blob: 786c6da21a1852900a3cb1f99c23c0eb73989145 [file] [log] [blame]
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +00001// RUN: %clang_cc1 -std=c++11 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -fsanitize-recover=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -emit-llvm %s -o - -triple x86_64-linux-gnu | opt -instnamer -S | FileCheck %s
Vedant Kumara0c36712017-08-02 18:10:31 +00002// RUN: %clang_cc1 -std=c++11 -fsanitize=vptr,address -fsanitize-recover=vptr,address -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=CHECK-ASAN
3// RUN: %clang_cc1 -std=c++11 -fsanitize=vptr -fsanitize-recover=vptr -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=DOWNCAST-NULL
Peter Collingbourne69b004d2015-02-25 23:18:42 +00004// RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple x86_64-linux-gnux32 | FileCheck %s --check-prefix=CHECK-X32
5// RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple i386-linux-gnu | FileCheck %s --check-prefix=CHECK-X86
Richard Smith69d0d262012-08-24 00:54:33 +00006
Richard Smithbe024a82012-12-18 00:22:45 +00007struct S {
8 double d;
9 int a, b;
10 virtual int f();
11};
12
Alexey Samsonov6c124142014-07-18 17:50:06 +000013// Check that type descriptor global is not modified by ASan.
14// CHECK-ASAN: [[TYPE_DESCR:@[0-9]+]] = private unnamed_addr constant { i16, i16, [4 x i8] } { i16 -1, i16 0, [4 x i8] c"'S'\00" }
15
16// Check that type mismatch handler is not modified by ASan.
17// CHECK-ASAN: private unnamed_addr global { { [{{.*}} x i8]*, i32, i32 }, { i16, i16, [4 x i8] }*, i8*, i8 } { {{.*}}, { i16, i16, [4 x i8] }* [[TYPE_DESCR]], {{.*}} }
18
Vedant Kumarbb5d4852017-09-13 00:04:35 +000019// CHECK: [[IndirectRTTI_ZTIFvPFviEE:@.+]] = private constant i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*)
20// CHECK-X86: [[IndirectRTTI_ZTIFvPFviEE:@.+]] = private constant i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*)
21// CHECK-X32: [[IndirectRTTI_ZTIFvPFviEE:@.+]] = private constant i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*)
22
Richard Smith2c5868c2013-02-13 21:18:23 +000023struct T : S {};
24
Alexey Samsonovc9939332014-07-17 23:53:44 +000025// CHECK-LABEL: @_Z17reference_binding
Richard Smithbe024a82012-12-18 00:22:45 +000026void reference_binding(int *p, S *q) {
Richard Smith69d0d262012-08-24 00:54:33 +000027 // C++ core issue 453: If an lvalue to which a reference is directly bound
28 // designates neither an existing object or function of an appropriate type,
29 // nor a region of storage of suitable size and alignment to contain an object
30 // of the reference's type, the behavior is undefined.
31
32 // CHECK: icmp ne {{.*}}, null
33
34 // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
35 // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
36
37 // CHECK: %[[PTRINT:.*]] = ptrtoint
38 // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
39 // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
40 int &r = *p;
Richard Smith69d0d262012-08-24 00:54:33 +000041
Richard Smithbe024a82012-12-18 00:22:45 +000042 // A reference is not required to refer to an object within its lifetime.
43 // CHECK-NOT: __ubsan_handle_dynamic_type_cache_miss
44 S &r2 = *q;
45}
Richard Smith69d0d262012-08-24 00:54:33 +000046
Alexey Samsonovc9939332014-07-17 23:53:44 +000047// CHECK-LABEL: @_Z13member_access
Alexey Samsonov6c124142014-07-18 17:50:06 +000048// CHECK-ASAN-LABEL: @_Z13member_access
Richard Smith69d0d262012-08-24 00:54:33 +000049void member_access(S *p) {
Richard Smith10483562012-10-25 21:59:45 +000050 // (1a) Check 'p' is appropriately sized and aligned for member access.
Richard Smith69d0d262012-08-24 00:54:33 +000051
52 // CHECK: icmp ne {{.*}}, null
53
54 // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
55 // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
56
57 // CHECK: %[[PTRINT:.*]] = ptrtoint
58 // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
59 // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
60
Richard Smith10483562012-10-25 21:59:45 +000061 // (1b) Check that 'p' actually points to an 'S'.
62
63 // CHECK: %[[VPTRADDR:.*]] = bitcast {{.*}} to i64*
David Blaikiea953f282015-02-27 21:19:58 +000064 // CHECK-NEXT: %[[VPTR:.*]] = load i64, i64* %[[VPTRADDR]]
Richard Smith10483562012-10-25 21:59:45 +000065 //
66 // hash_16_bytes:
67 //
68 // If this number changes, it indicates that either the mangled name of ::S
69 // has changed, or that LLVM's hashing function has changed. The latter case
70 // is OK if the hashing function is still stable.
