[tsan] Add support for C++ exceptions into TSan (call __tsan_func_exit during unwinding)

[kubamracek]

Summary

This patch is a re-incarnation of https://reviews.llvm.org/D10740 (which seems to be abandoned now). This adds support for TSan C++ exception handling, where we need to add extra calls to __tsan_func_exit when a function is exitted via exception mechanisms. Otherwise the shadow stack gets corrupted (leaked). There is an existing implementation that finds all possible function exit points, and adds extra EH cleanup blocks where needed.

I moved the implementation of EscapeEnumerator to a header file, but note that I made one change, which is the addition of the II->setDebugLoc(CI->getDebugLoc()); line. This makes sure we don't lose debug information.

[kubamracek]

Also note that this change increases the code size of TSanified binaries, roughly by 10-20%.

[rnk]

In D26177#585299, @kubabrecka wrote:

Also note that this change increases the code size of TSanified binaries, roughly by 10-20%.

I don't expect there will be any increase in code size if -fno-exceptions is set, because all functions will be marked nounwind, so we won't do the call-to-invoke transformation.

include/llvm/Transforms/Utils/EscapeEnumerator.h

31–32

The state machine is superfluous, it only has two real states: 1 (running) and 2 (done). The state 0 logic could be handled in the constructor by setting StateBB and StateE. Mind killing the switch and this comment, assuming we don't implement the code size optimization I described below?

46

The implementation of Next should not live in a header.

55

LLVM_FALLTHROUGH would help me understand what's supposed to happen here.

75–77

Range-based for?

79–80

The right way to ask this is !CI->doesNotThrow(). I'm surprised we don't have a non-virtual override of Instruction::mayThrow in CallInst, but whatever.

93

This isn't going to be right everywhere. You probably want to add some function to lib/Analysis/EHPersonalities.cpp to pick a good default based on the target triple.

98

A landingpad instruction would be wrong on Windows, you would want to insert a cleanuppad that unwinds to the caller. For now I think it would be OK to report_fatal_error if isFuncletEHPersonality(classifyEHPersonality(PersFn)) is true.

123

This fails to handle operand bundles on calls. We should factor this logic out of the inliner, which gets it 100% correct, into lib/Transforms/Util/Local.cpp next to changeToCall, and use it from here.

lib/Transforms/Instrumentation/ThreadSanitizer.cpp

452–453

This is probably outside the scope of this patch, but is this really what you want to do? Instead of inserting a call before every return, you could create a new single return block with only one call. That might be better for code size. The same is true for resumes: you can make all resumes a jump to the same resume block, and then you only need one exit call, for a total of two calls per function, max.

Actually, this gives me a maybe too clever idea for code size reduction... what if we had __tsan_func_exit check if we are unwinding and call _Unwind_Resume from there? We'd still have binary size increase from the LSDA and we probably couldn't eliminate the landingpad basic block, but it's an interesting idea.

[kubamracek]

Note that I'm just moving the code for EscapeEnumerator, which is some pretty old code (r45670), and I'd CC the author, but I don't think he works on LLVM anymore. Anyway, thanks for the review, I'll update the patch!

[kubamracek]

Updating patch. Added some helper function to EHPersonalitites.h/.cpp. I still kept getDefaultEHPersonality always return EHPersonality::GNU_C -- please advise what the behavior should be. Annotated all TSan callbacks as "nounwind", which means we don't need to transform leaf functions. Extracted the BB splitting and CallInst-to-InvokeInst logic from InlineFunction.cpp into Utils/Local.cpp. Removed the state machine from EscapeEnumerator.

I'll look into the size optimizations later, but shouldn't the optimizer already do what you describe for higher -O levels?

[rnk]

Looks good to me, but we should probably wait to see if Dmitry has any concerns about turning this on by default.

In D26177#586077, @kubabrecka wrote:

Note that I'm just moving the code for EscapeEnumerator, which is some pretty old code (r45670), and I'd CC the author, but I don't think he works on LLVM anymore. Anyway, thanks for the review, I'll update the patch!

Yeah, I noticed that after I got halfway through it, and then I felt like it was still worth a good rewrite. :)

[dvyukov]

1. Please add tsan pass flag that turns exception interception off. We may need to disable it during deployment if it causes instability, compilation errors or too large binary increase.

2. Are we sure that longjmp won't cause double call to __tsan_func_exit? At least MSVC longjmp will unwind stack and call destructors, which will most likely lead to double exit calls. Linux docs are vague in this regard. Not sure about mac.

projects/compiler-rt/test/tsan/exceptions.cc

111

More than 80 columns. Please fix.

[kubamracek]

In D26177#590185, @dvyukov wrote:

1. Please add tsan pass flag that turns exception interception off. We may need to disable it during deployment if it causes instability, compilation errors or too large binary increase.

Will do. What's "too large" for you? This does cause increases, which are larger in -O0 builds.

2. Are we sure that longjmp won't cause double call to __tsan_func_exit? At least MSVC longjmp will unwind stack and call destructors, which will most likely lead to double exit calls. Linux docs are vague in this regard. Not sure about mac.

I'll try to check. Besides longjmp, do you have some particular scenario that's worth adding a testcase for?

[dvyukov]

In D26177#590243, @kubabrecka wrote:

In D26177#590185, @dvyukov wrote:

1. Please add tsan pass flag that turns exception interception off. We may need to disable it during deployment if it causes instability, compilation errors or too large binary increase.

Will do. What's "too large" for you? This does cause increases, which are larger in -O0 builds.

Any increase will cause some failures. We should have -fno-exceptions for most binaries, but maybe not for all.

2. Are we sure that longjmp won't cause double call to __tsan_func_exit? At least MSVC longjmp will unwind stack and call destructors, which will most likely lead to double exit calls. Linux docs are vague in this regard. Not sure about mac.

I'll try to check. Besides longjmp, do you have some particular scenario that's worth adding a testcase for?

Can't think of anything else.

