maxjhandsome
/
llvm-project
forked from OSchip/llvm-project
1
0
Fork 0
Code Issues Pull Requests Packages Releases Wiki Activity
llvm-project/clang/test/CodeGenCXX/catch-undef-behavior.cpp

643 lines
22 KiB
C++
Raw Normal View History

Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// RUN: %clang_cc1 -std=c++11 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -fsanitize-recover=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -emit-llvm %s -o - -triple x86_64-linux-gnu | opt -instnamer -S | FileCheck %s
[ubsan] Have -fsanitize=vptr emit a null check if -fsanitize=null isn't available In r309007, I made -fsanitize=null a hard prerequisite for -fsanitize=vptr. I did not see the need for the two checks to have separate null checking logic for the same pointer. I expected the two checks to either always be enabled together, or to be mutually compatible. In the mailing list discussion re: r309007 it became clear that that isn't the case. If a codebase is -fsanitize=vptr clean but not -fsanitize=null clean, it's useful to have -fsanitize=vptr emit its own null check. That's what this patch does: with it, -fsanitize=vptr can be used without -fsanitize=null. Differential Revision: https://reviews.llvm.org/D36112 llvm-svn: 309846
2017-08-03 02:10:31 +08:00
// RUN: %clang_cc1 -std=c++11 -fsanitize=vptr,address -fsanitize-recover=vptr,address -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=CHECK-ASAN
// RUN: %clang_cc1 -std=c++11 -fsanitize=vptr -fsanitize-recover=vptr -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=DOWNCAST-NULL
UBSan: Use the correct function prologue for x32. llvm-svn: 230571
2015-02-26 07:18:42 +08:00
// RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple x86_64-linux-gnux32 | FileCheck %s --check-prefix=CHECK-X32
// RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple i386-linux-gnu | FileCheck %s --check-prefix=CHECK-X86
New -fcatch-undefined-behavior features: * when checking that a pointer or reference refers to appropriate storage for a type, also check the alignment and perform a null check * check that references are bound to appropriate storage * check that 'this' has appropriate storage in member accesses and member function calls llvm-svn: 162523
2012-08-24 08:54:33 +08:00
Rein ubsan's vptr sanitizer back a bit. Per core issue 453, binding a reference to an object outside its lifetime does not have undefined behavior. llvm-svn: 170387
2012-12-18 08:22:45 +08:00
struct S {
double d;
int a, b;
virtual int f();
};
Make sure globals created by UBSan are not instrumented by ASan. Summary: This change adds description of globals created by UBSan instrumentation (UBSan handlers, type descriptors, filenames) to llvm.asan.globals metadata, effectively "blacklisting" them. This can dramatically decrease the data section in binaries built with UBSan+ASan, as UBSan tends to create a lot of handlers, and ASan instrumentation increases the global size to at least 64 bytes. Test Plan: clang regression test suite Reviewers: rsmith Reviewed By: rsmith Subscribers: cfe-commits, byoungyoung, kcc Differential Revision: http://reviews.llvm.org/D4575 llvm-svn: 213392
2014-07-19 01:50:06 +08:00
// Check that type descriptor global is not modified by ASan.
// CHECK-ASAN: [[TYPE_DESCR:@[0-9]+]] = private unnamed_addr constant { i16, i16, [4 x i8] } { i16 -1, i16 0, [4 x i8] c"'S'\00" }
// Check that type mismatch handler is not modified by ASan.
// CHECK-ASAN: private unnamed_addr global { { [{{.*}} x i8]*, i32, i32 }, { i16, i16, [4 x i8] }*, i8*, i8 } { {{.*}}, { i16, i16, [4 x i8] }* [[TYPE_DESCR]], {{.*}} }
[ubsan] Function Sanitizer: Don't require writable text segments This change will make it possible to use -fsanitize=function on Darwin and possibly on other platforms. It fixes an issue with the way RTTI is stored into function prologue data. On Darwin, addresses stored in prologue data can't require run-time fixups and must be PC-relative. Run-time fixups are undesirable because they necessitate writable text segments, which can lead to security issues. And absolute addresses are undesirable because they break PIE mode. The fix is to create a private global which points to the RTTI, and then to encode a PC-relative reference to the global into prologue data. Differential Revision: https://reviews.llvm.org/D37597 llvm-svn: 313096
2017-09-13 08:04:35 +08:00
// CHECK: [[IndirectRTTI_ZTIFvPFviEE:@.+]] = private constant i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*)
// CHECK-X86: [[IndirectRTTI_ZTIFvPFviEE:@.+]] = private constant i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*)
// CHECK-X32: [[IndirectRTTI_ZTIFvPFviEE:@.+]] = private constant i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*)
ubsan: Add checking for invalid downcasts. Per [expr.static.cast]p2 and p11, base-to-derived casts have undefined behavior if the object is not actually an instance of the derived type. llvm-svn: 175078
2013-02-14 05:18:23 +08:00
struct T : S {};
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z17reference_binding
Rein ubsan's vptr sanitizer back a bit. Per core issue 453, binding a reference to an object outside its lifetime does not have undefined behavior. llvm-svn: 170387
2012-12-18 08:22:45 +08:00
void reference_binding(int *p, S *q) {
New -fcatch-undefined-behavior features: * when checking that a pointer or reference refers to appropriate storage for a type, also check the alignment and perform a null check * check that references are bound to appropriate storage * check that 'this' has appropriate storage in member accesses and member function calls llvm-svn: 162523
2012-08-24 08:54:33 +08:00
// C++ core issue 453: If an lvalue to which a reference is directly bound
// designates neither an existing object or function of an appropriate type,
// nor a region of storage of suitable size and alignment to contain an object
// of the reference's type, the behavior is undefined.
// CHECK: icmp ne {{.*}}, null
// CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
// CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
// CHECK: %[[PTRINT:.*]] = ptrtoint
// CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
// CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
int &r = *p;
Rein ubsan's vptr sanitizer back a bit. Per core issue 453, binding a reference to an object outside its lifetime does not have undefined behavior. llvm-svn: 170387
2012-12-18 08:22:45 +08:00
// A reference is not required to refer to an object within its lifetime.
// CHECK-NOT: __ubsan_handle_dynamic_type_cache_miss
S &r2 = *q;
}
New -fcatch-undefined-behavior features: * when checking that a pointer or reference refers to appropriate storage for a type, also check the alignment and perform a null check * check that references are bound to appropriate storage * check that 'this' has appropriate storage in member accesses and member function calls llvm-svn: 162523
2012-08-24 08:54:33 +08:00
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z13member_access
Make sure globals created by UBSan are not instrumented by ASan. Summary: This change adds description of globals created by UBSan instrumentation (UBSan handlers, type descriptors, filenames) to llvm.asan.globals metadata, effectively "blacklisting" them. This can dramatically decrease the data section in binaries built with UBSan+ASan, as UBSan tends to create a lot of handlers, and ASan instrumentation increases the global size to at least 64 bytes. Test Plan: clang regression test suite Reviewers: rsmith Reviewed By: rsmith Subscribers: cfe-commits, byoungyoung, kcc Differential Revision: http://reviews.llvm.org/D4575 llvm-svn: 213392
2014-07-19 01:50:06 +08:00
// CHECK-ASAN-LABEL: @_Z13member_access
New -fcatch-undefined-behavior features: * when checking that a pointer or reference refers to appropriate storage for a type, also check the alignment and perform a null check * check that references are bound to appropriate storage * check that 'this' has appropriate storage in member accesses and member function calls llvm-svn: 162523
2012-08-24 08:54:33 +08:00
void member_access(S *p) {
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
// (1a) Check 'p' is appropriately sized and aligned for member access.
