Allow libFuzer to build with MSVC

[metzman]

Summary

Allow libFuzer to build with MSVC

Previously, libFuzzer on Windows could only be built with
clang-cl, this changes that by making libFuzzer compilable
with MSVC's cl.exe

The following changes were made to accomplish this:

1. libFuzzer's handling of external functions on Windows was

changed to be compatible with MSVC (previously it relied on
attributes, which MSVC does not support.

2. SanitizerCoverage's code-coverage instrumentation arrays

were changed so that MSVC's alignment wouldn't break
libFuzzer.

3. Calls to __builtin functions were replaced with calls to

macros or functions that on POSIX call the builtins, but on
Windows, call Windows-specific intrinsics.

4. Attributes were replaced by macros that on POSIX are

defined as attributes, but on Windows are defined as the
corresponding __declspec (if one exists).

[metzman]

Improve comments, dont reformat if inconsistent

[metzman]

• add dllexport back

[metzman]

undo

[metzman]

This change was broken up and landed.

compiler-rt/cmake/config-ix.cmake

 if (COMPILER_RT_HAS_SANITIZER_COMMON AND XRAY_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Darwin|Linux|FreeBSD|NetBSD|OpenBSD|Fuchsia")
   set(COMPILER_RT_HAS_XRAY TRUE)
 else()
   set(COMPILER_RT_HAS_XRAY FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND FUZZER_SUPPORTED_ARCH AND
-    OS_NAME MATCHES "Android|Darwin|Linux|NetBSD|FreeBSD|OpenBSD|Fuchsia|Windows" AND
-    # TODO: Support builds with MSVC.
-    NOT "${CMAKE_CXX_COMPILER_ID}" STREQUAL "MSVC" AND
-    NOT "${CMAKE_C_COMPILER_ID}" STREQUAL "MSVC")
+    OS_NAME MATCHES "Android|Darwin|Linux|NetBSD|FreeBSD|OpenBSD|Fuchsia|Windows")
   set(COMPILER_RT_HAS_FUZZER TRUE)
 else()
   set(COMPILER_RT_HAS_FUZZER FALSE)
 endif()
 
 if (COMPILER_RT_HAS_SANITIZER_COMMON AND SHADOWCALLSTACK_SUPPORTED_ARCH AND
     OS_NAME MATCHES "Linux|Android")
   set(COMPILER_RT_HAS_SHADOWCALLSTACK TRUE)
 else()
   set(COMPILER_RT_HAS_SHADOWCALLSTACK FALSE)
 endif()

compiler-rt/lib/fuzzer/CMakeLists.txt

 append_list_if(COMPILER_RT_HAS_OMIT_FRAME_POINTER_FLAG -fno-omit-frame-pointer LIBFUZZER_CFLAGS)
 
 if (CMAKE_CXX_FLAGS MATCHES "fsanitize-coverage")
   list(APPEND LIBFUZZER_CFLAGS -fno-sanitize-coverage=trace-pc-guard,edge,trace-cmp,indirect-calls,8bit-counters)
 endif()
 
 if(NOT HAS_THREAD_LOCAL)
   list(APPEND LIBFUZZER_CFLAGS -Dthread_local=__thread)
+  if (OS_NAME MATCHES "Windows")
+     list(APPEND LIBFUZZER_CFLAGS -D_XKEYCHECK_H=1)
+  endif()
 endif()
 
 set(FUZZER_SUPPORTED_OS ${SANITIZER_COMMON_SUPPORTED_OS})
 
 add_compiler_rt_object_libraries(RTfuzzer
   OS ${FUZZER_SUPPORTED_OS}
   ARCHS ${FUZZER_SUPPORTED_ARCH}
   SOURCES ${LIBFUZZER_SOURCES}

compiler-rt/lib/fuzzer/FuzzerDefs.h

 #    define ATTRIBUTE_NO_SANITIZE_MEMORY
 #  endif
 #  define ALWAYS_INLINE __attribute__((always_inline))
 #else
 #  define ATTRIBUTE_NO_SANITIZE_MEMORY
 #  define ALWAYS_INLINE
 #endif // __clang__
 