[rnk]

Maybe there's a better way to do this. What if we wrote a custom personality function in the TSan RTL that wraps the normal personality function variants, and calls __tsan_func_exit internally? We can definitely do this for now, but it might be nice to experiment with the custom personality to win back the 10% code size bloat here.

[kubamracek]

Updating patch:

• added a switch to turn this off
• added a testcase for the IR transformations and for the switch
• added two testcase for setjmp/longjmp
• changed EscapeEnumerator to have an "HandleExceptions" argument (default true)
• changed EscapeEnumerator to not insert EH landingpads when the function itself is nounwind

[kubamracek]

I tested the setjmp/longjmp and it's okay on Darwin and Linux. Since this C++ exceptions support doesn't support exceptions on Windows, I didn't even try that. Reid, could you test this patch for me if it breaks compilation on Windows?

I'm also not sure what does it mean when a nounwind function calls something that's not nounwind. Should we instrument in this case?

Lastly, do you have an example that would trigger this instrumentation, but should not with -fno-exceptions?

[rnk]

In D26177#592464, @kubabrecka wrote:

I tested the setjmp/longjmp and it's okay on Darwin and Linux. Since this C++ exceptions support doesn't support exceptions on Windows, I didn't even try that. Reid, could you test this patch for me if it breaks compilation on Windows?

I'm not set up to build tsan on Windows, it's only supported for gotsan. Dmitry knows how to build that, maybe he has time to test it.

I'm also not sure what does it mean when a nounwind function calls something that's not nounwind. Should we instrument in this case?

That's UB, so we don't need a cleanup, and we shouldn't insert one.

Lastly, do you have an example that would trigger this instrumentation, but should not with -fno-exceptions?

I think the only way this can happen is if there's a bug in clang or a subsequent IR instrumentation pass that inserts new functions.

[dvyukov]

I'm not set up to build tsan on Windows, it's only supported for gotsan. Dmitry knows how to build that, maybe he has time to test it.

gotsan uses Go compiler for instrumentation.

[dvyukov]

I am happy with tsan pass and runtime changes, leaving to Reid for approval.

[rnk]

lgtm

[kubamracek]

This landed in r286893 (LLVM) and r286894 (compiler-rt). Thanks for reviewing!

include/llvm/Analysis/EHPersonalities.h

 //===- EHPersonalities.h - Compute EH-related information -----------------===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_ANALYSIS_EHPERSONALITIES_H
 #define LLVM_ANALYSIS_EHPERSONALITIES_H
 
 #include "llvm/ADT/DenseMap.h"
 #include "llvm/ADT/TinyPtrVector.h"
+#include "llvm/ADT/Triple.h"
 #include "llvm/Support/ErrorHandling.h"
 
 namespace llvm {
 class BasicBlock;
 class Function;
 class Value;
 
 enum class EHPersonality {
enum class EHPersonality {
   Rust
 };
 
 /// \brief See if the given exception handling personality function is one
 /// that we understand.  If so, return a description of it; otherwise return
 /// Unknown.
 EHPersonality classifyEHPersonality(const Value *Pers);
 
+StringRef getEHPersonalityName(EHPersonality Pers);
+
+EHPersonality getDefaultEHPersonality(const Triple &T);
+
 /// \brief Returns true if this personality function catches asynchronous
 /// exceptions.
 inline bool isAsynchronousEHPersonality(EHPersonality Pers) {
   // The two SEH personality functions can catch asynch exceptions. We assume
   // unknown personalities don't catch asynch exceptions.
   switch (Pers) {
   case EHPersonality::MSVC_X86SEH:
   case EHPersonality::MSVC_Win64SEH:

include/llvm/Transforms/Utils/EscapeEnumerator.h

+//===-- EscapeEnumerator.h --------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Defines a helper class that enumerates all possible exits from a function,
+// including exception handling.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef LLVM_TRANSFORMS_UTILS_ESCAPEENUMERATOR_H
+#define LLVM_TRANSFORMS_UTILS_ESCAPEENUMERATOR_H
+
+#include "llvm/IR/IRBuilder.h"
+#include "llvm/IR/Function.h"
+
+namespace llvm {
+
+/// EscapeEnumerator - This is a little algorithm to find all escape points
+/// from a function so that "finally"-style code can be inserted. In addition
+/// to finding the existing return and unwind instructions, it also (if
+/// necessary) transforms any call instructions into invokes and sends them to
+/// a landing pad.
+class EscapeEnumerator {
+  Function &F;
+  const char *CleanupBBName;
+
+  Function::iterator StateBB, StateE;
+  IRBuilder<> Builder;
+  bool Done;
+
+public:
+  EscapeEnumerator(Function &F, const char *N = "cleanup")
+      : F(F), CleanupBBName(N), StateBB(F.begin()), StateE(F.end()),
+        Builder(F.getContext()), Done(false) {}
+
+  IRBuilder<> *Next();
+};
+
+}
+
+#endif // LLVM_TRANSFORMS_UTILS_ESCAPEENUMERATOR_H

include/llvm/Transforms/Utils/Local.h

 /// Remove all instructions from a basic block other than it's terminator
 /// and any present EH pad instructions.
 unsigned removeAllNonTerminatorAndEHPadInstructions(BasicBlock *BB);
 
 /// Insert an unreachable instruction before the specified
 /// instruction, making it and the rest of the code in the block dead.
 unsigned changeToUnreachable(Instruction *I, bool UseLLVMTrap);
 