New -fcatch-undefined-behavior features: * when checking that a pointer or reference refers to appropriate storage for a type, also check the alignment and perform a null check * check that references are bound to appropriate storage * check that 'this' has appropriate storage in member accesses and member function calls llvm-svn: 162523
2012-08-24 08:54:33 +08:00
// CHECK: icmp ne {{.*}}, null
// CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
// CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
// CHECK: %[[PTRINT:.*]] = ptrtoint
// CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
// CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
// (1b) Check that 'p' actually points to an 'S'.
// CHECK: %[[VPTRADDR:.*]] = bitcast {{.*}} to i64*
Update Clang tests to handle explicitly typed load changes in LLVM. llvm-svn: 230795
2015-02-28 05:19:58 +08:00
// CHECK-NEXT: %[[VPTR:.*]] = load i64, i64* %[[VPTRADDR]]
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
//
// hash_16_bytes:
//
// If this number changes, it indicates that either the mangled name of ::S
// has changed, or that LLVM's hashing function has changed. The latter case
// is OK if the hashing function is still stable.
LLVM's hashing routines produce a size_t, and thus generate different values for 32- and 64-bit host compilers. This really needs to be fixed -- the IR generated should not depend on the host -- but this change will get the bots green again. Proper fix to follow. llvm-svn: 166731
2012-10-26 06:27:30 +08:00
//
// The two hash values are for 64- and 32-bit Clang binaries, respectively.
// FIXME: We should produce a 64-bit value either way.
//
Tests: fix tests encoding specific hash values for 32-bit systems. I changed the seed slightly, but forgot to run the tests on a 32-bit system, so tests which hard-code a specific hash value started breaking. llvm-svn: 341240
2018-09-01 03:24:37 +08:00
// CHECK-NEXT: xor i64 {{-4030275160588942838|1107558922}}, %[[VPTR]]
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
// CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
// CHECK-NEXT: lshr i64 {{.*}}, 47
// CHECK-NEXT: xor i64
// CHECK-NEXT: xor i64 %[[VPTR]]
// CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
// CHECK-NEXT: lshr i64 {{.*}}, 47
// CHECK-NEXT: xor i64
// CHECK-NEXT: %[[HASH:.*]] = mul i64 {{.*}}, -7070675565921424023
//
// Check the hash against the table:
//
// CHECK-NEXT: %[[IDX:.*]] = and i64 %{{.*}}, 127
Update Clang tests to handle explicitly typed gep changes in LLVM. llvm-svn: 230783
2015-02-28 03:18:17 +08:00
// CHECK-NEXT: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %[[IDX]]
Update Clang tests to handle explicitly typed load changes in LLVM. llvm-svn: 230795
2015-02-28 05:19:58 +08:00
// CHECK-NEXT: %[[CACHEVAL:.*]] = load i64, i64*
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
// CHECK-NEXT: icmp eq i64 %[[CACHEVAL]], %[[HASH]]
// CHECK-NEXT: br i1
[ubsan] Recover by default, use -fno-sanitize-recover to disable. llvm-svn: 171264
2012-12-31 04:53:28 +08:00
// CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %[[HASH]])
[ubsan] Add flag to enable recovery from checks when possible. llvm-svn: 169114
2012-12-03 03:50:33 +08:00
// CHECK-NOT: unreachable
// CHECK: {{.*}}:
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
New -fcatch-undefined-behavior features: * when checking that a pointer or reference refers to appropriate storage for a type, also check the alignment and perform a null check * check that references are bound to appropriate storage * check that 'this' has appropriate storage in member accesses and member function calls llvm-svn: 162523
2012-08-24 08:54:33 +08:00
// (2) Check 'p->b' is appropriately sized and aligned for a load.
// FIXME: Suppress this in the trivial case of a member access, because we
// know we've just checked the member access expression itself.
// CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
// CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
// CHECK: %[[PTRINT:.*]] = ptrtoint
// CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
// CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
int k = p->b;
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
// (3a) Check 'p' is appropriately sized and aligned for member function call.
New -fcatch-undefined-behavior features: * when checking that a pointer or reference refers to appropriate storage for a type, also check the alignment and perform a null check * check that references are bound to appropriate storage * check that 'this' has appropriate storage in member accesses and member function calls llvm-svn: 162523
2012-08-24 08:54:33 +08:00
// CHECK: icmp ne {{.*}}, null
// CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
// CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
// CHECK: %[[PTRINT:.*]] = ptrtoint
// CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
// CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
// (3b) Check that 'p' actually points to an 'S'
Update Clang tests to handle explicitly typed load changes in LLVM. llvm-svn: 230795
2015-02-28 05:19:58 +08:00
// CHECK: load i64, i64*
Tests: fix tests encoding specific hash values for 32-bit systems. I changed the seed slightly, but forgot to run the tests on a 32-bit system, so tests which hard-code a specific hash value started breaking. llvm-svn: 341240
2018-09-01 03:24:37 +08:00
// CHECK-NEXT: xor i64 {{-4030275160588942838|1107558922}},
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
// [...]
Update Clang tests to handle explicitly typed gep changes in LLVM. llvm-svn: 230783
2015-02-28 03:18:17 +08:00
// CHECK: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
// CHECK: br i1
[ubsan] Recover by default, use -fno-sanitize-recover to disable. llvm-svn: 171264
2012-12-31 04:53:28 +08:00
// CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %{{.*}})
[ubsan] Add flag to enable recovery from checks when possible. llvm-svn: 169114
2012-12-03 03:50:33 +08:00
// CHECK-NOT: unreachable
// CHECK: {{.*}}:
Add a more direct test for r166661. llvm-svn: 166727
2012-10-26 05:59:45 +08:00
New -fcatch-undefined-behavior features: * when checking that a pointer or reference refers to appropriate storage for a type, also check the alignment and perform a null check * check that references are bound to appropriate storage * check that 'this' has appropriate storage in member accesses and member function calls llvm-svn: 162523
2012-08-24 08:54:33 +08:00
k = p->f();
}
-fcatch-undefined-behavior: add the -ftrapv checks to the set of things caught by this mode, and also check for signed left shift overflow. The rules for the latter are a little subtle: * neither C89 nor C++98 specify the behavior of a signed left shift at all * in C99 and C11, shifting a 1 bit into the sign bit has undefined behavior * in C++11, with core issue 1457, shifting a 1 bit *out* of the sign bit has undefined behavior As of this change, we use the C99 rules for all C language variants, and the C++11 rules for all C++ language variants. Once we have individual -fcatch-undefined-behavior= flags, this should be revisited. llvm-svn: 162634
2012-08-25 08:32:28 +08:00
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z12lsh_overflow
-fcatch-undefined-behavior: add the -ftrapv checks to the set of things caught by this mode, and also check for signed left shift overflow. The rules for the latter are a little subtle: * neither C89 nor C++98 specify the behavior of a signed left shift at all * in C99 and C11, shifting a 1 bit into the sign bit has undefined behavior * in C++11, with core issue 1457, shifting a 1 bit *out* of the sign bit has undefined behavior As of this change, we use the C99 rules for all C language variants, and the C++11 rules for all C++ language variants. Once we have individual -fcatch-undefined-behavior= flags, this should be revisited. llvm-svn: 162634
