[sanitizers] Disable target-specific lowering of string functions.

[• koriakin]

Summary

CodeGen has hooks that allow targets to emit specialized code instead
of calls to memcmp, memchr, strcpy, stpcpy, strcmp, strlen, strnlen.
When ASan/MSan/TSan/ESan is in use, this sidesteps its interceptors, resulting
in uninstrumented memory accesses. To avoid that, make these sanitizers
mark the calls as nobuiltin.

Depends on D19801.

[echristo]

Seems like a good idea. Is there a place you could hoist the no isNoBuiltin checks?

[• koriakin]

Now the nobuiltin check applies to all libcalls (which makes sense, after all).

[filcab]

Thanks for working on this.
Can you split this patch in two, please?
The SelectionDAG + CodeGen tests on one, the ASan-specific code on another.
Not having a proper way to test SelectionDAG is annoying. To have perfecct coverage, we'd need to replicate those tests for other targets. This will do for now, though. :-)

BTW, have you measured performance impact?
If it's too big, we probably want to put this under a flag (the sanitizer philosophy is that we know we have false negatives, but no false positives, so it fits not doing this by default if it's a big performance hit).

lib/CodeGen/SelectionDAG/SelectionDAGBuilder.cpp

6177 ↗

(On Diff #55799)

We probably want to check for isNoBuiltin before we query LibInfo, which involves lookups.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

1857

We probably want to add some of the other intercepted functions (but instead of duplicating everything, I guess it's better to only add those that actually have special handling).
That can be a follow up patch, though, as needed.

[• koriakin]

In D19781#418442, @filcab wrote:

Thanks for working on this.
Can you split this patch in two, please?
The SelectionDAG + CodeGen tests on one, the ASan-specific code on another.
Not having a proper way to test SelectionDAG is annoying. To have perfecct coverage, we'd need to replicate those tests for other targets. This will do for now, though. :-)

Alright, I'll split it up. However, there's not much to test for other platforms - only SystemZ currently has customised lowering for those functions.

BTW, have you measured performance impact?
If it's too big, we probably want to put this under a flag (the sanitizer philosophy is that we know we have false negatives, but no false positives, so it fits not doing this by default if it's a big performance hit).

I haven't - I'm still trying to get the testsuite passing on SystemZ. However, all other platforms are perfectly fine with always running the interceptors, so I doubt there's anything to gain here.

[filcab]

Since no-one else does anything special with the libcalls for now, I'm totally ok with the patch.
LGTM with the change + split I asked, then. But wait to see if Eric has more comments.

[filcab]

test/Instrumentation/AddressSanitizer/str-nobuiltin.ll

4

Do we need -asan-module? We should be able to get away with just the FunctionPass, right?

[• koriakin]

Removed -asan-module

[eugenis]

Do we want this in the other sanitizers? Probably yes, and with the same list of functions.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

1784

We typically write single-statement ifs without the braces.

1842

Did you mean maybeMarkCallNoBuiltin ?

[• koriakin]

In D19781#419110, @eugenis wrote:

Do we want this in the other sanitizers? Probably yes, and with the same list of functions.

Yeah, I think so. What would be a good place to put the maybeMark...() function?

[eugenis]

lib/Transforms/Utils/ModuleUtils.cpp, or maybe a new file in that directory.

[• koriakin]

Added MSan and TSan to the mix. LSan and UBSan don't intercept these, DFSan already mangles all symbols and avoids the issue, and I have no clue about ESan.

[• koriakin]

Added ESan as well.

[eugenis]

include/llvm/Transforms/Utils/Local.h

358

I don't think this is a good name for a global function. It is specific to the sanitizer interceptors. How about maybeMarkSanitizerLibraryCallNoBuiltin?

[• koriakin]

Rather wordy (I'm having problems wrapping the lines), but it's indeed better.