+/// Convert the CallInst to InvokeInst with the specified unwind edge basic
+/// block.  This also splits the basic block where CI is located, because
+/// InvokeInst is a terminator instruction.  Returns the newly split basic
+/// block.
+BasicBlock *changeToInvokeAndSplitBasicBlock(CallInst *CI,
+                                             BasicBlock *UnwindEdge);
+
 /// Replace 'BB's terminator with one that does not have an unwind successor
 /// block. Rewrites `invoke` to `call`, etc. Updates any PHIs in unwind
 /// successor.
 ///
 /// \param BB  Block whose terminator will be replaced.  Its terminator must
 ///            have an unwind successor.
 void removeUnwindEdge(BasicBlock *BB);
 

lib/Analysis/EHPersonalities.cpp

return StringSwitch<EHPersonality>(F->getName())
     .Case("_except_handler4",      EHPersonality::MSVC_X86SEH)
     .Case("__C_specific_handler",  EHPersonality::MSVC_Win64SEH)
     .Case("__CxxFrameHandler3",    EHPersonality::MSVC_CXX)
     .Case("ProcessCLRException",   EHPersonality::CoreCLR)
     .Case("rust_eh_personality",   EHPersonality::Rust)
     .Default(EHPersonality::Unknown);
 }
 
+StringRef llvm::getEHPersonalityName(EHPersonality Pers) {
+  switch (Pers) {
+  case EHPersonality::GNU_Ada:       return "__gnat_eh_personality";
+  case EHPersonality::GNU_CXX:       return "__gxx_personality_v0";
+  case EHPersonality::GNU_CXX_SjLj:  return "__gxx_personality_sj0";
+  case EHPersonality::GNU_C:         return "__gcc_personality_v0";
+  case EHPersonality::GNU_C_SjLj:    return "__gcc_personality_sj0";
+  case EHPersonality::GNU_ObjC:      return "__objc_personality_v0";
+  case EHPersonality::MSVC_X86SEH:   return "_except_handler3";
+  case EHPersonality::MSVC_Win64SEH: return "__C_specific_handler";
+  case EHPersonality::MSVC_CXX:      return "__CxxFrameHandler3";
+  case EHPersonality::CoreCLR:       return "ProcessCLRException";
+  case EHPersonality::Rust:          return "rust_eh_personality";
+  case EHPersonality::Unknown:       llvm_unreachable("Unknown EHPersonality!");
+  }
+
+  llvm_unreachable("Invalid EHPersonality!");
+}
+
+EHPersonality llvm::getDefaultEHPersonality(const Triple &T) {
+  return EHPersonality::GNU_C;
+}
+
 bool llvm::canSimplifyInvokeNoUnwind(const Function *F) {
   EHPersonality Personality = classifyEHPersonality(F->getPersonalityFn());
   // We can't simplify any invokes to nounwind functions if the personality
   // function wants to catch asynch exceptions.  The nounwind attribute only
   // implies that the function does not throw synchronous exceptions.
   return !isAsynchronousEHPersonality(Personality);
 }
 

lib/CodeGen/ShadowStackGCLowering.cpp

 
 #include "llvm/CodeGen/Passes.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/CodeGen/GCStrategy.h"
 #include "llvm/IR/CallSite.h"
 #include "llvm/IR/IRBuilder.h"
 #include "llvm/IR/IntrinsicInst.h"
 #include "llvm/IR/Module.h"
+#include "llvm/Transforms/Utils/EscapeEnumerator.h"
 
 using namespace llvm;
 
 #define DEBUG_TYPE "shadowstackgclowering"
 
 namespace {
 
 class ShadowStackGCLowering : public FunctionPass {

 char ShadowStackGCLowering::ID = 0;
 
 ShadowStackGCLowering::ShadowStackGCLowering()
   : FunctionPass(ID), Head(nullptr), StackEntryTy(nullptr),
     FrameMapTy(nullptr) {
   initializeShadowStackGCLoweringPass(*PassRegistry::getPassRegistry());
 }
 
-namespace {
-/// EscapeEnumerator - This is a little algorithm to find all escape points
-/// from a function so that "finally"-style code can be inserted. In addition
-/// to finding the existing return and unwind instructions, it also (if
-/// necessary) transforms any call instructions into invokes and sends them to
-/// a landing pad.
-///
-/// It's wrapped up in a state machine using the same transform C# uses for
-/// 'yield return' enumerators, This transform allows it to be non-allocating.
-class EscapeEnumerator {
-  Function &F;
-  const char *CleanupBBName;
-
-  // State.
-  int State;
-  Function::iterator StateBB, StateE;
-  IRBuilder<> Builder;
-
-public:
-  EscapeEnumerator(Function &F, const char *N = "cleanup")
-      : F(F), CleanupBBName(N), State(0), Builder(F.getContext()) {}
-
-  IRBuilder<> *Next() {
-    switch (State) {
-    default:
-      return nullptr;
-
-    case 0:
-      StateBB = F.begin();
-      StateE = F.end();
-      State = 1;
-
-    case 1:
-      // Find all 'return', 'resume', and 'unwind' instructions.
-      while (StateBB != StateE) {
-        BasicBlock *CurBB = &*StateBB++;
-
-        // Branches and invokes do not escape, only unwind, resume, and return
-        // do.
-        TerminatorInst *TI = CurBB->getTerminator();
-        if (!isa<ReturnInst>(TI) && !isa<ResumeInst>(TI))
-          continue;
-
-        Builder.SetInsertPoint(TI);
-        return &Builder;
-      }
-
-      State = 2;
-
-      // Find all 'call' instructions.
-      SmallVector<Instruction *, 16> Calls;
-      for (Function::iterator BB = F.begin(), E = F.end(); BB != E; ++BB)
-        for (BasicBlock::iterator II = BB->begin(), EE = BB->end(); II != EE;
-             ++II)
-          if (CallInst *CI = dyn_cast<CallInst>(II))
-            if (!CI->getCalledFunction() ||
-                !CI->getCalledFunction()->getIntrinsicID())
-              Calls.push_back(CI);
-
-      if (Calls.empty())
-        return nullptr;
-
-      // Create a cleanup block.
-      LLVMContext &C = F.getContext();
-      BasicBlock *CleanupBB = BasicBlock::Create(C, CleanupBBName, &F);
-      Type *ExnTy =
-          StructType::get(Type::getInt8PtrTy(C), Type::getInt32Ty(C), nullptr);
-      if (!F.hasPersonalityFn()) {
-        Constant *PersFn = F.getParent()->getOrInsertFunction(
-            "__gcc_personality_v0",
-            FunctionType::get(Type::getInt32Ty(C), true));
-        F.setPersonalityFn(PersFn);
-      }
-      LandingPadInst *LPad =
-          LandingPadInst::Create(ExnTy, 1, "cleanup.lpad", CleanupBB);
-      LPad->setCleanup(true);
-      ResumeInst *RI = ResumeInst::Create(LPad, CleanupBB);
-
-      // Transform the 'call' instructions into 'invoke's branching to the
-      // cleanup block. Go in reverse order to make prettier BB names.
-      SmallVector<Value *, 16> Args;
-      for (unsigned I = Calls.size(); I != 0;) {
-        CallInst *CI = cast<CallInst>(Calls[--I]);
-
-        // Split the basic block containing the function call.
-        BasicBlock *CallBB = CI->getParent();
-        BasicBlock *NewBB = CallBB->splitBasicBlock(
-            CI->getIterator(), CallBB->getName() + ".cont");
-
-        // Remove the unconditional branch inserted at the end of CallBB.
-        CallBB->getInstList().pop_back();
-        NewBB->getInstList().remove(CI);
-
-        // Create a new invoke instruction.
-        Args.clear();
-        CallSite CS(CI);
-        Args.append(CS.arg_begin(), CS.arg_end());
-
-        InvokeInst *II =
-            InvokeInst::Create(CI->getCalledValue(), NewBB, CleanupBB, Args,
-                               CI->getName(), CallBB);
-        II->setCallingConv(CI->getCallingConv());
-        II->setAttributes(CI->getAttributes());
-        CI->replaceAllUsesWith(II);
-        delete CI;
-      }
-
-      Builder.SetInsertPoint(RI);
-      return &Builder;
-    }
-  }
-};
-}
-
-
 Constant *ShadowStackGCLowering::GetFrameMap(Function &F) {
   // doInitialization creates the abstract type of this value.
   Type *VoidPtr = Type::getInt8PtrTy(F.getContext());
 