2012-08-25 08:32:28 +08:00
int lsh_overflow(int a, int b) {
[UBSan] Split -fsanitize=shift into -fsanitize=shift-base and -fsanitize=shift-exponent. This is a recommit of r231150, reverted in r231409. Turns out that -fsanitize=shift-base check implementation only works if the shift exponent is valid, otherwise it contains undefined behavior itself. Make sure we check that exponent is valid before we proceed to check the base. Make sure that we actually report invalid values of base or exponent if -fsanitize=shift-base or -fsanitize=shift-exponent is specified, respectively. llvm-svn: 231711
2015-03-10 05:50:19 +08:00
// CHECK: %[[RHS_INBOUNDS:.*]] = icmp ule i32 %[[RHS:.*]], 31
// CHECK-NEXT: br i1 %[[RHS_INBOUNDS]], label %[[CHECK_BB:.*]], label %[[CONT_BB:.*]],
Revert "[UBSan] Split -fsanitize=shift into -fsanitize=shift-base and -fsanitize=shift-exponent." It's not that easy. If we're only checking -fsanitize=shift-base we still need to verify that exponent has sane value, otherwise UBSan-inserted checks for base will contain undefined behavior themselves. llvm-svn: 231409
2015-03-06 05:57:35 +08:00
[UBSan] Split -fsanitize=shift into -fsanitize=shift-base and -fsanitize=shift-exponent. This is a recommit of r231150, reverted in r231409. Turns out that -fsanitize=shift-base check implementation only works if the shift exponent is valid, otherwise it contains undefined behavior itself. Make sure we check that exponent is valid before we proceed to check the base. Make sure that we actually report invalid values of base or exponent if -fsanitize=shift-base or -fsanitize=shift-exponent is specified, respectively. llvm-svn: 231711
2015-03-10 05:50:19 +08:00
// CHECK: [[CHECK_BB]]:
// CHECK-NEXT: %[[SHIFTED_OUT_WIDTH:.*]] = sub nuw nsw i32 31, %[[RHS]]
-fcatch-undefined-behavior: add the -ftrapv checks to the set of things caught by this mode, and also check for signed left shift overflow. The rules for the latter are a little subtle: * neither C89 nor C++98 specify the behavior of a signed left shift at all * in C99 and C11, shifting a 1 bit into the sign bit has undefined behavior * in C++11, with core issue 1457, shifting a 1 bit *out* of the sign bit has undefined behavior As of this change, we use the C99 rules for all C language variants, and the C++11 rules for all C++ language variants. Once we have individual -fcatch-undefined-behavior= flags, this should be revisited. llvm-svn: 162634
2012-08-25 08:32:28 +08:00
// CHECK-NEXT: %[[SHIFTED_OUT:.*]] = lshr i32 %[[LHS:.*]], %[[SHIFTED_OUT_WIDTH]]
// This is present for C++11 but not for C: C++ core issue 1457 allows a '1'
// to be shifted into the sign bit, but not out of it.
// CHECK-NEXT: %[[SHIFTED_OUT_NOT_SIGN:.*]] = lshr i32 %[[SHIFTED_OUT]], 1
// CHECK-NEXT: %[[NO_OVERFLOW:.*]] = icmp eq i32 %[[SHIFTED_OUT_NOT_SIGN]], 0
[UBSan] Split -fsanitize=shift into -fsanitize=shift-base and -fsanitize=shift-exponent. This is a recommit of r231150, reverted in r231409. Turns out that -fsanitize=shift-base check implementation only works if the shift exponent is valid, otherwise it contains undefined behavior itself. Make sure we check that exponent is valid before we proceed to check the base. Make sure that we actually report invalid values of base or exponent if -fsanitize=shift-base or -fsanitize=shift-exponent is specified, respectively. llvm-svn: 231711
2015-03-10 05:50:19 +08:00
// CHECK-NEXT: br label %[[CONT_BB]]
[ubsan] Emit single check for left shift. Avoids warning twice on same shift. llvm-svn: 176056
2013-02-26 06:37:49 +08:00
[UBSan] Split -fsanitize=shift into -fsanitize=shift-base and -fsanitize=shift-exponent. This is a recommit of r231150, reverted in r231409. Turns out that -fsanitize=shift-base check implementation only works if the shift exponent is valid, otherwise it contains undefined behavior itself. Make sure we check that exponent is valid before we proceed to check the base. Make sure that we actually report invalid values of base or exponent if -fsanitize=shift-base or -fsanitize=shift-exponent is specified, respectively. llvm-svn: 231711
2015-03-10 05:50:19 +08:00
// CHECK: [[CONT_BB]]:
// CHECK-NEXT: %[[VALID_BASE:.*]] = phi i1 [ true, {{.*}} ], [ %[[NO_OVERFLOW]], %[[CHECK_BB]] ]
// CHECK-NEXT: %[[VALID:.*]] = and i1 %[[RHS_INBOUNDS]], %[[VALID_BASE]]
[ubsan] Emit single check for left shift. Avoids warning twice on same shift. llvm-svn: 176056
2013-02-26 06:37:49 +08:00
// CHECK-NEXT: br i1 %[[VALID]]
// CHECK: call void @__ubsan_handle_shift_out_of_bounds
// CHECK-NOT: call void @__ubsan_handle_shift_out_of_bounds
-fcatch-undefined-behavior: add the -ftrapv checks to the set of things caught by this mode, and also check for signed left shift overflow. The rules for the latter are a little subtle: * neither C89 nor C++98 specify the behavior of a signed left shift at all * in C99 and C11, shifting a 1 bit into the sign bit has undefined behavior * in C++11, with core issue 1457, shifting a 1 bit *out* of the sign bit has undefined behavior As of this change, we use the C99 rules for all C language variants, and the C++11 rules for all C++ language variants. Once we have individual -fcatch-undefined-behavior= flags, this should be revisited. llvm-svn: 162634
2012-08-25 08:32:28 +08:00
// CHECK: %[[RET:.*]] = shl i32 %[[LHS]], %[[RHS]]
// CHECK-NEXT: ret i32 %[[RET]]
return a << b;
}
If we flow off the end of a value-returning function: - outside C++, return undef (behavior is not undefined unless the value is used) - in C++, with -fcatch-undefined-behavior, perform an appropriate trap - in C++, produce an 'unreachable' (behavior is undefined immediately) llvm-svn: 165273
2012-10-05 07:52:29 +08:00
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z9no_return
If we flow off the end of a value-returning function: - outside C++, return undef (behavior is not undefined unless the value is used) - in C++, with -fcatch-undefined-behavior, perform an appropriate trap - in C++, produce an 'unreachable' (behavior is undefined immediately) llvm-svn: 165273
2012-10-05 07:52:29 +08:00
int no_return() {
Update to use references to attribute groups instead of listing the attributes on the call/invoke instructions. llvm-svn: 175878
2013-02-22 17:10:20 +08:00
// CHECK: call void @__ubsan_handle_missing_return(i8* bitcast ({{.*}}* @{{.*}} to i8*)) [[NR_NUW:#[0-9]+]]
-fcatch-undefined-behavior: emit calls to the runtime library whenever one of the checks fails. llvm-svn: 165536
2012-10-10 03:52:38 +08:00
// CHECK-NEXT: unreachable
If we flow off the end of a value-returning function: - outside C++, return undef (behavior is not undefined unless the value is used) - in C++, with -fcatch-undefined-behavior, perform an appropriate trap - in C++, produce an 'unreachable' (behavior is undefined immediately) llvm-svn: 165273
2012-10-05 07:52:29 +08:00
}
ubsan: Add -fsanitize=bool and -fsanitize=enum, which check for loads of bit-patterns which are not valid values for enumerated or boolean types. These checks are the ubsan analogue of !range metadata. llvm-svn: 170108
2012-12-13 15:11:50 +08:00
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z9sour_bool
ubsan: Add -fsanitize=bool and -fsanitize=enum, which check for loads of bit-patterns which are not valid values for enumerated or boolean types. These checks are the ubsan analogue of !range metadata. llvm-svn: 170108
