[libFuzzer] Use OptForFuzzing attribute with -fsanitize=fuzzer.

[morehouse]

Summary

Disables certain CMP optimizations to improve fuzzing signal under -O1
and -O2.

Switches all fuzzer tests to -O2 except for a few leak tests where the
leak is optimized out under -O2.

[morehouse]

16-bit variables are switched to 32-bit variables in SwapCmpTest.cpp and SimpleCmpTest.cpp. This is because those tests rely on libFuzzer's TraceCMP heuristic to pass, but 16-bit compares are not considered for the heuristic.

The only reason the test used to pass was because under -O0 16-bit compares are promoted to 32-bit compares.

[vitalybuka]

compiler-rt/test/fuzzer/lit.cfg

86

Maybe instead of new substitutions, better just explicitly add -O0 into tests

[morehouse]

• Remove new substitutions. Use -O0 to avoid optimization.

clang/lib/CodeGen/CodeGenFunction.cpp

if (SanOpts.hasOneOf(SanitizerKind::HWAddress))
     Fn->addFnAttr(llvm::Attribute::SanitizeHWAddress);
   if (SanOpts.has(SanitizerKind::Thread))
     Fn->addFnAttr(llvm::Attribute::SanitizeThread);
   if (SanOpts.has(SanitizerKind::Memory))
     Fn->addFnAttr(llvm::Attribute::SanitizeMemory);
   if (SanOpts.has(SanitizerKind::SafeStack))
     Fn->addFnAttr(llvm::Attribute::SafeStack);
 
+  // Apply fuzzing attribute to the function.
+  if (SanOpts.hasOneOf(SanitizerKind::Fuzzer | SanitizerKind::FuzzerNoLink))
+    Fn->addFnAttr(llvm::Attribute::OptForFuzzing);
+
   // Ignore TSan memory acesses from within ObjC/ObjC++ dealloc, initialize,
   // .cxx_destruct, __destroy_helper_block_ and all of their calees at run time.
   if (SanOpts.has(SanitizerKind::Thread)) {
     if (const auto *OMD = dyn_cast_or_null<ObjCMethodDecl>(D)) {
       IdentifierInfo *II = OMD->getSelector().getIdentifierInfoForSlot(0);
       if (OMD->getMethodFamily() == OMF_dealloc ||
           OMD->getMethodFamily() == OMF_initialize ||
           (OMD->getSelector().isUnarySelector() && II->isStr(".cxx_destruct"))) {

compiler-rt/test/fuzzer/SimpleCmpTest.cpp

 bool PrintOnce(int Line) {
   if (!AllLines[Line])
     fprintf(stderr, "Seen line %d\n", Line);
   AllLines[Line] = 1;
   return true;
 }
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
-  if (Size != 22) return 0;
+  if (Size != 24) return 0;
   uint64_t x = 0;
   int64_t  y = 0;
   int32_t z = 0;
-  uint16_t a = 0;
+  uint32_t a = 0;
   memcpy(&x, Data, 8);  // 8
   memcpy(&y, Data + 8, 8);  // 16
   memcpy(&z, Data + 16, sizeof(z));  // 20
-  memcpy(&a, Data + 20, sizeof(a));  // 22
+  memcpy(&a, Data + 20, sizeof(a));  // 24
   const bool k32bit = sizeof(void*) == 4;
 
   if ((k32bit || x > 1234567890) && PrintOnce(__LINE__) &&
       (k32bit || x < 1234567895) && PrintOnce(__LINE__) &&
       a == 0x4242 && PrintOnce(__LINE__) &&
       (k32bit || y >= 987654321) && PrintOnce(__LINE__) &&
       (k32bit || y <= 987654325) && PrintOnce(__LINE__) &&
       z < -10000 && PrintOnce(__LINE__) &&

compiler-rt/test/fuzzer/SwapCmpTest.cpp

 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 
 // The fuzzer must find several constants with swapped bytes.
 #include <cstdint>
 #include <cstdio>
 #include <cstdlib>
 #include <cstring>
 
 extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
   if (Size < 14) return 0;
   uint64_t x = 0;
   uint32_t y = 0;
-  uint16_t z = 0;
+  uint32_t z = 0;
   memcpy(&x, Data, sizeof(x));
   memcpy(&y, Data + Size / 2, sizeof(y));
   memcpy(&z, Data + Size - sizeof(z), sizeof(z));
 
