clang/test/CodeGenCXX/catch-undef-behavior.cpp

   1 // RUN: %clang_cc1 -no-enable-noundef-analysis -std=c++11 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -fsanitize-recover=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefixes=CHECK,CHECK-FUNCSAN
   2 // RUN: %clang_cc1 -no-enable-noundef-analysis -std=c++11 -fsanitize=vptr,address -fsanitize-recover=vptr,address -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=CHECK-ASAN
   3 // RUN: %clang_cc1 -no-enable-noundef-analysis -std=c++11 -fsanitize=vptr -fsanitize-recover=vptr -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=DOWNCAST-NULL
   4 // RUN: %clang_cc1 -no-enable-noundef-analysis -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple x86_64-linux-gnux32 | FileCheck %s --check-prefix=CHECK-FUNCSAN
   5 // RUN: %clang_cc1 -no-enable-noundef-analysis -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple i386-linux-gnu | FileCheck %s --check-prefix=CHECK-FUNCSAN
   6
   7 struct S {
   8   double d;
   9   int a, b;
  10   virtual int f();
  11 };
  12
  13 // Check that type descriptor global is not modified by ASan.
  14 // CHECK-ASAN: [[TYPE_DESCR:@[0-9]+]] = private unnamed_addr constant { i16, i16, [4 x i8] } { i16 -1, i16 0, [4 x i8] c"'S'\00" }
  15
  16 // Check that type mismatch handler is not modified by ASan.
  17 // CHECK-ASAN: private unnamed_addr global { { ptr, i32, i32 }, ptr, ptr, i8 } { {{.*}}, ptr [[TYPE_DESCR]], {{.*}} }
  18
  19 struct T : S {};
  20
  21 // CHECK-LABEL: @_Z17reference_binding
  22 void reference_binding(int *p, S *q) {
  23   // C++ core issue 453: If an lvalue to which a reference is directly bound
  24   // designates neither an existing object or function of an appropriate type,
  25   // nor a region of storage of suitable size and alignment to contain an object
  26   // of the reference's type, the behavior is undefined.
  27
  28   // CHECK: icmp ne {{.*}}, null
  29
  30   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
  31   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
  32
  33   // CHECK: %[[PTRINT:.*]] = ptrtoint
  34   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
  35   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
  36   int &r = *p;
  37
  38   // A reference is not required to refer to an object within its lifetime.
  39   // CHECK-NOT: __ubsan_handle_dynamic_type_cache_miss
  40   S &r2 = *q;
  41 }
  42
  43 // CHECK-LABEL: @_Z13member_access
  44 // CHECK-ASAN-LABEL: @_Z13member_access
  45 void member_access(S *p) {
  46   // (1a) Check 'p' is appropriately sized and aligned for member access.
  47
  48   // CHECK: icmp ne {{.*}}, null
  49
  50   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
  51   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
  52
  53   // CHECK: %[[PTRINT:.*]] = ptrtoint
  54   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
  55   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
  56
  57   // (1b) Check that 'p' actually points to an 'S'.
  58
  59   // CHECK: %[[VPTR:.*]] = load i64, ptr
  60   //
  61   // hash_16_bytes:
  62   //
  63   // If this number changes, it indicates that either the mangled name of ::S
  64   // has changed, or that LLVM's hashing function has changed. The latter case
  65   // is OK if the hashing function is still stable.
  66   //
  67   // The two hash values are for 64- and 32-bit Clang binaries, respectively.
  68   // FIXME: We should produce a 64-bit value either way.
  69   //
  70   // CHECK-NEXT: xor i64 {{-4030275160588942838|1107558922}}, %[[VPTR]]
  71   // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
  72   // CHECK-NEXT: lshr i64 {{.*}}, 47
  73   // CHECK-NEXT: xor i64
  74   // CHECK-NEXT: xor i64 %[[VPTR]]
  75   // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
  76   // CHECK-NEXT: lshr i64 {{.*}}, 47
  77   // CHECK-NEXT: xor i64
  78   // CHECK-NEXT: %[[HASH:.*]] = mul i64 {{.*}}, -7070675565921424023
  79   //
  80   // Check the hash against the table:
  81   //
  82   // CHECK-NEXT: %[[IDX:.*]] = and i64 %{{.*}}, 127
  83   // CHECK-NEXT: getelementptr inbounds [128 x i64], ptr @__ubsan_vptr_type_cache, i32 0, i64 %[[IDX]]
  84   // CHECK-NEXT: %[[CACHEVAL:.*]] = load i64, ptr
  85   // CHECK-NEXT: icmp eq i64 %[[CACHEVAL]], %[[HASH]]
  86   // CHECK-NEXT: br i1
  87
  88   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %[[HASH]])
  89   // CHECK-NOT: unreachable
  90   // CHECK: {{.*}}:
  91
  92   // (2) Check 'p->b' is appropriately sized and aligned for a load.
