sanmd: refine selection of functions for UAR checking

[dvyukov]

Summary

There are no intrinsic functions that leak arguments.
If the called function does not return, the current function
does not return as well, so no possibility of use-after-return.
Sanitizer function also don't leak or don't return.
It's safe to both pass pointers to local variables to them
and to tail-call them.

[aeubanks]

uar.cpp is failing when specifying -DCOMPILER_RT_BUILD_SANITIZERS=OFF because asan libs aren't built.

[aeubanks]

going to revert, feel free to reland when -DCOMPILER_RT_BUILD_SANITIZERS=OFF handling is fixed

[dvyukov]

run metadata tests only if COMPILER_RT_BUILD_SANITIZERS=ON

[dvyukov]

also don't run on OpenBSD

compiler-rt/test/metadata/CMakeLists.txt

 if(CAN_TARGET_x86_64)
   set(TEST_ARCH ${X86_64})
 
   set(METADATA_LIT_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR})
   set(METADATA_LIT_BINARY_DIR ${CMAKE_CURRENT_BINARY_DIR})
 
+  set(METADATA_TEST_DEPS ${SANITIZER_COMMON_LIT_TEST_DEPS})
+  if (NOT COMPILER_RT_STANDALONE_BUILD)
+    list(APPEND METADATA_TEST_DEPS asan ubsan)
+  endif()
+
   set(SANITIZER_COMMON_TEST_TARGET_ARCH ${X86_64})
   get_test_cc_for_arch(x86_64 METADATA_TEST_TARGET_CC METADATA_TEST_TARGET_CFLAGS)
   configure_lit_site_cfg(
     ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.py.in
     ${CMAKE_CURRENT_BINARY_DIR}/lit.site.cfg.py)
 
   add_lit_testsuite(check-sanmd "Running the SanitizerBinaryMetadata tests"
     ${CMAKE_CURRENT_BINARY_DIR}
-    DEPENDS ${SANITIZER_COMMON_LIT_TEST_DEPS})
+    DEPENDS ${METADATA_TEST_DEPS})
   set_target_properties(check-sanmd PROPERTIES FOLDER "Compiler-RT Misc")
 endif()

compiler-rt/test/metadata/uar.cpp

 // RUN: %clangxx %s -O1 -o %t -fexperimental-sanitize-metadata=covered,uar && %t | FileCheck %s
+// RUN: %clangxx %s -O1 -o %t -fexperimental-sanitize-metadata=covered,uar -fsanitize=address,signed-integer-overflow && %t | FileCheck %s
 
 // CHECK: metadata add version 1
 
 __attribute__((noinline, not_tail_called)) void escape(const volatile void *p) {
   static const volatile void *sink;
   sink = p;
 }
 
 __attribute__((noinline, not_tail_called)) void use(int x) {
   static volatile int sink;
   sink += x;
 }
 
 // CHECK: empty: features=0 stack_args=0
 void empty() {}
 
+// CHECK: simple: features=0 stack_args=0
+int simple(int *data, int index) { return data[index + 1]; }
+
+// CHECK: builtins: features=0 stack_args=0
+int builtins() {
+  int x = 0;
+  __builtin_prefetch(&x);
+  return x;
+}
+
 // CHECK: ellipsis: features=0 stack_args=0
 void ellipsis(const char *fmt, ...) {
   int x;
   escape(&x);
 }
 
 // CHECK: non_empty_function: features=2 stack_args=0
 void non_empty_function() {
void struct_stack_args(large a) {
   escape(&x);
 }
 
 __attribute__((noinline)) int tail_called(int x) { return x; }
 
 // CHECK: with_tail_call: features=2
 int with_tail_call(int x) { [[clang::musttail]] return tail_called(x); }
 
+__attribute__((noinline, noreturn)) int noreturn(int x) { __builtin_trap(); }
+
+// CHECK: with_noreturn_tail_call: features=0
+int with_noreturn_tail_call(int x) { return noreturn(x); }
+
 // CHECK: local_array: features=0
 void local_array(int x) {
   int data[10];
   use(data[x]);
 }
 
