[MSAN] Update tests due to widespread eager checking

[vitalybuka]

Summary

Adds lit configuration to be able to test MSAN's interaction
with widespread eager checking due to clang emitting noundef attrs.

[vitalybuka]

Each of these can be a separate patch

Additionally introduces tests for:
- Bitfield handling
- Different sized function parameters
- MSAN and struct padding (when passing structs by value)

And It would be nice if you cut off some other pieces

[guiand]

Kept only core of patch: adding new LIT configration for eager-checks

[eugenis]

The patch is missing context

[guiand]

Sorry about that. Reuploaded with full context.

[eugenis]

compiler-rt/test/msan/signal_stress_test.cpp

7

I think REQUIRES: makes more sense here.

compiler-rt/test/msan/vararg.cpp

89

This test becomes super confusing, I no longer understand all the combinations.
Why do you need explicit __msan_unpoison_param?
It would help to rename EXPECT_PASS and EXPECT_FAIL to reflect what they do (pass uninit or not) instead of what they expect to happen.

[vitalybuka]

compiler-rt/test/msan/vararg.cpp

40

is volatile needed here?
noinline should be enough?

[guiand]

compiler-rt/test/msan/vararg.cpp

40

I wasn't sure if just using noinline would also prevent the compiler from doing dead code elimination on a call to an empty function.

89

That's fair. I think this test could just be restored to its original state with the changes for noundef.

compiler-rt/test/msan/CMakeLists.txt

 set(MSAN_LIT_SOURCE_DIR ${CMAKE_CURRENT_SOURCE_DIR})
 
 set(MSAN_TESTSUITES)
 set(MSAN_TEST_DEPS ${SANITIZER_COMMON_LIT_TEST_DEPS})
 
 set(MSAN_TEST_ARCH ${MSAN_SUPPORTED_ARCH})
 if(APPLE)
   darwin_filter_host_archs(MSAN_SUPPORTED_ARCH MSAN_TEST_ARCH)
 endif()
 
-macro(add_msan_testsuite arch lld thinlto)
+macro(add_msan_testsuite arch lld thinlto eager)
   set(MSAN_TEST_TARGET_ARCH ${arch})
   get_test_cc_for_arch(${arch} MSAN_TEST_TARGET_CC MSAN_TEST_TARGET_CFLAGS)
 
   string(TOUPPER ${arch} CONFIG_NAME)
 
   if (${thinlto})
     set(CONFIG_NAME "thinlto-${CONFIG_NAME}")
     list(APPEND MSAN_TEST_DEPS LTO)
   endif()
   if (${lld})
     set(CONFIG_NAME "lld-${CONFIG_NAME}")
     if (TARGET lld)
       list(APPEND MSAN_TEST_DEPS lld)
     endif()
   endif()
+  if (${eager})
+    set(CONFIG_NAME "eager-${CONFIG_NAME}")
+  endif()
   set(MSAN_TEST_USE_THINLTO ${thinlto})
   set(MSAN_TEST_USE_LLD ${lld})
+  set(MSAN_TEST_EAGER_CHECK ${eager})
 
   configure_lit_site_cfg(
     ${CMAKE_CURRENT_SOURCE_DIR}/lit.site.cfg.py.in
     ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME}/lit.site.cfg.py)
   list(APPEND MSAN_TESTSUITES ${CMAKE_CURRENT_BINARY_DIR}/${CONFIG_NAME})
 endmacro()
 
 foreach(arch ${MSAN_TEST_ARCH})
-  add_msan_testsuite(${arch} False False)
+  add_msan_testsuite(${arch} False False False)
+  add_msan_testsuite(${arch} False False True)
 
   if(COMPILER_RT_HAS_LLD AND arch STREQUAL "x86_64" AND NOT (APPLE OR WIN32))
-    add_msan_testsuite(${arch} True False)
+    add_msan_testsuite(${arch} True False False)
   endif()
 endforeach()
 
 if(NOT COMPILER_RT_STANDALONE_BUILD)
   list(APPEND MSAN_TEST_DEPS msan)
 endif()
 
 if(COMPILER_RT_INCLUDE_TESTS AND

compiler-rt/test/msan/chained_origin.cpp

 // RUN:     not %run %t >%t.out 2>&1
 // RUN: FileCheck %s --check-prefix=CHECK --check-prefix=CHECK-HEAP < %t.out
 
 #include <stdio.h>
 
 volatile int x, y;
 