  93
  94   // FIXME: Suppress this in the trivial case of a member access, because we
  95   // know we've just checked the member access expression itself.
  96
  97   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
  98   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
  99
 100   // CHECK: %[[PTRINT:.*]] = ptrtoint
 101   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
 102   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
 103   int k = p->b;
 104
 105   // (3a) Check 'p' is appropriately sized and aligned for member function call.
 106
 107   // CHECK: icmp ne {{.*}}, null
 108
 109   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
 110   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
 111
 112   // CHECK: %[[PTRINT:.*]] = ptrtoint
 113   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
 114   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
 115
 116   // (3b) Check that 'p' actually points to an 'S'
 117
 118   // CHECK: load i64, ptr
 119   // CHECK-NEXT: xor i64 {{-4030275160588942838|1107558922}},
 120   // [...]
 121   // CHECK: getelementptr inbounds [128 x i64], ptr @__ubsan_vptr_type_cache, i32 0, i64 %
 122   // CHECK: br i1
 123   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %{{.*}})
 124   // CHECK-NOT: unreachable
 125   // CHECK: {{.*}}:
 126
 127   k = p->f();
 128 }
 129
 130 // CHECK-LABEL: @_Z12lsh_overflow
 131 int lsh_overflow(int a, int b) {
 132   // CHECK: %[[RHS_INBOUNDS:.*]] = icmp ule i32 %[[RHS:.*]], 31
 133   // CHECK-NEXT: br i1 %[[RHS_INBOUNDS]], label %[[CHECK_BB:.*]], label %[[CONT_BB:.*]],
 134
 135   // CHECK:      [[CHECK_BB]]:
 136   // CHECK-NEXT: %[[SHIFTED_OUT_WIDTH:.*]] = sub nuw nsw i32 31, %[[RHS]]
 137   // CHECK-NEXT: %[[SHIFTED_OUT:.*]] = lshr i32 %[[LHS:.*]], %[[SHIFTED_OUT_WIDTH]]
 138
 139   // This is present for C++11 but not for C: C++ core issue 1457 allows a '1'
 140   // to be shifted into the sign bit, but not out of it.
 141   // CHECK-NEXT: %[[SHIFTED_OUT_NOT_SIGN:.*]] = lshr i32 %[[SHIFTED_OUT]], 1
 142
 143   // CHECK-NEXT: %[[NO_OVERFLOW:.*]] = icmp eq i32 %[[SHIFTED_OUT_NOT_SIGN]], 0
 144   // CHECK-NEXT: br label %[[CONT_BB]]
 145
 146   // CHECK:      [[CONT_BB]]:
 147   // CHECK-NEXT: %[[VALID_BASE:.*]] = phi i1 [ true, {{.*}} ], [ %[[NO_OVERFLOW]], %[[CHECK_BB]] ]
 148   // CHECK-NEXT: %[[VALID:.*]] = and i1 %[[RHS_INBOUNDS]], %[[VALID_BASE]]
 149   // CHECK-NEXT: br i1 %[[VALID]]
 150
 151   // CHECK: call void @__ubsan_handle_shift_out_of_bounds
 152   // CHECK-NOT: call void @__ubsan_handle_shift_out_of_bounds
 153
 154   // CHECK: %[[RET:.*]] = shl i32 %[[LHS]], %[[RHS]]
 155   // CHECK-NEXT: ret i32 %[[RET]]
 156   return a << b;
 157 }
 158
 159 // CHECK-LABEL: @_Z9no_return
 160 int no_return() {
 161   // CHECK:      call void @__ubsan_handle_missing_return(ptr @{{.*}}) [[NR_NUW:#[0-9]+]]
 162   // CHECK-NEXT: unreachable
 163 }
 164
 165 // CHECK-LABEL: @_Z9sour_bool
 166 bool sour_bool(bool *p) {
 167   // CHECK: %[[OK:.*]] = icmp ule i8 {{.*}}, 1
 168   // CHECK: br i1 %[[OK]]
 169   // CHECK: call void @__ubsan_handle_load_invalid_value(ptr @{{.*}}, i64 {{.*}})
 170   return *p;
 171 }