[eugenis]

LGTM

include/llvm/Transforms/Utils/Local.h

 
 namespace llvm {
 
 class User;
 class BasicBlock;
 class Function;
 class BranchInst;
 class Instruction;
+class CallInst;
 class DbgDeclareInst;
 class StoreInst;
 class LoadInst;
 class Value;
 class PHINode;
 class AllocaInst;
 class AssumptionCache;
 class ConstantExpr;

 /// BW is the bitwidth of the integer type). A bswap idiom requires anywhere up
 /// to BW / 4 nodes to be searched, so is significantly faster.
 ///
 /// This function returns true on a successful match or false otherwise.
 bool recognizeBitReverseOrBSwapIdiom(
     Instruction *I, bool MatchBSwaps, bool MatchBitReversals,
     SmallVectorImpl<Instruction *> &InsertedInsts);
 
+//===----------------------------------------------------------------------===//
+//  Sanitizer utilities
+//
+
+/// Given a CallInst, check if it calls a string function known to CodeGen,
+/// and mark it with NoBuiltin if so.  To be used by sanitizers that intend
+/// to intercept string functions and want to avoid converting them to target
+/// specific instructions.
+void maybeMarkSanitizerLibraryCallNoBuiltin(CallInst *CI,
+                                            const TargetLibraryInfo *TLI);
+
 } // End llvm namespace
 
 #endif

lib/Transforms/Instrumentation/AddressSanitizer.cpp

bool AddressSanitizer::runOnFunction(Function &F) {
   SmallVector<Instruction *, 16> ToInstrument;
   SmallVector<Instruction *, 8> NoReturnCalls;
   SmallVector<BasicBlock *, 16> AllBlocks;
   SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts;
   int NumAllocas = 0;
   bool IsWrite;
   unsigned Alignment;
   uint64_t TypeSize;
+  const TargetLibraryInfo *TLI =
+      &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
 
   // Fill the set of memory operations to instrument.
   for (auto &BB : F) {
     AllBlocks.push_back(&BB);
     TempsToInstrument.clear();
     int NumInsnsPerBB = 0;
     for (auto &Inst : BB) {
       if (LooksLikeCodeInBug11395(&Inst)) return false;
for (auto &Inst : BB) {
       } else {
         if (isa<AllocaInst>(Inst)) NumAllocas++;
         CallSite CS(&Inst);
         if (CS) {
           // A call inside BB.
           TempsToInstrument.clear();
           if (CS.doesNotReturn()) NoReturnCalls.push_back(CS.getInstruction());
         }
+        if (CallInst *CI = dyn_cast<CallInst>(&Inst))
+          maybeMarkSanitizerLibraryCallNoBuiltin(CI, TLI);
         continue;
       }
       ToInstrument.push_back(&Inst);
       NumInsnsPerBB++;
       if (NumInsnsPerBB >= ClMaxInsnsToInstrumentPerBB) break;
     }
   }
 
   bool UseCalls =
       CompileKernel ||
       (ClInstrumentationWithCallsThreshold >= 0 &&
        ToInstrument.size() > (unsigned)ClInstrumentationWithCallsThreshold);
-  const TargetLibraryInfo *TLI =
-      &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
   const DataLayout &DL = F.getParent()->getDataLayout();
   ObjectSizeOffsetVisitor ObjSizeVis(DL, TLI, F.getContext(),
                                      /*RoundToAlign=*/true);
 
   // Instrument.
   int NumInstrumented = 0;
   for (auto Inst : ToInstrument) {
     if (ClDebugMin < 0 || ClDebugMax < 0 ||
bool AddressSanitizer::runOnFunction(Function &F) {
 
   return res;
 }
 
 // Workaround for bug 11395: we don't want to instrument stack in functions
 // with large assembly blobs (32-bit only), otherwise reg alloc may crash.
 // FIXME: remove once the bug 11395 is fixed.
 bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) {
   if (LongSize != 32) return false;
   CallInst *CI = dyn_cast<CallInst>(I);
   if (!CI || !CI->isInlineAsm()) return false;
   if (CI->getNumArgOperands() <= 5) return false;
   // We have inline assembly with quite a few arguments.
   return true;
 }
 
