Merge pull request #20725 from ziglang/fuzz

initial support for integrated fuzzing

15 files changed, 246 insertions, 78 deletions

diff --git a/src/Builtin.zig b/src/Builtin.zig
index dbdd746bcd..6e573d843f 100644
--- a/src/Builtin.zig
+++ b/src/Builtin.zig
@@ -10,6 +10,7 @@ optimize_mode: std.builtin.OptimizeMode,
 error_tracing: bool,
 valgrind: bool,
 sanitize_thread: bool,
+fuzz: bool,
 pic: bool,
 pie: bool,
 strip: bool,
@@ -185,6 +186,7 @@ pub fn append(opts: @This(), buffer: *std.ArrayList(u8)) Allocator.Error!void {
         \\pub const have_error_return_tracing = {};
         \\pub const valgrind_support = {};
         \\pub const sanitize_thread = {};
+        \\pub const fuzz = {};
         \\pub const position_independent_code = {};
         \\pub const position_independent_executable = {};
         \\pub const strip_debug_info = {};
@@ -199,6 +201,7 @@ pub fn append(opts: @This(), buffer: *std.ArrayList(u8)) Allocator.Error!void {
         opts.error_tracing,
         opts.valgrind,
         opts.sanitize_thread,
+        opts.fuzz,
         opts.pic,
         opts.pie,
         opts.strip,
diff --git a/src/Compilation.zig b/src/Compilation.zig
index 567d0b0a02..50fe8b36c3 100644
--- a/src/Compilation.zig
+++ b/src/Compilation.zig
@@ -191,6 +191,7 @@ debug_compile_errors: bool,
 incremental: bool,
 job_queued_compiler_rt_lib: bool = false,
 job_queued_compiler_rt_obj: bool = false,
+job_queued_fuzzer_lib: bool = false,
 job_queued_update_builtin_zig: bool,
 alloc_failure_occurred: bool = false,
 formatted_panics: bool = false,
@@ -232,6 +233,10 @@ compiler_rt_lib: ?CRTFile = null,
 /// Populated when we build the compiler_rt_obj object. A Job to build this is indicated
 /// by setting `job_queued_compiler_rt_obj` and resolved before calling linker.flush().
 compiler_rt_obj: ?CRTFile = null,
+/// Populated when we build the libfuzzer static library. A Job to build this
+/// is indicated by setting `job_queued_fuzzer_lib` and resolved before
+/// calling linker.flush().
+fuzzer_lib: ?CRTFile = null,
 
 glibc_so_files: ?glibc.BuiltSharedObjects = null,
 wasi_emulated_libs: []const wasi_libc.CRTFile,
@@ -800,6 +805,7 @@ pub const MiscTask = enum {
     libcxx,
     libcxxabi,
     libtsan,
+    libfuzzer,
     wasi_libc_crt_file,
     compiler_rt,
     zig_libc,
@@ -888,6 +894,7 @@ pub const cache_helpers = struct {
         hh.add(mod.red_zone);
         hh.add(mod.sanitize_c);
         hh.add(mod.sanitize_thread);
+        hh.add(mod.fuzz);
         hh.add(mod.unwind_tables);
         hh.add(mod.structured_cfg);
         hh.addListOfBytes(mod.cc_argv);
@@ -1303,6 +1310,7 @@ pub fn create(gpa: Allocator, arena: Allocator, options: CreateOptions) !*Compil
         const any_unwind_tables = options.config.any_unwind_tables or options.root_mod.unwind_tables;
         const any_non_single_threaded = options.config.any_non_single_threaded or !options.root_mod.single_threaded;
         const any_sanitize_thread = options.config.any_sanitize_thread or options.root_mod.sanitize_thread;
+        const any_fuzz = options.config.any_fuzz or options.root_mod.fuzz;
 
         const link_eh_frame_hdr = options.link_eh_frame_hdr or any_unwind_tables;
         const build_id = options.build_id orelse .none;
@@ -1564,6 +1572,7 @@ pub fn create(gpa: Allocator, arena: Allocator, options: CreateOptions) !*Compil
         comp.config.any_unwind_tables = any_unwind_tables;
         comp.config.any_non_single_threaded = any_non_single_threaded;
         comp.config.any_sanitize_thread = any_sanitize_thread;
+        comp.config.any_fuzz = any_fuzz;
 
         const lf_open_opts: link.File.OpenOptions = .{
             .linker_script = options.linker_script,
@@ -1909,6 +1918,13 @@ pub fn create(gpa: Allocator, arena: Allocator, options: CreateOptions) !*Compil
             }
         }
 
