Richard Smith | a0a628f | 2013-02-23 02:53:19 +0000 | [diff] [blame] | 1 | // RUN: %clang_cc1 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,bounds -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s |
Richard Smith | 2c9f87c | 2012-08-24 00:54:33 +0000 | [diff] [blame] | 2 | |
Richard Smith | 073fec9 | 2012-12-18 00:22:45 +0000 | [diff] [blame] | 3 | struct S { |
| 4 | double d; |
| 5 | int a, b; |
| 6 | virtual int f(); |
| 7 | }; |
| 8 | |
Richard Smith | c764830 | 2013-02-13 21:18:23 +0000 | [diff] [blame] | 9 | struct T : S {}; |
| 10 | |
Richard Smith | 2c9f87c | 2012-08-24 00:54:33 +0000 | [diff] [blame] | 11 | // CHECK: @_Z17reference_binding |
Richard Smith | 073fec9 | 2012-12-18 00:22:45 +0000 | [diff] [blame] | 12 | void reference_binding(int *p, S *q) { |
Richard Smith | 2c9f87c | 2012-08-24 00:54:33 +0000 | [diff] [blame] | 13 | // C++ core issue 453: If an lvalue to which a reference is directly bound |
| 14 | // designates neither an existing object or function of an appropriate type, |
| 15 | // nor a region of storage of suitable size and alignment to contain an object |
| 16 | // of the reference's type, the behavior is undefined. |
| 17 | |
| 18 | // CHECK: icmp ne {{.*}}, null |
| 19 | |
| 20 | // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64 |
| 21 | // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4 |
| 22 | |
| 23 | // CHECK: %[[PTRINT:.*]] = ptrtoint |
| 24 | // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3 |
| 25 | // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0 |
| 26 | int &r = *p; |
Richard Smith | 2c9f87c | 2012-08-24 00:54:33 +0000 | [diff] [blame] | 27 | |
Richard Smith | 073fec9 | 2012-12-18 00:22:45 +0000 | [diff] [blame] | 28 | // A reference is not required to refer to an object within its lifetime. |
| 29 | // CHECK-NOT: __ubsan_handle_dynamic_type_cache_miss |
| 30 | S &r2 = *q; |
| 31 | } |
Richard Smith | 2c9f87c | 2012-08-24 00:54:33 +0000 | [diff] [blame] | 32 | |
| 33 | // CHECK: @_Z13member_access |
| 34 | void member_access(S *p) { |
Richard Smith | 0848333 | 2012-10-25 21:59:45 +0000 | [diff] [blame] | 35 | // (1a) Check 'p' is appropriately sized and aligned for member access. |
Richard Smith | 2c9f87c | 2012-08-24 00:54:33 +0000 | [diff] [blame] | 36 | |
| 37 | // CHECK: icmp ne {{.*}}, null |
| 38 | |
| 39 | // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64 |
| 40 | // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24 |
| 41 | |
| 42 | // CHECK: %[[PTRINT:.*]] = ptrtoint |
| 43 | // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7 |
| 44 | // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0 |
| 45 | |
Richard Smith | 0848333 | 2012-10-25 21:59:45 +0000 | [diff] [blame] | 46 | // (1b) Check that 'p' actually points to an 'S'. |
| 47 | |
| 48 | // CHECK: %[[VPTRADDR:.*]] = bitcast {{.*}} to i64* |
| 49 | // CHECK-NEXT: %[[VPTR:.*]] = load i64* %[[VPTRADDR]] |
| 50 | // |
| 51 | // hash_16_bytes: |
| 52 | // |
| 53 | // If this number changes, it indicates that either the mangled name of ::S |
| 54 | // has changed, or that LLVM's hashing function has changed. The latter case |
| 55 | // is OK if the hashing function is still stable. |
Richard Smith | ca53087 | 2012-10-25 22:27:30 +0000 | [diff] [blame] | 56 | // |