+#if LIBFUZZER_WINDOWS
+#include <intrin.h>
+
+#define ATTRIBUTE_INTERFACE __declspec(dllexport)
+// This is used for __sancov_lowest_stack which is needed for
+// -fsanitize-coverage=stack-depth. That feature is not yet available on
+// Windows, so make the symbol static to avoid linking errors.
+#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC static
+
+#define ATTRIBUTE_NO_SANITIZE_ADDRESS
+#define ATTRIBUTE_NOINLINE __declspec(noinline)
+#define ATTRIBUTE_VISIBILITY_DEFAULT
+
+#define ATTRIBUTE_ALIGNED(X) __declspec(align(X))
+#define GET_CALLER_PC() _ReturnAddress()
+#else
+#define ATTRIBUTE_INTERFACE __attribute__((visibility("default")))
+#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC \
+  ATTRIBUTE_INTERFACE __attribute__((tls_model("initial-exec"))) thread_local
+
 #define ATTRIBUTE_NO_SANITIZE_ADDRESS __attribute__((no_sanitize_address))
+#define ATTRIBUTE_NOINLINE __attribute__((noinline))
+#define ATTRIBUTE_VISIBILITY_DEFAULT __attribute__((visibility("default")))
+
+#define ATTRIBUTE_ALIGNED(X) __attribute__((aligned(X)))
+#define GET_CALLER_PC() __builtin_return_address(0)
+#endif  // LIBFUZZER_WINDOWS
 
 #if defined(__has_feature)
 #  if __has_feature(address_sanitizer)
 #    define ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_NO_SANITIZE_ADDRESS
 #  elif __has_feature(memory_sanitizer)
 #    define ATTRIBUTE_NO_SANITIZE_ALL ATTRIBUTE_NO_SANITIZE_MEMORY
 #  else
 #    define ATTRIBUTE_NO_SANITIZE_ALL
 #  endif
 #else
 #  define ATTRIBUTE_NO_SANITIZE_ALL
 #endif
 
-#if LIBFUZZER_WINDOWS
-#define ATTRIBUTE_INTERFACE __declspec(dllexport)
-// This is used for __sancov_lowest_stack which is needed for
-// -fsanitize-coverage=stack-depth. That feature is not yet available on
-// Windows, so make the symbol static to avoid linking errors.
-#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC \
-  __attribute__((tls_model("initial-exec"))) thread_local static
-#else
-#define ATTRIBUTE_INTERFACE __attribute__((visibility("default")))
-#define ATTRIBUTES_INTERFACE_TLS_INITIAL_EXEC \
-  ATTRIBUTE_INTERFACE __attribute__((tls_model("initial-exec"))) thread_local
-#endif
-
 namespace fuzzer {
 
 template <class T> T Min(T a, T b) { return a < b ? a : b; }
 template <class T> T Max(T a, T b) { return a > b ? a : b; }
 
 class Random;
 class Dictionary;
 class DictionaryEntry;

 
 typedef Vector<uint8_t> Unit;
 typedef Vector<Unit> UnitVector;
 typedef int (*UserCallback)(const uint8_t *Data, size_t Size);
 
 int FuzzerDriver(int *argc, char ***argv, UserCallback Callback);
 