 172
 173 enum E1 { e1a = 0, e1b = 127 } e1;
 174 enum E2 { e2a = -1, e2b = 64 } e2;
 175 enum E3 { e3a = (1u << 31) - 1 } e3;
 176
 177 // CHECK-LABEL: @_Z14bad_enum_value
 178 int bad_enum_value() {
 179   // CHECK: %[[E1:.*]] = icmp ule i32 {{.*}}, 127
 180   // CHECK: br i1 %[[E1]]
 181   // CHECK: call void @__ubsan_handle_load_invalid_value(
 182   int a = e1;
 183
 184   // CHECK: %[[E2HI:.*]] = icmp sle i32 {{.*}}, 127
 185   // CHECK: %[[E2LO:.*]] = icmp sge i32 {{.*}}, -128
 186   // CHECK: %[[E2:.*]] = and i1 %[[E2HI]], %[[E2LO]]
 187   // CHECK: br i1 %[[E2]]
 188   // CHECK: call void @__ubsan_handle_load_invalid_value(
 189   int b = e2;
 190
 191   // CHECK: %[[E3:.*]] = icmp ule i32 {{.*}}, 2147483647
 192   // CHECK: br i1 %[[E3]]
 193   // CHECK: call void @__ubsan_handle_load_invalid_value(
 194   int c = e3;
 195   return a + b + c;
 196 }
 197
 198 // CHECK-LABEL: @_Z20bad_downcast_pointer
 199 // DOWNCAST-NULL-LABEL: @_Z20bad_downcast_pointer
 200 void bad_downcast_pointer(S *p) {
 201   // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
 202   // CHECK: br i1 %[[NONNULL]],
 203
 204   // A null pointer access is guarded without -fsanitize=null.
 205   // DOWNCAST-NULL: %[[NONNULL:.*]] = icmp ne {{.*}}, null
 206   // DOWNCAST-NULL: br i1 %[[NONNULL]],
 207
 208   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0(
 209   // CHECK: %[[E1:.*]] = icmp uge i64 %[[SIZE]], 24
 210   // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
 211   // CHECK: %[[E2:.*]] = icmp eq i64 %[[MISALIGN]], 0
 212   // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
 213   // CHECK: br i1 %[[E12]],
 214
 215   // CHECK: call void @__ubsan_handle_type_mismatch
 216   // CHECK: br label
 217
 218   // CHECK: br i1 %{{.*}},
 219
 220   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
 221   // CHECK: br label
 222   (void) static_cast<T*>(p);
 223 }
 224
 225 // CHECK-LABEL: @_Z22bad_downcast_reference
 226 void bad_downcast_reference(S &p) {
 227   // CHECK: %[[E1:.*]] = icmp ne {{.*}}, null
 228   // CHECK-NOT: br i1
 229
 230   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0(
 231   // CHECK: %[[E2:.*]] = icmp uge i64 %[[SIZE]], 24
 232
 233   // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
 234   // CHECK: %[[E3:.*]] = icmp eq i64 %[[MISALIGN]], 0
 235
 236   // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
 237   // CHECK: %[[E123:.*]] = and i1 %[[E12]], %[[E3]]
 238   // CHECK: br i1 %[[E123]],
 239
 240   // CHECK: call void @__ubsan_handle_type_mismatch
 241   // CHECK: br label
 242
 243   // CHECK: br i1 %{{.*}},
 244
 245   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
 246   // CHECK: br label
 247   (void) static_cast<T&>(p);
 248 }
 249
 250 // CHECK-LABEL: @_Z11array_index
 251 int array_index(const int (&a)[4], int n) {
 252   // CHECK: %[[K1_OK:.*]] = icmp ult i64 %{{.*}}, 4
 253   // CHECK: br i1 %[[K1_OK]]
 254   // CHECK: call void @__ubsan_handle_out_of_bounds(
 255   int k1 = a[n];
 256
 257   // CHECK: %[[R1_OK:.*]] = icmp ule i64 %{{.*}}, 4
 258   // CHECK: br i1 %[[R1_OK]]
 259   // CHECK: call void @__ubsan_handle_out_of_bounds(
 260   const int *r1 = &a[n];