   // Truncate the ShadowStackDescriptor if some metadata is null.
   unsigned NumMeta = 0;
   SmallVector<Constant *, 16> Metadata;
   for (unsigned I = 0; I != Roots.size(); ++I) {

lib/Transforms/Instrumentation/ThreadSanitizer.cpp

 #include "llvm/IR/Module.h"
 #include "llvm/IR/Type.h"
 #include "llvm/ProfileData/InstrProf.h"
 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/MathExtras.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
+#include "llvm/Transforms/Utils/EscapeEnumerator.h"
 #include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 
 using namespace llvm;
 
 #define DEBUG_TYPE "tsan"
 
 static cl::opt<bool>  ClInstrumentMemoryAccesses(

 }
 
 FunctionPass *llvm::createThreadSanitizerPass() {
   return new ThreadSanitizer();
 }
 
 void ThreadSanitizer::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(M.getContext());
+
+  AttributeSet Attr;
+  Attr = Attr.addAttribute(M.getContext(), AttributeSet::FunctionIndex, Attribute::NoUnwind);
+
   // Initialize the callbacks.
   TsanFuncEntry = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_func_entry", IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+      "__tsan_func_entry", Attr, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
   TsanFuncExit = checkSanitizerInterfaceFunction(
-      M.getOrInsertFunction("__tsan_func_exit", IRB.getVoidTy(), nullptr));
+      M.getOrInsertFunction("__tsan_func_exit", Attr, IRB.getVoidTy(), nullptr));
   OrdTy = IRB.getInt32Ty();
   for (size_t i = 0; i < kNumberOfAccessSizes; ++i) {
     const unsigned ByteSize = 1U << i;
     const unsigned BitSize = ByteSize * 8;
     std::string ByteSizeStr = utostr(ByteSize);
     std::string BitSizeStr = utostr(BitSize);
     SmallString<32> ReadName("__tsan_read" + ByteSizeStr);
     TsanRead[i] = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-        ReadName, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+        ReadName, Attr, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
 
     SmallString<32> WriteName("__tsan_write" + ByteSizeStr);
     TsanWrite[i] = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-        WriteName, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+        WriteName, Attr, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
 
     SmallString<64> UnalignedReadName("__tsan_unaligned_read" + ByteSizeStr);
     TsanUnalignedRead[i] =
         checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-            UnalignedReadName, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+            UnalignedReadName, Attr, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
 
     SmallString<64> UnalignedWriteName("__tsan_unaligned_write" + ByteSizeStr);
     TsanUnalignedWrite[i] =
         checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-            UnalignedWriteName, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+            UnalignedWriteName, Attr, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
 
     Type *Ty = Type::getIntNTy(M.getContext(), BitSize);
     Type *PtrTy = Ty->getPointerTo();
     SmallString<32> AtomicLoadName("__tsan_atomic" + BitSizeStr + "_load");
     TsanAtomicLoad[i] = checkSanitizerInterfaceFunction(
-        M.getOrInsertFunction(AtomicLoadName, Ty, PtrTy, OrdTy, nullptr));
+        M.getOrInsertFunction(AtomicLoadName, Attr, Ty, PtrTy, OrdTy, nullptr));
 