| 57 | // The two hash values are for 64- and 32-bit Clang binaries, respectively. |
| 58 | // FIXME: We should produce a 64-bit value either way. |
| 59 | // |
| 60 | // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}}, %[[VPTR]] |
Richard Smith | 0848333 | 2012-10-25 21:59:45 +0000 | [diff] [blame] | 61 | // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023 |
| 62 | // CHECK-NEXT: lshr i64 {{.*}}, 47 |
| 63 | // CHECK-NEXT: xor i64 |
| 64 | // CHECK-NEXT: xor i64 %[[VPTR]] |
| 65 | // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023 |
| 66 | // CHECK-NEXT: lshr i64 {{.*}}, 47 |
| 67 | // CHECK-NEXT: xor i64 |
| 68 | // CHECK-NEXT: %[[HASH:.*]] = mul i64 {{.*}}, -7070675565921424023 |
| 69 | // |
| 70 | // Check the hash against the table: |
| 71 | // |
| 72 | // CHECK-NEXT: %[[IDX:.*]] = and i64 %{{.*}}, 127 |
| 73 | // CHECK-NEXT: getelementptr inbounds [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %[[IDX]] |
| 74 | // CHECK-NEXT: %[[CACHEVAL:.*]] = load i64* |
| 75 | // CHECK-NEXT: icmp eq i64 %[[CACHEVAL]], %[[HASH]] |
| 76 | // CHECK-NEXT: br i1 |
| 77 | |
Will Dietz | 2d382d1 | 2012-12-30 20:53:28 +0000 | [diff] [blame] | 78 | // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %[[HASH]]) |
Will Dietz | ad95481 | 2012-12-02 19:50:33 +0000 | [diff] [blame] | 79 | // CHECK-NOT: unreachable |
| 80 | // CHECK: {{.*}}: |
Richard Smith | 0848333 | 2012-10-25 21:59:45 +0000 | [diff] [blame] | 81 | |
Richard Smith | 2c9f87c | 2012-08-24 00:54:33 +0000 | [diff] [blame] | 82 | // (2) Check 'p->b' is appropriately sized and aligned for a load. |
| 83 | |
| 84 | // FIXME: Suppress this in the trivial case of a member access, because we |
| 85 | // know we've just checked the member access expression itself. |
| 86 | |
| 87 | // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64 |
| 88 | // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4 |
| 89 | |
| 90 | // CHECK: %[[PTRINT:.*]] = ptrtoint |
| 91 | // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3 |
| 92 | // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0 |
| 93 | int k = p->b; |
| 94 | |
Richard Smith | 0848333 | 2012-10-25 21:59:45 +0000 | [diff] [blame] | 95 | // (3a) Check 'p' is appropriately sized and aligned for member function call. |
Richard Smith | 2c9f87c | 2012-08-24 00:54:33 +0000 | [diff] [blame] | 96 | |
| 97 | // CHECK: icmp ne {{.*}}, null |
| 98 | |
| 99 | // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64 |
| 100 | // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24 |
| 101 | |
| 102 | // CHECK: %[[PTRINT:.*]] = ptrtoint |
| 103 | // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7 |
| 104 | // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0 |
Richard Smith | 0848333 | 2012-10-25 21:59:45 +0000 | [diff] [blame] | 105 | |
| 106 | // (3b) Check that 'p' actually points to an 'S' |
| 107 | |
| 108 | // CHECK: load i64* |
Richard Smith | d6f8330 | 2012-10-25 23:05:00 +0000 | [diff] [blame] | 109 | // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}}, |
Richard Smith | 0848333 | 2012-10-25 21:59:45 +0000 | [diff] [blame] | 110 | // [...] |
| 111 | // CHECK: getelementptr inbounds [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 % |
| 112 | // CHECK: br i1 |
Will Dietz | 2d382d1 | 2012-12-30 20:53:28 +0000 | [diff] [blame] | 113 | // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %{{.*}}) |