 inline uint8_t  Bswap(uint8_t x)  { return x; }
+#if LIBFUZZER_WINDOWS
+inline uint16_t Bswap(uint16_t x) { return _byteswap_ushort(x); }
+inline uint32_t Bswap(uint32_t x) { return _byteswap_ulong(x); }
+inline uint64_t Bswap(uint64_t x) { return _byteswap_uint64(x); }
+
+// The functions below were mostly copied from
+// compiler-rt/lib/builtins/int_lib.h which defines the __builtin functions used
+// outside of Windows.
+inline uint32_t Clzll(uint64_t X) {
+  unsigned long LeadZeroIdx = 0;
+  // Does not work on x86 which is unsupported by LibFuzzer on Windows anyway.
+  if (_BitScanReverse64(&LeadZeroIdx, X)) return 63 - LeadZeroIdx;
+  return 64;
+}
+
+inline uint32_t Clz(uint32_t X) {
+  unsigned long LeadZeroIdx = 0;
+  if (_BitScanReverse(&LeadZeroIdx, X)) return 31 - LeadZeroIdx;
+  return 32;
+}
+
+inline int Popcountll(unsigned long long X) { return __popcnt64(X); }
+#else
 inline uint16_t Bswap(uint16_t x) { return __builtin_bswap16(x); }
 inline uint32_t Bswap(uint32_t x) { return __builtin_bswap32(x); }
 inline uint64_t Bswap(uint64_t x) { return __builtin_bswap64(x); }
 
+inline uint32_t Clzll(unsigned long long X) { return __builtin_clzll(X); }
+inline uint32_t Clz(unsigned long long X) { return __builtin_clz(X); }
+inline int Popcountll(unsigned long long X) { return __builtin_popcountll(X); }
+#endif  // LIBFUZZER_WINDOWS
+
 uint8_t *ExtraCountersBegin();
 uint8_t *ExtraCountersEnd();
 void ClearExtraCounters();
 
 extern bool RunningUserCallback;
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_DEFS_H

compiler-rt/lib/fuzzer/FuzzerDriver.cpp

 #include <cstdlib>
 #include <cstring>
 #include <mutex>
 #include <string>
 #include <thread>
 
 // This function should be present in the libFuzzer so that the client
 // binary can test for its existence.
+#if LIBFUZZER_WINDOWS
+extern "C" void __libfuzzer_is_present() {}
+#pragma comment(linker, "/include:__libfuzzer_is_present")
+#else
 extern "C" __attribute__((used)) void __libfuzzer_is_present() {}
+#endif  // LIBFUZZER_WINDOWS
 
 namespace fuzzer {
 
 // Program arguments.
 struct FlagDescription {
   const char *Name;
   const char *Description;
   int   Default;

compiler-rt/lib/fuzzer/FuzzerExtFunctionsWeakAlias.cpp

 
 #include "FuzzerExtFunctions.h"
 #include "FuzzerIO.h"
 
 using namespace fuzzer;
 
 extern "C" {
 // Declare these symbols as weak to allow them to be optionally defined.
-#define EXT_FUNC(NAME, RETURN_TYPE, FUNC_SIG, WARN)                            \
-  RETURN_TYPE NAME##Def FUNC_SIG {                                             \
-    Printf("ERROR: Function \"%s\" not defined.\n", #NAME);                    \
-    exit(1);                                                                   \
-  }                                                                            \
+// MSVC does not support attributes so we must use the alternatename declspec
+// when compiling with MSVC.
+// Clang supports alternatename in theory. However, the clang optimizer does not
+// know about it and will assume the function is never equal to its
+// alternatename. This prevents us from knowing whether a function has actually
+// been defined by the user. So instead of using alternatename use the "weak"
+// and "alias" attributes (which clang-cl supports) to accomplish this. Define
+// EXT_FUNC to do this if we are using clang, otherwise define it to use
+// alternatename.
+#ifdef __clang__
+#define EXT_FUNC(NAME, RETURN_TYPE, FUNC_SIG, WARN)         \
+  RETURN_TYPE NAME##Def FUNC_SIG {                          \
+    Printf("ERROR: Function \"%s\" not defined.\n", #NAME); \
+    exit(1);                                                \
+  }                                                         \
   RETURN_TYPE NAME FUNC_SIG __attribute__((weak, alias(#NAME "Def")));
+#else
+// Copied from compiler-rt/lib/sanitizer_common/sanitizer_win_defs.h
+#if defined(_M_IX86) || defined(__i386__)
+#define WIN_SYM_PREFIX "_"
+#else
+#define WIN_SYM_PREFIX
+#endif
+
+// Intermediate macro to ensure the parameter is expanded before stringified.
+#define STRINGIFY_(A) #A
+#define STRINGIFY(A) STRINGIFY_(A)
+
+#define WIN_WEAK_ALIAS(Name, Default)                                  \
+  __pragma(comment(linker, "/alternatename:" WIN_SYM_PREFIX STRINGIFY( \
+                               Name) "=" WIN_SYM_PREFIX STRINGIFY(Default)))
+
+#define EXT_FUNC(NAME, RETURN_TYPE, FUNC_SIG, WARN)         \
+  RETURN_TYPE NAME##Def FUNC_SIG {                          \
+    Printf("ERROR: Function \"%s\" not defined.\n", #NAME); \
+    exit(1);                                                \
+  }                                                         \
+  WIN_WEAK_ALIAS(NAME, NAME##Def) RETURN_TYPE NAME FUNC_SIG;
+#endif  // __clang__
 