+        if (comp.config.any_fuzz and capable_of_building_compiler_rt) {
+            if (is_exe_or_dyn_lib) {
+                log.debug("queuing a job to build libfuzzer", .{});
+                comp.job_queued_fuzzer_lib = true;
+            }
+        }
+
         if (!comp.skip_linker_dependencies and is_exe_or_dyn_lib and
             !comp.config.link_libc and capable_of_building_zig_libc)
         {
@@ -1957,6 +1973,9 @@ pub fn destroy(comp: *Compilation) void {
     if (comp.compiler_rt_obj) |*crt_file| {
         crt_file.deinit(gpa);
     }
+    if (comp.fuzzer_lib) |*crt_file| {
+        crt_file.deinit(gpa);
+    }
     if (comp.libc_static_lib) |*crt_file| {
         crt_file.deinit(gpa);
     }
@@ -2722,6 +2741,7 @@ pub fn emitLlvmObject(
         .is_small = comp.root_mod.optimize_mode == .ReleaseSmall,
         .time_report = comp.time_report,
         .sanitize_thread = comp.config.any_sanitize_thread,
+        .fuzz = comp.config.any_fuzz,
         .lto = comp.config.lto,
     });
 }
@@ -3641,15 +3661,9 @@ fn performAllTheWorkInner(
         break;
     }
 
-    if (comp.job_queued_compiler_rt_lib) {
-        comp.job_queued_compiler_rt_lib = false;
-        buildCompilerRtOneShot(comp, .Lib, &comp.compiler_rt_lib, main_progress_node);
-    }
-
-    if (comp.job_queued_compiler_rt_obj) {
-        comp.job_queued_compiler_rt_obj = false;
-        buildCompilerRtOneShot(comp, .Obj, &comp.compiler_rt_obj, main_progress_node);
-    }
+    buildCompilerRtOneShot(comp, &comp.job_queued_compiler_rt_lib, "compiler_rt.zig", .compiler_rt, .Lib, &comp.compiler_rt_lib, main_progress_node);
+    buildCompilerRtOneShot(comp, &comp.job_queued_compiler_rt_obj, "compiler_rt.zig", .compiler_rt, .Obj, &comp.compiler_rt_obj, main_progress_node);
+    buildCompilerRtOneShot(comp, &comp.job_queued_fuzzer_lib, "fuzzer.zig", .libfuzzer, .Lib, &comp.fuzzer_lib, main_progress_node);
 }
 
 const JobError = Allocator.Error;
@@ -4655,23 +4669,27 @@ fn workerUpdateWin32Resource(
 
 fn buildCompilerRtOneShot(
     comp: *Compilation,
+    job_queued: *bool,
+    root_source_name: []const u8,
+    misc_task: MiscTask,
     output_mode: std.builtin.OutputMode,
     out: *?CRTFile,
     prog_node: std.Progress.Node,
 ) void {
+    if (!job_queued.*) return;
+    job_queued.* = false;
+
     comp.buildOutputFromZig(
-        "compiler_rt.zig",
+        root_source_name,
         output_mode,
         out,
-        .compiler_rt,
+        misc_task,
         prog_node,
     ) catch |err| switch (err) {
         error.SubCompilationFailed => return, // error reported already
-        else => comp.lockAndSetMiscFailure(
-            .compiler_rt,
-            "unable to build compiler_rt: {s}",
-            .{@errorName(err)},
-        ),
+        else => comp.lockAndSetMiscFailure(misc_task, "unable to build {s}: {s}", .{
+            @tagName(misc_task), @errorName(err),
+        }),
     };
 }
 
@@ -5602,23 +5620,39 @@ pub fn addCCArgs(
                 try argv.append("-mthumb");
             }
 
-            if (mod.sanitize_c and !mod.sanitize_thread) {
-                try argv.append("-fsanitize=undefined");
-                try argv.append("-fsanitize-trap=undefined");
-                // It is very common, and well-defined, for a pointer on one side of a C ABI
-                // to have a different but compatible element type. Examples include:
-                // `char*` vs `uint8_t*` on a system with 8-bit bytes
-                // `const char*` vs `char*`
-                // `char*` vs `unsigned char*`
-                // Without this flag, Clang would invoke UBSAN when such an extern
-                // function was called.
-                try argv.append("-fno-sanitize=function");
-            } else if (mod.sanitize_c and mod.sanitize_thread) {
-                try argv.append("-fsanitize=undefined,thread");
-                try argv.append("-fsanitize-trap=undefined");
-                try argv.append("-fno-sanitize=function");
-            } else if (!mod.sanitize_c and mod.sanitize_thread) {
-                try argv.append("-fsanitize=thread");
+            {
+                var san_arg: std.ArrayListUnmanaged(u8) = .{};
+                const prefix = "-fsanitize=";
+                if (mod.sanitize_c) {
+                    if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix);
+                    try san_arg.appendSlice(arena, "undefined,");
+                }
+                if (mod.sanitize_thread) {
+                    if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix);
+                    try san_arg.appendSlice(arena, "thread,");
+                }
+                if (mod.fuzz) {
+                    if (san_arg.items.len == 0) try san_arg.appendSlice(arena, prefix);
+                    try san_arg.appendSlice(arena, "fuzzer-no-link,");
+                }
+                // Chop off the trailing comma and append to argv.
+                if (san_arg.popOrNull()) |_| {
+                    try argv.append(san_arg.items);
+
+                    // These args have to be added after the `-fsanitize` arg or
+                    // they won't take effect.
+                    if (mod.sanitize_c) {
+                        try argv.append("-fsanitize-trap=undefined");
+                        // It is very common, and well-defined, for a pointer on one side of a C ABI
+                        // to have a different but compatible element type. Examples include:
+                        // `char*` vs `uint8_t*` on a system with 8-bit bytes
+                        // `const char*` vs `char*`
+                        // `char*` vs `unsigned char*`
+                        // Without this flag, Clang would invoke UBSAN when such an extern
+                        // function was called.
+                        try argv.append("-fno-sanitize=function");
+                    }
+                }
             }
 
