCW;
116 MemMemTable<1024> MMT;
117
118 size_t GetNumPCs() const {
119 return NumGuards == 0 ? (1 << kTracePcBits) : Min(kNumPCs, NumGuards + 1);
120 }
121 uintptr_t GetPC(size_t Idx) {
122 assert(Idx < GetNumPCs())(static_cast <bool> (Idx < GetNumPCs()) ? void (0) :
__assert_fail ("Idx < GetNumPCs()", "/build/llvm-toolchain-snapshot-7~svn329677/projects/compiler-rt/lib/fuzzer/FuzzerTracePC.h"
, 122, __extension__ __PRETTY_FUNCTION__))
;
123 return PCs()[Idx];
124 }
125
126 void RecordInitialStack();
127 uintptr_t GetMaxStackOffset() const;
128
129 template<class CallBack>
130 void ForEachObservedPC(CallBack CB) {
131 for (auto PC : ObservedPCs)
132 CB(PC);
133 }
134
135private:
136 bool UseCounters = false;
137 bool UseValueProfile = false;
138 bool UseClangCoverage = false;
139 bool DoPrintNewPCs = false;
140 size_t NumPrintNewFuncs = 0;
141
142 struct Module {
143 uint32_t *Start, *Stop;
144 };
145
146 Module Modules[4096];
147 size_t NumModules; // linker-initialized.
148 size_t NumGuards; // linker-initialized.
149
150 struct { uint8_t *Start, *Stop; } ModuleCounters[4096];
151 size_t NumModulesWithInline8bitCounters; // linker-initialized.
152 size_t NumInline8bitCounters;
153
154 struct PCTableEntry {
155 uintptr_t PC, PCFlags;
156 };
157
158 struct { const PCTableEntry *Start, *Stop; } ModulePCTable[4096];
159 size_t NumPCTables;
160 size_t NumPCsInPCTables;
161
162 uint8_t *Counters() const;
163 uintptr_t *PCs() const;
164
165 Set<uintptr_t> ObservedPCs;
166 Set<uintptr_t> ObservedFuncs;
167
168 ValueBitMap ValueProfileMap;
169 uintptr_t InitialStack;
170};
171
172template <class Callback>
173// void Callback(size_t FirstFeature, size_t Idx, uint8_t Value);
174ATTRIBUTE_NO_SANITIZE_ALL
175void ForEachNonZeroByte(const uint8_t *Begin, const uint8_t *End,
176 size_t FirstFeature, Callback Handle8bitCounter) {
177 typedef uintptr_t LargeType;
178 const size_t Step = sizeof(LargeType) / sizeof(uint8_t);
179 const size_t StepMask = Step - 1;
180 auto P = Begin;
181 // Iterate by 1 byte until either the alignment boundary or the end.
182 for (; reinterpret_cast<uintptr_t>(P) & StepMask && P < End; P++)
183 if (uint8_t V = *P)
184 Handle8bitCounter(FirstFeature, P - Begin, V);
185
186 // Iterate by Step bytes at a time.
187 for (; P < End; P += Step)
188 if (LargeType Bundle = *reinterpret_cast<const LargeType *>(P))
189 for (size_t I = 0; I < Step; I++, Bundle >>= 8)
190 if (uint8_t V = Bundle & 0xff)
191 Handle8bitCounter(FirstFeature, P - Begin + I, V);
192
193 // Iterate by 1 byte until the end.
194 for (; P < End; P++)
195 if (uint8_t V = *P)
196 Handle8bitCounter(FirstFeature, P - Begin, V);
197}
198
199// Given a non-zero Counter returns a number in the range [0,7].
200template<class T>
201unsigned CounterToFeature(T Counter) {
202 // Returns a feature number by placing Counters into buckets as illustrated
203 // below.
204 //
205 // Counter bucket: [1] [2] [3] [4-7] [8-15] [16-31] [32-127] [128+]
206 // Feature number: 0 1 2 3 4 5 6 7
207 //
208 // This is a heuristic taken from AFL (see
209 // http://lcamtuf.coredump.cx/afl/technical_details.txt).
210 //
211 // This implementation may change in the future so clients should
212 // not rely on it.