Will Dietz | ad95481 | 2012-12-02 19:50:33 +0000 | [diff] [blame] | 114 | // CHECK-NOT: unreachable |
| 115 | // CHECK: {{.*}}: |
Richard Smith | 0848333 | 2012-10-25 21:59:45 +0000 | [diff] [blame] | 116 | |
Richard Smith | 2c9f87c | 2012-08-24 00:54:33 +0000 | [diff] [blame] | 117 | k = p->f(); |
| 118 | } |
Richard Smith | 9d3e226 | 2012-08-25 00:32:28 +0000 | [diff] [blame] | 119 | |
| 120 | // CHECK: @_Z12lsh_overflow |
| 121 | int lsh_overflow(int a, int b) { |
| 122 | // CHECK: %[[INBOUNDS:.*]] = icmp ule i32 %[[RHS:.*]], 31 |
| 123 | // CHECK-NEXT: br i1 %[[INBOUNDS]] |
| 124 | |
| 125 | // CHECK: %[[SHIFTED_OUT_WIDTH:.*]] = sub nuw nsw i32 31, %[[RHS]] |
| 126 | // CHECK-NEXT: %[[SHIFTED_OUT:.*]] = lshr i32 %[[LHS:.*]], %[[SHIFTED_OUT_WIDTH]] |
| 127 | |
| 128 | // This is present for C++11 but not for C: C++ core issue 1457 allows a '1' |
| 129 | // to be shifted into the sign bit, but not out of it. |
| 130 | // CHECK-NEXT: %[[SHIFTED_OUT_NOT_SIGN:.*]] = lshr i32 %[[SHIFTED_OUT]], 1 |
| 131 | |
| 132 | // CHECK-NEXT: %[[NO_OVERFLOW:.*]] = icmp eq i32 %[[SHIFTED_OUT_NOT_SIGN]], 0 |
Will Dietz | bb60fc6 | 2013-02-25 22:37:49 +0000 | [diff] [blame] | 133 | |
| 134 | // CHECK: %[[VALID:.*]] = phi i1 [ %[[INBOUNDS]], {{.*}} ], [ %[[NO_OVERFLOW]], {{.*}} ] |
| 135 | // CHECK-NEXT: br i1 %[[VALID]] |
| 136 | |
| 137 | // CHECK: call void @__ubsan_handle_shift_out_of_bounds |
| 138 | // CHECK-NOT: call void @__ubsan_handle_shift_out_of_bounds |
Richard Smith | 9d3e226 | 2012-08-25 00:32:28 +0000 | [diff] [blame] | 139 | |
| 140 | // CHECK: %[[RET:.*]] = shl i32 %[[LHS]], %[[RHS]] |
| 141 | // CHECK-NEXT: ret i32 %[[RET]] |
| 142 | return a << b; |
| 143 | } |
Richard Smith | 36ef0d5 | 2012-10-04 23:52:29 +0000 | [diff] [blame] | 144 | |
| 145 | // CHECK: @_Z9no_return |
| 146 | int no_return() { |
Bill Wendling | 4e1125f | 2013-02-22 09:10:20 +0000 | [diff] [blame] | 147 | // CHECK: call void @__ubsan_handle_missing_return(i8* bitcast ({{.*}}* @{{.*}} to i8*)) [[NR_NUW:#[0-9]+]] |
Richard Smith | 4def70d | 2012-10-09 19:52:38 +0000 | [diff] [blame] | 148 | // CHECK-NEXT: unreachable |
Richard Smith | 36ef0d5 | 2012-10-04 23:52:29 +0000 | [diff] [blame] | 149 | } |
Richard Smith | 463b48b | 2012-12-13 07:11:50 +0000 | [diff] [blame] | 150 | |
| 151 | // CHECK: @_Z9sour_bool |
| 152 | bool sour_bool(bool *p) { |
| 153 | // CHECK: %[[OK:.*]] = icmp ule i8 {{.*}}, 1 |
| 154 | // CHECK: br i1 %[[OK]] |
Will Dietz | 2d382d1 | 2012-12-30 20:53:28 +0000 | [diff] [blame] | 155 | // CHECK: call void @__ubsan_handle_load_invalid_value(i8* bitcast ({{.*}}), i64 {{.*}}) |
Richard Smith | 463b48b | 2012-12-13 07:11:50 +0000 | [diff] [blame] | 156 | return *p; |
| 157 | } |
| 158 | |
| 159 | enum E1 { e1a = 0, e1b = 127 } e1; |
| 160 | enum E2 { e2a = -1, e2b = 64 } e2; |
| 161 | enum E3 { e3a = (1u << 31) - 1 } e3; |
| 162 | |
| 163 | // CHECK: @_Z14bad_enum_value |
| 164 | int bad_enum_value() { |
| 165 | // CHECK: %[[E1:.*]] = icmp ule i32 {{.*}}, 127 |
| 166 | // CHECK: br i1 %[[E1]] |
Will Dietz | 2d382d1 | 2012-12-30 20:53:28 +0000 | [diff] [blame] | 167 | // CHECK: call void @__ubsan_handle_load_invalid_value( |
Richard Smith | 463b48b | 2012-12-13 07:11:50 +0000 | [diff] [blame] | 168 | int a = e1; |
