Add support for more llvm instrumentations; fix not working `disable_…

…branch_folding`

src/options.rs

@@ -136,6 +136,20 @@ pub struct BuildOptions {
     /// available.
     pub no_trace_compares: bool,
 
+    #[arg(long)]
+    /// Enables `sanitizer-coverage-trace-divs` LLVM instrumentation
+    ///
+    /// When set to `true`, the compiler will instrument integer division instructions
+    /// to capture the right argument of division.
+    pub trace_div: bool,
+
+    #[arg(long)]
+    /// Enables `sanitizer-coverage-trace-geps` LLVM instrumentation
+    ///
+    /// When set to `true`, instruments GetElementPtr (GEP) instructions to track
+    /// pointer arithmetic operations to capture array indices.
+    pub trace_gep: bool,
+
     #[arg(long)]
     /// Disable transformation of if-statements into `cmov` instructions (when this
     /// happens, we get no coverage feedback for that branch). Default setting is true.
@@ -165,7 +179,7 @@ pub struct BuildOptions {
     /// Note, that in the second program, there are now 2 new coverage feedback points,
     /// and the fuzzer can store an input to the corpus at each condition that it passes;
     /// giving it a better chance of producing an input that reaches `res = 2;`.
-    pub disable_branch_folding: Option<bool>,
+    pub disable_branch_folding: bool,
 
     #[arg(long)]
     /// Disable the inclusion of the `/include:main` MSVC linker argument

src/project.rs

@@ -182,8 +182,12 @@ impl FuzzProject {
             rustflags.push_str(" -Cllvm-args=-sanitizer-coverage-trace-compares");
         }
 
-        if build.disable_branch_folding.unwrap_or(true) {
-            rustflags.push_str(" -Cllvm-args=-simplifycfg-branch-fold-threshold=0");
+        if build.trace_div {
+            rustflags.push_str(" -Cllvm-args=-sanitizer-coverage-trace-divs");
+        }
+
+        if build.trace_gep {
+            rustflags.push_str(" -Cllvm-args=-sanitizer-coverage-trace-geps");
         }
 
         if !build.no_cfg_fuzzing {
@@ -194,6 +198,10 @@ impl FuzzProject {
             rustflags.push_str(" -Clink-dead-code");
         }
 
+        if build.disable_branch_folding {
+            rustflags.push_str(" -Cllvm-args=-simplifycfg-branch-fold-threshold=0");
+        }
+
         if build.coverage {
             rustflags.push_str(" -Cinstrument-coverage");
         }