             if (mod.red_zone) {
diff --git a/src/Compilation/Config.zig b/src/Compilation/Config.zig
index 6e28f5028c..63bd4c6fa2 100644
--- a/src/Compilation/Config.zig
+++ b/src/Compilation/Config.zig
@@ -32,6 +32,7 @@ any_non_single_threaded: bool,
 /// per-Module setting.
 any_error_tracing: bool,
 any_sanitize_thread: bool,
+any_fuzz: bool,
 pie: bool,
 /// If this is true then linker code is responsible for making an LLVM IR
 /// Module, outputting it to an object file, and then linking that together
@@ -82,6 +83,7 @@ pub const Options = struct {
     ensure_libcpp_on_non_freestanding: bool = false,
     any_non_single_threaded: bool = false,
     any_sanitize_thread: bool = false,
+    any_fuzz: bool = false,
     any_unwind_tables: bool = false,
     any_dyn_libs: bool = false,
     any_c_source_files: bool = false,
@@ -486,6 +488,7 @@ pub fn resolve(options: Options) ResolveError!Config {
         .any_non_single_threaded = options.any_non_single_threaded,
         .any_error_tracing = any_error_tracing,
         .any_sanitize_thread = options.any_sanitize_thread,
+        .any_fuzz = options.any_fuzz,
         .root_error_tracing = root_error_tracing,
         .pie = pie,
         .lto = lto,
diff --git a/src/InternPool.zig b/src/InternPool.zig
index c3cee5852b..2934340034 100644
--- a/src/InternPool.zig
+++ b/src/InternPool.zig
@@ -5184,11 +5184,11 @@ pub const FuncAnalysis = packed struct(u32) {
     is_noinline: bool,
     calls_or_awaits_errorable_fn: bool,
     stack_alignment: Alignment,
-
     /// True if this function has an inferred error set.
     inferred_error_set: bool,
+    disable_instrumentation: bool,
 
-    _: u14 = 0,
+    _: u13 = 0,
 
     pub const State = enum(u8) {
         /// This function has not yet undergone analysis, because we have not
@@ -8111,6 +8111,7 @@ pub fn getFuncDecl(
             .calls_or_awaits_errorable_fn = false,
             .stack_alignment = .none,
             .inferred_error_set = false,
+            .disable_instrumentation = false,
         },
         .owner_decl = key.owner_decl,
         .ty = key.ty,
@@ -8214,6 +8215,7 @@ pub fn getFuncDeclIes(
             .calls_or_awaits_errorable_fn = false,
             .stack_alignment = .none,
             .inferred_error_set = true,
+            .disable_instrumentation = false,
         },
         .owner_decl = key.owner_decl,
         .ty = func_ty,
@@ -8405,6 +8407,7 @@ pub fn getFuncInstance(
             .calls_or_awaits_errorable_fn = false,
             .stack_alignment = .none,
             .inferred_error_set = false,
+            .disable_instrumentation = false,
         },
         // This is populated after we create the Decl below. It is not read
         // by equality or hashing functions.
@@ -8504,6 +8507,7 @@ pub fn getFuncInstanceIes(
             .calls_or_awaits_errorable_fn = false,
             .stack_alignment = .none,
             .inferred_error_set = true,
+            .disable_instrumentation = false,
         },
         // This is populated after we create the Decl below. It is not read
         // by equality or hashing functions.
@@ -11225,6 +11229,18 @@ pub fn funcSetCallsOrAwaitsErrorableFn(ip: *InternPool, func: Index) void {
     @atomicStore(FuncAnalysis, analysis_ptr, analysis, .release);
 }
 
