libfuzzer forces use of popcnt instruction in its code

[theultramage]

FuzzerPlatform.h defines ATTRIBUTE_TARGET_POPCNT as a shorthand for __attribute__((target("popcnt"))). This applies an override to the global build options, letting the compiler use the (SSE4?) 'popcnt' instruction for faster execution of certain bit code. It is currently only being used in FuzzerTracePC.cpp on 13 functions.

The logic apparently being applied to ATTRIBUTE_TARGET_POPCNT is "if it's x86_64, it has popcnt". This is not true for various older processors. Forcing use of this instruction causes the resulting binary libclang_rt.fuzzer-x86_64.a to crash with SIGILL when executing any of the flagged functions on processors that don't support popcnt.

This was reported on the freebsd bugtracker in august 2021, after mysql80-server-8.0.26 was released and integrated into the ports tree. The relevant mysql change happened in february 2021 but wasn't put into a release until later. I have tried checking the now deleted svn history for libFuzzer and so far found llvm-svn: 279601 which shows that these overrides were already there in 2016. I could not find the changeset that initially added them since that site cannot access the repo.

It is not obvious why this code even exists. The popcnt flag should already be getting automatically set/unset based on the build's target architecture, so at best it's a no-op. Is it possible that the original author misunderstood the usage of this attribute, and thought it acted as a hint to the optimizer, and that it would be smart about only applying the optimization for eligible targets? (Does it actually also act as a hint?)

[DimitryAndric]

• 9eb170f (r300999 by @kubamracek) introduced the check whether attribute((target("popcnt"))) was even supported (for older compilers)
• bceadcf (r279601 by @kcc) added the attribute only for x86_64 (even though this isn't strictly true and __POPCNT__ should also have been checked)
• 5a5d554 (r279002 by @kcc) added the attribute unconditionally
• d46a59f (r278839 by @kcc) originally added a -mpopcnt compile flag

In all cases, I think the intent was that the popcnt instruction should be more efficient, but I don't know why it wasn't simply left to __builtin_popcnt to decide how to emit it...