 261
 262   // CHECK: %[[K2_OK:.*]] = icmp ult i64 %{{.*}}, 8
 263   // CHECK: br i1 %[[K2_OK]]
 264   // CHECK: call void @__ubsan_handle_out_of_bounds(
 265   int k2 = ((const int(&)[8])a)[n];
 266
 267   // CHECK: %[[K3_OK:.*]] = icmp ult i64 %{{.*}}, 4
 268   // CHECK: br i1 %[[K3_OK]]
 269   // CHECK: call void @__ubsan_handle_out_of_bounds(
 270   int k3 = n[a];
 271
 272   return k1 + *r1 + k2;
 273 }
 274
 275 // CHECK-LABEL: @_Z17multi_array_index
 276 int multi_array_index(int n, int m) {
 277   int arr[4][6];
 278
 279   // CHECK: %[[IDX1_OK:.*]] = icmp ult i64 %{{.*}}, 4
 280   // CHECK: br i1 %[[IDX1_OK]]
 281   // CHECK: call void @__ubsan_handle_out_of_bounds(
 282
 283   // CHECK: %[[IDX2_OK:.*]] = icmp ult i64 %{{.*}}, 6
 284   // CHECK: br i1 %[[IDX2_OK]]
 285   // CHECK: call void @__ubsan_handle_out_of_bounds(
 286   return arr[n][m];
 287 }
 288
 289 // CHECK-LABEL: @_Z11array_arith
 290 int array_arith(const int (&a)[4], int n) {
 291   // CHECK: %[[K1_OK:.*]] = icmp ule i64 %{{.*}}, 4
 292   // CHECK: br i1 %[[K1_OK]]
 293   // CHECK: call void @__ubsan_handle_out_of_bounds(
 294   const int *k1 = a + n;
 295
 296   // CHECK: %[[K2_OK:.*]] = icmp ule i64 %{{.*}}, 8
 297   // CHECK: br i1 %[[K2_OK]]
 298   // CHECK: call void @__ubsan_handle_out_of_bounds(
 299   const int *k2 = (const int(&)[8])a + n;
 300
 301   return *k1 + *k2;
 302 }
 303
 304 struct ArrayMembers {
 305   int a1[5];
 306   int a2[1];
 307 };
 308 // CHECK-LABEL: @_Z18struct_array_index
 309 int struct_array_index(ArrayMembers *p, int n) {
 310   // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 5
 311   // CHECK: br i1 %[[IDX_OK]]
 312   // CHECK: call void @__ubsan_handle_out_of_bounds(
 313   return p->a1[n];
 314 }
 315
 316 // CHECK-LABEL: @_Z16flex_array_index
 317 int flex_array_index(ArrayMembers *p, int n) {
 318   // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
 319   return p->a2[n];
 320 }
 321
 322 extern int incomplete[];
 323 // CHECK-LABEL: @_Z22incomplete_array_index
 324 int incomplete_array_index(int n) {
 325   // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
 326   return incomplete[n];
 327 }
 328
 329 typedef __attribute__((ext_vector_type(4))) int V4I;
 330 // CHECK-LABEL: @_Z12vector_index
 331 int vector_index(V4I v, int n) {
 332   // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 4
 333   // CHECK: br i1 %[[IDX_OK]]
 334   // CHECK: call void @__ubsan_handle_out_of_bounds(
 335   return v[n];
 336 }
 337
 338 // CHECK-LABEL: @_Z12string_index
 339 char string_index(int n) {
 340   // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 6
 341   // CHECK: br i1 %[[IDX_OK]]
 342   // CHECK: call void @__ubsan_handle_out_of_bounds(
 343   return "Hello"[n];
 344 }
 345
 346 class A // align=4
 347 {
 348   int a1, a2, a3;
 349 };
 350
 351 class B // align=8
 352 {
 353   long b1, b2;
 354 };
 355
 356 class C : public A, public B // align=16
 357 {
 358   alignas(16) int c1;
 359 };
 360
 361 // Make sure we check the alignment of the pointer after subtracting any
 362 // offset. The pointer before subtraction doesn't need to be aligned for
 363 // the destination type.