+pub fn funcSetDisableInstrumentation(ip: *InternPool, func: Index) void {
+    const unwrapped_func = func.unwrap(ip);
+    const extra_mutex = &ip.getLocal(unwrapped_func.tid).mutate.extra.mutex;
+    extra_mutex.lock();
+    defer extra_mutex.unlock();
+
+    const analysis_ptr = ip.funcAnalysisPtr(func);
+    var analysis = analysis_ptr.*;
+    analysis.disable_instrumentation = true;
+    @atomicStore(FuncAnalysis, analysis_ptr, analysis, .release);
+}
+
 pub fn funcSetCold(ip: *InternPool, func: Index, is_cold: bool) void {
     const unwrapped_func = func.unwrap(ip);
     const extra_mutex = &ip.getLocal(unwrapped_func.tid).mutate.extra.mutex;
diff --git a/src/Package/Module.zig b/src/Package/Module.zig
index 61b7d2ac4d..02d9921016 100644
--- a/src/Package/Module.zig
+++ b/src/Package/Module.zig
@@ -26,6 +26,7 @@ stack_protector: u32,
 red_zone: bool,
 sanitize_c: bool,
 sanitize_thread: bool,
+fuzz: bool,
 unwind_tables: bool,
 cc_argv: []const []const u8,
 /// (SPIR-V) whether to generate a structured control flow graph or not
@@ -92,6 +93,7 @@ pub const CreateOptions = struct {
         unwind_tables: ?bool = null,
         sanitize_c: ?bool = null,
         sanitize_thread: ?bool = null,
+        fuzz: ?bool = null,
         structured_cfg: ?bool = null,
     };
 };
@@ -106,6 +108,7 @@ pub const ResolvedTarget = struct {
 /// At least one of `parent` and `resolved_target` must be non-null.
 pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
     if (options.inherited.sanitize_thread == true) assert(options.global.any_sanitize_thread);
+    if (options.inherited.fuzz == true) assert(options.global.any_fuzz);
     if (options.inherited.single_threaded == false) assert(options.global.any_non_single_threaded);
     if (options.inherited.unwind_tables == true) assert(options.global.any_unwind_tables);
     if (options.inherited.error_tracing == true) assert(options.global.any_error_tracing);
@@ -210,6 +213,12 @@ pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
         break :b false;
     };
 
+    const fuzz = b: {
+        if (options.inherited.fuzz) |x| break :b x;
+        if (options.parent) |p| break :b p.fuzz;
+        break :b false;
+    };
+
     const code_model = b: {
         if (options.inherited.code_model) |x| break :b x;
         if (options.parent) |p| break :b p.code_model;
@@ -337,6 +346,7 @@ pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
         .red_zone = red_zone,
         .sanitize_c = sanitize_c,
         .sanitize_thread = sanitize_thread,
+        .fuzz = fuzz,
         .unwind_tables = unwind_tables,
         .cc_argv = options.cc_argv,
         .structured_cfg = structured_cfg,
@@ -359,6 +369,7 @@ pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
             .error_tracing = error_tracing,
             .valgrind = valgrind,
             .sanitize_thread = sanitize_thread,
+            .fuzz = fuzz,
             .pic = pic,
             .pie = options.global.pie,
             .strip = strip,
@@ -427,6 +438,7 @@ pub fn create(arena: Allocator, options: CreateOptions) !*Package.Module {
             .red_zone = red_zone,
             .sanitize_c = sanitize_c,
             .sanitize_thread = sanitize_thread,
+            .fuzz = fuzz,
             .unwind_tables = unwind_tables,
             .cc_argv = &.{},
             .structured_cfg = structured_cfg,
@@ -485,6 +497,7 @@ pub fn createLimited(gpa: Allocator, options: LimitedOptions) Allocator.Error!*P
         .red_zone = undefined,
         .sanitize_c = undefined,
         .sanitize_thread = undefined,
+        .fuzz = undefined,
         .unwind_tables = undefined,
         .cc_argv = undefined,
         .structured_cfg = undefined,
diff --git a/src/Sema.zig b/src/Sema.zig
index fbd5d636bd..b01c81ff22 100644
--- a/src/Sema.zig
+++ b/src/Sema.zig
@@ -1316,6 +1316,11 @@ fn analyzeBodyInner(
                         i += 1;
                         continue;
                     },
+                    .disable_instrumentation => {
+                        try sema.zirDisableInstrumentation();
+                        i += 1;
+                        continue;
+                    },
                     .restore_err_ret_index => {
                         try sema.zirRestoreErrRetIndex(block, extended);
                         i += 1;
@@ -6576,6 +6581,14 @@ fn zirSetCold(sema: *Sema, block: *Block, extended: Zir.Inst.Extended.InstData)
     ip.funcSetCold(sema.func_index, is_cold);
 }
 