Richard Smith94211562012-10-25 22:27:30 +000071 //
72 // The two hash values are for 64- and 32-bit Clang binaries, respectively.
73 // FIXME: We should produce a 64-bit value either way.
74 //
75 // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}}, %[[VPTR]]
Richard Smith10483562012-10-25 21:59:45 +000076 // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
77 // CHECK-NEXT: lshr i64 {{.*}}, 47
78 // CHECK-NEXT: xor i64
79 // CHECK-NEXT: xor i64 %[[VPTR]]
80 // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
81 // CHECK-NEXT: lshr i64 {{.*}}, 47
82 // CHECK-NEXT: xor i64
83 // CHECK-NEXT: %[[HASH:.*]] = mul i64 {{.*}}, -7070675565921424023
84 //
85 // Check the hash against the table:
86 //
87 // CHECK-NEXT: %[[IDX:.*]] = and i64 %{{.*}}, 127
David Blaikie218b7832015-02-27 19:18:17 +000088 // CHECK-NEXT: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %[[IDX]]
David Blaikiea953f282015-02-27 21:19:58 +000089 // CHECK-NEXT: %[[CACHEVAL:.*]] = load i64, i64*
Richard Smith10483562012-10-25 21:59:45 +000090 // CHECK-NEXT: icmp eq i64 %[[CACHEVAL]], %[[HASH]]
91 // CHECK-NEXT: br i1
92
Will Dietz3676d562012-12-30 20:53:28 +000093 // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %[[HASH]])
Will Dietz88e02332012-12-02 19:50:33 +000094 // CHECK-NOT: unreachable
95 // CHECK: {{.*}}:
Richard Smith10483562012-10-25 21:59:45 +000096
Richard Smith69d0d262012-08-24 00:54:33 +000097 // (2) Check 'p->b' is appropriately sized and aligned for a load.
98
99 // FIXME: Suppress this in the trivial case of a member access, because we
100 // know we've just checked the member access expression itself.
101
102 // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
103 // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
104
105 // CHECK: %[[PTRINT:.*]] = ptrtoint
106 // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
107 // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
108 int k = p->b;
109
Richard Smith10483562012-10-25 21:59:45 +0000110 // (3a) Check 'p' is appropriately sized and aligned for member function call.
Richard Smith69d0d262012-08-24 00:54:33 +0000111
112 // CHECK: icmp ne {{.*}}, null
113
114 // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
115 // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
116
117 // CHECK: %[[PTRINT:.*]] = ptrtoint
118 // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
119 // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
Richard Smith10483562012-10-25 21:59:45 +0000120
121 // (3b) Check that 'p' actually points to an 'S'
122
David Blaikiea953f282015-02-27 21:19:58 +0000123 // CHECK: load i64, i64*
Richard Smith3750e772012-10-25 23:05:00 +0000124 // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}},
Richard Smith10483562012-10-25 21:59:45 +0000125 // [...]
David Blaikie218b7832015-02-27 19:18:17 +0000126 // CHECK: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %
Richard Smith10483562012-10-25 21:59:45 +0000127 // CHECK: br i1
Will Dietz3676d562012-12-30 20:53:28 +0000128 // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %{{.*}})
Will Dietz88e02332012-12-02 19:50:33 +0000129 // CHECK-NOT: unreachable
130 // CHECK: {{.*}}:
Richard Smith10483562012-10-25 21:59:45 +0000131
Richard Smith69d0d262012-08-24 00:54:33 +0000132 k = p->f();
133}
Richard Smith3e056de2012-08-25 00:32:28 +0000134
Alexey Samsonovc9939332014-07-17 23:53:44 +0000135// CHECK-LABEL: @_Z12lsh_overflow
Richard Smith3e056de2012-08-25 00:32:28 +0000136int lsh_overflow(int a, int b) {
Alexey Samsonov21d2dda2015-03-09 21:50:19 +0000137 // CHECK: %[[RHS_INBOUNDS:.*]] = icmp ule i32 %[[RHS:.*]], 31
138 // CHECK-NEXT: br i1 %[[RHS_INBOUNDS]], label %[[CHECK_BB:.*]], label %[[CONT_BB:.*]],
Alexey Samsonov48a9db02015-03-05 21:57:35 +0000139
Alexey Samsonov21d2dda2015-03-09 21:50:19 +0000140 // CHECK: [[CHECK_BB]]:
141 // CHECK-NEXT: %[[SHIFTED_OUT_WIDTH:.*]] = sub nuw nsw i32 31, %[[RHS]]
Richard Smith3e056de2012-08-25 00:32:28 +0000142 // CHECK-NEXT: %[[SHIFTED_OUT:.*]] = lshr i32 %[[LHS:.*]], %[[SHIFTED_OUT_WIDTH]]
143
144 // This is present for C++11 but not for C: C++ core issue 1457 allows a '1'
145 // to be shifted into the sign bit, but not out of it.
