[libFuzzer] Use OptForFuzzing attribute with -fsanitize=fuzzer.

[morehouse]

Summary

Disables certain CMP optimizations to improve fuzzing signal under -O1
and -O2.

Switches all fuzzer tests to -O2 except for a few leak tests where the
leak is optimized out under -O2.

[morehouse]

16-bit variables are switched to 32-bit variables in SwapCmpTest.cpp and SimpleCmpTest.cpp. This is because those tests rely on libFuzzer's TraceCMP heuristic to pass, but 16-bit compares are not considered for the heuristic.

The only reason the test used to pass was because under -O0 16-bit compares are promoted to 32-bit compares.

[vitalybuka]

compiler-rt/test/fuzzer/lit.cfg

88 ↗

(On Diff #139491)

Maybe instead of new substitutions, better just explicitly add -O0 into tests

[morehouse]

• Remove new substitutions. Use -O0 to avoid optimization.

lib/CodeGen/CodeGenFunction.cpp

if (SanOpts.hasOneOf(SanitizerKind::HWAddress))
     Fn->addFnAttr(llvm::Attribute::SanitizeHWAddress);
   if (SanOpts.has(SanitizerKind::Thread))
     Fn->addFnAttr(llvm::Attribute::SanitizeThread);
   if (SanOpts.has(SanitizerKind::Memory))
     Fn->addFnAttr(llvm::Attribute::SanitizeMemory);
   if (SanOpts.has(SanitizerKind::SafeStack))
     Fn->addFnAttr(llvm::Attribute::SafeStack);
 
+  // Apply fuzzing attribute to the function.
+  if (SanOpts.hasOneOf(SanitizerKind::Fuzzer | SanitizerKind::FuzzerNoLink))
+    Fn->addFnAttr(llvm::Attribute::OptForFuzzing);
+
   // Ignore TSan memory acesses from within ObjC/ObjC++ dealloc, initialize,
   // .cxx_destruct, __destroy_helper_block_ and all of their calees at run time.
   if (SanOpts.has(SanitizerKind::Thread)) {
     if (const auto *OMD = dyn_cast_or_null<ObjCMethodDecl>(D)) {
       IdentifierInfo *II = OMD->getSelector().getIdentifierInfoForSlot(0);
       if (OMD->getMethodFamily() == OMF_dealloc ||
           OMD->getMethodFamily() == OMF_initialize ||
           (OMD->getSelector().isUnarySelector() && II->isStr(".cxx_destruct"))) {