 __attribute__((noinline))
-void fn_g(int a) {
+void fn_g(volatile int &a) {
   x = a;
 }
 
 __attribute__((noinline))
-void fn_f(int a) {
+void fn_f(volatile int &a) {
   fn_g(a);
 }
 
 __attribute__((noinline))
 void fn_h() {
   y = x;
 }
 

compiler-rt/test/msan/chained_origin_empty_stack.cpp

 // CHECK: Uninitialized value was created by an allocation of 'z' in the stack frame of function 'main'
 // CHECK:   #0 {{.*}} in main
 
 #include <stdio.h>
 
 volatile int x;
 
 __attribute__((noinline))
-void fn_g(int a) {
+void fn_g(volatile int &a) {
   x = a;
 }
 
 __attribute__((noinline))
-void fn_f(int a) {
+void fn_f(volatile int &a) {
   fn_g(a);
 }
 
 int main(int argc, char *argv[]) {
   int volatile z;
   fn_f(z);
   return x;
 }

compiler-rt/test/msan/chained_origin_memcpy.cpp

 #include <stdio.h>
 #include <string.h>
 
 int xx[10000];
 int yy[10000];
 volatile int idx = 30;
 
 __attribute__((noinline))
-void fn_g(int a, int b) {
+void fn_g(volatile int &a, volatile int &b) {
   xx[idx] = a; xx[idx + 10] = b;
 }
 
 __attribute__((noinline))
-void fn_f(int a, int b) {
+void fn_f(volatile int &a, volatile int &b) {
   fn_g(a, b);
 }
 
 __attribute__((noinline))
 void fn_h() {
   memcpy(&yy, &xx, sizeof(xx));
 }
 

compiler-rt/test/msan/cxa_atexit.cpp

 // RUN: %clangxx_msan -O0 %s -o %t && %run %t %p
+// REQUIRES: !msan_eager_checks
 
 // PR17377: C++ module destructors get stale argument shadow.
 
 #include <stdio.h>
 #include <stdlib.h>
 class A {
 public:
   // This destructor get stale argument shadow left from the call to f().

compiler-rt/test/msan/insertvalue_origin.cpp

 // RUN: %clangxx_msan -fsanitize-memory-track-origins -O0 %s -o %t && not %run %t >%t.out 2>&1
 // RUN: FileCheck %s < %t.out && FileCheck %s < %t.out
 // RUN: %clangxx_msan -fsanitize-memory-track-origins -O3 %s -o %t && not %run %t >%t.out 2>&1
 // RUN: FileCheck %s < %t.out && FileCheck %s < %t.out
 
 // Test origin propagation through insertvalue IR instruction.
 
 #include <stdio.h>
 #include <stdint.h>
 
 struct mypair {
  int64_t x;
  int y;
 };
 
-mypair my_make_pair(int64_t x, int y)  {
+mypair my_make_pair(const int64_t &x, const int &y)  {
  mypair p;
  p.x = x;
  p.y = y;
  return p;
 }
 
 int main() {
  int64_t * volatile p = new int64_t;

compiler-rt/test/msan/lit.site.cfg.py.in

 @LIT_SITE_CFG_IN_HEADER@
 
 # Tool-specific config options.
 config.name_suffix = "-@CONFIG_NAME@"
 config.target_cflags = "@MSAN_TEST_TARGET_CFLAGS@"
 config.target_arch = "@MSAN_TEST_TARGET_ARCH@"
 config.use_lld = @MSAN_TEST_USE_LLD@
 config.use_thinlto = @MSAN_TEST_USE_THINLTO@
 
+if @MSAN_TEST_EAGER_CHECK@:
+  config.target_cflags += " -mllvm -msan-eager-checks -DTEST_MSAN_EAGER_CHECKS"
+  config.available_features.add('msan_eager_checks')
+
 # Load common config for all compiler-rt lit tests.
 lit_config.load_config(config, "@COMPILER_RT_BINARY_DIR@/test/lit.common.configured")
 
 # Load tool-specific config that would do the real work.
 lit_config.load_config(config, "@MSAN_LIT_SOURCE_DIR@/lit.cfg.py")

compiler-rt/test/msan/no_sanitize_memory_prop.cpp

 // RUN: %clangxx_msan -O0 %s -o %t && %run %t >%t.out 2>&1
 // RUN: %clangxx_msan -O1 %s -o %t && %run %t >%t.out 2>&1
 // RUN: %clangxx_msan -O2 %s -o %t && %run %t >%t.out 2>&1
 // RUN: %clangxx_msan -O3 %s -o %t && %run %t >%t.out 2>&1
 
 // Test that (no_sanitize_memory) functions DO NOT propagate shadow.
 