146 // CHECK-NEXT: %[[SHIFTED_OUT_NOT_SIGN:.*]] = lshr i32 %[[SHIFTED_OUT]], 1
147
148 // CHECK-NEXT: %[[NO_OVERFLOW:.*]] = icmp eq i32 %[[SHIFTED_OUT_NOT_SIGN]], 0
Alexey Samsonov21d2dda2015-03-09 21:50:19 +0000149 // CHECK-NEXT: br label %[[CONT_BB]]
Will Dietz11d0a9f2013-02-25 22:37:49 +0000150
Alexey Samsonov21d2dda2015-03-09 21:50:19 +0000151 // CHECK: [[CONT_BB]]:
152 // CHECK-NEXT: %[[VALID_BASE:.*]] = phi i1 [ true, {{.*}} ], [ %[[NO_OVERFLOW]], %[[CHECK_BB]] ]
153 // CHECK-NEXT: %[[VALID:.*]] = and i1 %[[RHS_INBOUNDS]], %[[VALID_BASE]]
Will Dietz11d0a9f2013-02-25 22:37:49 +0000154 // CHECK-NEXT: br i1 %[[VALID]]
155
156 // CHECK: call void @__ubsan_handle_shift_out_of_bounds
157 // CHECK-NOT: call void @__ubsan_handle_shift_out_of_bounds
Richard Smith3e056de2012-08-25 00:32:28 +0000158
159 // CHECK: %[[RET:.*]] = shl i32 %[[LHS]], %[[RHS]]
160 // CHECK-NEXT: ret i32 %[[RET]]
161 return a << b;
162}
Richard Smith9f9e5822012-10-04 23:52:29 +0000163
Alexey Samsonovc9939332014-07-17 23:53:44 +0000164// CHECK-LABEL: @_Z9no_return
Richard Smith9f9e5822012-10-04 23:52:29 +0000165int no_return() {
Bill Wendlinge1c4a1b2013-02-22 09:10:20 +0000166 // CHECK: call void @__ubsan_handle_missing_return(i8* bitcast ({{.*}}* @{{.*}} to i8*)) [[NR_NUW:#[0-9]+]]
Richard Smithe30752c2012-10-09 19:52:38 +0000167 // CHECK-NEXT: unreachable
Richard Smith9f9e5822012-10-04 23:52:29 +0000168}
Richard Smith1629da92012-12-13 07:11:50 +0000169
Alexey Samsonovc9939332014-07-17 23:53:44 +0000170// CHECK-LABEL: @_Z9sour_bool
Richard Smith1629da92012-12-13 07:11:50 +0000171bool sour_bool(bool *p) {
172 // CHECK: %[[OK:.*]] = icmp ule i8 {{.*}}, 1
173 // CHECK: br i1 %[[OK]]
Will Dietz3676d562012-12-30 20:53:28 +0000174 // CHECK: call void @__ubsan_handle_load_invalid_value(i8* bitcast ({{.*}}), i64 {{.*}})
Richard Smith1629da92012-12-13 07:11:50 +0000175 return *p;
176}
177
178enum E1 { e1a = 0, e1b = 127 } e1;
179enum E2 { e2a = -1, e2b = 64 } e2;
180enum E3 { e3a = (1u << 31) - 1 } e3;
181
Alexey Samsonovc9939332014-07-17 23:53:44 +0000182// CHECK-LABEL: @_Z14bad_enum_value
Richard Smith1629da92012-12-13 07:11:50 +0000183int bad_enum_value() {
184 // CHECK: %[[E1:.*]] = icmp ule i32 {{.*}}, 127
185 // CHECK: br i1 %[[E1]]
Will Dietz3676d562012-12-30 20:53:28 +0000186 // CHECK: call void @__ubsan_handle_load_invalid_value(
Richard Smith1629da92012-12-13 07:11:50 +0000187 int a = e1;
188
189 // CHECK: %[[E2HI:.*]] = icmp sle i32 {{.*}}, 127
190 // CHECK: %[[E2LO:.*]] = icmp sge i32 {{.*}}, -128
191 // CHECK: %[[E2:.*]] = and i1 %[[E2HI]], %[[E2LO]]
192 // CHECK: br i1 %[[E2]]
Will Dietz3676d562012-12-30 20:53:28 +0000193 // CHECK: call void @__ubsan_handle_load_invalid_value(
Richard Smith1629da92012-12-13 07:11:50 +0000194 int b = e2;
195
196 // CHECK: %[[E3:.*]] = icmp ule i32 {{.*}}, 2147483647
197 // CHECK: br i1 %[[E3]]
Will Dietz3676d562012-12-30 20:53:28 +0000198 // CHECK: call void @__ubsan_handle_load_invalid_value(
Richard Smith1629da92012-12-13 07:11:50 +0000199 int c = e3;
200 return a + b + c;
201}
Richard Smith2c5868c2013-02-13 21:18:23 +0000202
Alexey Samsonovc9939332014-07-17 23:53:44 +0000203// CHECK-LABEL: @_Z20bad_downcast_pointer
Alexey Samsonov32f59d82014-07-18 18:15:39 +0000204// DOWNCAST-NULL-LABEL: @_Z20bad_downcast_pointer
Richard Smith2c5868c2013-02-13 21:18:23 +0000205void bad_downcast_pointer(S *p) {
206 // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
207 // CHECK: br i1 %[[NONNULL]],
208
Alexey Samsonov32f59d82014-07-18 18:15:39 +0000209 // A null poiner access is guarded without -fsanitize=null.