 #include "FuzzerExtFunctions.def"
 
 #undef EXT_FUNC
 }
 
 template <typename T>
 static T *GetFnPtr(T *Fun, T *FunDef, const char *FnName, bool WarnIfMissing) {

compiler-rt/lib/fuzzer/FuzzerInterface.h

 
 #include <stddef.h>
 #include <stdint.h>
 
 #ifdef __cplusplus
 extern "C" {
 #endif  // __cplusplus
 
+// Define FUZZER_INTERFACE_VISIBILITY to set default visibility in a way that
+// doesn't break MSVC.
+#if defined(_WIN32) && _WIN32
+#define FUZZER_INTERFACE_VISIBILITY
+#else
+#define FUZZER_INTERFACE_VISIBILITY __attribute__((visibility("default")))
+#endif
+
 // Mandatory user-provided target function.
 // Executes the code under test with [Data, Data+Size) as the input.
 // libFuzzer will invoke this function *many* times with different inputs.
 // Must return 0.
-__attribute__((visibility("default"))) int
+FUZZER_INTERFACE_VISIBILITY int
 LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
 
 // Optional user-provided initialization function.
 // If provided, this function will be called by libFuzzer once at startup.
 // It may read and modify argc/argv.
 // Must return 0.
-__attribute__((visibility("default"))) int LLVMFuzzerInitialize(int *argc,
-                                                                char ***argv);
+FUZZER_INTERFACE_VISIBILITY int LLVMFuzzerInitialize(int *argc, char ***argv);
 
 // Optional user-provided custom mutator.
 // Mutates raw data in [Data, Data+Size) inplace.
 // Returns the new size, which is not greater than MaxSize.
 // Given the same Seed produces the same mutation.
-__attribute__((visibility("default"))) size_t
+FUZZER_INTERFACE_VISIBILITY size_t
 LLVMFuzzerCustomMutator(uint8_t *Data, size_t Size, size_t MaxSize,
                         unsigned int Seed);
 
 // Optional user-provided custom cross-over function.
 // Combines pieces of Data1 & Data2 together into Out.
 // Returns the new size, which is not greater than MaxOutSize.
 // Should produce the same mutation given the same Seed.
-__attribute__((visibility("default"))) size_t
+FUZZER_INTERFACE_VISIBILITY size_t
 LLVMFuzzerCustomCrossOver(const uint8_t *Data1, size_t Size1,
                           const uint8_t *Data2, size_t Size2, uint8_t *Out,
                           size_t MaxOutSize, unsigned int Seed);
 
 // Experimental, may go away in future.
 // libFuzzer-provided function to be used inside LLVMFuzzerCustomMutator.
 // Mutates raw data in [Data, Data+Size) inplace.
 // Returns the new size, which is not greater than MaxSize.
-__attribute__((visibility("default"))) size_t
+FUZZER_INTERFACE_VISIBILITY size_t
 LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize);
 
+#undef FUZZER_INTERFACE_VISIBILITY
+
 #ifdef __cplusplus
 }  // extern "C"
 #endif  // __cplusplus
 