2012-12-13 15:11:50 +08:00
bool sour_bool(bool *p) {
// CHECK: %[[OK:.*]] = icmp ule i8 {{.*}}, 1
// CHECK: br i1 %[[OK]]
[ubsan] Recover by default, use -fno-sanitize-recover to disable. llvm-svn: 171264
2012-12-31 04:53:28 +08:00
// CHECK: call void @__ubsan_handle_load_invalid_value(i8* bitcast ({{.*}}), i64 {{.*}})
ubsan: Add -fsanitize=bool and -fsanitize=enum, which check for loads of bit-patterns which are not valid values for enumerated or boolean types. These checks are the ubsan analogue of !range metadata. llvm-svn: 170108
2012-12-13 15:11:50 +08:00
return *p;
}
enum E1 { e1a = 0, e1b = 127 } e1;
enum E2 { e2a = -1, e2b = 64 } e2;
enum E3 { e3a = (1u << 31) - 1 } e3;
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z14bad_enum_value
ubsan: Add -fsanitize=bool and -fsanitize=enum, which check for loads of bit-patterns which are not valid values for enumerated or boolean types. These checks are the ubsan analogue of !range metadata. llvm-svn: 170108
2012-12-13 15:11:50 +08:00
int bad_enum_value() {
// CHECK: %[[E1:.*]] = icmp ule i32 {{.*}}, 127
// CHECK: br i1 %[[E1]]
[ubsan] Recover by default, use -fno-sanitize-recover to disable. llvm-svn: 171264
2012-12-31 04:53:28 +08:00
// CHECK: call void @__ubsan_handle_load_invalid_value(
ubsan: Add -fsanitize=bool and -fsanitize=enum, which check for loads of bit-patterns which are not valid values for enumerated or boolean types. These checks are the ubsan analogue of !range metadata. llvm-svn: 170108
2012-12-13 15:11:50 +08:00
int a = e1;
// CHECK: %[[E2HI:.*]] = icmp sle i32 {{.*}}, 127
// CHECK: %[[E2LO:.*]] = icmp sge i32 {{.*}}, -128
// CHECK: %[[E2:.*]] = and i1 %[[E2HI]], %[[E2LO]]
// CHECK: br i1 %[[E2]]
[ubsan] Recover by default, use -fno-sanitize-recover to disable. llvm-svn: 171264
2012-12-31 04:53:28 +08:00
// CHECK: call void @__ubsan_handle_load_invalid_value(
ubsan: Add -fsanitize=bool and -fsanitize=enum, which check for loads of bit-patterns which are not valid values for enumerated or boolean types. These checks are the ubsan analogue of !range metadata. llvm-svn: 170108
2012-12-13 15:11:50 +08:00
int b = e2;
// CHECK: %[[E3:.*]] = icmp ule i32 {{.*}}, 2147483647
// CHECK: br i1 %[[E3]]
[ubsan] Recover by default, use -fno-sanitize-recover to disable. llvm-svn: 171264
2012-12-31 04:53:28 +08:00
// CHECK: call void @__ubsan_handle_load_invalid_value(
ubsan: Add -fsanitize=bool and -fsanitize=enum, which check for loads of bit-patterns which are not valid values for enumerated or boolean types. These checks are the ubsan analogue of !range metadata. llvm-svn: 170108
2012-12-13 15:11:50 +08:00
int c = e3;
return a + b + c;
}
ubsan: Add checking for invalid downcasts. Per [expr.static.cast]p2 and p11, base-to-derived casts have undefined behavior if the object is not actually an instance of the derived type. llvm-svn: 175078
2013-02-14 05:18:23 +08:00
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z20bad_downcast_pointer
[UBsan] Skip -fsanitize=vptr instrumentations when the pointer value is null. Otherwise -fsanitize=vptr causes the program to crash when it downcasts a null pointer. Reviewed in http://reviews.llvm.org/D4412. Patch by Byoungyoung Lee! llvm-svn: 213393
2014-07-19 02:15:39 +08:00
// DOWNCAST-NULL-LABEL: @_Z20bad_downcast_pointer
ubsan: Add checking for invalid downcasts. Per [expr.static.cast]p2 and p11, base-to-derived casts have undefined behavior if the object is not actually an instance of the derived type. llvm-svn: 175078
2013-02-14 05:18:23 +08:00
void bad_downcast_pointer(S *p) {
// CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
// CHECK: br i1 %[[NONNULL]],
Fix typo llvm-svn: 328791
2018-03-29 22:31:59 +08:00
// A null pointer access is guarded without -fsanitize=null.
[UBsan] Skip -fsanitize=vptr instrumentations when the pointer value is null. Otherwise -fsanitize=vptr causes the program to crash when it downcasts a null pointer. Reviewed in http://reviews.llvm.org/D4412. Patch by Byoungyoung Lee! llvm-svn: 213393
2014-07-19 02:15:39 +08:00
// DOWNCAST-NULL: %[[NONNULL:.*]] = icmp ne {{.*}}, null
// DOWNCAST-NULL: br i1 %[[NONNULL]],
Fix objectsize tests after r192117 llvm-svn: 192120
2013-10-08 03:00:18 +08:00
// CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
ubsan: Add checking for invalid downcasts. Per [expr.static.cast]p2 and p11, base-to-derived casts have undefined behavior if the object is not actually an instance of the derived type. llvm-svn: 175078
2013-02-14 05:18:23 +08:00
// CHECK: %[[E1:.*]] = icmp uge i64 %[[SIZE]], 24
// CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
// CHECK: %[[E2:.*]] = icmp eq i64 %[[MISALIGN]], 0
// CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
// CHECK: br i1 %[[E12]],
// CHECK: call void @__ubsan_handle_type_mismatch
// CHECK: br label
// CHECK: br i1 %{{.*}},
// CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
// CHECK: br label
(void) static_cast<T*>(p);
}
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z22bad_downcast_reference
ubsan: Add checking for invalid downcasts. Per [expr.static.cast]p2 and p11, base-to-derived casts have undefined behavior if the object is not actually an instance of the derived type. llvm-svn: 175078
2013-02-14 05:18:23 +08:00
void bad_downcast_reference(S &p) {
// CHECK: %[[E1:.*]] = icmp ne {{.*}}, null
// CHECK-NOT: br i1
Bundle conditions checked by UBSan with sanitizer kinds they implement. Summary: This change makes CodeGenFunction::EmitCheck() take several conditions that needs to be checked (all of them need to be true), together with sanitizer kinds these checks are for. This would allow to split one call into UBSan runtime into several calls in case different sanitizer kinds would have different recoverability settings. Tests should be fixed accordingly, I'm working on it. Test Plan: regression test suite. Reviewers: rsmith Reviewed By: rsmith Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D6219 llvm-svn: 221716
2014-11-12 06:03:54 +08:00
Fix objectsize tests after r192117 llvm-svn: 192120
2013-10-08 03:00:18 +08:00
// CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
ubsan: Add checking for invalid downcasts. Per [expr.static.cast]p2 and p11, base-to-derived casts have undefined behavior if the object is not actually an instance of the derived type. llvm-svn: 175078
2013-02-14 05:18:23 +08:00
// CHECK: %[[E2:.*]] = icmp uge i64 %[[SIZE]], 24
Bundle conditions checked by UBSan with sanitizer kinds they implement. Summary: This change makes CodeGenFunction::EmitCheck() take several conditions that needs to be checked (all of them need to be true), together with sanitizer kinds these checks are for. This would allow to split one call into UBSan runtime into several calls in case different sanitizer kinds would have different recoverability settings. Tests should be fixed accordingly, I'm working on it. Test Plan: regression test suite. Reviewers: rsmith Reviewed By: rsmith Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D6219 llvm-svn: 221716
2014-11-12 06:03:54 +08:00
ubsan: Add checking for invalid downcasts. Per [expr.static.cast]p2 and p11, base-to-derived casts have undefined behavior if the object is not actually an instance of the derived type. llvm-svn: 175078
2013-02-14 05:18:23 +08:00
// CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
// CHECK: %[[E3:.*]] = icmp eq i64 %[[MISALIGN]], 0