210 // DOWNCAST-NULL: %[[NONNULL:.*]] = icmp ne {{.*}}, null
211 // DOWNCAST-NULL: br i1 %[[NONNULL]],
212
Matt Arsenault2f152632013-10-07 19:00:18 +0000213 // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
Richard Smith2c5868c2013-02-13 21:18:23 +0000214 // CHECK: %[[E1:.*]] = icmp uge i64 %[[SIZE]], 24
215 // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
216 // CHECK: %[[E2:.*]] = icmp eq i64 %[[MISALIGN]], 0
217 // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
218 // CHECK: br i1 %[[E12]],
219
220 // CHECK: call void @__ubsan_handle_type_mismatch
221 // CHECK: br label
222
223 // CHECK: br i1 %{{.*}},
224
225 // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
226 // CHECK: br label
227 (void) static_cast<T*>(p);
228}
229
Alexey Samsonovc9939332014-07-17 23:53:44 +0000230// CHECK-LABEL: @_Z22bad_downcast_reference
Richard Smith2c5868c2013-02-13 21:18:23 +0000231void bad_downcast_reference(S &p) {
232 // CHECK: %[[E1:.*]] = icmp ne {{.*}}, null
233 // CHECK-NOT: br i1
Alexey Samsonove396bfc2014-11-11 22:03:54 +0000234
Matt Arsenault2f152632013-10-07 19:00:18 +0000235 // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
Richard Smith2c5868c2013-02-13 21:18:23 +0000236 // CHECK: %[[E2:.*]] = icmp uge i64 %[[SIZE]], 24
Alexey Samsonove396bfc2014-11-11 22:03:54 +0000237
Richard Smith2c5868c2013-02-13 21:18:23 +0000238 // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
239 // CHECK: %[[E3:.*]] = icmp eq i64 %[[MISALIGN]], 0
Alexey Samsonove396bfc2014-11-11 22:03:54 +0000240
241 // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
Richard Smith2c5868c2013-02-13 21:18:23 +0000242 // CHECK: %[[E123:.*]] = and i1 %[[E12]], %[[E3]]
243 // CHECK: br i1 %[[E123]],
244
245 // CHECK: call void @__ubsan_handle_type_mismatch
246 // CHECK: br label
247
248 // CHECK: br i1 %{{.*}},
249
250 // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
251 // CHECK: br label
252 (void) static_cast<T&>(p);
253}
Bill Wendlinge1c4a1b2013-02-22 09:10:20 +0000254
Alexey Samsonovc9939332014-07-17 23:53:44 +0000255// CHECK-LABEL: @_Z11array_index
Richard Smith539e4a72013-02-23 02:53:19 +0000256int array_index(const int (&a)[4], int n) {
257 // CHECK: %[[K1_OK:.*]] = icmp ult i64 %{{.*}}, 4
258 // CHECK: br i1 %[[K1_OK]]
259 // CHECK: call void @__ubsan_handle_out_of_bounds(
260 int k1 = a[n];
261
262 // CHECK: %[[R1_OK:.*]] = icmp ule i64 %{{.*}}, 4
263 // CHECK: br i1 %[[R1_OK]]
264 // CHECK: call void @__ubsan_handle_out_of_bounds(
265 const int *r1 = &a[n];
266
267 // CHECK: %[[K2_OK:.*]] = icmp ult i64 %{{.*}}, 8
268 // CHECK: br i1 %[[K2_OK]]
269 // CHECK: call void @__ubsan_handle_out_of_bounds(
270 int k2 = ((const int(&)[8])a)[n];
271
272 // CHECK: %[[K3_OK:.*]] = icmp ult i64 %{{.*}}, 4
273 // CHECK: br i1 %[[K3_OK]]
274 // CHECK: call void @__ubsan_handle_out_of_bounds(
275 int k3 = n[a];
276
277 return k1 + *r1 + k2;
278}
279
Alexey Samsonovc9939332014-07-17 23:53:44 +0000280// CHECK-LABEL: @_Z17multi_array_index
Richard Smith539e4a72013-02-23 02:53:19 +0000281int multi_array_index(int n, int m) {
282 int arr[4][6];
283
Richard Smith539e4a72013-02-23 02:53:19 +0000284 // CHECK: %[[IDX1_OK:.*]] = icmp ult i64 %{{.*}}, 4