 364
 365 // CHECK-LABEL: define{{.*}} void @_Z16downcast_pointerP1B(ptr %b)
 366 void downcast_pointer(B *b) {
 367   (void) static_cast<C*>(b);
 368   // Alignment check from EmitTypeCheck(TCK_DowncastPointer, ...)
 369   // CHECK: [[SUB:%[.a-z0-9]*]] = getelementptr inbounds i8, ptr {{.*}}, i64 -16
 370   // null check goes here
 371   // CHECK: [[FROM_PHI:%.+]] = phi ptr [ [[SUB]], {{.*}} ], {{.*}}
 372   // Objectsize check goes here
 373   // CHECK: [[C_INT:%.+]] = ptrtoint ptr [[FROM_PHI]] to i64
 374   // CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
 375   // CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
 376   // AND the alignment test with the objectsize test.
 377   // CHECK-NEXT: [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
 378   // CHECK-NEXT: br i1 [[AND]]
 379 }
 380
 381 // CHECK-LABEL: define{{.*}} void @_Z18downcast_referenceR1B(ptr nonnull align {{[0-9]+}} dereferenceable({{[0-9]+}}) %b)
 382 void downcast_reference(B &b) {
 383   (void) static_cast<C&>(b);
 384   // Alignment check from EmitTypeCheck(TCK_DowncastReference, ...)
 385   // CHECK:      [[SUB:%[.a-z0-9]*]] = getelementptr inbounds i8, ptr {{.*}}, i64 -16
 386   // Objectsize check goes here
 387   // CHECK:      [[C_INT:%.+]] = ptrtoint ptr [[SUB]] to i64
 388   // CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
 389   // CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
 390   // AND the alignment test with the objectsize test.
 391   // CHECK:      [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
 392   // CHECK-NEXT: br i1 [[AND]]
 393 }
 394
 395 // CHECK-FUNCSAN: @_Z22indirect_function_callPFviE({{.*}} !func_sanitize ![[FUNCSAN:.*]] {
 396 void indirect_function_call(void (*p)(int)) {
 397   // CHECK: [[PTR:%.+]] = load ptr, ptr
 398
 399   // Signature check
 400   // CHECK-NEXT: [[SIGPTR:%.+]] = getelementptr <{ i32, i32 }>, ptr [[PTR]], i32 -1, i32 0
 401   // CHECK-NEXT: [[SIG:%.+]] = load i32, ptr [[SIGPTR]]
 402   // CHECK-NEXT: [[SIGCMP:%.+]] = icmp eq i32 [[SIG]], -1056584962
 403   // CHECK-NEXT: br i1 [[SIGCMP]]
 404
 405   // CalleeTypeHash check
 406   // CHECK: [[CalleeTypeHashPtr:%.+]] = getelementptr <{ i32, i32 }>, ptr [[PTR]], i32 -1, i32 1
 407   // CHECK-NEXT: [[CalleeTypeHash:%.+]] = load i32, ptr [[CalleeTypeHashPtr]]
 408   // CHECK-NEXT: [[CalleeTypeHashMatch:%.+]] = icmp eq i32 [[CalleeTypeHash]], -1988405058
 409   // CHECK-NEXT: br i1 [[CalleeTypeHashMatch]]
 410
 411   p(42);
 412 }
 413
 414 namespace VBaseObjectSize {
 415   // Note: C is laid out such that offsetof(C, B) + sizeof(B) extends outside
 416   // the C object.