213 assert(Counter)(static_cast <bool> (Counter) ? void (0) : __assert_fail
("Counter", "/build/llvm-toolchain-snapshot-7~svn329677/projects/compiler-rt/lib/fuzzer/FuzzerTracePC.h"
, 213, __extension__ __PRETTY_FUNCTION__))
;
214 unsigned Bit = 0;
215 /**/ if (Counter >= 128) Bit = 7;
216 else if (Counter >= 32) Bit = 6;
217 else if (Counter >= 16) Bit = 5;
218 else if (Counter >= 8) Bit = 4;
219 else if (Counter >= 4) Bit = 3;
220 else if (Counter >= 3) Bit = 2;
221 else if (Counter >= 2) Bit = 1;
222 return Bit;
223}
224
225template <class Callback> // void Callback(size_t Feature)
226ATTRIBUTE_NO_SANITIZE_ADDRESS__attribute__((no_sanitize_address))
227__attribute__((noinline))
228void TracePC::CollectFeatures(Callback HandleFeature) const {
229 uint8_t *Counters = this->Counters();
230 size_t N = GetNumPCs();
231 auto Handle8bitCounter = [&](size_t FirstFeature,
232 size_t Idx, uint8_t Counter) {
233 if (UseCounters)
234 HandleFeature(FirstFeature + Idx * 8 + CounterToFeature(Counter));
235 else
236 HandleFeature(FirstFeature + Idx);
237 };
238
239 size_t FirstFeature = 0;
240
241 if (!NumInline8bitCounters) {
242 ForEachNonZeroByte(Counters, Counters + N, FirstFeature, Handle8bitCounter);
243 FirstFeature += N * 8;
244 }
245
246 if (NumInline8bitCounters) {
247 for (size_t i = 0; i < NumModulesWithInline8bitCounters; i++) {
248 ForEachNonZeroByte(ModuleCounters[i].Start, ModuleCounters[i].Stop,
249 FirstFeature, Handle8bitCounter);
250 FirstFeature += 8 * (ModuleCounters[i].Stop - ModuleCounters[i].Start);
251 }
252 }
253
254 if (size_t NumClangCounters = ClangCountersEnd() - ClangCountersBegin()) {
255 auto P = ClangCountersBegin();
256 for (size_t Idx = 0; Idx < NumClangCounters; Idx++)
257 if (auto Cnt = P[Idx]) {
258 if (UseCounters)
259 HandleFeature(FirstFeature + Idx * 8 + CounterToFeature(Cnt));
260 else
261 HandleFeature(FirstFeature + Idx);
262 }
263 FirstFeature += NumClangCounters;
264 }
265
266 ForEachNonZeroByte(ExtraCountersBegin(), ExtraCountersEnd(), FirstFeature,
267 Handle8bitCounter);
268 FirstFeature += (ExtraCountersEnd() - ExtraCountersBegin()) * 8;
269
270 if (UseValueProfile) {
271 ValueProfileMap.ForEach([&](size_t Idx) {
272 HandleFeature(FirstFeature + Idx);
273 });
274 FirstFeature += ValueProfileMap.SizeInBits();
275 }
276
277 // Step function, grows similar to 8 * Log_2(A).
278 auto StackDepthStepFunction = [](uint32_t A) -> uint32_t {
279 if (!A) return A;
280 uint32_t Log2 = Log(A);
281 if (Log2 < 3) return A;
282 Log2 -= 3;
283 return (Log2 + 1) * 8 + ((A >> Log2) & 7);
284 };
285 assert(StackDepthStepFunction(1024) == 64)(static_cast <bool> (StackDepthStepFunction(1024) == 64
) ? void (0) : __assert_fail ("StackDepthStepFunction(1024) == 64"
, "/build/llvm-toolchain-snapshot-7~svn329677/projects/compiler-rt/lib/fuzzer/FuzzerTracePC.h"
, 285, __extension__ __PRETTY_FUNCTION__))
;
286 assert(StackDepthStepFunction(1024 * 4) == 80)(static_cast <bool> (StackDepthStepFunction(1024 * 4) ==
80) ? void (0) : __assert_fail ("StackDepthStepFunction(1024 * 4) == 80"
, "/build/llvm-toolchain-snapshot-7~svn329677/projects/compiler-rt/lib/fuzzer/FuzzerTracePC.h"
, 286, __extension__ __PRETTY_FUNCTION__))
;
287 assert(StackDepthStepFunction(1024 * 1024) == 144)(static_cast <bool> (StackDepthStepFunction(1024 * 1024
) == 144) ? void (0) : __assert_fail ("StackDepthStepFunction(1024 * 1024) == 144"
, "/build/llvm-toolchain-snapshot-7~svn329677/projects/compiler-rt/lib/fuzzer/FuzzerTracePC.h"
, 287, __extension__ __PRETTY_FUNCTION__))
;
288
289 if (auto MaxStackOffset = GetMaxStackOffset())
290 HandleFeature(FirstFeature + StackDepthStepFunction(MaxStackOffset / 8));
291}
292
293extern TracePC TPC;
294
295} // namespace fuzzer
296
297#endif // LLVM_FUZZER_TRACE_PC