 void FunctionStackPoisoner::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(*C);
   for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) {
     std::string Suffix = itostr(i);
     AsanStackMallocFunc[i] = checkSanitizerInterfaceFunction(
         M.getOrInsertFunction(kAsanStackMallocNameTemplate + Suffix, IntptrTy,
                               IntptrTy, nullptr));
     AsanStackFreeFunc[i] = checkSanitizerInterfaceFunction(
         M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix,
                               IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr));
   }
   AsanPoisonStackMemoryFunc = checkSanitizerInterfaceFunction(
       M.getOrInsertFunction(kAsanPoisonStackMemoryName, IRB.getVoidTy(),
                             IntptrTy, IntptrTy, nullptr));
   AsanUnpoisonStackMemoryFunc = checkSanitizerInterfaceFunction(
       M.getOrInsertFunction(kAsanUnpoisonStackMemoryName, IRB.getVoidTy(),

lib/Transforms/Instrumentation/EfficiencySanitizer.cpp

 // The rest is handled by the run-time library.
 //===----------------------------------------------------------------------===//
 
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/ADT/StringExtras.h"
+#include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/IRBuilder.h"
 #include "llvm/IR/IntrinsicInst.h"
 #include "llvm/IR/Module.h"
 #include "llvm/IR/Type.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
+#include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 
 using namespace llvm;
 
 #define DEBUG_TYPE "esan"
 
 // The tool type must be just one of these ClTool* options, as the tools
 // cannot be combined due to shadow memory constraints.

 
 /// EfficiencySanitizer: instrument each module to find performance issues.
 class EfficiencySanitizer : public FunctionPass {
 public:
   EfficiencySanitizer(
       const EfficiencySanitizerOptions &Opts = EfficiencySanitizerOptions())
       : FunctionPass(ID), Options(OverrideOptionsFromCL(Opts)) {}
   const char *getPassName() const override;
+  void getAnalysisUsage(AnalysisUsage &AU) const override;
   bool runOnFunction(Function &F) override;
   bool doInitialization(Module &M) override;
   static char ID;
 
 private:
   void initializeCallbacks(Module &M);
   bool instrumentLoadOrStore(Instruction *I, const DataLayout &DL);
   bool instrumentMemIntrinsic(MemIntrinsic *MI);

 char EfficiencySanitizer::ID = 0;
 INITIALIZE_PASS(EfficiencySanitizer, "esan",
                 "EfficiencySanitizer: finds performance issues.", false, false)
 
 const char *EfficiencySanitizer::getPassName() const {
   return "EfficiencySanitizer";
 }
 
+void EfficiencySanitizer::getAnalysisUsage(AnalysisUsage &AU) const {
+  AU.addRequired<TargetLibraryInfoWrapperPass>();
+}
+
 FunctionPass *
 llvm::createEfficiencySanitizerPass(const EfficiencySanitizerOptions &Options) {
   return new EfficiencySanitizer(Options);
 }
 
 void EfficiencySanitizer::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(M.getContext());
   // Initialize the callbacks.
bool EfficiencySanitizer::runOnFunction(Function &F) {
   if (&F == EsanCtorFunction)
     return false;
   // As a function pass, we must re-initialize every time.
   initializeCallbacks(*F.getParent());
   SmallVector<Instruction *, 8> LoadsAndStores;
   SmallVector<Instruction *, 8> MemIntrinCalls;
   bool Res = false;
   const DataLayout &DL = F.getParent()->getDataLayout();
+  const TargetLibraryInfo *TLI =
+      &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
 
   for (auto &BB : F) {
     for (auto &Inst : BB) {
       if ((isa<LoadInst>(Inst) || isa<StoreInst>(Inst) ||
            isa<AtomicRMWInst>(Inst) || isa<AtomicCmpXchgInst>(Inst)) &&
           !shouldIgnoreMemoryAccess(&Inst))
         LoadsAndStores.push_back(&Inst);
       else if (isa<MemIntrinsic>(Inst))
         MemIntrinCalls.push_back(&Inst);
+      else if (CallInst *CI = dyn_cast<CallInst>(&Inst))
+        maybeMarkSanitizerLibraryCallNoBuiltin(CI, TLI);
     }
   }
 