 417   struct alignas(16) A { void *a1, *a2; };
 418   struct B : virtual A { void *b; void* g(); };
 419   struct C : virtual A, virtual B { };
 420   // CHECK-LABEL: define {{.*}} @_ZN15VBaseObjectSize1fERNS_1BE(
 421   B &f(B &b) {
 422     // Size check: check for nvsize(B) == 16 (do not require size(B) == 32)
 423     // CHECK: [[SIZE:%.+]] = call i{{32|64}} @llvm.objectsize.i64.p0(
 424     // CHECK: icmp uge i{{32|64}} [[SIZE]], 16,
 425
 426     // Alignment check: check for nvalign(B) == 8 (do not require align(B) == 16)
 427     // CHECK: [[PTRTOINT:%.+]] = ptrtoint {{.*}} to i64,
 428     // CHECK: and i64 [[PTRTOINT]], 7,
 429     return b;
 430   }
 431
 432   // CHECK-LABEL: define {{.*}} @_ZN15VBaseObjectSize1B1gEv(
 433   void *B::g() {
 434     // Ensure that the check on the "this" pointer also uses the proper
 435     // alignment. We should be using nvalign(B) == 8, not 16.
 436     // CHECK: [[PTRTOINT:%.+]] = ptrtoint {{.*}} to i64,
 437     // CHECK: and i64 [[PTRTOINT]], 7
 438     return nullptr;
 439   }
 440 }
 441
 442 namespace FunctionSanitizerVirtualCalls {
 443 struct A {
 444   virtual void f() {}
 445   virtual void g() {}
 446   void h() {}
 447 };
 448
 449 struct B : virtual A {
 450   virtual void b() {}
 451   virtual void f();
 452   void g() final {}
 453   static void q() {}
 454 };
 455
 456 void B::f() {}
 457
 458 void force_irgen() {
 459   A a;
 460   a.g();
 461   a.h();
 462
 463   B b;
 464   b.f();
 465   b.b();
 466   b.g();
 467   B::q();
 468 }
 469
 470 // CHECK-LABEL: define{{.*}} void @_ZN29FunctionSanitizerVirtualCalls1B1fEv
 471 // CHECK-NOT: !func_sanitize
 472 //
 473 // CHECK-LABEL: define{{.*}} void @_ZTv0_n24_N29FunctionSanitizerVirtualCalls1B1fEv
 474 // CHECK-NOT: !func_sanitize
 475 //
 476 // CHECK-LABEL: define{{.*}} void @_ZN29FunctionSanitizerVirtualCalls11force_irgenEv()
 477 // CHECK: !func_sanitize
 478 //
 479 // CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1AC1Ev
 480 // CHECK-NOT: !func_sanitize
 481 //
 482 // CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1A1gEv
 483 // CHECK-NOT: !func_sanitize
 484 //
 485 // CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1A1hEv
 486 // CHECK-NOT: !func_sanitize
 487 //
 488 // CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1BC1Ev
 489 // CHECK-NOT: !func_sanitize
 490 //
 491 // CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1B1bEv
 492 // CHECK-NOT: !func_sanitize
 493 //
 494 // CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1B1gEv
 495 // CHECK-NOT: !func_sanitize
 496 //
 497 // CHECK-LABEL: define linkonce_odr void @_ZN29FunctionSanitizerVirtualCalls1B1qEv
 498 // CHECK: !func_sanitize
 499
 500 }
 501
 502 namespace UpcastPointerTest {
 503 struct S {};
 504 struct T : S { double d; };
 505 struct V : virtual S {};
 506
 507 // CHECK-LABEL: upcast_pointer
 508 S* upcast_pointer(T* t) {
 509   // Check for null pointer
 510   // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
 511   // CHECK: br i1 %[[NONNULL]]
 512
 513   // Check alignment
 514   // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
 515   // CHECK: icmp eq i64 %[[MISALIGN]], 0
 516
 517   // CHECK: call void @__ubsan_handle_type_mismatch
 518   return t;
 519 }
 520
 521 V getV();
 522
 523 // CHECK-LABEL: upcast_to_vbase
 524 void upcast_to_vbase() {
 525   // No need to check for null here, as we have a temporary here.