285 // CHECK: br i1 %[[IDX1_OK]]
286 // CHECK: call void @__ubsan_handle_out_of_bounds(
Richard Smith9e67b992016-09-26 23:49:47 +0000287
288 // CHECK: %[[IDX2_OK:.*]] = icmp ult i64 %{{.*}}, 6
289 // CHECK: br i1 %[[IDX2_OK]]
290 // CHECK: call void @__ubsan_handle_out_of_bounds(
Richard Smith539e4a72013-02-23 02:53:19 +0000291 return arr[n][m];
292}
293
Alexey Samsonovc9939332014-07-17 23:53:44 +0000294// CHECK-LABEL: @_Z11array_arith
Richard Smith539e4a72013-02-23 02:53:19 +0000295int array_arith(const int (&a)[4], int n) {
296 // CHECK: %[[K1_OK:.*]] = icmp ule i64 %{{.*}}, 4
297 // CHECK: br i1 %[[K1_OK]]
298 // CHECK: call void @__ubsan_handle_out_of_bounds(
299 const int *k1 = a + n;
300
301 // CHECK: %[[K2_OK:.*]] = icmp ule i64 %{{.*}}, 8
302 // CHECK: br i1 %[[K2_OK]]
303 // CHECK: call void @__ubsan_handle_out_of_bounds(
304 const int *k2 = (const int(&)[8])a + n;
305
306 return *k1 + *k2;
307}
308
309struct ArrayMembers {
310 int a1[5];
311 int a2[1];
312};
Alexey Samsonovc9939332014-07-17 23:53:44 +0000313// CHECK-LABEL: @_Z18struct_array_index
Richard Smith539e4a72013-02-23 02:53:19 +0000314int struct_array_index(ArrayMembers *p, int n) {
315 // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 5
316 // CHECK: br i1 %[[IDX_OK]]
317 // CHECK: call void @__ubsan_handle_out_of_bounds(
318 return p->a1[n];
319}
320
Alexey Samsonovc9939332014-07-17 23:53:44 +0000321// CHECK-LABEL: @_Z16flex_array_index
Richard Smith539e4a72013-02-23 02:53:19 +0000322int flex_array_index(ArrayMembers *p, int n) {
323 // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
324 return p->a2[n];
325}
326
Richard Smith2847b222013-02-24 01:56:24 +0000327extern int incomplete[];
Alexey Samsonovc9939332014-07-17 23:53:44 +0000328// CHECK-LABEL: @_Z22incomplete_array_index
Richard Smith2847b222013-02-24 01:56:24 +0000329int incomplete_array_index(int n) {
330 // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
331 return incomplete[n];
332}
333
Richard Smith539e4a72013-02-23 02:53:19 +0000334typedef __attribute__((ext_vector_type(4))) int V4I;
Alexey Samsonovc9939332014-07-17 23:53:44 +0000335// CHECK-LABEL: @_Z12vector_index
Richard Smith539e4a72013-02-23 02:53:19 +0000336int vector_index(V4I v, int n) {
337 // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 4
338 // CHECK: br i1 %[[IDX_OK]]
339 // CHECK: call void @__ubsan_handle_out_of_bounds(
340 return v[n];
341}
342
Alexey Samsonovc9939332014-07-17 23:53:44 +0000343// CHECK-LABEL: @_Z12string_index
Richard Smith539e4a72013-02-23 02:53:19 +0000344char string_index(int n) {
345 // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 6
346 // CHECK: br i1 %[[IDX_OK]]
347 // CHECK: call void @__ubsan_handle_out_of_bounds(
348 return "Hello"[n];
349}
350
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000351class A // align=4
352{
353 int a1, a2, a3;
354};
355
356class B // align=8
357{
358 long b1, b2;
359};
360
361class C : public A, public B // align=16
362{
363 alignas(16) int c1;
364};
365
366// Make sure we check the alignment of the pointer after subtracting any
367// offset. The pointer before subtraction doesn't need to be aligned for
368// the destination type.