 #endif  // LLVM_FUZZER_INTERFACE_H

compiler-rt/lib/fuzzer/FuzzerLoop.cpp

if (SMR.IsServer()) {
     }
   }
 }
 
 } // namespace fuzzer
 
 extern "C" {
 
-__attribute__((visibility("default"))) size_t
-LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
+ATTRIBUTE_VISIBILITY_DEFAULT
+size_t LLVMFuzzerMutate(uint8_t *Data, size_t Size, size_t MaxSize) {
   assert(fuzzer::F);
   return fuzzer::F->GetMD().DefaultMutate(Data, Size, MaxSize);
 }
 
 // Experimental
-__attribute__((visibility("default"))) void
-LLVMFuzzerAnnounceOutput(const uint8_t *Data, size_t Size) {
+ATTRIBUTE_VISIBILITY_DEFAULT
+void LLVMFuzzerAnnounceOutput(const uint8_t *Data, size_t Size) {
   assert(fuzzer::F);
   fuzzer::F->AnnounceOutput(Data, Size);
 }
 } // extern "C"

compiler-rt/lib/fuzzer/FuzzerMain.cpp

 
 #include "FuzzerDefs.h"
 
 extern "C" {
 // This function should be defined by the user.
 int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size);
 }  // extern "C"
 
-__attribute__((visibility("default"))) int main(int argc, char **argv) {
+ATTRIBUTE_VISIBILITY_DEFAULT int main(int argc, char **argv) {
   return fuzzer::FuzzerDriver(&argc, &argv, LLVMFuzzerTestOneInput);
 }

compiler-rt/lib/fuzzer/FuzzerSHA1.cpp

 #ifdef __BIG_ENDIAN__
 # define SHA_BIG_ENDIAN
 #elif defined __LITTLE_ENDIAN__
 /* override */
 #elif defined __BYTE_ORDER
 # if __BYTE_ORDER__ ==  __ORDER_BIG_ENDIAN__
 # define SHA_BIG_ENDIAN
 # endif
-#else // ! defined __LITTLE_ENDIAN__
+// Windows doesn't have <endian.h>. It is always little endian, even on ARM.
+#elif !defined(LIBFUZZER_WINDOWS) // ! defined __LITTLE_ENDIAN__
 # include <endian.h> // machine/endian.h
 # if __BYTE_ORDER__ ==  __ORDER_BIG_ENDIAN__
 #  define SHA_BIG_ENDIAN
 # endif
 #endif
 
 
 /* header */

compiler-rt/lib/fuzzer/FuzzerTracePC.h

unsigned CounterToFeature(T Counter) {
     else if (Counter >= 4) Bit = 3;
     else if (Counter >= 3) Bit = 2;
     else if (Counter >= 2) Bit = 1;
     return Bit;
 }
 
 template <class Callback>  // void Callback(size_t Feature)
 ATTRIBUTE_NO_SANITIZE_ADDRESS
-__attribute__((noinline))
+ATTRIBUTE_NOINLINE
 void TracePC::CollectFeatures(Callback HandleFeature) const {
   uint8_t *Counters = this->Counters();
   size_t N = GetNumPCs();
   auto Handle8bitCounter = [&](size_t FirstFeature,
                                size_t Idx, uint8_t Counter) {
     if (UseCounters)
       HandleFeature(FirstFeature + Idx * 8 + CounterToFeature(Counter));
     else