 526
 527   // CHECK-NOT: br i1
 528
 529   // CHECK: call i64 @llvm.objectsize
 530   // CHECK: call void @__ubsan_handle_type_mismatch
 531   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
 532   const S& s = getV();
 533 }
 534 }
 535
 536 struct nothrow {};
 537 void *operator new[](__SIZE_TYPE__, nothrow) noexcept;
 538
 539 namespace NothrowNew {
 540   struct X { X(); };
 541
 542   // CHECK-LABEL: define{{.*}}nothrow_new_trivial
 543   void *nothrow_new_trivial() {
 544     // CHECK: %[[is_null:.*]] = icmp eq ptr{{.*}}, null
 545     // CHECK: br i1 %[[is_null]], label %[[null:.*]], label %[[nonnull:.*]]
 546
 547     // CHECK: [[nonnull]]:
 548     // CHECK: llvm.objectsize
 549     // CHECK: icmp uge i64 {{.*}}, 123456,
 550     // CHECK: br i1
 551     //
 552     // CHECK: call {{.*}}__ubsan_handle_type_mismatch
 553     //
 554     // CHECK: [[null]]:
 555     // CHECK-NOT: {{ }}br{{ }}
 556     // CHECK: ret
 557     return new (nothrow{}) char[123456];
 558   }
 559
 560   // CHECK-LABEL: define{{.*}}nothrow_new_nontrivial
 561   void *nothrow_new_nontrivial() {
 562     // CHECK: %[[is_null:.*]] = icmp eq ptr{{.*}}, null
 563     // CHECK: br i1 %[[is_null]], label %[[null:.*]], label %[[nonnull:.*]]
 564
 565     // CHECK: [[nonnull]]:
 566     // CHECK: llvm.objectsize
 567     // CHECK: icmp uge i64 {{.*}}, 123456,
 568     // CHECK: br i1
 569     //
 570     // CHECK: call {{.*}}__ubsan_handle_type_mismatch
 571     //
 572     // CHECK: call {{.*}}_ZN10NothrowNew1XC1Ev
 573     //
 574     // CHECK: [[null]]:
 575     // CHECK-NOT: {{ }}br{{ }}
 576     // CHECK: ret
 577     return new (nothrow{}) X[123456];
 578   }
 579
 580   // CHECK-LABEL: define{{.*}}throwing_new
 581   void *throwing_new(int size) {
 582     // CHECK: icmp ne ptr{{.*}}, null
 583     // CHECK: %[[size:.*]] = mul
 584     // CHECK: llvm.objectsize
 585     // CHECK: icmp uge i64 {{.*}}, %[[size]],
 586     // CHECK: %[[ok:.*]] = and
 587     // CHECK: br i1 %[[ok]], label %[[good:.*]], label %[[bad:[^,]*]]
 588     //
 589     // CHECK: [[bad]]:
 590     // CHECK: call {{.*}}__ubsan_handle_type_mismatch
 591     //
 592     // CHECK: [[good]]:
 593     // CHECK-NOT: {{ }}br{{ }}
 594     // CHECK: ret
 595     return new char[size];
 596   }
 597
 598   // CHECK-LABEL: define{{.*}}nothrow_new_zero_size
 599   void *nothrow_new_zero_size() {
 600     // CHECK: %[[nonnull:.*]] = icmp ne ptr{{.*}}, null
 601     // CHECK-NOT: llvm.objectsize
 602     // CHECK: br i1 %[[nonnull]], label %[[good:.*]], label %[[bad:[^,]*]]
 603     //
 604     // CHECK: [[bad]]:
 605     // CHECK: call {{.*}}__ubsan_handle_type_mismatch
 606     //
 607     // CHECK: [[good]]:
 608     // CHECK-NOT: {{ }}br{{ }}
 609     // CHECK: ret
 610     return new char[0];
 611   }
 612
 613   // CHECK-LABEL: define{{.*}}throwing_new_zero_size
 614   void *throwing_new_zero_size() {
 615     // Nothing to check here.
