fsanitize-coverage trace-cmp/div/gep don't emit callbacks

Hi, I'm trying to use the different trace options for the coverage
sanitizer, but for the cmp/div/gep trace options no callbacks are
emitted. Is this a known bug / is there something I can do to still use
these options?

Surprisingly the trace-pc coverage works as expected and adds the
correct callbacks:

clang -fsanitize-coverage=trace-pc test.c
objdump -DM intel a.out | grep -n50 '<main>'

[...]
mov QWORD PTR [rbp-0x10],rsi
cmp DWORD PTR [rbp-0x8],0x2
je <main+0x44>
call <__sanitizer_cov_trace_pc>
mov DWORD PTR [rbp-0x4],0x0
[...]

(If test.c doesn't include a definition of void
__sanitizer_cov_trace_pc(){}, a link time error is thrown)

However, the following will not introduce any callbacks (there should be
one before the cmp), and missing definitions of the callbacks do not
trigger any errors:

clang -fsanitize-coverage=trace-cmp test.c
objdump -DM intel a.out | grep -n50 '<main>'

[...]
mov QWORD PTR [rbp-0x10],rsi
cmp DWORD PTR [rbp-0x8],0x2
je <main+0x2c>
mov DWORD PTR [rbp-0x4],0x0
[...]

I build clang freshly from trunk:

clang --version
clang version 4.0.0 (trunk 284459)
Target: x86_64-unknown-linux-gnu

Cheers
Cornelius

test.c (927 Bytes)