   if (ClInstrumentLoadsAndStores) {
     for (auto Inst : LoadsAndStores) {
       Res |= instrumentLoadOrStore(Inst, DL);
     }
   }

lib/Transforms/Instrumentation/MemorySanitizer.cpp

 /// uninitialized reads.
 class MemorySanitizer : public FunctionPass {
  public:
   MemorySanitizer(int TrackOrigins = 0)
       : FunctionPass(ID),
         TrackOrigins(std::max(TrackOrigins, (int)ClTrackOrigins)),
         WarningFn(nullptr) {}
   const char *getPassName() const override { return "MemorySanitizer"; }
+  void getAnalysisUsage(AnalysisUsage &AU) const override {
+    AU.addRequired<TargetLibraryInfoWrapperPass>();
+  }
   bool runOnFunction(Function &F) override;
   bool doInitialization(Module &M) override;
   static char ID;  // Pass identification, replacement for typeid.
 
  private:
   void initializeCallbacks(Module &M);
 
   /// \brief Track origins (allocation points) of uninitialized values.

 /// test their argument shadow and print reports (with a runtime call) if it's
 /// non-zero.
 struct MemorySanitizerVisitor : public InstVisitor<MemorySanitizerVisitor> {
   Function &F;
   MemorySanitizer &MS;
   SmallVector<PHINode *, 16> ShadowPHINodes, OriginPHINodes;
   ValueMap<Value*, Value*> ShadowMap, OriginMap;
   std::unique_ptr<VarArgHelper> VAHelper;
+  const TargetLibraryInfo *TLI;
 
   // The following flags disable parts of MSan instrumentation based on
   // blacklist contents and command-line options.
   bool InsertChecks;
   bool PropagateShadow;
   bool PoisonStack;
   bool PoisonUndef;
   bool CheckReturnValue;
MemorySanitizerVisitor(Function &F, MemorySanitizer &MS)
     bool SanitizeFunction = F.hasFnAttribute(Attribute::SanitizeMemory);
     InsertChecks = SanitizeFunction;
     PropagateShadow = SanitizeFunction;
     PoisonStack = SanitizeFunction && ClPoisonStack;
     PoisonUndef = SanitizeFunction && ClPoisonUndef;
     // FIXME: Consider using SpecialCaseList to specify a list of functions that
     // must always return fully initialized values. For now, we hardcode "main".
     CheckReturnValue = SanitizeFunction && (F.getName() == "main");
+    TLI = &MS.getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
 
     DEBUG(if (!InsertChecks)
           dbgs() << "MemorySanitizer is not inserting checks into '"
                  << F.getName() << "'\n");
   }
 
   Value *updateOrigin(Value *V, IRBuilder<> &IRB) {
     if (MS.TrackOrigins <= 1) return V;
if (CS.isCall()) {
         AttrBuilder B;
         B.addAttribute(Attribute::ReadOnly)
           .addAttribute(Attribute::ReadNone);
         Func->removeAttributes(AttributeSet::FunctionIndex,
                                AttributeSet::get(Func->getContext(),
                                                  AttributeSet::FunctionIndex,
                                                  B));
       }
+
+      maybeMarkSanitizerLibraryCallNoBuiltin(Call, TLI);
     }
     IRBuilder<> IRB(&I);
 
     unsigned ArgOffset = 0;
     DEBUG(dbgs() << "  CallSite: " << I << "\n");
     for (CallSite::arg_iterator ArgIt = CS.arg_begin(), End = CS.arg_end();
          ArgIt != End; ++ArgIt) {
       Value *A = *ArgIt;

lib/Transforms/Instrumentation/ThreadSanitizer.cpp

 
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/ADT/SmallSet.h"
 #include "llvm/ADT/SmallString.h"
 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/Analysis/CaptureTracking.h"
+#include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/Analysis/ValueTracking.h"
 #include "llvm/IR/DataLayout.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/IRBuilder.h"
 #include "llvm/IR/IntrinsicInst.h"
 #include "llvm/IR/Intrinsics.h"
 #include "llvm/IR/LLVMContext.h"
 #include "llvm/IR/Metadata.h"
 #include "llvm/IR/Module.h"
 #include "llvm/IR/Type.h"
 #include "llvm/ProfileData/InstrProf.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/MathExtras.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
+#include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 
 using namespace llvm;
 