   x = __builtin_bswap64(x);
   y = __builtin_bswap32(y);
-  z = __builtin_bswap16(z);
+  z = __builtin_bswap32(z);
   const bool k32bit = sizeof(void*) == 4;
 
   if ((k32bit || x == 0x46555A5A5A5A5546ULL) &&
       z == 0x4F4B &&
       y == 0x66757A7A &&
       true
       ) {
-    if (Data[Size - 3] == 'z') {
+    if (Data[Size - 5] == 'z') {
       fprintf(stderr, "BINGO; Found the target\n");
       exit(1);
     }
   }
   return 0;
 }

compiler-rt/test/fuzzer/fuzzer-leak.test

 REQUIRES: lsan
-RUN: %cpp_compiler %S/LeakTest.cpp -o %t-LeakTest
-RUN: %cpp_compiler %S/ThreadedLeakTest.cpp -o %t-ThreadedLeakTest
+
+// Avoid optimizing since it causes these leaks to go away.
+RUN: %cpp_compiler -O0 %S/LeakTest.cpp -o %t-LeakTest
+RUN: %cpp_compiler -O0 %S/ThreadedLeakTest.cpp -o %t-ThreadedLeakTest
+
 RUN: %cpp_compiler %S/LeakTimeoutTest.cpp -o %t-LeakTimeoutTest
 
 RUN: rm -rf %t-corpus && mkdir -p %t-corpus
 RUN: not %t-LeakTest -runs=100000 -detect_leaks=1 %t-corpus 2>&1 | FileCheck %s --check-prefix=LEAK_DURING
 LEAK_DURING: ERROR: LeakSanitizer: detected memory leaks
 LEAK_DURING: Direct leak of 4 byte(s) in 1 object(s) allocated from:
 LEAK_DURING: INFO: to ignore leaks on libFuzzer side use -detect_leaks=0
 LEAK_DURING: Test unit written to ./leak-

compiler-rt/test/fuzzer/lit.cfg

else:
     link_cmd = '-lc++' if any(x in config.target_triple for x in ('darwin', 'freebsd')) else '-lstdc++'
   std_cmd = '--driver-mode=g++ -std=c++11' if is_cpp else ''
   sanitizers = ['address']
   if fuzzer_enabled:
     sanitizers.append('fuzzer')
   sanitizers_cmd = ('-fsanitize=%s' % ','.join(sanitizers))
   isysroot_cmd = config.osx_sysroot_flag if config.osx_sysroot_flag else ''
   include_cmd = '-I%s' % libfuzzer_src_root
-  return '%s %s %s -gline-tables-only %s %s %s' % (
+  return '%s %s %s -O2 -gline-tables-only %s %s %s' % (
       compiler_cmd, std_cmd, link_cmd, isysroot_cmd, sanitizers_cmd, include_cmd)
 
 config.substitutions.append(('%cpp_compiler',
       generate_compiler_cmd(is_cpp=True, fuzzer_enabled=True)
       ))
 
 config.substitutions.append(('%c_compiler',
       generate_compiler_cmd(is_cpp=False, fuzzer_enabled=True)
       ))
 
 config.substitutions.append(('%no_fuzzer_cpp_compiler',
       generate_compiler_cmd(is_cpp=True, fuzzer_enabled=False)
       ))
 
 config.substitutions.append(('%no_fuzzer_c_compiler',
       generate_compiler_cmd(is_cpp=False, fuzzer_enabled=False)
       ))

compiler-rt/test/fuzzer/trace-malloc-threaded.test

 // FIXME: This test infinite loops on darwin because it crashes
 // printing a stack trace repeatedly
 UNSUPPORTED: darwin
 
-RUN: %cpp_compiler %S/TraceMallocThreadedTest.cpp -o %t-TraceMallocThreadedTest
+// Avoid optimizing since it causes the malloc to go away.
+RUN: %cpp_compiler -O0 %S/TraceMallocThreadedTest.cpp -o \
+RUN:   %t-TraceMallocThreadedTest
 
 RUN: %t-TraceMallocThreadedTest -trace_malloc=2 -runs=1 2>&1 | FileCheck %s
 CHECK: {{MALLOC\[[0-9]+] +0x[0-9]+ 5639}}
 CHECK-NEXT: {{ +\#0 +}}
 CHECK-NEXT: {{ +\#1 +}}
 CHECK-NEXT: {{ +\#2 +}}
 
 CHECK: {{MALLOC\[[0-9]+] +0x[0-9]+ 5639}}