Trace cmp substrate

Benchmarks/CoverageBenchmarks/CoverageBenchmarks.swift

@@ -93,7 +93,7 @@ let benchmarks: @Sendable () -> Void = {
             let result = try await fuzz(
                 duration: .seconds(0.1),
                 persistence: .ephemeral,
-                coverageStrategy: .newEdge
+                scheduler: MutationScheduler.weightedPool(coverageStrategy: .newEdge)
             ) { (input: Int) in
                 blackHole(input)
             }
@@ -140,7 +140,7 @@ let benchmarks: @Sendable () -> Void = {
             let result = try await fuzz(
                 duration: .seconds(0.1),
                 persistence: .ephemeral,
-                coverageStrategy: CoverageStrategy(onEdge: { edge, _ in blackHole(edge) }) { _ in false }
+                scheduler: MutationScheduler.weightedPool(coverageStrategy: CoverageStrategy(onEdge: { edge, _ in blackHole(edge) }) { _ in false })
             ) { (input: Int) in
                 blackHole(input)
             }
@@ -182,7 +182,7 @@ let benchmarks: @Sendable () -> Void = {
             let result = try await fuzz(
                 duration: .seconds(0.1),
                 persistence: .ephemeral,
-                coverageStrategy: .pathTrie
+                scheduler: MutationScheduler.weightedPool(coverageStrategy: .pathTrie)
             ) { (input: Int) in
                 blackHole(input)
             }

Benchmarks/ProfiledBenchmark/ProfiledBenchmark.swift

@@ -49,7 +49,8 @@ let benchmarks: @Sendable () -> Void = {
             let startWall = DispatchTime.now().uptimeNanoseconds
 
             let result = try await fuzz(
-                duration: .seconds(0.1), persistence: .replace, coverageStrategy: .pathTrie
+                duration: .seconds(0.1), persistence: .replace,
+                scheduler: MutationScheduler.weightedPool(coverageStrategy: .pathTrie)
             ) { (input: Int) in
                 blackHole(input)
             }