     SmallString<32> AtomicStoreName("__tsan_atomic" + BitSizeStr + "_store");
     TsanAtomicStore[i] = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-        AtomicStoreName, IRB.getVoidTy(), PtrTy, Ty, OrdTy, nullptr));
+        AtomicStoreName, Attr, IRB.getVoidTy(), PtrTy, Ty, OrdTy, nullptr));
 
     for (int op = AtomicRMWInst::FIRST_BINOP;
         op <= AtomicRMWInst::LAST_BINOP; ++op) {
       TsanAtomicRMW[op][i] = nullptr;
       const char *NamePart = nullptr;
       if (op == AtomicRMWInst::Xchg)
         NamePart = "_exchange";
       else if (op == AtomicRMWInst::Add)
         NamePart = "_fetch_add";
       else if (op == AtomicRMWInst::Sub)
         NamePart = "_fetch_sub";
       else if (op == AtomicRMWInst::And)
         NamePart = "_fetch_and";
       else if (op == AtomicRMWInst::Or)
         NamePart = "_fetch_or";
       else if (op == AtomicRMWInst::Xor)
         NamePart = "_fetch_xor";
       else if (op == AtomicRMWInst::Nand)
         NamePart = "_fetch_nand";
       else
         continue;
       SmallString<32> RMWName("__tsan_atomic" + itostr(BitSize) + NamePart);
       TsanAtomicRMW[op][i] = checkSanitizerInterfaceFunction(
-          M.getOrInsertFunction(RMWName, Ty, PtrTy, Ty, OrdTy, nullptr));
+          M.getOrInsertFunction(RMWName, Attr, Ty, PtrTy, Ty, OrdTy, nullptr));
     }
 
     SmallString<32> AtomicCASName("__tsan_atomic" + BitSizeStr +
                                   "_compare_exchange_val");
     TsanAtomicCAS[i] = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-        AtomicCASName, Ty, PtrTy, Ty, Ty, OrdTy, OrdTy, nullptr));
+        AtomicCASName, Attr, Ty, PtrTy, Ty, Ty, OrdTy, OrdTy, nullptr));
   }
   TsanVptrUpdate = checkSanitizerInterfaceFunction(
-      M.getOrInsertFunction("__tsan_vptr_update", IRB.getVoidTy(),
+      M.getOrInsertFunction("__tsan_vptr_update", Attr, IRB.getVoidTy(),
                             IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), nullptr));
   TsanVptrLoad = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_vptr_read", IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+      "__tsan_vptr_read", Attr, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
   TsanAtomicThreadFence = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_atomic_thread_fence", IRB.getVoidTy(), OrdTy, nullptr));
+      "__tsan_atomic_thread_fence", Attr, IRB.getVoidTy(), OrdTy, nullptr));
   TsanAtomicSignalFence = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_atomic_signal_fence", IRB.getVoidTy(), OrdTy, nullptr));
+      "__tsan_atomic_signal_fence", Attr, IRB.getVoidTy(), OrdTy, nullptr));
 
   MemmoveFn = checkSanitizerInterfaceFunction(
-      M.getOrInsertFunction("memmove", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
+      M.getOrInsertFunction("memmove", Attr, IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
                             IRB.getInt8PtrTy(), IntptrTy, nullptr));
   MemcpyFn = checkSanitizerInterfaceFunction(
-      M.getOrInsertFunction("memcpy", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
+      M.getOrInsertFunction("memcpy", Attr, IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
                             IRB.getInt8PtrTy(), IntptrTy, nullptr));
   MemsetFn = checkSanitizerInterfaceFunction(
-      M.getOrInsertFunction("memset", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
+      M.getOrInsertFunction("memset", Attr, IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
                             IRB.getInt32Ty(), IntptrTy, nullptr));
 }
 
 bool ThreadSanitizer::doInitialization(Module &M) {
   const DataLayout &DL = M.getDataLayout();
   IntptrTy = DL.getIntPtrType(M.getContext());
   std::tie(TsanCtorFunction, std::ignore) = createSanitizerCtorAndInitFunctions(
       M, kTsanModuleCtorName, kTsanInitName, /*InitArgTypes=*/{},

 }
 
 bool ThreadSanitizer::runOnFunction(Function &F) {
   // This is required to prevent instrumenting call to __tsan_init from within
   // the module constructor.
   if (&F == TsanCtorFunction)
     return false;
   initializeCallbacks(*F.getParent());
-  SmallVector<Instruction*, 8> RetVec;
   SmallVector<Instruction*, 8> AllLoadsAndStores;
   SmallVector<Instruction*, 8> LocalLoadsAndStores;
   SmallVector<Instruction*, 8> AtomicAccesses;
   SmallVector<Instruction*, 8> MemIntrinCalls;
   bool Res = false;
   bool HasCalls = false;
   bool SanitizeFunction = F.hasFnAttribute(Attribute::SanitizeThread);
   const DataLayout &DL = F.getParent()->getDataLayout();
   const TargetLibraryInfo *TLI =
       &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
 
   // Traverse all instructions, collect loads/stores/returns, check for calls.
   for (auto &BB : F) {
     for (auto &Inst : BB) {
       if (isAtomic(&Inst))
         AtomicAccesses.push_back(&Inst);
       else if (isa<LoadInst>(Inst) || isa<StoreInst>(Inst))
         LocalLoadsAndStores.push_back(&Inst);
-      else if (isa<ReturnInst>(Inst))
-        RetVec.push_back(&Inst);
       else if (isa<CallInst>(Inst) || isa<InvokeInst>(Inst)) {
         if (CallInst *CI = dyn_cast<CallInst>(&Inst))
           maybeMarkSanitizerLibraryCallNoBuiltin(CI, TLI);
         if (isa<MemIntrinsic>(Inst))
           MemIntrinCalls.push_back(&Inst);
         HasCalls = true;
         chooseInstructionsToInstrument(LocalLoadsAndStores, AllLoadsAndStores,
                                        DL);
bool ThreadSanitizer::runOnFunction(Function &F) {
 