compiler-rt/lib/fuzzer/FuzzerTracePC.cpp

 ATTRIBUTE_TARGET_POPCNT ALWAYS_INLINE
 ATTRIBUTE_NO_SANITIZE_ALL
 void TracePC::HandleCmp(uintptr_t PC, T Arg1, T Arg2) {
   uint64_t ArgXor = Arg1 ^ Arg2;
   if (sizeof(T) == 4)
       TORC4.Insert(ArgXor, Arg1, Arg2);
   else if (sizeof(T) == 8)
       TORC8.Insert(ArgXor, Arg1, Arg2);
-  uint64_t HammingDistance = __builtin_popcountll(ArgXor); // [0,64]
-  uint64_t AbsoluteDistance =
-      (Arg1 == Arg2 ? 0 : __builtin_clzll(Arg1 - Arg2) + 1);
+  uint64_t HammingDistance = Popcountll(ArgXor);  // [0,64]
+  uint64_t AbsoluteDistance = (Arg1 == Arg2 ? 0 : Clzll(Arg1 - Arg2) + 1);
   ValueProfileMap.AddValue(PC * 128 + HammingDistance);
   ValueProfileMap.AddValue(PC * 128 + 64 + AbsoluteDistance);
 }
 
 static size_t InternalStrnlen(const char *S, size_t MaxLen) {
   size_t Len = 0;
   for (; Len < MaxLen && S[Len]; Len++) {}
   return Len;

 }
 
 } // namespace fuzzer
 
 extern "C" {
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 void __sanitizer_cov_trace_pc_guard(uint32_t *Guard) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   uint32_t Idx = *Guard;
   __sancov_trace_pc_pcs[Idx] = PC;
   __sancov_trace_pc_guard_8bit_counters[Idx]++;
 }
 
 // Best-effort support for -fsanitize-coverage=trace-pc, which is available
 // in both Clang and GCC.
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 void __sanitizer_cov_trace_pc() {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   uintptr_t Idx = PC & (((uintptr_t)1 << fuzzer::TracePC::kTracePcBits) - 1);
   __sancov_trace_pc_pcs[Idx] = PC;
   __sancov_trace_pc_guard_8bit_counters[Idx]++;
 }
 
 ATTRIBUTE_INTERFACE
 void __sanitizer_cov_trace_pc_guard_init(uint32_t *Start, uint32_t *Stop) {
   fuzzer::TPC.HandleInit(Start, Stop);
 }
 
 ATTRIBUTE_INTERFACE
 void __sanitizer_cov_8bit_counters_init(uint8_t *Start, uint8_t *Stop) {
   fuzzer::TPC.HandleInline8bitCountersInit(Start, Stop);
 }
 
 ATTRIBUTE_INTERFACE
 void __sanitizer_cov_pcs_init(const uintptr_t *pcs_beg,
                               const uintptr_t *pcs_end) {
   fuzzer::TPC.HandlePCsInit(pcs_beg, pcs_end);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 void __sanitizer_cov_trace_pc_indir(uintptr_t Callee) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCallerCallee(PC, Callee);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_cmp8(uint64_t Arg1, uint64_t Arg2) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 // Now the __sanitizer_cov_trace_const_cmp[1248] callbacks just mimic
 // the behaviour of __sanitizer_cov_trace_cmp[1248] ones. This, however,
 // should be changed later to make full use of instrumentation.
 void __sanitizer_cov_trace_const_cmp8(uint64_t Arg1, uint64_t Arg2) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_cmp4(uint32_t Arg1, uint32_t Arg2) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_const_cmp4(uint32_t Arg1, uint32_t Arg2) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_cmp2(uint16_t Arg1, uint16_t Arg2) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_const_cmp2(uint16_t Arg1, uint16_t Arg2) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_cmp1(uint8_t Arg1, uint8_t Arg2) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_const_cmp1(uint8_t Arg1, uint8_t Arg2) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Arg1, Arg2);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_switch(uint64_t Val, uint64_t *Cases) {
   uint64_t N = Cases[0];
   uint64_t ValSizeInBits = Cases[1];
   uint64_t *Vals = Cases + 2;
   // Skip the most common and the most boring case.
   if (Vals[N - 1]  < 256 && Val < 256)
     return;
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   size_t i;
   uint64_t Token = 0;
   for (i = 0; i < N; i++) {
     Token = Val ^ Vals[i];
     if (Val < Vals[i])
       break;
   }
 
   if (ValSizeInBits == 16)
     fuzzer::TPC.HandleCmp(PC + i, static_cast<uint16_t>(Token), (uint16_t)(0));
   else if (ValSizeInBits == 32)
     fuzzer::TPC.HandleCmp(PC + i, static_cast<uint32_t>(Token), (uint32_t)(0));
   else
     fuzzer::TPC.HandleCmp(PC + i, Token, (uint64_t)(0));
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_div4(uint32_t Val) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Val, (uint32_t)0);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_div8(uint64_t Val) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Val, (uint64_t)0);
 }
 