 #include <stdlib.h>
 #include <stdio.h>
 
 __attribute__((noinline))
 __attribute__((weak))
 __attribute__((no_sanitize_memory))
-int f(int x) {
+int f(int &x) {
   return x;
 }
 
 int main(void) {
   int x;
   int * volatile p = &x;
   int y = f(*p);
   if (y)
     exit(0);
   return 0;
 }

compiler-rt/test/msan/param_tls_limit.cpp

 // ParamTLS has limited size. Everything that does not fit is considered fully
 // initialized.
 
 // RUN: %clangxx_msan -O0 %s -o %t && %run %t
 // RUN: %clangxx_msan -fsanitize-memory-track-origins -O0 %s -o %t && %run %t
 // RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -O0 %s -o %t && %run %t
+// REQUIRES: !msan_eager_checks
 //
 // AArch64 fails with:
 // void f801(S<801>): Assertion `__msan_test_shadow(&s, sizeof(s)) == -1' failed
 // XFAIL: aarch64
 // When passing huge structs by value, SystemZ uses pointers, therefore this
 // test in its present form is unfortunately not applicable.
 // ABI says: "A struct or union of any other size <snip>. Replace such an
 // argument by a pointer to the object, or to a copy where necessary to enforce

compiler-rt/test/msan/qsort.cpp

 constexpr size_t kSize2 = 7;
 
 bool seen2;
 
 void dummy(long a, long b, long c, long d, long e) {}
 
 void poison_stack_and_param() {
   char x[10000];
+#ifndef TEST_MSAN_EAGER_CHECKS
   int y;
   dummy(y, y, y, y, y);
+#endif
 }
 
 __attribute__((always_inline)) int cmp(long a, long b) {
   if (a < b)
     return -1;
   else if (a > b)
     return 1;
   else

compiler-rt/test/msan/signal_stress_test.cpp

 // RUN: %clangxx_msan -std=c++11 -O0 %s -o %t && %run %t
 //
 // Test that va_arg shadow from a signal handler does not leak outside.
 
 // Reported deadly signal due to stack-overflow
 // XFAIL: netbsd
+// XFAIL: msan_eager_checks
 
 #include <signal.h>
 #include <stdarg.h>
 #include <sanitizer/msan_interface.h>
 #include <assert.h>
 #include <sys/time.h>
 #include <stdio.h>
 

compiler-rt/test/msan/stack-origin2.cpp

 // RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-ORIGINS < %t.out
 // RUN: %clangxx_msan -fsanitize-memory-track-origins -O1 %s -o %t && not %run %t >%t.out 2>&1
 // RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-ORIGINS < %t.out
 // RUN: %clangxx_msan -fsanitize-memory-track-origins -O2 %s -o %t && not %run %t >%t.out 2>&1
 // RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-ORIGINS < %t.out
 // RUN: %clangxx_msan -fsanitize-memory-track-origins -O3 %s -o %t && not %run %t >%t.out 2>&1
 // RUN: FileCheck %s < %t.out && FileCheck %s --check-prefix=CHECK-ORIGINS < %t.out
 
+// REQUIRES: !msan_eager_checks
+
 #include <stdlib.h>
 
 extern "C"
 int f(int depth) {
   if (depth) return f(depth - 1);
 
   int x;
   int *volatile p = &x;

compiler-rt/test/msan/unpoison_param.cpp

 // Tests that __msan_unpoison_param() works as specified.  To prevent MSan
 // instrumentation from modifying parameter shadow before each call to foo(), we
 // compile main() without MSan.
 
 // RUN: %clangxx_msan -fno-sanitize=memory -c %s -o %t-main.o
 // RUN: %clangxx_msan %t-main.o %s -o %t
 // RUN: %run %t
+// REQUIRES: !msan_eager_checks
 
 #include <assert.h>
 #include <sanitizer/msan_interface.h>
 
 #if __has_feature(memory_sanitizer)
 
 __attribute__((noinline)) int bar(int a, int b) {
   volatile int zero = 0;

compiler-rt/test/msan/vararg.cpp

-// RUN: %clangxx_msan -fsanitize-memory-track-origins=0 -O3 %s -o %t && \
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=0 -DEXPECT_PASS -O3 %s -o %t && \
+// RUN:     not %run %t va_arg_tls >%t.out 2>&1
+// RUN: not [ -s %t.out ]
+
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=0 -DEXPECT_PASS -O3 %s -o %t && \
+// RUN:     not %run %t overflow >%t.out 2>&1
+// RUN: not [ -s %t.out ]
+ 
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=0 -DEXPECT_FAIL -O3 %s -o %t && \
 // RUN:     not %run %t va_arg_tls >%t.out 2>&1
 // RUN: FileCheck %s --check-prefix=CHECK < %t.out
 