+fn zirDisableInstrumentation(sema: *Sema) CompileError!void {
+    const pt = sema.pt;
+    const mod = pt.zcu;
+    const ip = &mod.intern_pool;
+    if (sema.func_index == .none) return; // does nothing outside a function
+    ip.funcSetDisableInstrumentation(sema.func_index);
+}
+
 fn zirSetFloatMode(sema: *Sema, block: *Block, extended: Zir.Inst.Extended.InstData) CompileError!void {
     const extra = sema.code.extraData(Zir.Inst.UnNode, extended.operand).data;
     const src = block.builtinCallArgSrc(extra.node, 0);
diff --git a/src/codegen/llvm.zig b/src/codegen/llvm.zig
index 58e71c7eda..e5f8250064 100644
--- a/src/codegen/llvm.zig
+++ b/src/codegen/llvm.zig
@@ -1101,6 +1101,7 @@ pub const Object = struct {
         is_small: bool,
         time_report: bool,
         sanitize_thread: bool,
+        fuzz: bool,
         lto: bool,
     };
 
@@ -1287,6 +1288,7 @@ pub const Object = struct {
                 options.is_small,
                 options.time_report,
                 options.sanitize_thread,
+                options.fuzz,
                 options.lto,
                 null,
                 emit_bin_path,
@@ -1311,6 +1313,7 @@ pub const Object = struct {
             options.is_small,
             options.time_report,
             options.sanitize_thread,
+            options.fuzz,
             options.lto,
             options.asm_path,
             emit_bin_path,
@@ -1380,6 +1383,25 @@ pub const Object = struct {
             _ = try attributes.removeFnAttr(.cold);
         }
 
+        if (owner_mod.sanitize_thread and !func_analysis.disable_instrumentation) {
+            try attributes.addFnAttr(.sanitize_thread, &o.builder);
+        } else {
+            _ = try attributes.removeFnAttr(.sanitize_thread);
+        }
+        if (owner_mod.fuzz and !func_analysis.disable_instrumentation) {
+            try attributes.addFnAttr(.optforfuzzing, &o.builder);
+            if (comp.config.any_fuzz) {
+                _ = try attributes.removeFnAttr(.skipprofile);
+                _ = try attributes.removeFnAttr(.nosanitize_coverage);
+            }
+        } else {
+            _ = try attributes.removeFnAttr(.optforfuzzing);
+            if (comp.config.any_fuzz) {
+                try attributes.addFnAttr(.skipprofile, &o.builder);
+                try attributes.addFnAttr(.nosanitize_coverage, &o.builder);
+            }
+        }
+
         // TODO: disable this if safety is off for the function scope
         const ssp_buf_size = owner_mod.stack_protector;
         if (ssp_buf_size != 0) {
@@ -2979,9 +3001,6 @@ pub const Object = struct {
             try attributes.addFnAttr(.minsize, &o.builder);
             try attributes.addFnAttr(.optsize, &o.builder);
         }
-        if (owner_mod.sanitize_thread) {
-            try attributes.addFnAttr(.sanitize_thread, &o.builder);
-        }
         const target = owner_mod.resolved_target.result;
         if (target.cpu.model.llvm_name) |s| {
             try attributes.addFnAttr(.{ .string = .{
diff --git a/src/codegen/llvm/bindings.zig b/src/codegen/llvm/bindings.zig
index a32f1d74bc..f49214b660 100644
--- a/src/codegen/llvm/bindings.zig
+++ b/src/codegen/llvm/bindings.zig
@@ -93,6 +93,7 @@ pub const TargetMachine = opaque {
         is_small: bool,
         time_report: bool,
         tsan: bool,
+        sancov: bool,
         lto: bool,
         asm_filename: ?[*:0]const u8,
         bin_filename: ?[*:0]const u8,
diff --git a/src/link/Coff/lld.zig b/src/link/Coff/lld.zig
index 17bcefc1b4..cd9d8c2e76 100644
--- a/src/link/Coff/lld.zig
+++ b/src/link/Coff/lld.zig
@@ -460,6 +460,10 @@ pub fn linkWithLLD(self: *Coff, arena: Allocator, tid: Zcu.PerThread.Id, prog_no
             try argv.append(comp.libunwind_static_lib.?.full_object_path);
         }
 