 #define DEBUG_TYPE "tsan"
 
 static cl::opt<bool>  ClInstrumentMemoryAccesses(
     "tsan-instrument-memory-accesses", cl::init(true),

 static const char *const kTsanInitName = "__tsan_init";
 
 namespace {
 
 /// ThreadSanitizer: instrument the code in module to find races.
 struct ThreadSanitizer : public FunctionPass {
   ThreadSanitizer() : FunctionPass(ID) {}
   const char *getPassName() const override;
+  void getAnalysisUsage(AnalysisUsage &AU) const override;
   bool runOnFunction(Function &F) override;
   bool doInitialization(Module &M) override;
   static char ID;  // Pass identification, replacement for typeid.
 
  private:
   void initializeCallbacks(Module &M);
   bool instrumentLoadOrStore(Instruction *I, const DataLayout &DL);
   bool instrumentAtomic(Instruction *I, const DataLayout &DL);

 INITIALIZE_PASS(ThreadSanitizer, "tsan",
     "ThreadSanitizer: detects data races.",
     false, false)
 
 const char *ThreadSanitizer::getPassName() const {
   return "ThreadSanitizer";
 }
 
+void ThreadSanitizer::getAnalysisUsage(AnalysisUsage &AU) const {
+  AU.addRequired<TargetLibraryInfoWrapperPass>();
+}
+
 FunctionPass *llvm::createThreadSanitizerPass() {
   return new ThreadSanitizer();
 }
 
 void ThreadSanitizer::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(M.getContext());
   // Initialize the callbacks.
   TsanFuncEntry = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
bool ThreadSanitizer::runOnFunction(Function &F) {
   SmallVector<Instruction*, 8> AllLoadsAndStores;
   SmallVector<Instruction*, 8> LocalLoadsAndStores;
   SmallVector<Instruction*, 8> AtomicAccesses;
   SmallVector<Instruction*, 8> MemIntrinCalls;
   bool Res = false;
   bool HasCalls = false;
   bool SanitizeFunction = F.hasFnAttribute(Attribute::SanitizeThread);
   const DataLayout &DL = F.getParent()->getDataLayout();
+  const TargetLibraryInfo *TLI =
+      &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
 
   // Traverse all instructions, collect loads/stores/returns, check for calls.
   for (auto &BB : F) {
     for (auto &Inst : BB) {
       if (isAtomic(&Inst))
         AtomicAccesses.push_back(&Inst);
       else if (isa<LoadInst>(Inst) || isa<StoreInst>(Inst))
         LocalLoadsAndStores.push_back(&Inst);
       else if (isa<ReturnInst>(Inst))
         RetVec.push_back(&Inst);
       else if (isa<CallInst>(Inst) || isa<InvokeInst>(Inst)) {
+        if (CallInst *CI = dyn_cast<CallInst>(&Inst))
+          maybeMarkSanitizerLibraryCallNoBuiltin(CI, TLI);
         if (isa<MemIntrinsic>(Inst))
           MemIntrinCalls.push_back(&Inst);
         HasCalls = true;
         chooseInstructionsToInstrument(LocalLoadsAndStores, AllLoadsAndStores,
                                        DL);
       }
     }
     chooseInstructionsToInstrument(LocalLoadsAndStores, AllLoadsAndStores, DL);

lib/Transforms/Utils/Local.cpp

else if (OKForBitReverse && MatchBitReversals)
     Intrin = Intrinsic::bitreverse;
   else
     return false;
 
