[libc] default enable -ftrivial-auto-var-init=pattern

[nickdesaulniers]

Usage of uninitialized memory is a top memory safety issue in C++ codebases.
Help mitigate this somewhat by default initialize stack allocations to a
pattern (0xAA repeating).

Clang has received optimizations to sink these into control flow paths that
access such values to minimize the overhead of these added initializations.

If there's a measurable slowdown, we can add
-ftrivial-auto-var-init-max-size= for some value N bytes if we have any
large stack allocations, or add attribute uninitialized to any variable
declarations.

Unsupported until GCC 12.1 / Clang 8.

Increases file size of libc.a from a full build by +8.79Ki (+0.2%).

[llvmbot]

@llvm/pr-subscribers-libc

Author: Nick Desaulniers (nickdesaulniers)

Changes

Usage of uninitialized memory is a top memory safety issue in C++ codebases.
Help mitigate this somewhat by default initialize stack allocations to a
pattern (0xAA repeating).

Clang has received optimizations to sink these into control flow paths that
access such values to minimize the overhead of these added initializations.

If there's a measurable slowdown, we can add
-ftrivial-auto-var-init-max-size=<N> for some value N bytes if we have any
large stack allocations, or add attribute uninitialized to any variable
declarations.

Unsupported until GCC 12.1 / Clang 8.

Increases file size of libc.a from a full build by +8.79Ki (+0.2%).

---

Full diff: https://github.com/llvm/llvm-project/pull/78776.diff

2 Files Affected:

• (modified) libc/cmake/modules/LLVMLibCObjectRules.cmake (+5)
• (modified) utils/bazel/llvm-project-overlay/libc/libc_build_rules.bzl (+6-1)

diff --git a/libc/cmake/modules/LLVMLibCObjectRules.cmake b/libc/cmake/modules/LLVMLibCObjectRules.cmake
index 6eba17ae9201c8..46f5ed5cd7465f 100644
--- a/libc/cmake/modules/LLVMLibCObjectRules.cmake
+++ b/libc/cmake/modules/LLVMLibCObjectRules.cmake
@@ -41,6 +41,11 @@ function(_get_common_compile_options output_var flags)
     list(APPEND compile_options "-fno-unwind-tables")
     list(APPEND compile_options "-fno-asynchronous-unwind-tables")
     list(APPEND compile_options "-fno-rtti")
+    # clang-8+, gcc-12+
+    check_cxx_compiler_flag("-ftrivial-auto-var-init=pattern" LIBC_CC_SUPPORTS_PATTERN_INIT)
+    if (LIBC_CC_SUPPORTS_PATTERN_INIT)
+      list(APPEND compile_options "-ftrivial-auto-var-init=pattern")
+    endif()
     list(APPEND compile_options "-Wall")
     list(APPEND compile_options "-Wextra")
     # -DLIBC_WNO_ERROR=ON if you can't build cleanly with -Werror.
diff --git a/utils/bazel/llvm-project-overlay/libc/libc_build_rules.bzl b/utils/bazel/llvm-project-overlay/libc/libc_build_rules.bzl
index cf27001be9dfed..a28fa51a39f99d 100644
--- a/utils/bazel/llvm-project-overlay/libc/libc_build_rules.bzl
+++ b/utils/bazel/llvm-project-overlay/libc/libc_build_rules.bzl
@@ -81,7 +81,12 @@ def libc_function(
     # We use the explicit equals pattern here because append and += mutate the
     # original list, where this creates a new list and stores it in deps.
     copts = copts or []
-    copts = copts + ["-O3", "-fno-builtin", "-fno-lax-vector-conversions"]
+    copts = copts + [
+      "-O3",
+      "-fno-builtin",
+      "-fno-lax-vector-conversions",
+      "-ftrivial-auto-var-init=pattern"
+    ]
 
     # We compile the code twice, the first target is suffixed with ".__internal__" and contains the
     # C++ functions in the "LIBC_NAMESPACE" namespace. This allows us to test the function in the

[nickdesaulniers]

FWIW, here's some measurements from bloaty: https://gist.github.com/nickdesaulniers/1092b3748b6810ae97053973c40b19a2.

The two cases of relatively large increases in code size:

1. __llvm_libc_18_0_0_git::StrToNumResult<__llvm_libc_18_0_0_git::internal::ExpandedFloat<long double> > __llvm_libc_18_0_0_git::internal::hexadecimal_string_to_float<long double>(char const*, char, __llvm_libc_18_0_0_git::internal::RoundDirection)
2. __llvm_libc_18_0_0_git::internal::FloatConvertReturn<long double> __llvm_libc_18_0_0_git::internal::decimal_exp_to_float<long double>(__llvm_libc_18_0_0_git::internal::ExpandedFloat<long double>, char const*, bool, __llvm_libc_18_0_0_git::internal::RoundDirection)

These look like their no longer being inlined due to increases in code size, perhaps:

1. __llvm_libc_18_0_0_git::construct_thread_name_file_path(__llvm_libc_18_0_0_git::cpp::StringStream&, int)
2. __llvm_libc_18_0_0_git::printf_core::FloatWriter::write_middle_block(unsigned int)

[lntue]

Can you move this check outside of this function, as it is called quite a lot? Either to the top of the file, or to somewhere in CheckCompilerFeatures.cmake.

[nickdesaulniers]

done in 862dc3c

[nickdesaulniers]

diff --git a/libc/src/__support/str_to_float.h b/libc/src/__support/str_to_float.h
index 8aeb3d2cea03..e8f0cb613b07 100644
--- a/libc/src/__support/str_to_float.h
+++ b/libc/src/__support/str_to_float.h
@@ -30,8 +30,8 @@ namespace LIBC_NAMESPACE {
 namespace internal {
 
 template <class T> struct ExpandedFloat {
-  typename fputil::FPBits<T>::StorageType mantissa;
-  int32_t exponent;
+  typename fputil::FPBits<T>::StorageType mantissa = {};
+  int32_t exponent = 0;
 };
 
 template <class T> struct FloatConvertReturn {

knocks out the second difference.