-// RUN: %clangxx_msan -fsanitize-memory-track-origins=0 -O3 %s -o %t && \
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=0 -DEXPECT_FAIL -O3 %s -o %t && \
 // RUN:     not %run %t overflow >%t.out 2>&1
 // RUN: FileCheck %s --check-prefix=CHECK < %t.out
 
-// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -O3 %s -o %t && \
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -DEXPECT_FAIL -O3 %s -o %t && \
 // RUN:     not %run %t va_arg_tls >%t.out 2>&1
 // RUN: FileCheck %s --check-prefixes=CHECK,CHECK-ORIGIN < %t.out
 
-// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -O3 %s -o %t && \
+// RUN: %clangxx_msan -fsanitize-memory-track-origins=2 -DEXPECT_FAIL -O3 %s -o %t && \
 // RUN:     not %run %t overflow >%t.out 2>&1
 // RUN: FileCheck %s --check-prefixes=CHECK,CHECK-ORIGIN < %t.out
 
 // Check that shadow and origin are passed through va_args.
 
 // Copying origins on AArch64, MIPS and PowerPC isn't supported yet.
 // XFAIL: aarch64
 // XFAIL: mips
 // XFAIL: powerpc64
 
 #include <stdarg.h>
 #include <string.h>
 
+#include <sanitizer/msan_interface.h>
+
+__attribute__((noinline))
+void dummy(long a, long b, long c, long d, long e) {
+  __asm__ __volatile__ (""::"r"(a), "r"(b), "r"(c), "r"(d), "r"(e));
+}
+
+__attribute__((noinline))
+void poison_stack_and_param() {
+  char x[10000];
+#ifndef TEST_MSAN_EAGER_CHECKS
+  int y;
+  dummy(y, y, y, y, y);
+#endif
+}
+
 __attribute__((noinline))
 int sum(int n, ...) {
   va_list args;
   int i, sum = 0, arg;
   volatile int temp;
   va_start(args, n);
   for (i = 0; i < n; i++) {
     arg = va_arg(args, int);
     sum += arg;
   }
   va_end(args);
   return sum;
 }
 
 int main(int argc, char *argv[]) {
+#if defined(EXPECT_FAIL)
   volatile int uninit;
+  #define PRE_RUN for (int i = 0; i < 6; i++) __msan_unpoison_param(i)
+  // CHECK: WARNING: MemorySanitizer: use-of-uninitialized-value
+  // CHECK-ORIGIN: Uninitialized value was created by an allocation of 'uninit' in the stack frame of function 'main'
+#elif defined(EXPECT_PASS)
+  volatile int uninit = 0;
+  #define PRE_RUN poison_stack_and_param()
+#else
+  #error Bad configuration
+#endif
+
   volatile int a = 1, b = 2;
   if (argc == 2) {
     // Shadow/origin will be passed via va_arg_tls/va_arg_origin_tls.
     if (strcmp(argv[1], "va_arg_tls") == 0) {
+      PRE_RUN;
       return sum(3, uninit, a, b);
     }
     // Shadow/origin of |uninit| will be passed via overflow area.
     if (strcmp(argv[1], "overflow") == 0) {
+      PRE_RUN;
       return sum(7,
         a, a, a, a, a, a, uninit
       );
     }
   }
   return 0;
 }
-
-// CHECK: WARNING: MemorySanitizer: use-of-uninitialized-value
-// CHECK-ORIGIN: Uninitialized value was created by an allocation of 'uninit' in the stack frame of function 'main'

compiler-rt/test/msan/vector_cvt.cpp

 // RUN: %clangxx_msan -O0 %s -o %t && %run %t
 // RUN: %clangxx_msan -DPOSITIVE -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s
 // REQUIRES: x86_64-target-arch
 
 #include <emmintrin.h>
 
-int to_int(double v) {
+int to_int(double &v) {
   __m128d t = _mm_set_sd(v);
   int x = _mm_cvtsd_si32(t);
   return x;
   // CHECK: WARNING: MemorySanitizer: use-of-uninitialized-value
   // CHECK: #{{.*}} in to_int{{.*}}vector_cvt.cpp:[[@LINE-3]]
 }
 
 int main() {