Commit Graph

49 Commits

Author SHA1 Message Date
Filipe Cabecinhas 6328f8e9e6 [BitCode] Make sure atomicrmw's argument is an actual PointerType
llvm-svn: 271851
2016-06-05 18:43:40 +00:00
Filipe Cabecinhas 036e73c8bf [BitCode] Make sure storeatomic's argument is an actual PointerType
llvm-svn: 271850
2016-06-05 18:43:33 +00:00
Filipe Cabecinhas fc2a3c98e9 [BitCode] Diagnose GEPs with no indices
llvm-svn: 271849
2016-06-05 18:43:26 +00:00
Filipe Cabecinhas 2849b48fea [BitCode] Don't allow constants of void type.
llvm-svn: 271848
2016-06-05 18:43:17 +00:00
Duncan P. N. Exon Smith 456c9968e5 Support: Implement StreamingMemoryObject::getPointer
The implementation is fairly obvious.  This is preparation for using
some blobs in bitcode.

For clarity (and perhaps future-proofing?), I moved the call to
JumpToBit in BitstreamCursor::readRecord ahead of calling
MemoryObject::getPointer, since JumpToBit can theoretically (a) read
bytes, which (b) invalidates the blob pointer.

This isn't strictly necessary the two memory objects we have:

  - The return of RawMemoryObject::getPointer is valid until the memory
    object is destroyed.

  - StreamingMemoryObject::getPointer is valid until the next chunk is
    read from the stream.  Since the JumpToBit call is only going ahead
    to a word boundary, we'll never load another chunk.

However, reordering makes it clear by inspection that the blob returned
by BitstreamCursor::readRecord will be valid.

I added some tests for StreamingMemoryObject::getPointer and
BitstreamCursor::readRecord.

llvm-svn: 264549
2016-03-27 23:00:59 +00:00
Duncan P. N. Exon Smith fc8110041f Revert "Bitcode: Collect all MDString records into a single blob"
This reverts commit r264409 since it failed to bootstrap:
http://lab.llvm.org:8080/green/job/clang-stage2-configure-Rlto_build/8302/

llvm-svn: 264410
2016-03-25 15:22:27 +00:00
Duncan P. N. Exon Smith fdbf0a5af8 Bitcode: Collect all MDString records into a single blob
Optimize output of MDStrings in bitcode.  This emits them in big blocks
(currently 1024) in a pair of records:
  - BULK_STRING_SIZES: the sizes of the strings in the block, and
  - BULK_STRING_DATA: a single blob, which is the concatenation of all
    the strings.

Inspired by Mehdi's similar patch, http://reviews.llvm.org/D18342, this
should (a) slightly reduce bitcode size, since there is less record
overhead, and (b) greatly improve reading speed, since blobs are super
cheap to deserialize.

I needed to add support for blobs to streaming input to get the test
suite passing.
  - StreamingMemoryObject::getPointer reads ahead and returns the
    address of the blob.
  - To avoid a possible reallocation of StreamingMemoryObject::Bytes,
    BitstreamCursor::readRecord needs to move the call to JumpToEnd
    forward so that getPointer is the last bitstream operation.

llvm-svn: 264409
2016-03-25 14:40:18 +00:00
Filipe Cabecinhas a2b0ac40cf Error out when faced with value names containing '\0'
Bug found with afl-fuzz.

llvm-svn: 252048
2015-11-04 14:53:36 +00:00
Filipe Cabecinhas 7aae2f23c8 Don't assert if materializing before seeing any function bodies
This assert was reachable from user input. A minimized test case (no
FUNCTION_BLOCK_ID record) is attached.

Bug found with afl-fuzz

llvm-svn: 251910
2015-11-03 13:48:26 +00:00
Filipe Cabecinhas 14323e02e6 Revert "Don't assert if materializing before seeing any function bodies"
This reverts r251667 since it broke the bots.

llvm-svn: 251671
2015-10-30 00:00:58 +00:00
Filipe Cabecinhas bcfd1f0c56 Don't assert if materializing before seeing any function bodies
This assert was reachable from user input. A minimized test case (no
FUNCTION_BLOCK_ID record) is attached.

Bug found with afl-fuzz

llvm-svn: 251667
2015-10-29 23:37:28 +00:00
Filipe Cabecinhas b70fd8719e Make sure the CastInst is valid before trying to create it
Bug found with afl-fuzz.

llvm-svn: 249396
2015-10-06 12:37:54 +00:00
Filipe Cabecinhas da86b6d409 [BitcodeReader] Diagnose type mismatches with aliases
Bug found with AFL fuzz.

llvm-svn: 238895
2015-06-03 01:30:13 +00:00
Filipe Cabecinhas 8e42190d20 [BitcodeReader] Check vector size before trying to create a VectorType
Bug found with AFL fuzz

llvm-svn: 238891
2015-06-03 00:05:30 +00:00
Filipe Cabecinhas 14e686774d [BitcodeReader] Change an assert to a call to a call to Error()
It's reachable from user input.