 ATTRIBUTE_INTERFACE
 ATTRIBUTE_NO_SANITIZE_ALL
 ATTRIBUTE_TARGET_POPCNT
 void __sanitizer_cov_trace_gep(uintptr_t Idx) {
-  uintptr_t PC = reinterpret_cast<uintptr_t>(__builtin_return_address(0));
+  uintptr_t PC = reinterpret_cast<uintptr_t>(GET_CALLER_PC());
   fuzzer::TPC.HandleCmp(PC, Idx, (uintptr_t)0);
 }
 
 ATTRIBUTE_INTERFACE ATTRIBUTE_NO_SANITIZE_MEMORY
 void __sanitizer_weak_hook_memcmp(void *caller_pc, const void *s1,
                                   const void *s2, size_t n, int result) {
   if (!fuzzer::RunningUserCallback) return;
   if (result == 0) return;  // No reason to mutate.

compiler-rt/lib/fuzzer/FuzzerUtil.h

 }
 
 std::string DisassembleCmd(const std::string &FileName);
 
 std::string SearchRegexCmd(const std::string &Regex);
 
 size_t SimpleFastHash(const uint8_t *Data, size_t Size);
 
-inline uint32_t Log(uint32_t X) { return 32 - __builtin_clz(X) - 1; }
+inline uint32_t Log(uint32_t X) { return 32 - Clz(X) - 1; }
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_UTIL_H

compiler-rt/lib/fuzzer/FuzzerValueBitMap.h

public:
   // Computes a hash function of Value and sets the corresponding bit.
   // Returns true if the bit was changed from 0 to 1.
   ATTRIBUTE_NO_SANITIZE_ALL
   inline bool AddValue(uintptr_t Value) {
     uintptr_t Idx = Value % kMapSizeInBits;
     uintptr_t WordIdx = Idx / kBitsInWord;
     uintptr_t BitIdx = Idx % kBitsInWord;
     uintptr_t Old = Map[WordIdx];
-    uintptr_t New = Old | (1UL << BitIdx);
+    uintptr_t New = Old | (1ULL << BitIdx);
     Map[WordIdx] = New;
     return New != Old;
   }
 
   ATTRIBUTE_NO_SANITIZE_ALL
   inline bool AddValueModPrime(uintptr_t Value) {
     return AddValue(Value % kMapPrimeMod);
   }
 
   inline bool Get(uintptr_t Idx) {
     assert(Idx < kMapSizeInBits);
     uintptr_t WordIdx = Idx / kBitsInWord;
     uintptr_t BitIdx = Idx % kBitsInWord;
-    return Map[WordIdx] & (1UL << BitIdx);
+    return Map[WordIdx] & (1ULL << BitIdx);
   }
 
   size_t SizeInBits() const { return kMapSizeInBits; }
 
   template <class Callback>
   ATTRIBUTE_NO_SANITIZE_ALL
   void ForEach(Callback CB) const {
     for (size_t i = 0; i < kMapSizeInWords; i++)
       if (uintptr_t M = Map[i])
         for (size_t j = 0; j < sizeof(M) * 8; j++)
           if (M & ((uintptr_t)1 << j))
             CB(i * sizeof(M) * 8 + j);
   }
 
  private:
-  uintptr_t Map[kMapSizeInWords] __attribute__((aligned(512)));
+  ATTRIBUTE_ALIGNED(512) uintptr_t Map[kMapSizeInWords];
 };
 