   Function *F = Intrinsic::getDeclaration(I->getModule(), Intrin, ITy);
   InsertedInsts.push_back(CallInst::Create(F, Res->Provider, "rev", I));
   return true;
 }
+
+// CodeGen has special handling for some string functions that may replace
+// them with target-specific intrinsics.  Since that'd skip our interceptors
+// in ASan/MSan/TSan/DFSan, and thus make us miss some memory accesses,
+// we mark affected calls as NoBuiltin, which will disable optimization
+// in CodeGen.
+void llvm::maybeMarkSanitizerLibraryCallNoBuiltin(CallInst *CI,
+                                          const TargetLibraryInfo *TLI) {
+  Function *F = CI->getCalledFunction();
+  LibFunc::Func Func;
+  if (!F || F->hasLocalLinkage() || !F->hasName() ||
+      !TLI->getLibFunc(F->getName(), Func))
+    return;
+  switch (Func) {
+    default: break;
+    case LibFunc::memcmp:
+    case LibFunc::memchr:
+    case LibFunc::strcpy:
+    case LibFunc::stpcpy:
+    case LibFunc::strcmp:
+    case LibFunc::strlen:
+    case LibFunc::strnlen:
+      CI->addAttribute(AttributeSet::FunctionIndex, Attribute::NoBuiltin);
+      break;
+  }
+}

test/Instrumentation/AddressSanitizer/str-nobuiltin.ll

+; Test marking string functions as nobuiltin in address sanitizer.
+;
+; RUN: opt < %s -asan -S | FileCheck %s
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
+target triple = "x86_64-unknown-linux-gnu"
+
+declare i8* @memchr(i8* %a, i32 %b, i64 %c)
+declare i32 @memcmp(i8* %a, i8* %b, i64 %c)
+declare i32 @strcmp(i8* %a, i8* %b)
+declare i8* @strcpy(i8* %a, i8* %b)
+declare i8* @stpcpy(i8* %a, i8* %b)
+declare i64 @strlen(i8* %a)
+declare i64 @strnlen(i8* %a, i64 %b)
+
+; CHECK: call{{.*}}@memchr{{.*}} #[[ATTR:[0-9]+]]
+; CHECK: call{{.*}}@memcmp{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strcmp{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strcpy{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@stpcpy{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strlen{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strnlen{{.*}} #[[ATTR]]
+; attributes #[[ATTR]] = { nobuiltin }
+
+define void @f1(i8* %a, i8* %b) nounwind uwtable sanitize_address {
+  tail call i8* @memchr(i8* %a, i32 1, i64 12)
+  tail call i32 @memcmp(i8* %a, i8* %b, i64 12)
+  tail call i32 @strcmp(i8* %a, i8* %b)
+  tail call i8* @strcpy(i8* %a, i8* %b)
+  tail call i8* @stpcpy(i8* %a, i8* %b)
+  tail call i64 @strlen(i8* %a)
+  tail call i64 @strnlen(i8* %a, i64 12)
+  ret void
+}

test/Instrumentation/EfficiencySanitizer/str-nobuiltin.ll

+; Test marking string functions as nobuiltin in efficiency sanitizer.
+;
+; RUN: opt < %s -esan -S | FileCheck %s
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
+target triple = "x86_64-unknown-linux-gnu"
+
+declare i8* @memchr(i8* %a, i32 %b, i64 %c)
+declare i32 @memcmp(i8* %a, i8* %b, i64 %c)
+declare i32 @strcmp(i8* %a, i8* %b)
+declare i8* @strcpy(i8* %a, i8* %b)
+declare i8* @stpcpy(i8* %a, i8* %b)
+declare i64 @strlen(i8* %a)
+declare i64 @strnlen(i8* %a, i64 %b)
+
+; CHECK: call{{.*}}@memchr{{.*}} #[[ATTR:[0-9]+]]
+; CHECK: call{{.*}}@memcmp{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strcmp{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strcpy{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@stpcpy{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strlen{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strnlen{{.*}} #[[ATTR]]
+; attributes #[[ATTR]] = { nobuiltin }
+
+define void @f1(i8* %a, i8* %b) nounwind uwtable {
+  tail call i8* @memchr(i8* %a, i32 1, i64 12)
+  tail call i32 @memcmp(i8* %a, i8* %b, i64 12)
+  tail call i32 @strcmp(i8* %a, i8* %b)
+  tail call i8* @strcpy(i8* %a, i8* %b)
+  tail call i8* @stpcpy(i8* %a, i8* %b)
+  tail call i64 @strlen(i8* %a)
+  tail call i64 @strnlen(i8* %a, i64 12)
+  ret void
+}

