Understanding the Difference in Instrumentation Edge Count Between LTO and Classic Modes #2285
Replies: 2 comments · 4 replies
-
|
Suggest that you can read Based on LTO feature provided by LLVM, the instrumentation pass can be mounted and work on almost whole-program, but per compilation unit in classic mode. It's different optimize pipeline from LLVM toolchain that matters mostly, not the pass itself load from AFL++. AFLplusplus/instrumentation/SanitizerCoveragePCGUARD.so.cc Lines 228 to 232 in 4eaacfb AFLplusplus/instrumentation/SanitizerCoverageLTO.so.cc Lines 351 to 355 in 4eaacfb |
Beta Was this translation helpful? Give feedback.
-
|
I might not have expressed myself clearly earlier. I understand that the LTO mode is based on LLVM's link-time optimization. However, I’m puzzled as to why, for some large-scale programs, the number of edges instrumented in LTO mode is greater than that in classic mode or PCGuard mode. Intuitively, the number of edges instrumented in LTO mode should be fewer because LTO performs optimizations to simplify the program. Is my understanding correct? |
Beta Was this translation helpful? Give feedback.
-
|
classic mode has colliding coverage and for even a medium sized project (ffmpeg is large) you will have will loose coverage information because of this. LTO does not have this issue so naturally you see more edges and more paths. |
Beta Was this translation helpful? Give feedback.
-
|
also classic mode always has 65536 edges, so you never know how many edges there really would be ... 10, 1000000 .... |
Beta Was this translation helpful? Give feedback.
-
|
I understand that. I’ve rewritten the pass based on Classic instrumentation and recalculated the number of edges. The result shows fewer edges compared to the LTO mode. Is this behavior normal? |
Beta Was this translation helpful? Give feedback.
-
|
I have no clue what you did and numbers etc so I am unable to go deeper than what I wrote |
Beta Was this translation helpful? Give feedback.
-
Hello, when using the LTO mode to instrument large-scale programs like FFmpeg, I found that the number of edges instrumented by LTO mode is greater than the number of edges recorded with the classic mode. My understanding is that LTO mode optimizes the program, making the control flow graph (CFG) more complex, which increases the number of edges. Is my understanding correct? If not, why does LTO mode result in more edges being instrumented compared to classic mode? Additionally, does LTO mode adopt a strategy for simplified instrumentation?
Beta Was this translation helpful? Give feedback.
All reactions