LLVMPasses/EmitCmpTrace.cpp

@@ -0,0 +1,125 @@
+// Out-of-tree LLVM pass plugin: emit __sanitizer_cov_trace_cmp* callbacks
+// ourselves for the comparisons we care about, replacing SanitizerCoverage's
+// trace-cmp emission. Build the SUT with `-sanitize-coverage=edge,pc-table`
+// (NO trace-cmp) and load this plugin; it emits cmp callbacks for every integer
+// comparison EXCEPT trap guards (bounds / overflow / precondition checks, whose
+// branch reaches `unreachable`). Faithful to InjectTraceForCmp otherwise.
+
+#include "llvm/ADT/SmallVector.h"
+#include "llvm/IR/DataLayout.h"
+#include "llvm/IR/Function.h"
+#include "llvm/IR/IRBuilder.h"
+#include "llvm/IR/Instructions.h"
+#include "llvm/IR/Module.h"
+#include "llvm/IR/PassManager.h"
+#include "llvm/Passes/PassBuilder.h"
+#include "llvm/Passes/PassPlugin.h"
+#include "llvm/Support/Compiler.h"
+
+using namespace llvm;
+
+namespace {
+
+// True iff following single-successor edges from BB reaches an `unreachable`
+// terminator within MaxDepth hops. Swift lowers cond_fail (bounds/overflow/
+// precondition checks) to a branch whose failure edge runs — directly or via an
+// empty split critical edge + shared trap merge block — into a
+// _fatalErrorMessage/llvm.trap block ending in `unreachable`.
+static bool reachesUnreachable(const BasicBlock *BB, unsigned MaxDepth) {
+  for (unsigned I = 0; BB && I <= MaxDepth; ++I) {
+    if (isa<UnreachableInst>(BB->getTerminator()))
+      return true;
+    BB = BB->getSingleSuccessor();
+  }
+  return false;
+}
+
+static bool isTrapGuard(ICmpInst *CMP) {
+  if (!CMP->hasOneUse())
+    return false;
+  auto *BR = dyn_cast<BranchInst>(CMP->user_back());
+  if (!BR || !BR->isConditional())
+    return false;
+  for (BasicBlock *Succ : BR->successors())
+    if (reachesUnreachable(Succ, /*MaxDepth=*/3))
+      return true;
+  return false;
+}
+
+struct EmitCmpTrace : PassInfoMixin<EmitCmpTrace> {
+  PreservedAnalyses run(Module &M, ModuleAnalysisManager &) {
+    LLVMContext &Ctx = M.getContext();
+    const DataLayout &DL = M.getDataLayout();
+    Type *VoidTy = Type::getVoidTy(Ctx);
+    IntegerType *IntTys[4] = {Type::getInt8Ty(Ctx), Type::getInt16Ty(Ctx),
+                              Type::getInt32Ty(Ctx), Type::getInt64Ty(Ctx)};
+    const char *CmpNames[4] = {
+        "__sanitizer_cov_trace_cmp1", "__sanitizer_cov_trace_cmp2",
+        "__sanitizer_cov_trace_cmp4", "__sanitizer_cov_trace_cmp8"};
+    const char *ConstNames[4] = {"__sanitizer_cov_trace_const_cmp1",
+                                 "__sanitizer_cov_trace_const_cmp2",
+                                 "__sanitizer_cov_trace_const_cmp4",
+                                 "__sanitizer_cov_trace_const_cmp8"};
+    FunctionCallee CmpFn[4], ConstFn[4];
+    for (int i = 0; i < 4; ++i) {
+      FunctionType *FT = FunctionType::get(VoidTy, {IntTys[i], IntTys[i]}, false);
+      CmpFn[i] = M.getOrInsertFunction(CmpNames[i], FT);
+      ConstFn[i] = M.getOrInsertFunction(ConstNames[i], FT);
+    }
+
+    bool Changed = false;
+    for (Function &F : M) {
+      if (F.isDeclaration())
+        continue;
+      if (F.getName().starts_with("__sanitizer_"))
+        continue;
+      if (F.hasFnAttribute(Attribute::NoSanitizeCoverage))
+        continue;
+
+      SmallVector<ICmpInst *, 16> Targets;
+      for (BasicBlock &BB : F)
+        for (Instruction &I : BB)
+          if (auto *CMP = dyn_cast<ICmpInst>(&I))
+            if (!isTrapGuard(CMP))
+              Targets.push_back(CMP);
+
+      for (ICmpInst *CMP : Targets) {
+        Value *A0 = CMP->getOperand(0);
+        Value *A1 = CMP->getOperand(1);
+        if (!A0->getType()->isIntegerTy())
+          continue;
+        uint64_t TS = DL.getTypeStoreSizeInBits(A0->getType());
+        int Idx = TS == 8 ? 0 : TS == 16 ? 1 : TS == 32 ? 2 : TS == 64 ? 3 : -1;
+        if (Idx < 0)
+          continue;
+        bool C0 = isa<ConstantInt>(A0), C1 = isa<ConstantInt>(A1);
+        if (C0 && C1)
+          continue; // both const: nothing to learn
+        FunctionCallee Fn = CmpFn[Idx];
+        if (C0 || C1) {
+          Fn = ConstFn[Idx];
+          if (C1)
+            std::swap(A0, A1); // const goes first, matching SanCov
+        }
+        IRBuilder<> IRB(CMP);
+        Type *Ty = IntTys[Idx];
+        IRB.CreateCall(Fn, {IRB.CreateIntCast(A0, Ty, /*isSigned=*/true),
+                            IRB.CreateIntCast(A1, Ty, /*isSigned=*/true)});
+        Changed = true;
+      }
+    }
+    return Changed ? PreservedAnalyses::none() : PreservedAnalyses::all();
+  }
+};
+
+} // namespace
+
+extern "C" LLVM_ATTRIBUTE_WEAK ::llvm::PassPluginLibraryInfo
+llvmGetPassPluginInfo() {
+  return {LLVM_PLUGIN_API_VERSION, "EmitCmpTrace", "0.1",
+          [](PassBuilder &PB) {
+            PB.registerOptimizerLastEPCallback(
+                [](ModulePassManager &MPM, OptimizationLevel,
+                   ThinOrFullLTOPhase) { MPM.addPass(EmitCmpTrace()); });
+          }};
+}