| 169 | |
| 170 | // CHECK: %[[E2HI:.*]] = icmp sle i32 {{.*}}, 127 |
| 171 | // CHECK: %[[E2LO:.*]] = icmp sge i32 {{.*}}, -128 |
| 172 | // CHECK: %[[E2:.*]] = and i1 %[[E2HI]], %[[E2LO]] |
| 173 | // CHECK: br i1 %[[E2]] |
Will Dietz | 2d382d1 | 2012-12-30 20:53:28 +0000 | [diff] [blame] | 174 | // CHECK: call void @__ubsan_handle_load_invalid_value( |
Richard Smith | 463b48b | 2012-12-13 07:11:50 +0000 | [diff] [blame] | 175 | int b = e2; |
| 176 | |
| 177 | // CHECK: %[[E3:.*]] = icmp ule i32 {{.*}}, 2147483647 |
| 178 | // CHECK: br i1 %[[E3]] |
Will Dietz | 2d382d1 | 2012-12-30 20:53:28 +0000 | [diff] [blame] | 179 | // CHECK: call void @__ubsan_handle_load_invalid_value( |
Richard Smith | 463b48b | 2012-12-13 07:11:50 +0000 | [diff] [blame] | 180 | int c = e3; |
| 181 | return a + b + c; |
| 182 | } |
Richard Smith | c764830 | 2013-02-13 21:18:23 +0000 | [diff] [blame] | 183 | |
| 184 | // CHECK: @_Z20bad_downcast_pointer |
| 185 | void bad_downcast_pointer(S *p) { |
| 186 | // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null |
| 187 | // CHECK: br i1 %[[NONNULL]], |
| 188 | |
| 189 | // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64( |
| 190 | // CHECK: %[[E1:.*]] = icmp uge i64 %[[SIZE]], 24 |
| 191 | // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7 |
| 192 | // CHECK: %[[E2:.*]] = icmp eq i64 %[[MISALIGN]], 0 |
| 193 | // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]] |
| 194 | // CHECK: br i1 %[[E12]], |
| 195 | |
| 196 | // CHECK: call void @__ubsan_handle_type_mismatch |
| 197 | // CHECK: br label |
| 198 | |
| 199 | // CHECK: br i1 %{{.*}}, |
| 200 | |
| 201 | // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss |
| 202 | // CHECK: br label |
| 203 | (void) static_cast<T*>(p); |
| 204 | } |
| 205 | |
| 206 | // CHECK: @_Z22bad_downcast_reference |
| 207 | void bad_downcast_reference(S &p) { |
| 208 | // CHECK: %[[E1:.*]] = icmp ne {{.*}}, null |
| 209 | // CHECK-NOT: br i1 |
| 210 | // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64( |
| 211 | // CHECK: %[[E2:.*]] = icmp uge i64 %[[SIZE]], 24 |
| 212 | // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]] |
| 213 | // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7 |
| 214 | // CHECK: %[[E3:.*]] = icmp eq i64 %[[MISALIGN]], 0 |
| 215 | // CHECK: %[[E123:.*]] = and i1 %[[E12]], %[[E3]] |
| 216 | // CHECK: br i1 %[[E123]], |
| 217 | |
| 218 | // CHECK: call void @__ubsan_handle_type_mismatch |
| 219 | // CHECK: br label |
| 220 | |
| 221 | // CHECK: br i1 %{{.*}}, |
| 222 | |
| 223 | // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss |
| 224 | // CHECK: br label |
| 225 | (void) static_cast<T&>(p); |
| 226 | } |
Bill Wendling | 4e1125f | 2013-02-22 09:10:20 +0000 | [diff] [blame] | 227 | |
Richard Smith | a0a628f | 2013-02-23 02:53:19 +0000 | [diff] [blame] | 228 | // CHECK: @_Z11array_index |
| 229 | int array_index(const int (&a)[4], int n) { |
| 230 | // CHECK: %[[K1_OK:.*]] = icmp ult i64 %{{.*}}, 4 |
| 231 | // CHECK: br i1 %[[K1_OK]] |
| 232 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 233 | int k1 = a[n]; |
| 234 | |
| 235 | // CHECK: %[[R1_OK:.*]] = icmp ule i64 %{{.*}}, 4 |
| 236 | // CHECK: br i1 %[[R1_OK]] |
| 237 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 238 | const int *r1 = &a[n]; |