 616     // CHECK-NOT: __ubsan_handle_type_mismatch
 617     return new (nothrow{}) char[0];
 618     // CHECK: ret
 619   }
 620 }
 621
 622 struct ThisAlign {
 623   void this_align_lambda();
 624   void this_align_lambda_2();
 625 };
 626 void ThisAlign::this_align_lambda() {
 627   // CHECK-LABEL: define internal ptr @"_ZZN9ThisAlign17this_align_lambdaEvENK3$_0clEv"
 628   // CHECK-SAME: (ptr {{[^,]*}} %[[this:[^)]*]])
 629   // CHECK: %[[this_addr:.*]] = alloca
 630   // CHECK: store ptr %[[this]], ptr %[[this_addr]],
 631   // CHECK: %[[this_inner:.*]] = load ptr, ptr %[[this_addr]],
 632   // CHECK: %[[this_outer_addr:.*]] = getelementptr inbounds %{{.*}}, ptr %[[this_inner]], i32 0, i32 0
 633   // CHECK: %[[this_outer:.*]] = load ptr, ptr %[[this_outer_addr]],
 634   //
 635   // CHECK: %[[this_inner_isnonnull:.*]] = icmp ne ptr %[[this_inner]], null
 636   // CHECK: %[[this_inner_asint:.*]] = ptrtoint ptr %[[this_inner]] to i
 637   // CHECK: %[[this_inner_misalignment:.*]] = and i{{32|64}} %[[this_inner_asint]], {{3|7}},
 638   // CHECK: %[[this_inner_isaligned:.*]] = icmp eq i{{32|64}} %[[this_inner_misalignment]], 0
 639   // CHECK: %[[this_inner_valid:.*]] = and i1 %[[this_inner_isnonnull]], %[[this_inner_isaligned]],
 640   // CHECK: br i1 %[[this_inner_valid:.*]]
 641   [&] { return this; } ();
 642 }
 643
 644 namespace CopyValueRepresentation {
 645   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S3aSERKS0_
 646   // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
 647   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S4aSEOS0_
 648   // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
 649   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S1C2ERKS0_
 650   // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
 651   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S2C2ERKS0_
 652   // CHECK: __ubsan_handle_load_invalid_value
 653   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S5C2ERKS0_
 654   // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
 655
 656   struct CustomCopy { CustomCopy(); CustomCopy(const CustomCopy&); };
 657   struct S1 {
 658     CustomCopy CC;
 659     bool b;
 660   };
 661   void callee1(S1);
 662   void test1() {
 663     S1 s11;
 664     callee1(s11);
 665     S1 s12;
 666     s12 = s11;
 667   }
 668
 669   static bool some_global_bool;
 670   struct ExprCopy {
 671     ExprCopy();
 672     ExprCopy(const ExprCopy&, bool b = some_global_bool);
 673   };
 674   struct S2 {
 675     ExprCopy EC;
 676     bool b;
 677   };
 678   void callee2(S2);
 679   void test2(void) {
 680     S2 s21;
 681     callee2(s21);
 682     S2 s22;
 683     s22 = s21;
 684   }
 685
 686   struct CustomAssign { CustomAssign &operator=(const CustomAssign&); };
 687   struct S3 {
 688     CustomAssign CA;
 689     bool b;
 690   };
 691   void test3() {
 692     S3 x, y;
 693     x = y;
 694   }
 695
 696   struct CustomMove {
 697     CustomMove();
 698     CustomMove(const CustomMove&&);
 699     CustomMove &operator=(const CustomMove&&);
 700   };
 701   struct S4 {
 702     CustomMove CM;
 703     bool b;
 704   };
 705   void test4() {
 706     S4 x, y;
 707     x = static_cast<S4&&>(y);
 708   }
 709
 710   struct EnumCustomCopy {
 711     EnumCustomCopy();
 712     EnumCustomCopy(const EnumCustomCopy&);
 713   };
 714   struct S5 {
 715     EnumCustomCopy ECC;
 716     bool b;
 717   };
 718   void callee5(S5);
 719   void test5() {
 720     S5 s51;
 721     callee5(s51);
 722     S5 s52;
 723     s52 = s51;
 724   }
 725 }
 726
 727 void ThisAlign::this_align_lambda_2() {
 728   // CHECK-LABEL: define internal void @"_ZZN9ThisAlign19this_align_lambda_2EvENK3$_0clEv"
 729   // CHECK-SAME: (ptr {{[^,]*}} %[[this:[^)]*]])
 730   // CHECK: %[[this_addr:.*]] = alloca
 731   // CHECK: store ptr %[[this]], ptr %[[this_addr]],
 732   // CHECK: %[[this_inner:.*]] = load ptr, ptr %[[this_addr]],
 733   //
 734   // Do not perform a null check on the 'this' pointer if the function might be
 735   // called from a static invoker.
 736   // CHECK-NOT: icmp ne ptr %[[this_inner]], null
 737   auto *p = +[] {};
 738   p();
 739 }
 740
 741 // CHECK: attributes [[NR_NUW]] = { noreturn nounwind }
 742
 743 // CHECK-FUNCSAN: ![[FUNCSAN]] = !{i32 -1056584962, i32 -1000226989}