test/Instrumentation/MemorySanitizer/str-nobuiltin.ll

+; Test marking string functions as nobuiltin in memory sanitizer.
+;
+; RUN: opt < %s -msan -S | FileCheck %s
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
+target triple = "x86_64-unknown-linux-gnu"
+
+declare i8* @memchr(i8* %a, i32 %b, i64 %c)
+declare i32 @memcmp(i8* %a, i8* %b, i64 %c)
+declare i32 @strcmp(i8* %a, i8* %b)
+declare i8* @strcpy(i8* %a, i8* %b)
+declare i8* @stpcpy(i8* %a, i8* %b)
+declare i64 @strlen(i8* %a)
+declare i64 @strnlen(i8* %a, i64 %b)
+
+; CHECK: call{{.*}}@memchr{{.*}} #[[ATTR:[0-9]+]]
+; CHECK: call{{.*}}@memcmp{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strcmp{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strcpy{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@stpcpy{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strlen{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strnlen{{.*}} #[[ATTR]]
+; attributes #[[ATTR]] = { nobuiltin }
+
+define void @f1(i8* %a, i8* %b) nounwind uwtable sanitize_memory {
+  tail call i8* @memchr(i8* %a, i32 1, i64 12)
+  tail call i32 @memcmp(i8* %a, i8* %b, i64 12)
+  tail call i32 @strcmp(i8* %a, i8* %b)
+  tail call i8* @strcpy(i8* %a, i8* %b)
+  tail call i8* @stpcpy(i8* %a, i8* %b)
+  tail call i64 @strlen(i8* %a)
+  tail call i64 @strnlen(i8* %a, i64 12)
+  ret void
+}

test/Instrumentation/ThreadSanitizer/str-nobuiltin.ll

+; Test marking string functions as nobuiltin in thread sanitizer.
+;
+; RUN: opt < %s -tsan -S | FileCheck %s
+target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
+target triple = "x86_64-unknown-linux-gnu"
+
+declare i8* @memchr(i8* %a, i32 %b, i64 %c)
+declare i32 @memcmp(i8* %a, i8* %b, i64 %c)
+declare i32 @strcmp(i8* %a, i8* %b)
+declare i8* @strcpy(i8* %a, i8* %b)
+declare i8* @stpcpy(i8* %a, i8* %b)
+declare i64 @strlen(i8* %a)
+declare i64 @strnlen(i8* %a, i64 %b)
+
+; CHECK: call{{.*}}@memchr{{.*}} #[[ATTR:[0-9]+]]
+; CHECK: call{{.*}}@memcmp{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strcmp{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strcpy{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@stpcpy{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strlen{{.*}} #[[ATTR]]
+; CHECK: call{{.*}}@strnlen{{.*}} #[[ATTR]]
+; attributes #[[ATTR]] = { nobuiltin }
+
+define void @f1(i8* %a, i8* %b) nounwind uwtable sanitize_thread {
+  tail call i8* @memchr(i8* %a, i32 1, i64 12)
+  tail call i32 @memcmp(i8* %a, i8* %b, i64 12)
+  tail call i32 @strcmp(i8* %a, i8* %b)
+  tail call i8* @strcpy(i8* %a, i8* %b)
+  tail call i8* @stpcpy(i8* %a, i8* %b)
+  tail call i64 @strlen(i8* %a)
+  tail call i64 @strnlen(i8* %a, i64 12)
+  ret void
+}