Bundle conditions checked by UBSan with sanitizer kinds they implement. Summary: This change makes CodeGenFunction::EmitCheck() take several conditions that needs to be checked (all of them need to be true), together with sanitizer kinds these checks are for. This would allow to split one call into UBSan runtime into several calls in case different sanitizer kinds would have different recoverability settings. Tests should be fixed accordingly, I'm working on it. Test Plan: regression test suite. Reviewers: rsmith Reviewed By: rsmith Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D6219 llvm-svn: 221716
2014-11-12 06:03:54 +08:00
// CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
ubsan: Add checking for invalid downcasts. Per [expr.static.cast]p2 and p11, base-to-derived casts have undefined behavior if the object is not actually an instance of the derived type. llvm-svn: 175078
2013-02-14 05:18:23 +08:00
// CHECK: %[[E123:.*]] = and i1 %[[E12]], %[[E3]]
// CHECK: br i1 %[[E123]],
// CHECK: call void @__ubsan_handle_type_mismatch
// CHECK: br label
// CHECK: br i1 %{{.*}},
// CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
// CHECK: br label
(void) static_cast<T&>(p);
}
Update to use references to attribute groups instead of listing the attributes on the call/invoke instructions. llvm-svn: 175878
2013-02-22 17:10:20 +08:00
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z11array_index
ubsan: Emit bounds checks for array indexing, vector indexing, and (in really simple cases) pointer arithmetic. This augments the existing bounds checking with language-level array bounds information. llvm-svn: 175949
2013-02-23 10:53:19 +08:00
int array_index(const int (&a)[4], int n) {
// CHECK: %[[K1_OK:.*]] = icmp ult i64 %{{.*}}, 4
// CHECK: br i1 %[[K1_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
int k1 = a[n];
// CHECK: %[[R1_OK:.*]] = icmp ule i64 %{{.*}}, 4
// CHECK: br i1 %[[R1_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
const int *r1 = &a[n];
// CHECK: %[[K2_OK:.*]] = icmp ult i64 %{{.*}}, 8
// CHECK: br i1 %[[K2_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
int k2 = ((const int(&)[8])a)[n];
// CHECK: %[[K3_OK:.*]] = icmp ult i64 %{{.*}}, 4
// CHECK: br i1 %[[K3_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
int k3 = n[a];
return k1 + *r1 + k2;
}
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z17multi_array_index
ubsan: Emit bounds checks for array indexing, vector indexing, and (in really simple cases) pointer arithmetic. This augments the existing bounds checking with language-level array bounds information. llvm-svn: 175949
2013-02-23 10:53:19 +08:00
int multi_array_index(int n, int m) {
int arr[4][6];
// CHECK: %[[IDX1_OK:.*]] = icmp ult i64 %{{.*}}, 4
// CHECK: br i1 %[[IDX1_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
P0145R3 (C++17 evaluation order tweaks): consistently emit the LHS of array subscripting before the RHS, regardless of which is the base and which is the index. llvm-svn: 282453
2016-09-27 07:49:47 +08:00
// CHECK: %[[IDX2_OK:.*]] = icmp ult i64 %{{.*}}, 6
// CHECK: br i1 %[[IDX2_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
ubsan: Emit bounds checks for array indexing, vector indexing, and (in really simple cases) pointer arithmetic. This augments the existing bounds checking with language-level array bounds information. llvm-svn: 175949
2013-02-23 10:53:19 +08:00
return arr[n][m];
}
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z11array_arith
ubsan: Emit bounds checks for array indexing, vector indexing, and (in really simple cases) pointer arithmetic. This augments the existing bounds checking with language-level array bounds information. llvm-svn: 175949
2013-02-23 10:53:19 +08:00
int array_arith(const int (&a)[4], int n) {
// CHECK: %[[K1_OK:.*]] = icmp ule i64 %{{.*}}, 4
// CHECK: br i1 %[[K1_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
const int *k1 = a + n;
// CHECK: %[[K2_OK:.*]] = icmp ule i64 %{{.*}}, 8
// CHECK: br i1 %[[K2_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
const int *k2 = (const int(&)[8])a + n;
return *k1 + *k2;
}
struct ArrayMembers {
int a1[5];
int a2[1];
};
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z18struct_array_index
ubsan: Emit bounds checks for array indexing, vector indexing, and (in really simple cases) pointer arithmetic. This augments the existing bounds checking with language-level array bounds information. llvm-svn: 175949
2013-02-23 10:53:19 +08:00
int struct_array_index(ArrayMembers *p, int n) {
// CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 5
// CHECK: br i1 %[[IDX_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
return p->a1[n];
}
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z16flex_array_index
ubsan: Emit bounds checks for array indexing, vector indexing, and (in really simple cases) pointer arithmetic. This augments the existing bounds checking with language-level array bounds information. llvm-svn: 175949
2013-02-23 10:53:19 +08:00
int flex_array_index(ArrayMembers *p, int n) {
// CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
return p->a2[n];
}
PR15338: Don't assert if -fsanitize=bounds sees array indexing on an incomplete array type. llvm-svn: 175982
2013-02-24 09:56:24 +08:00
extern int incomplete[];
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z22incomplete_array_index
PR15338: Don't assert if -fsanitize=bounds sees array indexing on an incomplete array type. llvm-svn: 175982
2013-02-24 09:56:24 +08:00
int incomplete_array_index(int n) {
// CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
return incomplete[n];
}
ubsan: Emit bounds checks for array indexing, vector indexing, and (in really simple cases) pointer arithmetic. This augments the existing bounds checking with language-level array bounds information. llvm-svn: 175949
2013-02-23 10:53:19 +08:00
typedef __attribute__((ext_vector_type(4))) int V4I;
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z12vector_index
ubsan: Emit bounds checks for array indexing, vector indexing, and (in really simple cases) pointer arithmetic. This augments the existing bounds checking with language-level array bounds information. llvm-svn: 175949
2013-02-23 10:53:19 +08:00
int vector_index(V4I v, int n) {
// CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 4
// CHECK: br i1 %[[IDX_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
return v[n];
}
Check-labelize ubsan tests llvm-svn: 213334
2014-07-18 07:53:44 +08:00
// CHECK-LABEL: @_Z12string_index
ubsan: Emit bounds checks for array indexing, vector indexing, and (in really simple cases) pointer arithmetic. This augments the existing bounds checking with language-level array bounds information. llvm-svn: 175949
2013-02-23 10:53:19 +08:00
char string_index(int n) {
// CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 6
// CHECK: br i1 %[[IDX_OK]]
// CHECK: call void @__ubsan_handle_out_of_bounds(
return "Hello"[n];
}
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
class A // align=4
{
int a1, a2, a3;
};
class B // align=8
{
long b1, b2;
};
class C : public A, public B // align=16
{
alignas(16) int c1;
};
// Make sure we check the alignment of the pointer after subtracting any
// offset. The pointer before subtraction doesn't need to be aligned for
// the destination type.
Disable the bool and enum sanitizers when emitting the implicitly-defined copy constructor, copy assignment operator and move assignment operator. llvm-svn: 190481
2013-09-11 10:03:20 +08:00
// CHECK-LABEL: define void @_Z16downcast_pointerP1B(%class.B* %b)
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
void downcast_pointer(B *b) {
(void) static_cast<C*>(b);
// Alignment check from EmitTypeCheck(TCK_DowncastPointer, ...)