Bug found with AFL fuzz.

llvm-svn: 238633
2015-05-30 00:17:20 +00:00
Filipe Cabecinhas 6a92a3fe34 [BitcodeReader] Change assert to report_fatal_error
It can be triggered by user input.

Bug found with AFL fuzz.

llvm-svn: 238272
2015-05-27 01:05:40 +00:00
Filipe Cabecinhas 8cd99e9a5a [BitstreamReader] Make sure the Array operand type is an encoding
Bug found with AFL fuzz.

llvm-svn: 238269
2015-05-27 00:48:43 +00:00
Filipe Cabecinhas bc6a909384 [BitcodeReader] Make sure abbrev records have at least one operand (record code)
Bug found with AFL fuzz.

llvm-svn: 238265
2015-05-26 23:52:21 +00:00
Filipe Cabecinhas 0eb8a59a67 [BitcodeReader] Sanity check on Comdat ID
Shouldn't be an assert, since user input can trigger it.

Bug found with AFL fuzz.

llvm-svn: 238261
2015-05-26 23:00:56 +00:00
Filipe Cabecinhas fc93be21ea Change a reachable unreachable to a fatal error.
Summary:
Also tagged a FIXME comment, and added information about why it breaks.

Bug found using AFL fuzz.

Reviewers: rafael, craig.topper

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9729

llvm-svn: 237709
2015-05-19 18:18:10 +00:00
Filipe Cabecinhas 32af542194 [BitcodeReader] Error out if we read an invalid function argument type
Bug found with AFL fuzz.

llvm-svn: 237650
2015-05-19 01:21:06 +00:00
Filipe Cabecinhas f3fa99c48e [BitcodeReader] It's a malformed block if CodeLenWidth is too big
Bug found with AFL fuzz.

llvm-svn: 237646
2015-05-19 00:34:17 +00:00
Filipe Cabecinhas 4708a02a78 [BitcodeReader] Make sure the type of the inserted value matches the type of the aggregate at those indices
Bug found with AFL-fuzz.

llvm-svn: 237628
2015-05-18 22:27:11 +00:00
Filipe Cabecinhas 11bb8495f6 Extract the load/store type verification to a separate function.
Summary:
Added isLoadableOrStorableType to PointerType.

We were doing some checks in some places, occasionally assert()ing instead
of telling the caller. With this patch, I'm putting all type checking in
the same place for load/store type instructions, and verifying the same
thing every time.

I also added a check for load/store of a function type.

Applied extracted check to Load, Store, and Cmpxcg.

I don't have exhaustive tests for all of these, but all Error() calls in
TypeCheckLoadStoreInst are being tested (in invalid.test).

Reviewers: dblaikie, rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9785

llvm-svn: 237619
2015-05-18 21:48:55 +00:00
Filipe Cabecinhas 1c299d05e6 [BitcodeReader] Don't allow INSERTVAL/EXTRACTVAL with 0 indices
This would trigger an assertion later.

Bug found with AFL fuzz.

llvm-svn: 237494
2015-05-16 00:33:12 +00:00
Filipe Cabecinhas f8a16a952d Don't overflow GCTable
Summary: Bug found with AFL fuzz.

Reviewers: rafael, dexonsmith

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9361

llvm-svn: 236200
2015-04-30 04:09:41 +00:00
Filipe Cabecinhas 9a19e56306 Make sure Op->getType() is a PointerType before we cast<> it.
Bug found with AFL fuzz.

llvm-svn: 236193
2015-04-30 01:13:31 +00:00
Filipe Cabecinhas bad0779f63 Make sure we don't resize(0) when we get a fwdref with Idx == UINT_MAX
Make it an error instead.

Bug found with AFL fuzz.

llvm-svn: 236190
2015-04-30 00:52:42 +00:00
Filipe Cabecinhas d8a1bcd0ad Check that we have a valid PointerType element type before calling get()
Same as r236073 but for PointerType.

Bug found with AFL fuzz.

llvm-svn: 236079
2015-04-29 02:27:28 +00:00
Filipe Cabecinhas 1351cba720 Turn an assert into report_fatal_error since it's reachable based on user input
Bug found with AFL fuzz.

llvm-svn: 236076
2015-04-29 01:58:31 +00:00
Filipe Cabecinhas f15fb032ef Make sure that isValidElementType(Type) before calling {Array,Struct}Type::get(Type)
Bug found with AFL fuzz.

llvm-svn: 236073
2015-04-29 01:27:01 +00:00
Filipe Cabecinhas b435d0f439 Relax an assert when there's a type mismatch in forward references
Summary:
We don't seem to need to assert here, since this function's callers expect
to get a nullptr on error. This way we don't assert on user input.

Bug found with AFL fuzz.

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9308

llvm-svn: 236027
2015-04-28 20:18:47 +00:00
David Blaikie 5ea1f7b744 [opaque pointer type] bitcode: add explicit callee type to invoke instructions
llvm-svn: 235735
2015-04-24 18:06:06 +00:00
Filipe Cabecinhas ff1e234fb8 [BitcodeReader] Fix asserts when we read a non-vector type for insert/extract/shuffle
Added some additional checking for vector types + tests.