369
Nick Lewycky8b4e3792013-09-11 02:03:20 +0000370// CHECK-LABEL: define void @_Z16downcast_pointerP1B(%class.B* %b)
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000371void downcast_pointer(B *b) {
372 (void) static_cast<C*>(b);
373 // Alignment check from EmitTypeCheck(TCK_DowncastPointer, ...)
Sanjay Patel372c3f12018-01-19 15:14:51 +0000374 // CHECK: [[SUB:%[.a-z0-9]*]] = getelementptr inbounds i8, i8* {{.*}}, i64 -16
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +0000375 // CHECK-NEXT: [[C:%.+]] = bitcast i8* [[SUB]] to %class.C*
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000376 // null check goes here
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +0000377 // CHECK: [[FROM_PHI:%.+]] = phi %class.C* [ [[C]], {{.*}} ], {{.*}}
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000378 // Objectsize check goes here
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +0000379 // CHECK: [[C_INT:%.+]] = ptrtoint %class.C* [[FROM_PHI]] to i64
380 // CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
381 // CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000382 // AND the alignment test with the objectsize test.
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +0000383 // CHECK-NEXT: [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
Filipe Cabecinhasb2eb1d92013-08-08 01:24:29 +0000384 // CHECK-NEXT: br i1 [[AND]]
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000385}
386
Hal Finkela2347ba2014-07-18 15:52:10 +0000387// CHECK-LABEL: define void @_Z18downcast_referenceR1B(%class.B* dereferenceable({{[0-9]+}}) %b)
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000388void downcast_reference(B &b) {
389 (void) static_cast<C&>(b);
390 // Alignment check from EmitTypeCheck(TCK_DowncastReference, ...)
Sanjay Patel372c3f12018-01-19 15:14:51 +0000391 // CHECK: [[SUB:%[.a-z0-9]*]] = getelementptr inbounds i8, i8* {{.*}}, i64 -16
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +0000392 // CHECK-NEXT: [[C:%.+]] = bitcast i8* [[SUB]] to %class.C*
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000393 // Objectsize check goes here
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +0000394 // CHECK: [[C_INT:%.+]] = ptrtoint %class.C* [[C]] to i64
395 // CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
396 // CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000397 // AND the alignment test with the objectsize test.
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +0000398 // CHECK: [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
Filipe Cabecinhasb2eb1d92013-08-08 01:24:29 +0000399 // CHECK-NEXT: br i1 [[AND]]
Filipe Cabecinhas178a8df2013-08-08 01:08:17 +0000400}
401
Vedant Kumarbb5d4852017-09-13 00:04:35 +0000402//
403// CHECK-LABEL: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i32 }> <{ i32 846595819, i32 trunc (i64 sub (i64 ptrtoint (i8** {{.*}} to i64), i64 ptrtoint (void (void (i32)*)* @_Z22indirect_function_callPFviE to i64)) to i32) }>
404// CHECK-X32: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i32 }> <{ i32 846595819, i32 sub (i32 ptrtoint (i8** [[IndirectRTTI_ZTIFvPFviEE]] to i32), i32 ptrtoint (void (void (i32)*)* @_Z22indirect_function_callPFviE to i32)) }>
405// CHECK-X86: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i32 }> <{ i32 846595819, i32 sub (i32 ptrtoint (i8** [[IndirectRTTI_ZTIFvPFviEE]] to i32), i32 ptrtoint (void (void (i32)*)* @_Z22indirect_function_callPFviE to i32)) }>
Peter Collingbourneb453cd62013-10-20 21:29:19 +0000406void indirect_function_call(void (*p)(int)) {
Vedant Kumarbb5d4852017-09-13 00:04:35 +0000407 // CHECK: [[PTR:%.+]] = bitcast void (i32)* {{.*}} to <{ i32, i32 }>*