[CodeGenCXX] annotate a GEP to a derived class with 'inbounds' (PR35909) The standard says: [expr.static.cast] p11: "If the prvalue of type “pointer to cv1 B” points to a B that is actually a subobject of an object of type D, the resulting pointer points to the enclosing object of type D. Otherwise, the behavior is undefined." Therefore, the GEP must be inbounds. This should solve the failure to optimize away a null check shown in PR35909: https://bugs.llvm.org/show_bug.cgi?id=35909 Differential Revision: https://reviews.llvm.org/D42249 llvm-svn: 322950
2018-01-19 23:14:51 +08:00
// CHECK: [[SUB:%[.a-z0-9]*]] = getelementptr inbounds i8, i8* {{.*}}, i64 -16
Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// CHECK-NEXT: [[C:%.+]] = bitcast i8* [[SUB]] to %class.C*
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
// null check goes here
Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// CHECK: [[FROM_PHI:%.+]] = phi %class.C* [ [[C]], {{.*}} ], {{.*}}
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
// Objectsize check goes here
Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// CHECK: [[C_INT:%.+]] = ptrtoint %class.C* [[FROM_PHI]] to i64
// CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
// CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
// AND the alignment test with the objectsize test.
Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// CHECK-NEXT: [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
catch-undefined-behavior.cpp: Remove names that don't appear in every build. llvm-svn: 187952
2013-08-08 09:24:29 +08:00
// CHECK-NEXT: br i1 [[AND]]
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
}
Mark C++ reference parameters as dereferenceable Because references must be initialized using some evaluated expression, they must point to something, and a callee can assume the reference parameter is dereferenceable. Taking advantage of a new attribute just added to LLVM, mark them as such. Because dereferenceability in addrspace(0) implies nonnull in the backend, we don't need both attributes. However, we need to know the size of the object to use the dereferenceable attribute, so for incomplete types we still emit only nonnull. llvm-svn: 213386
2014-07-18 23:52:10 +08:00
// CHECK-LABEL: define void @_Z18downcast_referenceR1B(%class.B* dereferenceable({{[0-9]+}}) %b)
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
void downcast_reference(B &b) {
(void) static_cast<C&>(b);
// Alignment check from EmitTypeCheck(TCK_DowncastReference, ...)
[CodeGenCXX] annotate a GEP to a derived class with 'inbounds' (PR35909) The standard says: [expr.static.cast] p11: "If the prvalue of type “pointer to cv1 B” points to a B that is actually a subobject of an object of type D, the resulting pointer points to the enclosing object of type D. Otherwise, the behavior is undefined." Therefore, the GEP must be inbounds. This should solve the failure to optimize away a null check shown in PR35909: https://bugs.llvm.org/show_bug.cgi?id=35909 Differential Revision: https://reviews.llvm.org/D42249 llvm-svn: 322950
2018-01-19 23:14:51 +08:00
// CHECK: [[SUB:%[.a-z0-9]*]] = getelementptr inbounds i8, i8* {{.*}}, i64 -16
Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// CHECK-NEXT: [[C:%.+]] = bitcast i8* [[SUB]] to %class.C*
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
// Objectsize check goes here
Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// CHECK: [[C_INT:%.+]] = ptrtoint %class.C* [[C]] to i64
// CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
// CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
// AND the alignment test with the objectsize test.
Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// CHECK: [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
catch-undefined-behavior.cpp: Remove names that don't appear in every build. llvm-svn: 187952
2013-08-08 09:24:29 +08:00
// CHECK-NEXT: br i1 [[AND]]
UBSan: Fix alignment checks emitted in downcasts. Summary: UBSan was checking for alignment of the derived class on the pointer to the base class, before converting. With some class hierarchies, this could generate false positives. Added test-case. llvm-svn: 187948
2013-08-08 09:08:17 +08:00
}
[ubsan] Function Sanitizer: Don't require writable text segments This change will make it possible to use -fsanitize=function on Darwin and possibly on other platforms. It fixes an issue with the way RTTI is stored into function prologue data. On Darwin, addresses stored in prologue data can't require run-time fixups and must be PC-relative. Run-time fixups are undesirable because they necessitate writable text segments, which can lead to security issues. And absolute addresses are undesirable because they break PIE mode. The fix is to create a private global which points to the RTTI, and then to encode a PC-relative reference to the global into prologue data. Differential Revision: https://reviews.llvm.org/D37597 llvm-svn: 313096
2017-09-13 08:04:35 +08:00
//
// CHECK-LABEL: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i32 }> <{ i32 846595819, i32 trunc (i64 sub (i64 ptrtoint (i8** {{.*}} to i64), i64 ptrtoint (void (void (i32)*)* @_Z22indirect_function_callPFviE to i64)) to i32) }>
// CHECK-X32: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i32 }> <{ i32 846595819, i32 sub (i32 ptrtoint (i8** [[IndirectRTTI_ZTIFvPFviEE]] to i32), i32 ptrtoint (void (void (i32)*)* @_Z22indirect_function_callPFviE to i32)) }>
// CHECK-X86: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i32 }> <{ i32 846595819, i32 sub (i32 ptrtoint (i8** [[IndirectRTTI_ZTIFvPFviEE]] to i32), i32 ptrtoint (void (void (i32)*)* @_Z22indirect_function_callPFviE to i32)) }>
Implement function type checker for the undefined behavior sanitizer. This uses function prefix data to store function type information at the function pointer. Differential Revision: http://llvm-reviews.chandlerc.com/D1338 llvm-svn: 193058
2013-10-21 05:29:19 +08:00
void indirect_function_call(void (*p)(int)) {
[ubsan] Function Sanitizer: Don't require writable text segments This change will make it possible to use -fsanitize=function on Darwin and possibly on other platforms. It fixes an issue with the way RTTI is stored into function prologue data. On Darwin, addresses stored in prologue data can't require run-time fixups and must be PC-relative. Run-time fixups are undesirable because they necessitate writable text segments, which can lead to security issues. And absolute addresses are undesirable because they break PIE mode. The fix is to create a private global which points to the RTTI, and then to encode a PC-relative reference to the global into prologue data. Differential Revision: https://reviews.llvm.org/D37597 llvm-svn: 313096
2017-09-13 08:04:35 +08:00
// CHECK: [[PTR:%.+]] = bitcast void (i32)* {{.*}} to <{ i32, i32 }>*
Implement function type checker for the undefined behavior sanitizer. This uses function prefix data to store function type information at the function pointer. Differential Revision: http://llvm-reviews.chandlerc.com/D1338 llvm-svn: 193058
2013-10-21 05:29:19 +08:00
// Signature check
[ubsan] Function Sanitizer: Don't require writable text segments This change will make it possible to use -fsanitize=function on Darwin and possibly on other platforms. It fixes an issue with the way RTTI is stored into function prologue data. On Darwin, addresses stored in prologue data can't require run-time fixups and must be PC-relative. Run-time fixups are undesirable because they necessitate writable text segments, which can lead to security issues. And absolute addresses are undesirable because they break PIE mode. The fix is to create a private global which points to the RTTI, and then to encode a PC-relative reference to the global into prologue data. Differential Revision: https://reviews.llvm.org/D37597 llvm-svn: 313096