 // CHECK: local_alloca: features=0
 void local_alloca(int size, int i, int j) {
   volatile int *p = static_cast<int *>(__builtin_alloca(size));
   p[i] = 0;
   use(p[j]);
 }
 
 // CHECK: escaping_alloca: features=2
 void escaping_alloca(int size, int i) {
   volatile int *p = static_cast<int *>(__builtin_alloca(size));
   escape(&p[i]);
 }
 
 #define FUNCTIONS                                                              \
   FN(empty);                                                                   \
+  FN(simple);                                                                  \
+  FN(builtins);                                                                \
   FN(ellipsis);                                                                \
   FN(non_empty_function);                                                      \
   FN(no_stack_args);                                                           \
   FN(stack_args);                                                              \
   FN(more_stack_args);                                                         \
   FN(struct_stack_args);                                                       \
   FN(with_tail_call);                                                          \
+  FN(with_noreturn_tail_call);                                                 \
   FN(local_array);                                                             \
   FN(local_alloca);                                                            \
   FN(escaping_alloca);                                                         \
   /**/
 
 #include "common.h"

llvm/lib/Transforms/Instrumentation/SanitizerBinaryMetadata.cpp

if (Options.Covered || (FeatureMask && RequiresCovered)) {
     // The feature mask will be placed after the size (32 bit) of the function,
     // so in total one covered entry will use `sizeof(void*) + 4 + 4`.
     Constant *CFM = IRB.getInt32(FeatureMask);
     F.setMetadata(LLVMContext::MD_pcsections,
                   MDB.createPCSections({{Section, {CFM}}}));
   }
 }
 
+bool isUARSafeCall(CallInst *CI) {
+  auto *F = CI->getCalledFunction();
+  // There are no intrinsic functions that leak arguments.
+  // If the called function does not return, the current function
+  // does not return as well, so no possibility of use-after-return.
+  // Sanitizer function also don't leak or don't return.
+  // It's safe to both pass pointers to local variables to them
+  // and to tail-call them.
+  return F && (F->isIntrinsic() || F->doesNotReturn() ||
+               F->getName().startswith("__asan_") ||
+               F->getName().startswith("__hwsan_") ||
+               F->getName().startswith("__ubsan_") ||
+               F->getName().startswith("__msan_") ||
+               F->getName().startswith("__tsan_"));
+}
+
 bool hasUseAfterReturnUnsafeUses(Value &V) {
   for (User *U : V.users()) {
     if (auto *I = dyn_cast<Instruction>(U)) {
       if (I->isLifetimeStartOrEnd() || I->isDroppable())
         continue;
+      if (auto *CI = dyn_cast<CallInst>(U)) {
+        if (isUARSafeCall(CI))
+          continue;
+      }
       if (isa<LoadInst>(U))
         continue;
       if (auto *SI = dyn_cast<StoreInst>(U)) {
         // If storing TO the alloca, then the address isn't taken.
         if (SI->getOperand(1) == &V)
           continue;
       }
       if (auto *GEPI = dyn_cast<GetElementPtrInst>(U)) {

 
 bool useAfterReturnUnsafe(Instruction &I) {
   if (isa<AllocaInst>(I))
     return hasUseAfterReturnUnsafeUses(I);
   // Tail-called functions are not necessary intercepted
   // at runtime because there is no call instruction.
   // So conservatively mark the caller as requiring checking.
   else if (auto *CI = dyn_cast<CallInst>(&I))
-    return CI->isTailCall();
+    return CI->isTailCall() && !isUARSafeCall(CI);
   return false;
 }
 
 bool SanitizerBinaryMetadata::runOn(Instruction &I, MetadataInfoSet &MIS,
                                     MDBuilder &MDB, uint32_t &FeatureMask) {
   SmallVector<const MetadataInfo *, 1> InstMetadata;
   bool RequiresCovered = false;