Peter Collingbourneb453cd62013-10-20 21:29:19 +0000408
409 // Signature check
Vedant Kumarbb5d4852017-09-13 00:04:35 +0000410 // CHECK-NEXT: [[SIGPTR:%.+]] = getelementptr <{ i32, i32 }>, <{ i32, i32 }>* [[PTR]], i32 0, i32 0
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +0000411 // CHECK-NEXT: [[SIG:%.+]] = load i32, i32* [[SIGPTR]]
Vedant Kumarbb5d4852017-09-13 00:04:35 +0000412 // CHECK-NEXT: [[SIGCMP:%.+]] = icmp eq i32 [[SIG]], 846595819
Peter Collingbourneb453cd62013-10-20 21:29:19 +0000413 // CHECK-NEXT: br i1 [[SIGCMP]]
414
415 // RTTI pointer check
Vedant Kumarbb5d4852017-09-13 00:04:35 +0000416 // CHECK: [[RTTIPTR:%.+]] = getelementptr <{ i32, i32 }>, <{ i32, i32 }>* [[PTR]], i32 0, i32 1
417 // CHECK-NEXT: [[RTTIEncIntTrunc:%.+]] = load i32, i32* [[RTTIPTR]]
418 // CHECK-NEXT: [[RTTIEncInt:%.+]] = sext i32 [[RTTIEncIntTrunc]] to i64
419 // CHECK-NEXT: [[FuncAddrInt:%.+]] = ptrtoint void (i32)* {{.*}} to i64
420 // CHECK-NEXT: [[IndirectGVInt:%.+]] = add i64 [[RTTIEncInt]], [[FuncAddrInt]]
421 // CHECK-NEXT: [[IndirectGV:%.+]] = inttoptr i64 [[IndirectGVInt]] to i8**
422 // CHECK-NEXT: [[RTTI:%.+]] = load i8*, i8** [[IndirectGV]], align 8
NAKAMURA Takumif9c52dc2015-09-15 09:50:24 +0000423 // CHECK-NEXT: [[RTTICMP:%.+]] = icmp eq i8* [[RTTI]], bitcast ({ i8*, i8* }* @_ZTIFviE to i8*)
Peter Collingbourneb453cd62013-10-20 21:29:19 +0000424 // CHECK-NEXT: br i1 [[RTTICMP]]
Vedant Kumarbb5d4852017-09-13 00:04:35 +0000425
Peter Collingbourneb453cd62013-10-20 21:29:19 +0000426 p(42);
427}
428
Vedant Kumaraa4ea5f2017-10-14 01:23:30 +0000429namespace FunctionSanitizerVirtualCalls {
430struct A {
431 virtual void f() {}
432 virtual void g() {}
433 void h() {}
434};
435
436struct B : virtual A {
437 virtual void b() {}
438 virtual void f();
439 void g() final {}
440 static void q() {}
441};
442
443void B::f() {}
444
445void force_irgen() {
446 A a;
447 a.g();
448 a.h();
449
450 B b;
451 b.f();
452 b.b();
453 b.g();
454 B::q();
455}
456
457// CHECK-LABEL: define void @_ZN29FunctionSanitizerVirtualCalls1B1fEv
458// CHECK-NOT: prologue
459//
460// CHECK-LABEL: define void @_ZTv0_n24_N29FunctionSanitizerVirtualCalls1B1fEv
461// CHECK-NOT: prologue
462//
463// CHECK-LABEL: define void @_ZN29FunctionSanitizerVirtualCalls11force_irgenEv()
464// CHECK: prologue
465//
466// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1AC1Ev
467// CHECK-NOT: prologue
468//
469// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1A1gEv
470// CHECK-NOT: prologue
471//
472// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1A1hEv
473// CHECK-NOT: prologue
474//
475// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1BC1Ev
476// CHECK-NOT: prologue
477//
478// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1B1bEv
479// CHECK-NOT: prologue
480//
481// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1B1gEv
482// CHECK-NOT: prologue
483//
484// CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1B1qEv
485// CHECK: prologue
486
487}
488
Alexey Samsonoveb47d8a2014-10-13 23:59:00 +0000489namespace UpcastPointerTest {
490struct S {};
491struct T : S { double d; };
492struct V : virtual S {};
493
494// CHECK-LABEL: upcast_pointer
495S* upcast_pointer(T* t) {
496 // Check for null pointer
497 // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
498 // CHECK: br i1 %[[NONNULL]]
499
500 // Check alignment
501 // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
502 // CHECK: icmp eq i64 %[[MISALIGN]], 0
503
504 // CHECK: call void @__ubsan_handle_type_mismatch
505 return t;
506}
507
508V getV();
509
510// CHECK-LABEL: upcast_to_vbase
511void upcast_to_vbase() {
512 // No need to check for null here, as we have a temporary here.