LLVMPasses/TagCompilerGenerated.cpp

@@ -0,0 +1,94 @@
+// Out-of-tree LLVM pass plugin: tag compiler-generated Swift functions with
+// `nosanitize_coverage` BEFORE SanitizerCoverage runs, so SanCov emits no edge
+// guards / pc-table entries (and no cmp callbacks) for them. This replaces the
+// RUNTIME edge filter (SanCovHooks.c: g_edge_state / sancov_apply_edge_filter /
+// sancov_is_compiler_generated) with a compile-time decision.
+//
+// The name patterns are ported verbatim from sancov_is_compiler_generated.
+// MUST run at OptimizerLast (after coroutine splitting, so async funclet names
+// like ...TQ3_ exist) and before SanitizerCoverage (plugin EP callbacks are
+// registered ahead of Swift's, so this pass runs first at OptimizerLast).
+
+#include "llvm/ADT/StringRef.h"
+#include "llvm/IR/Function.h"
+#include "llvm/IR/Module.h"
+#include "llvm/IR/PassManager.h"
+#include "llvm/Passes/PassBuilder.h"
+#include "llvm/Passes/PassPlugin.h"
+#include "llvm/Support/Compiler.h"
+
+using namespace llvm;
+
+namespace {
+
+// Verbatim port of SanCovHooks.c `sancov_is_compiler_generated`, operating on
+// the function's mangled name. Async continuation edges (T[QY]<n>_) are filtered
+// for pathTrie determinism, not just noise — keep parity exact.
+static bool isCompilerGenerated(StringRef N) {
+  if (N.starts_with("__swift_"))
+    return true;
+  if (N.starts_with("_swift_"))
+    return true;
+  size_t len = N.size();
+  if (len < 3)
+    return false;
+
+  if (N.ends_with("Wl") || N.ends_with("WL") || N.ends_with("Ma"))
+    return true;
+  // WO + specifier (all outlined operations: WOh/c/d/r/b/e/...)
+  if (N[len - 3] == 'W' && N[len - 2] == 'O')
+    return true;
+  if (N.ends_with("TA") || N.ends_with("TR") || N.ends_with("TK") ||
+      N.ends_with("Mr"))
+    return true;
+  if (N.contains("TATQ") || N.contains("TATY") || N.contains("TRTQ") ||
+      N.contains("TRTY"))
+    return true;
+  // global/static variable addressor
+  if (N.ends_with("vau"))
+    return true;
+
+  // bare async resume/yield: ...T[QY]<digits>_
+  if (len >= 4 && N[len - 1] == '_') {
+    size_t p = len - 2;
+    while (p > 0 && N[p] >= '0' && N[p] <= '9')
+      --p;
+    if (p >= 1 && (N[p] == 'Q' || N[p] == 'Y') && N[p - 1] == 'T')
+      return true;
+  }
+
+  // default argument generator: ...fA_ or ...fA<digit>_
+  if (N[len - 3] == 'f' && N[len - 2] == 'A' && N[len - 1] == '_')
+    return true;
+  if (len >= 4 && N[len - 4] == 'f' && N[len - 3] == 'A' && N[len - 1] == '_')
+    return true;
+
+  return false;
+}
+
+struct TagCompilerGenerated : PassInfoMixin<TagCompilerGenerated> {
+  PreservedAnalyses run(Module &M, ModuleAnalysisManager &) {
+    for (Function &F : M) {
+      if (F.isDeclaration())
+        continue;
+      if (F.hasFnAttribute(Attribute::NoSanitizeCoverage))
+        continue;
+      if (isCompilerGenerated(F.getName()))
+        F.addFnAttr(Attribute::NoSanitizeCoverage);
+    }
+    // Only function attributes change; no IR/CFG mutation.
+    return PreservedAnalyses::all();
+  }
+};
+
+} // namespace
+
+extern "C" LLVM_ATTRIBUTE_WEAK ::llvm::PassPluginLibraryInfo
+llvmGetPassPluginInfo() {
+  return {LLVM_PLUGIN_API_VERSION, "TagCompilerGenerated", "0.1",
+          [](PassBuilder &PB) {
+            PB.registerOptimizerLastEPCallback(
+                [](ModulePassManager &MPM, OptimizationLevel,
+                   ThinOrFullLTOPhase) { MPM.addPass(TagCompilerGenerated()); });
+          }};
+}

Package.swift

@@ -2,6 +2,35 @@
 // The swift-tools-version declares the minimum version of Swift required to build this package.
 
