[UBSan] Consider zero input to __builtin_clz/ctz to be undefined independent of the target.

[craig.topper]

Summary

Previously we checked isCLZForZeroUndef and only added UBSan checks
if it returned true.

The builtin should be considered undefined for 0 regardless of
the target so that code using it is portable. The isCLZForZeroUndef
was only intended to disable optimizations in the middle end and
backend.

See https://discourse.llvm.org/t/should-ubsan-detect-0-input-to-builtin-clz-ctz-regardless-of-target/71060

[nikic]

LGTM

[tmatheson]

I think this breaks the ACLE header, see https://github.com/llvm/llvm-project/issues/63113

clang/lib/CodeGen/CGBuiltin.cpp

 //===---- CGBuiltin.cpp - Emit LLVM Code for builtins ---------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 //

 }
 
 Value *CodeGenFunction::EmitCheckedArgForBuiltin(const Expr *E,
                                                  BuiltinCheckKind Kind) {
   assert((Kind == BCK_CLZPassedZero || Kind == BCK_CTZPassedZero)
           && "Unsupported builtin check kind");
 
   Value *ArgValue = EmitScalarExpr(E);
-  if (!SanOpts.has(SanitizerKind::Builtin) || !getTarget().isCLZForZeroUndef())
+  if (!SanOpts.has(SanitizerKind::Builtin))
     return ArgValue;
 
   SanitizerScope SanScope(this);
   Value *Cond = Builder.CreateICmpNE(
       ArgValue, llvm::Constant::getNullValue(ArgValue->getType()));
   EmitCheck(std::make_pair(Cond, SanitizerKind::Builtin),
             SanitizerHandler::InvalidBuiltin,
             {EmitCheckSourceLocation(E->getExprLoc()),

clang/test/CodeGen/ubsan-builtin-checks.c

-// RUN: %clang_cc1 -triple x86_64-apple-darwin10 -w -emit-llvm -o - %s -fsanitize=builtin | FileCheck %s
-// RUN: %clang_cc1 -triple arm64-none-linux-gnu -w -emit-llvm -o - %s -fsanitize=builtin | FileCheck %s --check-prefix=NOT-UB
+// RUN: %clang_cc1 -triple x86_64-apple-darwin10 -w -emit-llvm -o - %s -fsanitize=builtin | FileCheck %s --check-prefixes=CHECK,POISON
+// RUN: %clang_cc1 -triple arm64-none-linux-gnu -w -emit-llvm -o - %s -fsanitize=builtin | FileCheck %s --check-prefixes=CHECK,NOPOISON
 
-// NOT-UB-NOT: __ubsan_handle_invalid_builtin
+// A zero input to __bultin_ctz/clz is considered UB even if the target does not
+// want to optimize based on zero input being undefined.
 
 // CHECK: define{{.*}} void @check_ctz
 void check_ctz(int n) {
   // CHECK: [[NOT_ZERO:%.*]] = icmp ne i32 [[N:%.*]], 0, !nosanitize
   // CHECK-NEXT: br i1 [[NOT_ZERO]]
   //
   // Handler block:
   // CHECK: call void @__ubsan_handle_invalid_builtin
   // CHECK-NEXT: unreachable
   //
   // Continuation block:
-  // CHECK: call i32 @llvm.cttz.i32(i32 [[N]], i1 true)
+  // POISON: call i32 @llvm.cttz.i32(i32 [[N]], i1 true)
+  // NOPOISON: call i32 @llvm.cttz.i32(i32 [[N]], i1 false)
   __builtin_ctz(n);
 
   // CHECK: call void @__ubsan_handle_invalid_builtin
   __builtin_ctzl(n);
 
   // CHECK: call void @__ubsan_handle_invalid_builtin
   __builtin_ctzll(n);
 }
 
 // CHECK: define{{.*}} void @check_clz
 void check_clz(int n) {
   // CHECK: [[NOT_ZERO:%.*]] = icmp ne i32 [[N:%.*]], 0, !nosanitize
   // CHECK-NEXT: br i1 [[NOT_ZERO]]
   //
   // Handler block:
   // CHECK: call void @__ubsan_handle_invalid_builtin
   // CHECK-NEXT: unreachable
   //
   // Continuation block:
-  // CHECK: call i32 @llvm.ctlz.i32(i32 [[N]], i1 true)
+  // POISON: call i32 @llvm.ctlz.i32(i32 [[N]], i1 true)
+  // NOPOISON: call i32 @llvm.ctlz.i32(i32 [[N]], i1 false)
   __builtin_clz(n);
 
   // CHECK: call void @__ubsan_handle_invalid_builtin
   __builtin_clzl(n);
 
   // CHECK: call void @__ubsan_handle_invalid_builtin
   __builtin_clzll(n);
 }