   // Instrument function entry/exit points if there were instrumented accesses.
   if ((Res || HasCalls) && ClInstrumentFuncEntryExit) {
     IRBuilder<> IRB(F.getEntryBlock().getFirstNonPHI());
     Value *ReturnAddress = IRB.CreateCall(
         Intrinsic::getDeclaration(F.getParent(), Intrinsic::returnaddress),
         IRB.getInt32(0));
     IRB.CreateCall(TsanFuncEntry, ReturnAddress);
-    for (auto RetInst : RetVec) {
-      IRBuilder<> IRBRet(RetInst);
-      IRBRet.CreateCall(TsanFuncExit, {});
+
+    EscapeEnumerator EE(F, "tsan_cleanup");
+    while (IRBuilder<> *AtExit = EE.Next()) {
+      AtExit->CreateCall(TsanFuncExit, {});
     }
     Res = true;
   }
   return Res;
 }
 
 bool ThreadSanitizer::instrumentLoadOrStore(Instruction *I,
                                             const DataLayout &DL) {

lib/Transforms/Utils/CMakeLists.txt

 add_llvm_library(LLVMTransformUtils
   ASanStackFrameLayout.cpp
   AddDiscriminators.cpp
   BasicBlockUtils.cpp
   BreakCriticalEdges.cpp
   BuildLibCalls.cpp
   BypassSlowDivision.cpp
   CloneFunction.cpp
   CloneModule.cpp
   CmpInstAnalysis.cpp
   CodeExtractor.cpp
   CtorUtils.cpp
   DemoteRegToStack.cpp
+  EscapeEnumerator.cpp
   Evaluator.cpp
   FlattenCFG.cpp
   FunctionImportUtils.cpp
   GlobalStatus.cpp
   InlineFunction.cpp
   ImportedFunctionsInliningStatistics.cpp
   InstructionNamer.cpp
   IntegerDivision.cpp

lib/Transforms/Utils/EscapeEnumerator.cpp

+//===- EscapeEnumerator.cpp -----------------------------------------------===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Defines a helper class that enumerates all possible exits from a function,
+// including exception handling.
+//
+//===----------------------------------------------------------------------===//
+
+#include "llvm/Transforms/Utils/EscapeEnumerator.h"
+#include "llvm/Analysis/EHPersonalities.h"
+#include "llvm/IR/CallSite.h"
+#include "llvm/IR/Module.h"
+#include "llvm/Transforms/Utils/Local.h"
+using namespace llvm;
+
+static Constant *getDefaultPersonalityFn(Module *M) {
+  LLVMContext &C = M->getContext();
+  Triple T(M->getTargetTriple());
+  EHPersonality Pers = getDefaultEHPersonality(T);
+  return M->getOrInsertFunction(getEHPersonalityName(Pers),
+                                FunctionType::get(Type::getInt32Ty(C), true));
+}
+
+IRBuilder<> *EscapeEnumerator::Next() {
+  if (Done)
+    return nullptr;
+
+  // Find all 'return', 'resume', and 'unwind' instructions.
+  while (StateBB != StateE) {
+    BasicBlock *CurBB = &*StateBB++;
+
+    // Branches and invokes do not escape, only unwind, resume, and return
+    // do.
+    TerminatorInst *TI = CurBB->getTerminator();
+    if (!isa<ReturnInst>(TI) && !isa<ResumeInst>(TI))
+      continue;
+
+    Builder.SetInsertPoint(TI);
+    return &Builder;
+  }
+
+  Done = true;
+
+  // Find all 'call' instructions that may throw.
+  SmallVector<Instruction *, 16> Calls;
+  for (BasicBlock &BB : F)
+    for (Instruction &II : BB)
+      if (CallInst *CI = dyn_cast<CallInst>(&II))
+        if (!CI->doesNotThrow())
+          Calls.push_back(CI);
+
+  if (Calls.empty())
+    return nullptr;
+
+  // Create a cleanup block.
+  LLVMContext &C = F.getContext();
+  BasicBlock *CleanupBB = BasicBlock::Create(C, CleanupBBName, &F);
+  Type *ExnTy =
+      StructType::get(Type::getInt8PtrTy(C), Type::getInt32Ty(C), nullptr);
+  if (!F.hasPersonalityFn()) {
+    Constant *PersFn = getDefaultPersonalityFn(F.getParent());
+    F.setPersonalityFn(PersFn);
+  }
+
+  if (isFuncletEHPersonality(classifyEHPersonality(F.getPersonalityFn()))) {
+    report_fatal_error("Funclet EH not supported");
+  }
+
+  LandingPadInst *LPad =
+      LandingPadInst::Create(ExnTy, 1, "cleanup.lpad", CleanupBB);
+  LPad->setCleanup(true);
+  ResumeInst *RI = ResumeInst::Create(LPad, CleanupBB);
+
+  // Transform the 'call' instructions into 'invoke's branching to the
+  // cleanup block. Go in reverse order to make prettier BB names.
+  SmallVector<Value *, 16> Args;
+  for (unsigned I = Calls.size(); I != 0;) {
+    CallInst *CI = cast<CallInst>(Calls[--I]);
+    changeToInvokeAndSplitBasicBlock(CI, CleanupBB);
+  }
+
+  Builder.SetInsertPoint(RI);
+  return &Builder;
+}

lib/Transforms/Utils/InlineFunction.cpp

#ifndef NDEBUG
       else
         MemoKey = FuncletPad;
       assert(FuncletUnwindMap->count(MemoKey) &&
              (*FuncletUnwindMap)[MemoKey] == UnwindDestToken &&
              "must get memoized to avoid confusing later searches");
 #endif // NDEBUG
     }
 
-    // Convert this function call into an invoke instruction.  First, split the
-    // basic block.
-    BasicBlock *Split =
-        BB->splitBasicBlock(CI->getIterator(), CI->getName() + ".noexc");
-
-    // Delete the unconditional branch inserted by splitBasicBlock
-    BB->getInstList().pop_back();
-
-    // Create the new invoke instruction.
-    SmallVector<Value*, 8> InvokeArgs(CI->arg_begin(), CI->arg_end());
-    SmallVector<OperandBundleDef, 1> OpBundles;
-
-    CI->getOperandBundlesAsDefs(OpBundles);
-
-    // Note: we're round tripping operand bundles through memory here, and that
-    // can potentially be avoided with a cleverer API design that we do not have
-    // as of this time.
-
-    InvokeInst *II =
-        InvokeInst::Create(CI->getCalledValue(), Split, UnwindEdge, InvokeArgs,
-                           OpBundles, CI->getName(), BB);
-    II->setDebugLoc(CI->getDebugLoc());
-    II->setCallingConv(CI->getCallingConv());
-    II->setAttributes(CI->getAttributes());
-    
-    // Make sure that anything using the call now uses the invoke!  This also
-    // updates the CallGraph if present, because it uses a WeakVH.
-    CI->replaceAllUsesWith(II);
-
-    // Delete the original call
-    Split->getInstList().pop_front();
+    changeToInvokeAndSplitBasicBlock(CI, UnwindEdge);
     return BB;
   }
   return nullptr;
 }
 