2017-09-13 08:04:35 +08:00
// CHECK-NEXT: [[SIGPTR:%.+]] = getelementptr <{ i32, i32 }>, <{ i32, i32 }>* [[PTR]], i32 0, i32 0
Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// CHECK-NEXT: [[SIG:%.+]] = load i32, i32* [[SIGPTR]]
[ubsan] Function Sanitizer: Don't require writable text segments This change will make it possible to use -fsanitize=function on Darwin and possibly on other platforms. It fixes an issue with the way RTTI is stored into function prologue data. On Darwin, addresses stored in prologue data can't require run-time fixups and must be PC-relative. Run-time fixups are undesirable because they necessitate writable text segments, which can lead to security issues. And absolute addresses are undesirable because they break PIE mode. The fix is to create a private global which points to the RTTI, and then to encode a PC-relative reference to the global into prologue data. Differential Revision: https://reviews.llvm.org/D37597 llvm-svn: 313096
2017-09-13 08:04:35 +08:00
// CHECK-NEXT: [[SIGCMP:%.+]] = icmp eq i32 [[SIG]], 846595819
Implement function type checker for the undefined behavior sanitizer. This uses function prefix data to store function type information at the function pointer. Differential Revision: http://llvm-reviews.chandlerc.com/D1338 llvm-svn: 193058
2013-10-21 05:29:19 +08:00
// CHECK-NEXT: br i1 [[SIGCMP]]
// RTTI pointer check
[ubsan] Function Sanitizer: Don't require writable text segments This change will make it possible to use -fsanitize=function on Darwin and possibly on other platforms. It fixes an issue with the way RTTI is stored into function prologue data. On Darwin, addresses stored in prologue data can't require run-time fixups and must be PC-relative. Run-time fixups are undesirable because they necessitate writable text segments, which can lead to security issues. And absolute addresses are undesirable because they break PIE mode. The fix is to create a private global which points to the RTTI, and then to encode a PC-relative reference to the global into prologue data. Differential Revision: https://reviews.llvm.org/D37597 llvm-svn: 313096
2017-09-13 08:04:35 +08:00
// CHECK: [[RTTIPTR:%.+]] = getelementptr <{ i32, i32 }>, <{ i32, i32 }>* [[PTR]], i32 0, i32 1
// CHECK-NEXT: [[RTTIEncIntTrunc:%.+]] = load i32, i32* [[RTTIPTR]]
// CHECK-NEXT: [[RTTIEncInt:%.+]] = sext i32 [[RTTIEncIntTrunc]] to i64
// CHECK-NEXT: [[FuncAddrInt:%.+]] = ptrtoint void (i32)* {{.*}} to i64
// CHECK-NEXT: [[IndirectGVInt:%.+]] = add i64 [[RTTIEncInt]], [[FuncAddrInt]]
// CHECK-NEXT: [[IndirectGV:%.+]] = inttoptr i64 [[IndirectGVInt]] to i8**
// CHECK-NEXT: [[RTTI:%.+]] = load i8*, i8** [[IndirectGV]], align 8
Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with "opt -instnamer". It reverts r231717. llvm-svn: 247667
2015-09-15 17:50:24 +08:00
// CHECK-NEXT: [[RTTICMP:%.+]] = icmp eq i8* [[RTTI]], bitcast ({ i8*, i8* }* @_ZTIFviE to i8*)
Implement function type checker for the undefined behavior sanitizer. This uses function prefix data to store function type information at the function pointer. Differential Revision: http://llvm-reviews.chandlerc.com/D1338 llvm-svn: 193058
2013-10-21 05:29:19 +08:00
// CHECK-NEXT: br i1 [[RTTICMP]]
[ubsan] Function Sanitizer: Don't require writable text segments This change will make it possible to use -fsanitize=function on Darwin and possibly on other platforms. It fixes an issue with the way RTTI is stored into function prologue data. On Darwin, addresses stored in prologue data can't require run-time fixups and must be PC-relative. Run-time fixups are undesirable because they necessitate writable text segments, which can lead to security issues. And absolute addresses are undesirable because they break PIE mode. The fix is to create a private global which points to the RTTI, and then to encode a PC-relative reference to the global into prologue data. Differential Revision: https://reviews.llvm.org/D37597 llvm-svn: 313096
2017-09-13 08:04:35 +08:00
Implement function type checker for the undefined behavior sanitizer. This uses function prefix data to store function type information at the function pointer. Differential Revision: http://llvm-reviews.chandlerc.com/D1338 llvm-svn: 193058
2013-10-21 05:29:19 +08:00
p(42);
}
[ubsan] Don't emit function signatures for non-static member functions The function sanitizer only checks indirect calls through function pointers. This excludes all non-static member functions (constructor calls, calls through thunks, etc. all use a separate code path). Don't emit function signatures for functions that won't be checked. Apart from cutting down on code size, this should fix a regression on Linux caused by r313096. For context, see the mailing list discussion: r313096 - [ubsan] Function Sanitizer: Don't require writable text segments Testing: check-clang, check-ubsan Differential Revision: https://reviews.llvm.org/D38913 llvm-svn: 315786
2017-10-14 09:23:30 +08:00
namespace FunctionSanitizerVirtualCalls {
struct A {
virtual void f() {}
virtual void g() {}
void h() {}
};
struct B : virtual A {
virtual void b() {}
virtual void f();
void g() final {}
static void q() {}
};
void B::f() {}
void force_irgen() {
A a;
a.g();
a.h();
B b;
b.f();
b.b();
b.g();
B::q();
}
// CHECK-LABEL: define void @_ZN29FunctionSanitizerVirtualCalls1B1fEv
// CHECK-NOT: prologue
//
// CHECK-LABEL: define void @_ZTv0_n24_N29FunctionSanitizerVirtualCalls1B1fEv
// CHECK-NOT: prologue
//
// CHECK-LABEL: define void @_ZN29FunctionSanitizerVirtualCalls11force_irgenEv()
// CHECK: prologue
//
// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1AC1Ev
// CHECK-NOT: prologue
//
// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1A1gEv
// CHECK-NOT: prologue
//
// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1A1hEv
// CHECK-NOT: prologue
//
// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1BC1Ev
// CHECK-NOT: prologue
//
// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1B1bEv
// CHECK-NOT: prologue
//
// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1B1gEv
// CHECK-NOT: prologue
//
// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1B1qEv
// CHECK: prologue
}
Sanitize upcasts and conversion to virtual base. This change adds UBSan check to upcasts. Namely, when we perform derived-to-base conversion, we: 1) check that the pointer-to-derived has suitable alignment and underlying storage, if this pointer is non-null. 2) if vptr-sanitizer is enabled, and we perform conversion to virtual base, we check that pointer-to-derived has a matching vptr. llvm-svn: 219642
2014-10-14 07:59:00 +08:00
namespace UpcastPointerTest {
struct S {};
struct T : S { double d; };
struct V : virtual S {};
// CHECK-LABEL: upcast_pointer
S* upcast_pointer(T* t) {
// Check for null pointer
// CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
// CHECK: br i1 %[[NONNULL]]
// Check alignment
// CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
// CHECK: icmp eq i64 %[[MISALIGN]], 0
// CHECK: call void @__ubsan_handle_type_mismatch
return t;
}
V getV();
// CHECK-LABEL: upcast_to_vbase
void upcast_to_vbase() {
// No need to check for null here, as we have a temporary here.