513
514 // CHECK-NOT: br i1
515
516 // CHECK: call i64 @llvm.objectsize
517 // CHECK: call void @__ubsan_handle_type_mismatch
518 // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
519 const S& s = getV();
520}
521}
522
Richard Smith376c28e2017-08-24 20:10:33 +0000523struct ThisAlign {
524 void this_align_lambda();
525 void this_align_lambda_2();
526};
527void ThisAlign::this_align_lambda() {
Vedant Kumar8e2baf92017-09-13 00:04:36 +0000528 // CHECK-LABEL: define internal %struct.ThisAlign* @"_ZZN9ThisAlign17this_align_lambdaEvENK3$_0clEv"
Richard Smith376c28e2017-08-24 20:10:33 +0000529 // CHECK-SAME: (%{{.*}}* %[[this:[^)]*]])
530 // CHECK: %[[this_addr:.*]] = alloca
531 // CHECK: store %{{.*}}* %[[this]], %{{.*}}** %[[this_addr]],
532 // CHECK: %[[this_inner:.*]] = load %{{.*}}*, %{{.*}}** %[[this_addr]],
533 // CHECK: %[[this_outer_addr:.*]] = getelementptr inbounds %{{.*}}, %{{.*}}* %[[this_inner]], i32 0, i32 0
534 // CHECK: %[[this_outer:.*]] = load %{{.*}}*, %{{.*}}** %[[this_outer_addr]],
535 //
536 // CHECK: %[[this_inner_isnonnull:.*]] = icmp ne %{{.*}}* %[[this_inner]], null
537 // CHECK: %[[this_inner_asint:.*]] = ptrtoint %{{.*}}* %[[this_inner]] to i
538 // CHECK: %[[this_inner_misalignment:.*]] = and i{{32|64}} %[[this_inner_asint]], {{3|7}},
539 // CHECK: %[[this_inner_isaligned:.*]] = icmp eq i{{32|64}} %[[this_inner_misalignment]], 0
540 // CHECK: %[[this_inner_valid:.*]] = and i1 %[[this_inner_isnonnull]], %[[this_inner_isaligned]],
541 // CHECK: br i1 %[[this_inner_valid:.*]]
542 [&] { return this; } ();
543}
544
Nick Lewycky8b4e3792013-09-11 02:03:20 +0000545namespace CopyValueRepresentation {
546 // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S3aSERKS0_
547 // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
548 // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S4aSEOS0_
549 // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
Rafael Espindolae5df59f2015-01-22 00:24:57 +0000550 // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S1C2ERKS0_
Nick Lewycky8b4e3792013-09-11 02:03:20 +0000551 // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
552 // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S2C2ERKS0_
553 // CHECK: __ubsan_handle_load_invalid_value
Rafael Espindolae5df59f2015-01-22 00:24:57 +0000554 // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S5C2ERKS0_
Nick Lewycky8b4e3792013-09-11 02:03:20 +0000555 // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
556
557 struct CustomCopy { CustomCopy(); CustomCopy(const CustomCopy&); };
558 struct S1 {
559 CustomCopy CC;
560 bool b;
561 };
562 void callee1(S1);
563 void test1() {
564 S1 s11;
565 callee1(s11);
566 S1 s12;
567 s12 = s11;
568 }
569
570 static bool some_global_bool;
571 struct ExprCopy {
572 ExprCopy();
573 ExprCopy(const ExprCopy&, bool b = some_global_bool);
574 };
575 struct S2 {
576 ExprCopy EC;
577 bool b;
578 };
579 void callee2(S2);
580 void test2(void) {
581 S2 s21;
582 callee2(s21);
583 S2 s22;
584 s22 = s21;
585 }
586
587 struct CustomAssign { CustomAssign &operator=(const CustomAssign&); };
588 struct S3 {
589 CustomAssign CA;
590 bool b;
591 };
592 void test3() {
593 S3 x, y;
594 x = y;
595 }
596
597 struct CustomMove {
598 CustomMove();
599 CustomMove(const CustomMove&&);
600 CustomMove &operator=(const CustomMove&&);
601 };
602 struct S4 {
603 CustomMove CM;
604 bool b;
605 };
606 void test4() {
607 S4 x, y;
608 x = static_cast<S4&&>(y);
609 }
610
611 struct EnumCustomCopy {
612 EnumCustomCopy();
613 EnumCustomCopy(const EnumCustomCopy&);
614 };
615 struct S5 {
616 EnumCustomCopy ECC;
617 bool b;
618 };
619 void callee5(S5);
620 void test5() {
621 S5 s51;
622 callee5(s51);
623 S5 s52;
624 s52 = s51;
625 }
626}
627
Richard Smith376c28e2017-08-24 20:10:33 +0000628void ThisAlign::this_align_lambda_2() {
Vedant Kumar8e2baf92017-09-13 00:04:36 +0000629 // CHECK-LABEL: define internal void @"_ZZN9ThisAlign19this_align_lambda_2EvENK3$_1clEv"
Richard Smith376c28e2017-08-24 20:10:33 +0000630 // CHECK-SAME: (%{{.*}}* %[[this:[^)]*]])
631 // CHECK: %[[this_addr:.*]] = alloca
632 // CHECK: store %{{.*}}* %[[this]], %{{.*}}** %[[this_addr]],
633 // CHECK: %[[this_inner:.*]] = load %{{.*}}*, %{{.*}}** %[[this_addr]],
634 //
635 // Do not perform a null check on the 'this' pointer if the function might be
636 // called from a static invoker.
637 // CHECK-NOT: icmp ne %{{.*}}* %[[this_inner]], null
638 auto *p = +[] {};
639 p();
640}
641
Bill Wendlinge1c4a1b2013-02-22 09:10:20 +0000642// CHECK: attributes [[NR_NUW]] = { noreturn nounwind }