 /// If we inlined an invoke site, we need to convert calls
 /// in the body of the inlined function into invokes.
 ///

lib/Transforms/Utils/Local.cpp

static void changeToCall(InvokeInst *II) {
   // Follow the call by a branch to the normal destination.
   BranchInst::Create(II->getNormalDest(), II);
 
   // Update PHI nodes in the unwind destination
   II->getUnwindDest()->removePredecessor(II->getParent());
   II->eraseFromParent();
 }
 
+BasicBlock *llvm::changeToInvokeAndSplitBasicBlock(CallInst *CI,
+                                                   BasicBlock *UnwindEdge) {
+  BasicBlock *BB = CI->getParent();
+
+  // Convert this function call into an invoke instruction.  First, split the
+  // basic block.
+  BasicBlock *Split =
+      BB->splitBasicBlock(CI->getIterator(), CI->getName() + ".noexc");
+
+  // Delete the unconditional branch inserted by splitBasicBlock
+  BB->getInstList().pop_back();
+
+  // Create the new invoke instruction.
+  SmallVector<Value *, 8> InvokeArgs(CI->arg_begin(), CI->arg_end());
+  SmallVector<OperandBundleDef, 1> OpBundles;
+
+  CI->getOperandBundlesAsDefs(OpBundles);
+
+  // Note: we're round tripping operand bundles through memory here, and that
+  // can potentially be avoided with a cleverer API design that we do not have
+  // as of this time.
+
+  InvokeInst *II = InvokeInst::Create(CI->getCalledValue(), Split, UnwindEdge,
+                                      InvokeArgs, OpBundles, CI->getName(), BB);
+  II->setDebugLoc(CI->getDebugLoc());
+  II->setCallingConv(CI->getCallingConv());
+  II->setAttributes(CI->getAttributes());
+
+  // Make sure that anything using the call now uses the invoke!  This also
+  // updates the CallGraph if present, because it uses a WeakVH.
+  CI->replaceAllUsesWith(II);
+
+  // Delete the original call
+  Split->getInstList().pop_front();
+  return Split;
+}
+
 static bool markAliveBlocks(Function &F,
                             SmallPtrSetImpl<BasicBlock*> &Reachable) {
 
   SmallVector<BasicBlock*, 128> Worklist;
   BasicBlock *BB = &F.front();
   Worklist.push_back(BB);
   Reachable.insert(BB);
   bool Changed = false;

projects/compiler-rt/lib/tsan/rtl/tsan_rtl.cc

void ThreadIgnoreEnd(ThreadState *thr, uptr pc) {
   if (thr->ignore_reads_and_writes == 0) {
     thr->fast_state.ClearIgnoreBit();
 #if !SANITIZER_GO
     thr->mop_ignore_set.Reset();
 #endif
   }
 }
 
+#if !SANITIZER_GO
+extern "C" SANITIZER_INTERFACE_ATTRIBUTE
+uptr __tsan_testonly_shadow_stack_current_size() {
+  ThreadState *thr = cur_thread();
+  return thr->shadow_stack_pos - thr->shadow_stack;
+}
+#endif
+
 void ThreadIgnoreSyncBegin(ThreadState *thr, uptr pc) {
   DPrintf("#%d: ThreadIgnoreSyncBegin\n", thr->tid);
   thr->ignore_sync++;
   CHECK_GT(thr->ignore_sync, 0);
 #if !SANITIZER_GO
   if (!ctx->after_multithreaded_fork)
     thr->sync_ignore_set.Add(CurrentStackId(thr, pc));
 #endif