Bug found with AFL fuzz.

llvm-svn: 235710
2015-04-24 11:30:15 +00:00
Filipe Cabecinhas 6621cb7478 Be more strict about the operand for the array type in BitcodeReader
Summary: Bug found with AFL fuzz.

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9016

llvm-svn: 235596
2015-04-23 13:38:21 +00:00
Filipe Cabecinhas ee48feadfd Verify sizes when trying to read a BitcodeAbbrevOp
Summary:
Make sure the abbrev operands are valid and that we can read/skip them
afterwards.

Bug found with AFL fuzz.

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9030

llvm-svn: 235595
2015-04-23 13:25:35 +00:00
Filipe Cabecinhas ea79c5b4f7 Have more strict type checks when creating BinOp nodes in BitcodeReader
Summary: Bug found with AFL.

Reviewers: rafael, bkramer

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9015

llvm-svn: 235489
2015-04-22 09:06:21 +00:00
David Blaikie dbe6e0f171 [opaque pointer type] Explicit pointee type for call instruction
Use an extra bit in the CCInfo to flag the newer version of the
instructiont hat includes the type explicitly.

Tested the newer error cases I added, but didn't add tests for the finer
granularity improvements to existing error paths.

llvm-svn: 235160
2015-04-17 06:40:14 +00:00
Filipe Cabecinhas 2e206eb65f Revert "Verify sizes when trying to read a VBR"
This reverts r234984 since it seems to break some bots (most of them
seemed arm*-selfhost).

llvm-svn: 234998
2015-04-15 11:10:17 +00:00
Filipe Cabecinhas 7dc896fcce Verify sizes when trying to read a VBR
Also added an assert to ReadVBR64.

llvm-svn: 234984
2015-04-15 08:48:08 +00:00
Filipe Cabecinhas 225542713b Error out of ParseBitcodeInto(Module*) if we haven't read a Module
Summary:
Without this check the following case failed:

Skip a SubBlock which is not a MODULE_BLOCK_ID nor a BLOCKINFO_BLOCK_ID
Got to end of file

TheModule would still be == nullptr, and we would subsequentially fail
when materializing the Module (assert at the start of
BitcodeReader::MaterializeModule).

Bug found with AFL.

Reviewers: dexonsmith, rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D9014

llvm-svn: 234887
2015-04-14 14:07:15 +00:00
David Blaikie 12cf5d70e8 Add testing for mismatched explicit type on a gep operator when loading from bitcode
llvm-svn: 232427
2015-03-16 22:03:50 +00:00
David Blaikie c695cc7e58 Add testing for mismatched explicit type on a load instruction when loading from bitcode
llvm-svn: 232424
2015-03-16 21:48:46 +00:00
David Blaikie 675e8cb09e Test bitcode parsing error-handling for incorrect explicit type
(turns out I had regressed this when sinking handling of this type down
into GetElementPtrInst::Create - since that asserted before the error
handling was performed)

llvm-svn: 232420
2015-03-16 21:35:48 +00:00
JF Bastien 30bf96bfe7 Use common parse routine to read alignment values from bitcode
While fuzzing LLVM bitcode files, I discovered that (1) the bitcode reader doesn't check that alignments are no larger than 2**29; (2) downstream code doesn't check the range; and (3) for values out of range, corresponding large memory requests (based on alignment size) will fail. This code fixes the bitcode reader to check for valid alignments, fixing this problem.

This CL fixes alignment value on global variables, functions, and instructions: alloca, load, load atomic, store, store atomic.

Patch by Karl Schimpf (kschimpf@google.com).

llvm-svn: 230180
2015-02-22 19:32:03 +00:00
Filipe Cabecinhas ecf8f7f49b [Bitcode reader] Fix a few assertions when reading invalid files
Summary:
When creating {insert,extract}value instructions from a BitcodeReader, we
weren't verifying the fields were valid.

Bugs found with afl-fuzz

Reviewers: rafael

Subscribers: llvm-commits

Differential Revision: http://reviews.llvm.org/D7325

llvm-svn: 229345
2015-02-16 00:03:11 +00:00
Filipe Cabecinhas fcd044b692 Check bit widths before trying to get a type.
Added a test case for it.
Also added run lines for the test case in r227566.

Bugs found with afl-fuzz

llvm-svn: 227589
2015-01-30 18:13:50 +00:00
Filipe Cabecinhas de968ecb05 [Bitcode] Diagnose errors instead of asserting from bad input
Eventually we can make some of these pass the error along to the caller.

Reports a fatal error if:
We find an invalid abbrev record
We try to get an invalid abbrev number
We can't fill the current word due to an EOF

Fixed an invalid bitcode test to check for output with FileCheck

Bugs found with afl-fuzz

llvm-svn: 226986
2015-01-24 04:15:05 +00:00
Filipe Cabecinhas 3ca723c9e5 Use report_fatal_error instead of llvm_unreachable, so we don't crash on user input
llvm-svn: 226248
2015-01-16 04:54:12 +00:00