+        if (comp.config.any_fuzz) {
+            try argv.append(comp.fuzzer_lib.?.full_object_path);
+        }
+
         if (is_exe_or_dyn_lib and !comp.skip_linker_dependencies) {
             if (!comp.config.link_libc) {
                 if (comp.libc_static_lib) |lib| {
diff --git a/src/link/Elf.zig b/src/link/Elf.zig
index d2d4fd2657..8085d35a22 100644
--- a/src/link/Elf.zig
+++ b/src/link/Elf.zig
@@ -1144,11 +1144,14 @@ pub fn flushModule(self: *Elf, arena: Allocator, tid: Zcu.PerThread.Id, prog_nod
         _ = try rpath_table.put(rpath, {});
     }
 
-    // TSAN
     if (comp.config.any_sanitize_thread) {
         try positionals.append(.{ .path = comp.tsan_lib.?.full_object_path });
     }
 
+    if (comp.config.any_fuzz) {
+        try positionals.append(.{ .path = comp.fuzzer_lib.?.full_object_path });
+    }
+
     // libc
     if (!comp.skip_linker_dependencies and !comp.config.link_libc) {
         if (comp.libc_static_lib) |lib| {
@@ -1607,6 +1610,10 @@ fn dumpArgv(self: *Elf, comp: *Compilation) !void {
             try argv.append(comp.tsan_lib.?.full_object_path);
         }
 
+        if (comp.config.any_fuzz) {
+            try argv.append(comp.fuzzer_lib.?.full_object_path);
+        }
+
         // libc
         if (!comp.skip_linker_dependencies and !comp.config.link_libc) {
             if (comp.libc_static_lib) |lib| {
@@ -2272,6 +2279,7 @@ fn linkWithLLD(self: *Elf, arena: Allocator, tid: Zcu.PerThread.Id, prog_node: s
         man.hash.add(self.bind_global_refs_locally);
         man.hash.add(self.compress_debug_sections);
         man.hash.add(comp.config.any_sanitize_thread);
+        man.hash.add(comp.config.any_fuzz);
         man.hash.addOptionalBytes(comp.sysroot);
 
         // We don't actually care whether it's a cache hit or miss; we just need the digest and the lock.
@@ -2616,6 +2624,10 @@ fn linkWithLLD(self: *Elf, arena: Allocator, tid: Zcu.PerThread.Id, prog_node: s
             try argv.append(comp.tsan_lib.?.full_object_path);
         }
 
+        if (comp.config.any_fuzz) {
+            try argv.append(comp.fuzzer_lib.?.full_object_path);
+        }
+
         // libc
         if (is_exe_or_dyn_lib and
             !comp.skip_linker_dependencies and
diff --git a/src/link/MachO.zig b/src/link/MachO.zig
index aa7a2a96aa..b70e09b84b 100644
--- a/src/link/MachO.zig
+++ b/src/link/MachO.zig
@@ -387,11 +387,14 @@ pub fn flushModule(self: *MachO, arena: Allocator, tid: Zcu.PerThread.Id, prog_n
 
     if (module_obj_path) |path| try positionals.append(.{ .path = path });
 
-    // TSAN
     if (comp.config.any_sanitize_thread) {
         try positionals.append(.{ .path = comp.tsan_lib.?.full_object_path });
     }
 
+    if (comp.config.any_fuzz) {
+        try positionals.append(.{ .path = comp.fuzzer_lib.?.full_object_path });
+    }
+
     for (positionals.items) |obj| {
         self.classifyInputFile(obj.path, .{ .path = obj.path }, obj.must_link) catch |err| switch (err) {
             error.UnknownFileType => try self.reportParseError(obj.path, "unknown file type for an input file", .{}),
@@ -725,6 +728,10 @@ fn dumpArgv(self: *MachO, comp: *Compilation) !void {
             try argv.appendSlice(&.{ "-rpath", std.fs.path.dirname(path) orelse "." });
         }
 