| 239 | |
| 240 | // CHECK: %[[K2_OK:.*]] = icmp ult i64 %{{.*}}, 8 |
| 241 | // CHECK: br i1 %[[K2_OK]] |
| 242 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 243 | int k2 = ((const int(&)[8])a)[n]; |
| 244 | |
| 245 | // CHECK: %[[K3_OK:.*]] = icmp ult i64 %{{.*}}, 4 |
| 246 | // CHECK: br i1 %[[K3_OK]] |
| 247 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 248 | int k3 = n[a]; |
| 249 | |
| 250 | return k1 + *r1 + k2; |
| 251 | } |
| 252 | |
| 253 | // CHECK: @_Z17multi_array_index |
| 254 | int multi_array_index(int n, int m) { |
| 255 | int arr[4][6]; |
| 256 | |
| 257 | // CHECK: %[[IDX2_OK:.*]] = icmp ult i64 %{{.*}}, 6 |
| 258 | // CHECK: br i1 %[[IDX2_OK]] |
| 259 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 260 | |
| 261 | // CHECK: %[[IDX1_OK:.*]] = icmp ult i64 %{{.*}}, 4 |
| 262 | // CHECK: br i1 %[[IDX1_OK]] |
| 263 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 264 | return arr[n][m]; |
| 265 | } |
| 266 | |
| 267 | // CHECK: @_Z11array_arith |
| 268 | int array_arith(const int (&a)[4], int n) { |
| 269 | // CHECK: %[[K1_OK:.*]] = icmp ule i64 %{{.*}}, 4 |
| 270 | // CHECK: br i1 %[[K1_OK]] |
| 271 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 272 | const int *k1 = a + n; |
| 273 | |
| 274 | // CHECK: %[[K2_OK:.*]] = icmp ule i64 %{{.*}}, 8 |
| 275 | // CHECK: br i1 %[[K2_OK]] |
| 276 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 277 | const int *k2 = (const int(&)[8])a + n; |
| 278 | |
| 279 | return *k1 + *k2; |
| 280 | } |
| 281 | |
| 282 | struct ArrayMembers { |
| 283 | int a1[5]; |
| 284 | int a2[1]; |
| 285 | }; |
| 286 | // CHECK: @_Z18struct_array_index |
| 287 | int struct_array_index(ArrayMembers *p, int n) { |
| 288 | // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 5 |
| 289 | // CHECK: br i1 %[[IDX_OK]] |
| 290 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 291 | return p->a1[n]; |
| 292 | } |
| 293 | |
| 294 | // CHECK: @_Z16flex_array_index |
| 295 | int flex_array_index(ArrayMembers *p, int n) { |
| 296 | // CHECK-NOT: call void @__ubsan_handle_out_of_bounds( |
| 297 | return p->a2[n]; |
| 298 | } |
| 299 | |
Richard Smith | 5956bcc | 2013-02-24 01:56:24 +0000 | [diff] [blame] | 300 | extern int incomplete[]; |
| 301 | // CHECK: @_Z22incomplete_array_index |
| 302 | int incomplete_array_index(int n) { |
| 303 | // CHECK-NOT: call void @__ubsan_handle_out_of_bounds( |
| 304 | return incomplete[n]; |
| 305 | } |
| 306 | |
Richard Smith | a0a628f | 2013-02-23 02:53:19 +0000 | [diff] [blame] | 307 | typedef __attribute__((ext_vector_type(4))) int V4I; |
| 308 | // CHECK: @_Z12vector_index |
| 309 | int vector_index(V4I v, int n) { |
| 310 | // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 4 |
| 311 | // CHECK: br i1 %[[IDX_OK]] |
| 312 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 313 | return v[n]; |
| 314 | } |
| 315 | |
| 316 | // CHECK: @_Z12string_index |
| 317 | char string_index(int n) { |
| 318 | // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 6 |
| 319 | // CHECK: br i1 %[[IDX_OK]] |
| 320 | // CHECK: call void @__ubsan_handle_out_of_bounds( |
| 321 | return "Hello"[n]; |
| 322 | } |
| 323 | |
Bill Wendling | 4e1125f | 2013-02-22 09:10:20 +0000 | [diff] [blame] | 324 | // CHECK: attributes [[NR_NUW]] = { noreturn nounwind } |