Revert "fix classify counts"

This reverts commit 4217a6606c92f6a88ab577ae8f91823dd731562d.

9 files changed, 57 insertions, 108 deletions

diff --git a/include/afl-fuzz.h b/include/afl-fuzz.h
index 1340d9ef..e225211f 100644
--- a/include/afl-fuzz.h
+++ b/include/afl-fuzz.h
@@ -1046,7 +1046,6 @@ u32  count_bytes(afl_state_t *, u8 *);
 u32  count_non_255_bytes(afl_state_t *, u8 *);
 void simplify_trace(afl_state_t *, u8 *);
 void classify_counts(afl_forkserver_t *);
-void classify_counts_off(afl_forkserver_t *, u32);
 #ifdef WORD_SIZE_64
 void discover_word(u8 *ret, u64 *current, u64 *virgin);
 #else
diff --git a/include/coverage-32.h b/include/coverage-32.h
index d213db12..ca36c29f 100644
--- a/include/coverage-32.h
+++ b/include/coverage-32.h
@@ -62,23 +62,6 @@ inline void classify_counts(afl_forkserver_t *fsrv) {
 
 }
 
-inline void classify_counts_off(afl_forkserver_t *fsrv, u32 off) {
-
-  u32 *mem = (u32 *)(fsrv->trace_bits + off);
-  u32  i = ((fsrv->map_size - off) >> 2);
-
-  while (i--) {
-
-    /* Optimize for sparse bitmaps. */
-
-    if (unlikely(*mem)) { *mem = classify_word(*mem); }
-
-    mem++;
-
-  }
-
-}
-
 /* Updates the virgin bits, then reflects whether a new count or a new tuple is
  * seen in ret. */
 inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
@@ -87,7 +70,7 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
      that have not been already cleared from the virgin map - since this will
      almost always be the case. */
 
-  if (unlikely(*current & *virgin)) {
+  if (*current & *virgin) {
 
     if (likely(*ret < 2)) {
 
@@ -97,8 +80,8 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
       /* Looks like we have not found any new bytes yet; see if any non-zero
          bytes in current[] are pristine in virgin[]. */
 
-      if (unlikely((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
-                   (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff)))
+      if ((cur[0] && vir[0] == 0xff) || (cur[1] && vir[1] == 0xff) ||
+          (cur[2] && vir[2] == 0xff) || (cur[3] && vir[3] == 0xff))
         *ret = 2;
       else
         *ret = 1;
@@ -114,14 +97,12 @@ inline void discover_word(u8 *ret, u32 *current, u32 *virgin) {
 #define PACK_SIZE 16
 inline u32 skim(const u32 *virgin, const u32 *current, const u32 *current_end) {
 
-  u32 *save = (u32*) current;
-
   for (; current < current_end; virgin += 4, current += 4) {
 
-    if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return (u32)(&current[1] - save);
-    if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return (u32)(&current[2] - save);
-    if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return (u32)(&current[3] - save);
-    if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return (u32)(&current[4] - save);
+    if (current[0] && classify_word(current[0]) & virgin[0]) return 1;
+    if (current[1] && classify_word(current[1]) & virgin[1]) return 1;
+    if (current[2] && classify_word(current[2]) & virgin[2]) return 1;
+    if (current[3] && classify_word(current[3]) & virgin[3]) return 1;
 
   }
 
diff --git a/include/coverage-64.h b/include/coverage-64.h
index ab29506c..54fe9d33 100644
--- a/include/coverage-64.h
+++ b/include/coverage-64.h
@@ -72,23 +72,6 @@ inline void classify_counts(afl_forkserver_t *fsrv) {
 