 import PackageDescription
+import Foundation
+
+// Compile-time coverage instrumentation is provided by two out-of-tree LLVM
+// pass plugins (sources in LLVMPasses/, built by scripts/build-llvm-plugins.sh
+// into .build/llvm-plugins). They replace the former runtime filters that used
+// to live in SanCovHooks.c:
+//   TagCompilerGenerated — tags compiler-generated functions NoSanitizeCoverage
+//                          so SanCov emits no edge/cmp guards for them (compile-
+//                          time edge filter; async resume/yield edges stay out,
+//                          preserving pathTrie determinism). MUST load first so
+//                          EmitCmpTrace also skips those functions.
+//   EmitCmpTrace         — emits __sanitizer_cov_trace_cmp* ourselves for the
+//                          comparisons we want, dropping trap-guard cmps
+//                          (bounds/overflow/precondition). Used INSTEAD of
+//                          `-sanitize-coverage=…,trace-cmp`.
+// build-local-toolchain.sh builds the plugins before compiling; for a raw
+// `swift build` run scripts/build-llvm-plugins.sh first.
+let pluginDir = URL(fileURLWithPath: #filePath)
+    .deletingLastPathComponent()
+    .appendingPathComponent(".build/llvm-plugins")
+func loadPass(_ name: String) -> [String] {
+    ["-Xfrontend", "-load-pass-plugin=\(pluginDir.appendingPathComponent(name + ".dylib").path)"]
+}
+
+// Edge coverage with the compile-time compiler-generated filter.
+let edgeCoverage: [String] =
+    ["-sanitize=undefined", "-sanitize-coverage=edge,pc-table"] + loadPass("TagCompilerGenerated")
+// Edge + comparison coverage (the cmp channel via EmitCmpTrace, not stock trace-cmp).
+let edgeCmpCoverage: [String] = edgeCoverage + loadPass("EmitCmpTrace")
 
 let package = Package(
     name: "PropertyTestingKit",
@@ -132,10 +161,10 @@ let package = Package(
             ],
             exclude: ["Corpus", "Fuzzing/Corpus"],
             swiftSettings: [
-                .unsafeFlags([
-                    "-sanitize=undefined",
-                    "-sanitize-coverage=edge,pc-table"
-                ])
+                // edge + comparison coverage; the cmp channel (via EmitCmpTrace)
+                // lets the input-to-state integration tests exercise the real cmp
+                // hooks (FuzzInputToStateTests fuzzes a magic-value SUT in-target).
+                .unsafeFlags(edgeCmpCoverage)
             ]
         ),
         .testTarget(
@@ -148,10 +177,7 @@ let package = Package(
                 .product(name: "Clocks", package: "swift-clocks"),
             ],
             swiftSettings: [
-                .unsafeFlags([
-                    "-sanitize=undefined",
-                    "-sanitize-coverage=edge,pc-table"
-                ])
+                .unsafeFlags(edgeCoverage)
             ]
         ),
         .testTarget(
@@ -163,10 +189,7 @@ let package = Package(
             ],
             exclude: ["Corpus"],
             swiftSettings: [
-                .unsafeFlags([
-                    "-sanitize=undefined",
-                    "-sanitize-coverage=edge,pc-table"
-                ])
+                .unsafeFlags(edgeCoverage)
             ]
         ),
         .testTarget(
@@ -177,10 +200,7 @@ let package = Package(
             ],
             swiftSettings: [
                 // Enable sanitizer coverage for thread-local coverage testing
-                .unsafeFlags([
-                    "-sanitize=undefined",
-                    "-sanitize-coverage=edge,pc-table"
-                ])
+                .unsafeFlags(edgeCoverage)
             ]
         ),
         // TSanTests: Race condition tests that exercise concurrent code paths.
@@ -205,10 +225,7 @@ let package = Package(
             ],
             swiftSettings: [
                 .swiftLanguageMode(.v5),
-                .unsafeFlags([
-                    "-sanitize=undefined",
-                    "-sanitize-coverage=edge,pc-table"
-                ])
+                .unsafeFlags(edgeCoverage)
             ]
         ),
         .testTarget(
@@ -238,11 +255,7 @@ package.targets += [
         swiftSettings: [
             // Enable sanitizer coverage so we have realistic counter counts
             // Note: sanitize-coverage requires a sanitizer to be enabled
-            .unsafeFlags([
-                "-O",
-                "-sanitize=undefined",
-                "-sanitize-coverage=edge,pc-table"
-            ])
+            .unsafeFlags(["-O"] + edgeCoverage)
         ],
         linkerSettings: [
             // Add rpath for Testing.framework from Xcode (needed for local toolchain)
@@ -263,11 +276,11 @@ package.targets += [
         ],
         path: "Benchmarks/ProfiledBenchmark",
         swiftSettings: [
-            .unsafeFlags([
-                "-O",
-                "-sanitize=undefined",
-                "-sanitize-coverage=edge,pc-table"
-            ])
+            // edge + comparison coverage (cmp channel via EmitCmpTrace) so the
+            // benchmark closure's integer comparisons dispatch through
+            // sancov_dispatch_cmp → the boundary observer, exercising the
+            // per-comparison hot path under profiling.
+            .unsafeFlags(["-O"] + edgeCmpCoverage)
         ],
         linkerSettings: [
             // Add rpath for Testing.framework from Xcode (needed for local toolchain)