+        if (comp.config.any_fuzz) {
+            try argv.append(comp.fuzzer_lib.?.full_object_path);
+        }
+
         for (self.lib_dirs) |lib_dir| {
             const arg = try std.fmt.allocPrint(arena, "-L{s}", .{lib_dir});
             try argv.append(arg);
diff --git a/src/main.zig b/src/main.zig
index a715b36b5c..ae34b083ae 100644
--- a/src/main.zig
+++ b/src/main.zig
@@ -502,12 +502,14 @@ const usage_build_generic =
     \\  -fno-stack-check          Disable stack probing in safe builds
     \\  -fstack-protector         Enable stack protection in unsafe builds
     \\  -fno-stack-protector      Disable stack protection in safe builds
-    \\  -fsanitize-c              Enable C undefined behavior detection in unsafe builds
-    \\  -fno-sanitize-c           Disable C undefined behavior detection in safe builds
     \\  -fvalgrind                Include valgrind client requests in release builds
     \\  -fno-valgrind             Omit valgrind client requests in debug builds
+    \\  -fsanitize-c              Enable C undefined behavior detection in unsafe builds
+    \\  -fno-sanitize-c           Disable C undefined behavior detection in safe builds
     \\  -fsanitize-thread         Enable Thread Sanitizer
     \\  -fno-sanitize-thread      Disable Thread Sanitizer
+    \\  -ffuzz                    Enable fuzz testing instrumentation
+    \\  -fno-fuzz                 Disable fuzz testing instrumentation
     \\  -funwind-tables           Always produce unwind table entries for all functions
     \\  -fno-unwind-tables        Never produce unwind table entries
     \\  -ferror-tracing           Enable error tracing in ReleaseFast mode
@@ -1432,6 +1434,10 @@ fn buildOutputType(
                         mod_opts.sanitize_thread = true;
                     } else if (mem.eql(u8, arg, "-fno-sanitize-thread")) {
                         mod_opts.sanitize_thread = false;
+                    } else if (mem.eql(u8, arg, "-ffuzz")) {
+                        mod_opts.fuzz = true;
+                    } else if (mem.eql(u8, arg, "-fno-fuzz")) {
+                        mod_opts.fuzz = false;
                     } else if (mem.eql(u8, arg, "-fllvm")) {
                         create_module.opts.use_llvm = true;
                     } else if (mem.eql(u8, arg, "-fno-llvm")) {
@@ -2063,11 +2069,21 @@ fn buildOutputType(
                         create_module.opts.debug_format = .{ .dwarf = .@"64" };
                     },
                     .sanitize => {
-                        if (mem.eql(u8, it.only_arg, "undefined")) {
-                            mod_opts.sanitize_c = true;
-                        } else if (mem.eql(u8, it.only_arg, "thread")) {
-                            mod_opts.sanitize_thread = true;
-                        } else {
+                        var san_it = std.mem.splitScalar(u8, it.only_arg, ',');
+                        var recognized_any = false;
+                        while (san_it.next()) |sub_arg| {
+                            if (mem.eql(u8, sub_arg, "undefined")) {
+                                mod_opts.sanitize_c = true;
+                                recognized_any = true;
+                            } else if (mem.eql(u8, sub_arg, "thread")) {
+                                mod_opts.sanitize_thread = true;
+                                recognized_any = true;
+                            } else if (mem.eql(u8, sub_arg, "fuzzer") or mem.eql(u8, sub_arg, "fuzzer-no-link")) {
+                                mod_opts.fuzz = true;
+                                recognized_any = true;
+                            }
+                        }
+                        if (!recognized_any) {
                             try cc_argv.appendSlice(arena, it.other_args);
                         }
                     },
@@ -2645,6 +2661,8 @@ fn buildOutputType(
             create_module.opts.any_non_single_threaded = true;
         if (mod_opts.sanitize_thread == true)
             create_module.opts.any_sanitize_thread = true;
+        if (mod_opts.fuzz == true)
+            create_module.opts.any_fuzz = true;
         if (mod_opts.unwind_tables == true)
             create_module.opts.any_unwind_tables = true;
         if (mod_opts.strip == false)
@@ -7494,6 +7512,8 @@ fn handleModArg(
         create_module.opts.any_non_single_threaded = true;
     if (mod_opts.sanitize_thread == true)
         create_module.opts.any_sanitize_thread = true;
+    if (mod_opts.fuzz == true)
+        create_module.opts.any_fuzz = true;
     if (mod_opts.unwind_tables == true)
         create_module.opts.any_unwind_tables = true;
     if (mod_opts.strip == false)
diff --git a/src/print_zir.zig b/src/print_zir.zig
index 2fee5f5d83..bd06362e62 100644
--- a/src/print_zir.zig
+++ b/src/print_zir.zig
@@ -524,6 +524,7 @@ const Writer = struct {
             .frame,
             .frame_address,
             .breakpoint,
+            .disable_instrumentation,
             .c_va_start,
             .in_comptime,
             .value_placeholder,
diff --git a/src/zig_llvm.cpp b/src/zig_llvm.cpp
index 72f1026617..5580b61367 100644
--- a/src/zig_llvm.cpp
+++ b/src/zig_llvm.cpp
@@ -54,6 +54,7 @@
 #include <llvm/Transforms/IPO.h>
 #include <llvm/Transforms/IPO/AlwaysInliner.h>
 #include <llvm/Transforms/Instrumentation/ThreadSanitizer.h>
+#include <llvm/Transforms/Instrumentation/SanitizerCoverage.h>
 #include <llvm/Transforms/Scalar.h>
 #include <llvm/Transforms/Utils.h>
 #include <llvm/Transforms/Utils/AddDiscriminators.h>
@@ -188,9 +189,31 @@ struct TimeTracerRAII {
 };
 } // end anonymous namespace
 