 }  // namespace fuzzer
 
 #endif  // LLVM_FUZZER_VALUE_BIT_MAP_H

compiler-rt/lib/sanitizer_common/sanitizer_coverage_win_sections.cc

 // section. We also need to prevent the linker from adding any padding. Each
 // technique we use for this is explained in the comments below.
 //===----------------------------------------------------------------------===//
 
 #include "sanitizer_platform.h"
 #if SANITIZER_WINDOWS
 #include <stdint.h>
 extern "C" {
-// The Guard array and counter array should both be merged into the .data
-// section to reduce the number of PE sections However, because PCTable is
-// constant it should be merged with the .rdata section.
-#pragma section(".SCOV$GA", read, write)  // NOLINT
-// Use align(1) to avoid adding any padding that will mess up clients trying to
-// determine the start and end of the array.
-__declspec(allocate(".SCOV$GA")) __declspec(align(1)) uint64_t
-    __start___sancov_guards = 0;
-#pragma section(".SCOV$GZ", read, write)  // NOLINT
-__declspec(allocate(".SCOV$GZ")) __declspec(align(1)) uint64_t
-    __stop___sancov_guards = 0;
+// Use align(1) to avoid adding any padding between the end of the array and the
+// symbol delimiting its end.
+#define BYTE_ALIGNMENT __declspec(align(1))
 
 #pragma section(".SCOV$CA", read, write)  // NOLINT
-__declspec(allocate(".SCOV$CA")) __declspec(align(1)) uint64_t
-    __start___sancov_cntrs = 0;
+__declspec(allocate(".SCOV$CA")) uint64_t __start___sancov_cntrs = 0;
+
+// Even though we tell the compiler not to align __stop__sancov_cntrs, the
+// linker may try to align the section it is in (".SCOV$CZ"). Use a uint8_t so
+// that it doesn't matter if the linker tries to align the section on a boundary
+// of its size (no padding bytes are needed to pad to 1 byte boundaries).
 #pragma section(".SCOV$CZ", read, write)  // NOLINT
-__declspec(allocate(".SCOV$CZ")) __declspec(align(1)) uint64_t
-    __stop___sancov_cntrs = 0;
+__declspec(allocate(".SCOV$CZ"))
+    BYTE_ALIGNMENT uint8_t __stop___sancov_cntrs = 0;
 
+#pragma section(".SCOV$GA", read, write)  // NOLINT
+__declspec(allocate(".SCOV$GA")) uint64_t __start___sancov_guards = 0;
+#pragma section(".SCOV$GZ", read, write)  // NOLINT
+__declspec(allocate(".SCOV$GZ"))
+    BYTE_ALIGNMENT uint8_t __stop___sancov_guards = 0;
+
+// The Guard array and counter array should both be merged into the .data
+// section to reduce the number of PE sections. However, because PCTable is
+// constant it should be merged with the .rdata section.
 #pragma comment(linker, "/MERGE:.SCOV=.data")
 
 // Use uint64_t so there won't be any issues if the linker tries to word align
-// the pc array.
+// the PCTable. On x64 each element in the PCTable is 8 bytes so if the linker
+// tries to word align the array, it will always start at the first byte after
+// the end of this symbol. We make __start__sancov_cntrs and
+// __start__sancov_guards 64 bit numbers so that the start of any of these
+// arrays is always 8 bytes from the address of the "__start" symbol.
 #pragma section(".SCOVP$A", read)  // NOLINT
-__declspec(allocate(".SCOVP$A")) __declspec(align(1)) uint64_t
-    __start___sancov_pcs = 0;
+__declspec(allocate(".SCOVP$A")) uint64_t __start___sancov_pcs = 0;
 #pragma section(".SCOVP$Z", read)  // NOLINT
-__declspec(allocate(".SCOVP$Z")) __declspec(align(1)) uint64_t
-    __stop___sancov_pcs = 0;
+__declspec(allocate(".SCOVP$Z")) BYTE_ALIGNMENT uint8_t __stop___sancov_pcs = 0;
 
 #pragma comment(linker, "/MERGE:.SCOVP=.rdata")
 }
 #endif  // SANITIZER_WINDOWS