 }
 
-inline void classify_counts_off(afl_forkserver_t *fsrv, u32 off) {
-
-  u64 *mem = (u64 *)(fsrv->trace_bits + off);
-  u32  i = ((fsrv->map_size - off) >> 3);
-
-  while (i--) {
-
-    /* Optimize for sparse bitmaps. */
-
-    if (unlikely(*mem)) { *mem = classify_word(*mem); }
-
-    mem++;
-
-  }
-
-}
-
 /* Updates the virgin bits, then reflects whether a new count or a new tuple is
  * seen in ret. */
 inline void discover_word(u8 *ret, u64 *current, u64 *virgin) {
@@ -127,20 +110,17 @@ inline void discover_word(u8 *ret, u64 *current, u64 *virgin) {
   #define PACK_SIZE 64
 inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
 
-  u64 *save = (u64*) current;
-
   for (; current != current_end; virgin += 8, current += 8) {
 
     __m512i  value = *(__m512i *)current;
     __mmask8 mask = _mm512_testn_epi64_mask(value, value);
 
     /* All bytes are zero. */
-    if (likely(mask == 0xff)) continue;
+    if (mask == 0xff) continue;
 
       /* Look for nonzero bytes and check for new bits. */
-  #define UNROLL(x)                                                            \
-    if (unlikely(!(mask & (1 << x)) && classify_word(current[x]) & virgin[x])) \
-    return (u32)(&current[x + 1] - save)
+  #define UNROLL(x) \
+    if (!(mask & (1 << x)) && classify_word(current[x]) & virgin[x]) return 1
     UNROLL(0);
     UNROLL(1);
     UNROLL(2);
@@ -163,7 +143,6 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
   #define PACK_SIZE 32
 inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
 
-  u64 *save = (u64*) current;
   __m256i zeroes = _mm256_setzero_si256();
 
   for (; current < current_end; virgin += 4, current += 4) {
@@ -173,17 +152,13 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
     u32     mask = _mm256_movemask_epi8(cmp);
 
     /* All bytes are zero. */
-    if (likely(mask == (u32)-1)) continue;
+    if (mask == (u32)-1) continue;
 
     /* Look for nonzero bytes and check for new bits. */
-    if (unlikely(!(mask & 0xff) && classify_word(current[0]) & virgin[0]))
-      return (u32)(&current[1] - save);
-    if (unlikely(!(mask & 0xff00) && classify_word(current[1]) & virgin[1]))
-      return (u32)(&current[2] - save);
-    if (unlikely(!(mask & 0xff0000) && classify_word(current[2]) & virgin[2]))
-      return (u32)(&current[3] - save);
-    if (unlikely(!(mask & 0xff000000) && classify_word(current[3]) & virgin[3]))
-      return (u32)(&current[4] - save);
+    if (!(mask & 0xff) && classify_word(current[0]) & virgin[0]) return 1;
+    if (!(mask & 0xff00) && classify_word(current[1]) & virgin[1]) return 1;
+    if (!(mask & 0xff0000) && classify_word(current[2]) & virgin[2]) return 1;
+    if (!(mask & 0xff000000) && classify_word(current[3]) & virgin[3]) return 1;
 
   }
 
@@ -197,14 +172,12 @@ inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
   #define PACK_SIZE 32
 inline u32 skim(const u64 *virgin, const u64 *current, const u64 *current_end) {
 
-  u64 *save = (u64*) current;
-
   for (; current < current_end; virgin += 4, current += 4) {
 
-    if (unlikely(current[0] && classify_word(current[0]) & virgin[0])) return (u32)(&current[1] - save);
-    if (unlikely(current[1] && classify_word(current[1]) & virgin[1])) return (u32)(&current[2] - save);
-    if (unlikely(current[2] && classify_word(current[2]) & virgin[2])) return (u32)(&current[3] - save);
-    if (unlikely(current[3] && classify_word(current[3]) & virgin[3])) return (u32)(&current[4] - save);
+    if (current[0] && classify_word(current[0]) & virgin[0]) return 1;
+    if (current[1] && classify_word(current[1]) & virgin[1]) return 1;
+    if (current[2] && classify_word(current[2]) & virgin[2]) return 1;
+    if (current[3] && classify_word(current[3]) & virgin[3]) return 1;
 