// CHECK-NOT: br i1
// CHECK: call i64 @llvm.objectsize
// CHECK: call void @__ubsan_handle_type_mismatch
// CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
const S& s = getV();
}
}
[ubsan] PR34266: When sanitizing the 'this' value for a member function that happens to be a lambda call operator, use the lambda's 'this' pointer, not the captured enclosing 'this' pointer (if any). Do not sanitize the 'this' pointer of a member call operator for a lambda with no capture-default, since that call operator can legitimately be called with a null this pointer from the static invoker function. Any actual call with a null this pointer should still be caught in the caller (if it is being sanitized). This reinstates r311589 (reverted in r311680) with the above fix. llvm-svn: 311695
2017-08-25 04:10:33 +08:00
struct ThisAlign {
void this_align_lambda();
void this_align_lambda_2();
};
void ThisAlign::this_align_lambda() {
Tighten up a test case. NFC. llvm-svn: 313098
2017-09-13 08:04:36 +08:00
// CHECK-LABEL: define internal %struct.ThisAlign* @"_ZZN9ThisAlign17this_align_lambdaEvENK3$_0clEv"
[ubsan] PR34266: When sanitizing the 'this' value for a member function that happens to be a lambda call operator, use the lambda's 'this' pointer, not the captured enclosing 'this' pointer (if any). Do not sanitize the 'this' pointer of a member call operator for a lambda with no capture-default, since that call operator can legitimately be called with a null this pointer from the static invoker function. Any actual call with a null this pointer should still be caught in the caller (if it is being sanitized). This reinstates r311589 (reverted in r311680) with the above fix. llvm-svn: 311695
2017-08-25 04:10:33 +08:00
// CHECK-SAME: (%{{.*}}* %[[this:[^)]*]])
// CHECK: %[[this_addr:.*]] = alloca
// CHECK: store %{{.*}}* %[[this]], %{{.*}}** %[[this_addr]],
// CHECK: %[[this_inner:.*]] = load %{{.*}}*, %{{.*}}** %[[this_addr]],
// CHECK: %[[this_outer_addr:.*]] = getelementptr inbounds %{{.*}}, %{{.*}}* %[[this_inner]], i32 0, i32 0
// CHECK: %[[this_outer:.*]] = load %{{.*}}*, %{{.*}}** %[[this_outer_addr]],
//
// CHECK: %[[this_inner_isnonnull:.*]] = icmp ne %{{.*}}* %[[this_inner]], null
// CHECK: %[[this_inner_asint:.*]] = ptrtoint %{{.*}}* %[[this_inner]] to i
// CHECK: %[[this_inner_misalignment:.*]] = and i{{32|64}} %[[this_inner_asint]], {{3|7}},
// CHECK: %[[this_inner_isaligned:.*]] = icmp eq i{{32|64}} %[[this_inner_misalignment]], 0
// CHECK: %[[this_inner_valid:.*]] = and i1 %[[this_inner_isnonnull]], %[[this_inner_isaligned]],
// CHECK: br i1 %[[this_inner_valid:.*]]
[&] { return this; } ();
}
Disable the bool and enum sanitizers when emitting the implicitly-defined copy constructor, copy assignment operator and move assignment operator. llvm-svn: 190481
2013-09-11 10:03:20 +08:00
namespace CopyValueRepresentation {
// CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S3aSERKS0_
// CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
// CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S4aSEOS0_
// CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
Emit DeferredDeclsToEmit in a DFS order. Currently we emit DeferredDeclsToEmit in reverse order. This patch changes that. The advantages of the change are that * The output order is a bit closer to the source order. The change to test/CodeGenCXX/pod-member-memcpys.cpp is a good example. * If we decide to deffer more, it will not cause as large changes in the estcases as it would without this patch. llvm-svn: 226751
2015-01-22 08:24:57 +08:00
// CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S1C2ERKS0_
Disable the bool and enum sanitizers when emitting the implicitly-defined copy constructor, copy assignment operator and move assignment operator. llvm-svn: 190481
2013-09-11 10:03:20 +08:00
// CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
// CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S2C2ERKS0_
// CHECK: __ubsan_handle_load_invalid_value
Emit DeferredDeclsToEmit in a DFS order. Currently we emit DeferredDeclsToEmit in reverse order. This patch changes that. The advantages of the change are that * The output order is a bit closer to the source order. The change to test/CodeGenCXX/pod-member-memcpys.cpp is a good example. * If we decide to deffer more, it will not cause as large changes in the estcases as it would without this patch. llvm-svn: 226751
2015-01-22 08:24:57 +08:00
// CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S5C2ERKS0_
Disable the bool and enum sanitizers when emitting the implicitly-defined copy constructor, copy assignment operator and move assignment operator. llvm-svn: 190481
2013-09-11 10:03:20 +08:00
// CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
struct CustomCopy { CustomCopy(); CustomCopy(const CustomCopy&); };
struct S1 {
CustomCopy CC;
bool b;
};
void callee1(S1);
void test1() {
S1 s11;
callee1(s11);
S1 s12;
s12 = s11;
}
static bool some_global_bool;
struct ExprCopy {
ExprCopy();
ExprCopy(const ExprCopy&, bool b = some_global_bool);
};
struct S2 {
ExprCopy EC;
bool b;
};
void callee2(S2);
void test2(void) {
S2 s21;
callee2(s21);
S2 s22;
s22 = s21;
}
struct CustomAssign { CustomAssign &operator=(const CustomAssign&); };
struct S3 {
CustomAssign CA;
bool b;
};
void test3() {
S3 x, y;
x = y;
}
struct CustomMove {
CustomMove();
CustomMove(const CustomMove&&);
CustomMove &operator=(const CustomMove&&);
};
struct S4 {
CustomMove CM;
bool b;
};
void test4() {
S4 x, y;
x = static_cast<S4&&>(y);
}
struct EnumCustomCopy {
EnumCustomCopy();
EnumCustomCopy(const EnumCustomCopy&);
};
struct S5 {
EnumCustomCopy ECC;
bool b;
};
void callee5(S5);
void test5() {
S5 s51;
callee5(s51);
S5 s52;
s52 = s51;
}
}
[ubsan] PR34266: When sanitizing the 'this' value for a member function that happens to be a lambda call operator, use the lambda's 'this' pointer, not the captured enclosing 'this' pointer (if any). Do not sanitize the 'this' pointer of a member call operator for a lambda with no capture-default, since that call operator can legitimately be called with a null this pointer from the static invoker function. Any actual call with a null this pointer should still be caught in the caller (if it is being sanitized). This reinstates r311589 (reverted in r311680) with the above fix. llvm-svn: 311695
2017-08-25 04:10:33 +08:00
void ThisAlign::this_align_lambda_2() {
Tighten up a test case. NFC. llvm-svn: 313098
2017-09-13 08:04:36 +08:00
// CHECK-LABEL: define internal void @"_ZZN9ThisAlign19this_align_lambda_2EvENK3$_1clEv"
[ubsan] PR34266: When sanitizing the 'this' value for a member function that happens to be a lambda call operator, use the lambda's 'this' pointer, not the captured enclosing 'this' pointer (if any). Do not sanitize the 'this' pointer of a member call operator for a lambda with no capture-default, since that call operator can legitimately be called with a null this pointer from the static invoker function. Any actual call with a null this pointer should still be caught in the caller (if it is being sanitized). This reinstates r311589 (reverted in r311680) with the above fix. llvm-svn: 311695
2017-08-25 04:10:33 +08:00
// CHECK-SAME: (%{{.*}}* %[[this:[^)]*]])
// CHECK: %[[this_addr:.*]] = alloca
// CHECK: store %{{.*}}* %[[this]], %{{.*}}** %[[this_addr]],
// CHECK: %[[this_inner:.*]] = load %{{.*}}*, %{{.*}}** %[[this_addr]],
//
// Do not perform a null check on the 'this' pointer if the function might be
// called from a static invoker.
// CHECK-NOT: icmp ne %{{.*}}* %[[this_inner]], null
auto *p = +[] {};
p();
}
Update to use references to attribute groups instead of listing the attributes on the call/invoke instructions. llvm-svn: 175878
2013-02-22 17:10:20 +08:00
// CHECK: attributes [[NR_NUW]] = { noreturn nounwind }