projects/compiler-rt/test/tsan/exceptions.cc

+// RUN: %clangxx_tsan -O0 %s -o %t && %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_tsan -O1 %s -o %t && %run %t 2>&1 | FileCheck %s
+
+#include "test.h"
+
+__attribute__((noinline)) void throws_int() {
+  throw 42;
+}
+
+__attribute__((noinline)) void callee_throws() {
+  try {
+    throws_int();
+  } catch (int) {  // NOLINT
+    fprintf(stderr, "callee_throws caught exception\n");
+  }
+}
+
+__attribute__((noinline)) void throws_catches_rethrows() {
+  try {
+    throws_int();
+  } catch (int) {  // NOLINT
+    fprintf(stderr, "throws_catches_rethrows caught exception\n");
+    throw;
+  }
+}
+
+__attribute__((noinline)) void callee_rethrows() {
+  try {
+    throws_catches_rethrows();
+  } catch (int) {  // NOLINT
+    fprintf(stderr, "callee_rethrows caught exception\n");
+  }
+}
+
+__attribute__((noinline)) void throws_and_catches() {
+  try {
+    throws_int();
+  } catch (int) {  // NOLINT
+    fprintf(stderr, "throws_and_catches caught exception\n");
+  }
+}
+
+__attribute__((noinline)) void nested_try() {
+  try {
+    try {
+      throws_int();
+    } catch (double) {  // NOLINT
+      fprintf(stderr, "nested_try inner block caught exception\n");
+    }
+  } catch (int) {  // NOLINT
+    fprintf(stderr, "nested_try outer block caught exception\n");
+  }
+}
+
+__attribute__((noinline)) void nested_try2() {
+  try {
+    try {
+      throws_int();
+    } catch (int) {  // NOLINT
+      fprintf(stderr, "nested_try inner block caught exception\n");
+    }
+  } catch (double) {  // NOLINT
+    fprintf(stderr, "nested_try outer block caught exception\n");
+  }
+}
+
+class ClassWithDestructor {
+ public:
+  ClassWithDestructor() {
+    fprintf(stderr, "ClassWithDestructor\n");
+  }
+  ~ClassWithDestructor() {
+    fprintf(stderr, "~ClassWithDestructor\n");
+  }
+};
+
+__attribute__((noinline)) void local_object_then_throw() {
+  ClassWithDestructor obj;
+  throws_int();
+}
+
+__attribute__((noinline)) void cpp_object_with_destructor() {
+  try {
+    local_object_then_throw();
+  } catch (int) {  // NOLINT
+    fprintf(stderr, "cpp_object_with_destructor caught exception\n");
+  }
+}
+
+__attribute__((noinline)) void recursive_call(long n) {
+  if (n > 0) {
+    recursive_call(n - 1);
+  } else {
+    throws_int();
+  }
+}
+
+__attribute__((noinline)) void multiframe_unwind() {
+  try {
+    recursive_call(5);
+  } catch (int) {  // NOLINT
+    fprintf(stderr, "multiframe_unwind caught exception\n");
+  }
+}
+
+int main(int argc, const char * argv[]) {
+  fprintf(stderr, "Hello, World!\n");
+  unsigned long shadow_stack_size = __tsan_testonly_shadow_stack_current_size();
+
+  throws_and_catches();
+  fprintf(stderr, (shadow_stack_size == __tsan_testonly_shadow_stack_current_size() ? "OK.\n" : "Shadow stack leak!\n"));
+
+  callee_throws();
+  fprintf(stderr, (shadow_stack_size == __tsan_testonly_shadow_stack_current_size() ? "OK.\n" : "Shadow stack leak!\n"));
+
+  callee_rethrows();
+  fprintf(stderr, (shadow_stack_size == __tsan_testonly_shadow_stack_current_size() ? "OK.\n" : "Shadow stack leak!\n"));
+
+  nested_try();
+  fprintf(stderr, (shadow_stack_size == __tsan_testonly_shadow_stack_current_size() ? "OK.\n" : "Shadow stack leak!\n"));
+
+  nested_try2();
+  fprintf(stderr, (shadow_stack_size == __tsan_testonly_shadow_stack_current_size() ? "OK.\n" : "Shadow stack leak!\n"));
+
+  cpp_object_with_destructor();
+  fprintf(stderr, (shadow_stack_size == __tsan_testonly_shadow_stack_current_size() ? "OK.\n" : "Shadow stack leak!\n"));
+
+  multiframe_unwind();
+  fprintf(stderr, (shadow_stack_size == __tsan_testonly_shadow_stack_current_size() ? "OK.\n" : "Shadow stack leak!\n"));
+
+  return 0;
+}
+
+// CHECK: Hello, World!
+// CHECK-NOT: Shadow stack leak

projects/compiler-rt/test/tsan/test.h

 typedef unsigned long long invisible_barrier_t;
 
 #ifdef __cplusplus
 extern "C" {
 #endif
 void __tsan_testonly_barrier_init(invisible_barrier_t *barrier,
     unsigned count);
 void __tsan_testonly_barrier_wait(invisible_barrier_t *barrier);
+unsigned long __tsan_testonly_shadow_stack_current_size();
 #ifdef __cplusplus
 }
 #endif
 
 static inline void barrier_init(invisible_barrier_t *barrier, unsigned count) {
   __tsan_testonly_barrier_init(barrier, count);
 }
 

test/Instrumentation/ThreadSanitizer/no_sanitize_thread.ll

 ; CHECK-NEXT: entry:
 ; CHECK-NEXT:   %0 = call i8* @llvm.returnaddress(i32 0)
 ; CHECK-NEXT:   call void @__tsan_func_entry(i8* %0)
 ; CHECK-NEXT:   call void @foo()
 ; CHECK-NEXT:   %tmp1 = load i32, i32* %a, align 4
 ; CHECK-NEXT:   call void @__tsan_func_exit()
 ; CHECK-NEXT:   ret i32 %tmp1
 
-declare void @foo()
+declare void @foo() nounwind
 

test/Instrumentation/ThreadSanitizer/str-nobuiltin.ll

 ; Test marking string functions as nobuiltin in thread sanitizer.
 ;
 ; RUN: opt < %s -tsan -S | FileCheck %s
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
 target triple = "x86_64-unknown-linux-gnu"
 
-declare i8* @memchr(i8* %a, i32 %b, i64 %c)
-declare i32 @memcmp(i8* %a, i8* %b, i64 %c)
-declare i32 @strcmp(i8* %a, i8* %b)
-declare i8* @strcpy(i8* %a, i8* %b)
-declare i8* @stpcpy(i8* %a, i8* %b)
-declare i64 @strlen(i8* %a)
-declare i64 @strnlen(i8* %a, i64 %b)
+declare i8* @memchr(i8* %a, i32 %b, i64 %c) nounwind
+declare i32 @memcmp(i8* %a, i8* %b, i64 %c) nounwind
+declare i32 @strcmp(i8* %a, i8* %b) nounwind
+declare i8* @strcpy(i8* %a, i8* %b) nounwind
+declare i8* @stpcpy(i8* %a, i8* %b) nounwind
+declare i64 @strlen(i8* %a) nounwind
+declare i64 @strnlen(i8* %a, i64 %b) nounwind
 
 ; CHECK: call{{.*}}@memchr{{.*}} #[[ATTR:[0-9]+]]
 ; CHECK: call{{.*}}@memcmp{{.*}} #[[ATTR]]
 ; CHECK: call{{.*}}@strcmp{{.*}} #[[ATTR]]
 ; CHECK: call{{.*}}@strcpy{{.*}} #[[ATTR]]
 ; CHECK: call{{.*}}@stpcpy{{.*}} #[[ATTR]]
 ; CHECK: call{{.*}}@strlen{{.*}} #[[ATTR]]
 ; CHECK: call{{.*}}@strnlen{{.*}} #[[ATTR]]