afl-clang*-fast toolchains built with clang from source fails `test_build`

[prashast]

Hi, I was trying to build afl-clang*-fast toolchains using clang built from source.The compiler wrappers do build successfully, however they fail at the test_build with the following error:

clang (LLVM option parsing): Unknown command line argument '-sanitizer-coverage-block-threshold=0'.  Try: 'clang (LLVM option parsing) --help'
clang (LLVM option parsing): Did you mean '  --sanitizer-coverage-pc-table=0'?

The error does indeed stop occuring if I make the mentioned fix in afl-clang-fast.c. However, from what I understand these are two completely different flags. The original flags is associated with inlining instrumentation callbacks and the pc-table flag refers to a feature where PC's corresponding to function/non-function entry blocks is made as a pre-processing step.

My clang version which I built from source is:

clang version 10.0.0 (git@github.com:llvm-mirror/clang.git 65acf43270ea2894dffa0d0b292b92402f80c8cb) (git@github.com:llvm-mirror/llvm.git 2c4ca6832fa6b306ee6a7010bfb80a3f2596f824)
Target: x86_64-unknown-linux-gnu

The command I am using to build llvm_mode is: AFL_TRACE_PC=1 CC=/path/to/built/clang CXX=/path/to/built/clang++ make -C llvm_mode clean all

[prashast]

For reproducibility, the commit hashes of projects I used to build my clang toolchains from source are provided below:
llvm: 2c4ca6832fa6b306ee6a7010bfb80a3f2596f824
clang: 65acf43270ea2894dffa0d0b292b92402f80c8cb
compiler-rt: 69445f095c22aac2388f939bedebf224a6efcdaf
lld: 64b024a57c56c3528d6be3d14be5e3da42614a6f

[Dor1s]

@lszekeres Laszlo, are you familiar with this by any chance?

[vanhauser-thc]

@prashast remove all -fsanitize-coverage* options and replaced them with this single one:
-fsanitize-coverage=trace-pc-guard and you are set to go. Note that this instrumentation is slower than the native llvm_mode one

[prashast]

@vanhauser-thc Thanks! Yeah, I think just simply commenting out -sanitizer-coverage-block-threshold makes it work.

@Dor1s My initial understanding of this flag was mistaken as well. From the discussion here, this flag helps in inlining if (*guard) checks which were initially used in __sanitizer_cov_trace_pc_guard. However, the current pc-guard instrumentation does not have this if check so I think we can safely remove this flag from afl-clang-fast.c without any observable performance drop. Let me know if you would want me to make a pull request making this change.

[vanhauser-thc]

@prashast the reason it didnt compile for you was that the llvm version you are using is not supported in this project. (only up to 4.0, however it works until 6.0 and with tricks until 8).
So IMHO if a PR starts supporting other llvm version, the "normal" instrumentation of llvm_mode should also be expanded to support that version

[prashast]

@vanhauser-thc I see. I noticed how AFLPlusPlus already accounts for varying LLVM versions in its default instrumentation pass here

I guess, in that case its just a matter of taking a decision whether to relay the changes in your fork to this repo as well. :)