+static SanitizerCoverageOptions getSanCovOptions(void) {
+    SanitizerCoverageOptions o;
+    o.CoverageType = SanitizerCoverageOptions::SCK_Edge;
+    o.IndirectCalls = true;
+    o.TraceBB = false;
+    o.TraceCmp = true;
+    o.TraceDiv = false;
+    o.TraceGep = false;
+    o.Use8bitCounters = false;
+    o.TracePC = false;
+    o.TracePCGuard = false;
+    o.Inline8bitCounters = true;
+    o.InlineBoolFlag = false;
+    o.PCTable = true;
+    o.NoPrune = false;
+    o.StackDepth = true;
+    o.TraceLoads = false;
+    o.TraceStores = false;
+    o.CollectControlFlow = false;
+    return o;
+}
+
 bool ZigLLVMTargetMachineEmitToFile(LLVMTargetMachineRef targ_machine_ref, LLVMModuleRef module_ref,
         char **error_message, bool is_debug,
-        bool is_small, bool time_report, bool tsan, bool lto,
+        bool is_small, bool time_report, bool tsan, bool sancov, bool lto,
         const char *asm_filename, const char *bin_filename,
         const char *llvm_ir_filename, const char *bitcode_filename)
 {
@@ -277,39 +300,38 @@ bool ZigLLVMTargetMachineEmitToFile(LLVMTargetMachineRef targ_machine_ref, LLVMM
     pass_builder.registerCGSCCAnalyses(cgscc_am);
     pass_builder.registerFunctionAnalyses(function_am);
     pass_builder.registerLoopAnalyses(loop_am);
-    pass_builder.crossRegisterProxies(loop_am, function_am,
-                                      cgscc_am, module_am);
-
-    // IR verification
-    if (assertions_on) {
-      // Verify the input
-      pass_builder.registerPipelineStartEPCallback(
-        [](ModulePassManager &module_pm, OptimizationLevel OL) {
-          module_pm.addPass(VerifierPass());
-        });
-      // Verify the output
-      pass_builder.registerOptimizerLastEPCallback(
-        [](ModulePassManager &module_pm, OptimizationLevel OL) {
-          module_pm.addPass(VerifierPass());
-        });
-    }
+    pass_builder.crossRegisterProxies(loop_am, function_am, cgscc_am, module_am);
 
-    // Passes specific for release build
-    if (!is_debug) {
-      pass_builder.registerPipelineStartEPCallback(
-        [](ModulePassManager &module_pm, OptimizationLevel OL) {
-          module_pm.addPass(
-            createModuleToFunctionPassAdaptor(AddDiscriminatorsPass()));
-        });
-    }
+    pass_builder.registerPipelineStartEPCallback([&](ModulePassManager &module_pm, OptimizationLevel OL) {
+        // Verify the input
+        if (assertions_on) {
+            module_pm.addPass(VerifierPass());
+        }
+
+        if (!is_debug) {
+            module_pm.addPass(createModuleToFunctionPassAdaptor(AddDiscriminatorsPass()));
+        }
+    });
+
+    pass_builder.registerOptimizerEarlyEPCallback([&](ModulePassManager &module_pm, OptimizationLevel OL) {
+        // Code coverage instrumentation.
+        if (sancov) {
+            module_pm.addPass(SanitizerCoveragePass(getSanCovOptions()));
+        }
 
-    // Thread sanitizer
-    if (tsan) {
-        pass_builder.registerOptimizerLastEPCallback([](ModulePassManager &module_pm, OptimizationLevel level) {
+        // Thread sanitizer
+        if (tsan) {
             module_pm.addPass(ModuleThreadSanitizerPass());
             module_pm.addPass(createModuleToFunctionPassAdaptor(ThreadSanitizerPass()));
-        });
-    }
+        }
+    });
+
+    pass_builder.registerOptimizerLastEPCallback([&](ModulePassManager &module_pm, OptimizationLevel level) {
+        // Verify the output
+        if (assertions_on) {
+            module_pm.addPass(VerifierPass());
+        }
+    });
 
     ModulePassManager module_pm;
     OptimizationLevel opt_level;
diff --git a/src/zig_llvm.h b/src/zig_llvm.h
index 89b53a802f..7ac632fe02 100644
--- a/src/zig_llvm.h
+++ b/src/zig_llvm.h
@@ -26,7 +26,7 @@
 
 ZIG_EXTERN_C bool ZigLLVMTargetMachineEmitToFile(LLVMTargetMachineRef targ_machine_ref, LLVMModuleRef module_ref,
         char **error_message, bool is_debug,
-        bool is_small, bool time_report, bool tsan, bool lto,
+        bool is_small, bool time_report, bool tsan, bool sancov, bool lto,
         const char *asm_filename, const char *bin_filename,
         const char *llvm_ir_filename, const char *bitcode_filename);