   }
 
diff --git a/instrumentation/afl-llvm-common.h b/instrumentation/afl-llvm-common.h
index dee5f9fc..bd424e21 100644
--- a/instrumentation/afl-llvm-common.h
+++ b/instrumentation/afl-llvm-common.h
@@ -33,17 +33,17 @@ typedef long double max_align_t;
 #endif
 
 #if LLVM_VERSION_MAJOR >= 11
-  #define MNAME M.getSourceFileName()
-  #define FMNAME F.getParent()->getSourceFileName()
+ #define MNAME M.getSourceFileName()
+ #define FMNAME F.getParent()->getSourceFileName()
 #else
-  #define MNAME std::string("")
-  #define FMNAME std::string("")
+ #define MNAME std::string("")
+ #define FMNAME std::string("")
 #endif
 
-char *getBBName(const llvm::BasicBlock *BB);
-bool  isIgnoreFunction(const llvm::Function *F);
-void  initInstrumentList();
-bool  isInInstrumentList(llvm::Function *F, std::string Filename);
+char *                 getBBName(const llvm::BasicBlock *BB);
+bool                   isIgnoreFunction(const llvm::Function *F);
+void                   initInstrumentList();
+bool                   isInInstrumentList(llvm::Function *F, std::string Filename);
 unsigned long long int calculateCollisions(uint32_t edges);
 void                   scanForDangerousFunctions(llvm::Module *M);
 
diff --git a/instrumentation/afl-llvm-pass.so.cc b/instrumentation/afl-llvm-pass.so.cc
index 5246ba08..899734f8 100644
--- a/instrumentation/afl-llvm-pass.so.cc
+++ b/instrumentation/afl-llvm-pass.so.cc
@@ -631,23 +631,18 @@ bool AFLCoverage::runOnModule(Module &M) {
       LoadInst *PrevLoc;
 
       if (ngram_size) {
-
         PrevLoc = IRB.CreateLoad(
 #if LLVM_VERSION_MAJOR >= 14
-            PrevLocTy,
+          PrevLocTy,
 #endif
-            AFLPrevLoc);
-
+          AFLPrevLoc);
       } else {
-
         PrevLoc = IRB.CreateLoad(
 #if LLVM_VERSION_MAJOR >= 14
-            IRB.getInt32Ty(),
+          IRB.getInt32Ty(),
 #endif
-            AFLPrevLoc);
-
+          AFLPrevLoc);
       }
-
       PrevLoc->setMetadata(M.getMDKindID("nosanitize"), MDNode::get(C, None));
       Value *PrevLocTrans;
 
diff --git a/instrumentation/cmplog-instructions-pass.cc b/instrumentation/cmplog-instructions-pass.cc
index 310f5585..a0b386d5 100644
--- a/instrumentation/cmplog-instructions-pass.cc
+++ b/instrumentation/cmplog-instructions-pass.cc
@@ -478,28 +478,27 @@ bool CmpLogInstructions::hookInstrs(Module &M) {
           */
           if (is_fp) {
 
-            /*
-                        ConstantFP *i0 = dyn_cast<ConstantFP>(op0);
-                        ConstantFP *i1 = dyn_cast<ConstantFP>(op1);
-                        // BUG FIXME TODO: this is null ... but why?
-                        // fprintf(stderr, "%p %p\n", i0, i1);
-                        if (i0) {
-
-                          cur_val = (uint64_t)i0->getValue().convertToDouble();
-                          if (last_val0 && last_val0 == cur_val) { skip = 1; }
-                          last_val0 = cur_val;
+/*
+            ConstantFP *i0 = dyn_cast<ConstantFP>(op0);
+            ConstantFP *i1 = dyn_cast<ConstantFP>(op1);
+            // BUG FIXME TODO: this is null ... but why?
+            // fprintf(stderr, "%p %p\n", i0, i1);
+            if (i0) {
 
-                        }
+              cur_val = (uint64_t)i0->getValue().convertToDouble();
+              if (last_val0 && last_val0 == cur_val) { skip = 1; }
+              last_val0 = cur_val;
 
-                        if (i1) {
+            }
 
-                          cur_val = (uint64_t)i1->getValue().convertToDouble();
-                          if (last_val1 && last_val1 == cur_val) { skip = 1; }
-                          last_val1 = cur_val;
+            if (i1) {
 
-                        }
+              cur_val = (uint64_t)i1->getValue().convertToDouble();
+              if (last_val1 && last_val1 == cur_val) { skip = 1; }
+              last_val1 = cur_val;
 
-            */
+            }
+*/
 
           } else {
 
diff --git a/src/afl-cc.c b/src/afl-cc.c
index 974b1d2a..49000877 100644
--- a/src/afl-cc.c
+++ b/src/afl-cc.c
@@ -876,12 +876,11 @@ static void edit_params(u32 argc, char **argv, char **envp) {
 
     cc_params[cc_par_cnt++] = "-fsanitize=leak";
     cc_params[cc_par_cnt++] = "-includesanitizer/lsan_interface.h";
-    cc_params[cc_par_cnt++] =
-        "-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) "
-        "_exit(23); }";
+    cc_params[cc_par_cnt++] = "-D__AFL_LEAK_CHECK()={if(__lsan_do_recoverable_leak_check() > 0) _exit(23); }";
     cc_params[cc_par_cnt++] = "-D__AFL_LSAN_OFF()=__lsan_disable();";
     cc_params[cc_par_cnt++] = "-D__AFL_LSAN_ON()=__lsan_enable();";
 
+
   }
 
   if (getenv("AFL_USE_CFISAN")) {
diff --git a/src/afl-fuzz-bitmap.c b/src/afl-fuzz-bitmap.c
index 98a705a5..8d044959 100644
--- a/src/afl-fuzz-bitmap.c
+++ b/src/afl-fuzz-bitmap.c
@@ -250,21 +250,20 @@ inline u8 has_new_bits(afl_state_t *afl, u8 *virgin_map) {
 inline u8 has_new_bits_unclassified(afl_state_t *afl, u8 *virgin_map) {
 
   /* Handle the hot path first: no new coverage */
-  u32 off;
   u8 *end = afl->fsrv.trace_bits + afl->fsrv.map_size;
 
 #ifdef WORD_SIZE_64
 
-  if (!(off = skim((u64 *)virgin_map, (u64 *)afl->fsrv.trace_bits, (u64 *)end)))
+  if (!skim((u64 *)virgin_map, (u64 *)afl->fsrv.trace_bits, (u64 *)end))
     return 0;
 
 #else
 
-  if (!(off = skim((u32 *)virgin_map, (u32 *)afl->fsrv.trace_bits, (u32 *)end)))
+  if (!skim((u32 *)virgin_map, (u32 *)afl->fsrv.trace_bits, (u32 *)end))
     return 0;
 
 #endif                                                     /* ^WORD_SIZE_64 */
-  classify_counts_off(&afl->fsrv, off);
+  classify_counts(&afl->fsrv);
   return has_new_bits(afl, virgin_map);
 
 }
diff --git a/src/afl-fuzz-queue.c b/src/afl-fuzz-queue.c
index 713c7447..fc8a0d55 100644
--- a/src/afl-fuzz-queue.c
+++ b/src/afl-fuzz-queue.c
@@ -769,7 +769,11 @@ void cull_queue(afl_state_t *afl) {
         afl->top_rated[i]->favored = 1;
         ++afl->queued_favored;
 
-        if (!afl->top_rated[i]->was_fuzzed) { ++afl->pending_favored; }
+        if (!afl->top_rated[i]->was_fuzzed) {
+
+          ++afl->pending_favored;
+
+        }
 
       }