1*67e74705SXin Li // RUN: %clang_cc1 -std=c++11 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -fsanitize-recover=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -emit-llvm %s -o - -triple x86_64-linux-gnu | opt -instnamer -S | FileCheck %s
2*67e74705SXin Li // RUN: %clang_cc1 -std=c++11 -fsanitize=vptr,address -fsanitize-recover=vptr,address -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=CHECK-ASAN
3*67e74705SXin Li // RUN: %clang_cc1 -std=c++11 -fsanitize=vptr -fsanitize-recover=vptr -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=DOWNCAST-NULL
4*67e74705SXin Li // RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple x86_64-linux-gnux32 | FileCheck %s --check-prefix=CHECK-X32
5*67e74705SXin Li // RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple i386-linux-gnu | FileCheck %s --check-prefix=CHECK-X86
6*67e74705SXin Li
7*67e74705SXin Li struct S {
8*67e74705SXin Li double d;
9*67e74705SXin Li int a, b;
10*67e74705SXin Li virtual int f();
11*67e74705SXin Li };
12*67e74705SXin Li
13*67e74705SXin Li // Check that type descriptor global is not modified by ASan.
14*67e74705SXin Li // CHECK-ASAN: [[TYPE_DESCR:@[0-9]+]] = private unnamed_addr constant { i16, i16, [4 x i8] } { i16 -1, i16 0, [4 x i8] c"'S'\00" }
15*67e74705SXin Li
16*67e74705SXin Li // Check that type mismatch handler is not modified by ASan.
17*67e74705SXin Li // CHECK-ASAN: private unnamed_addr global { { [{{.*}} x i8]*, i32, i32 }, { i16, i16, [4 x i8] }*, i8*, i8 } { {{.*}}, { i16, i16, [4 x i8] }* [[TYPE_DESCR]], {{.*}} }
18*67e74705SXin Li
19*67e74705SXin Li struct T : S {};
20*67e74705SXin Li
21*67e74705SXin Li // CHECK-LABEL: @_Z17reference_binding
reference_binding(int * p,S * q)22*67e74705SXin Li void reference_binding(int *p, S *q) {
23*67e74705SXin Li // C++ core issue 453: If an lvalue to which a reference is directly bound
24*67e74705SXin Li // designates neither an existing object or function of an appropriate type,
25*67e74705SXin Li // nor a region of storage of suitable size and alignment to contain an object
26*67e74705SXin Li // of the reference's type, the behavior is undefined.
27*67e74705SXin Li
28*67e74705SXin Li // CHECK: icmp ne {{.*}}, null
29*67e74705SXin Li
30*67e74705SXin Li // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
31*67e74705SXin Li // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
32*67e74705SXin Li
33*67e74705SXin Li // CHECK: %[[PTRINT:.*]] = ptrtoint
34*67e74705SXin Li // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
35*67e74705SXin Li // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
36*67e74705SXin Li int &r = *p;
37*67e74705SXin Li
38*67e74705SXin Li // A reference is not required to refer to an object within its lifetime.
39*67e74705SXin Li // CHECK-NOT: __ubsan_handle_dynamic_type_cache_miss
40*67e74705SXin Li S &r2 = *q;
41*67e74705SXin Li }
42*67e74705SXin Li
43*67e74705SXin Li // CHECK-LABEL: @_Z13member_access
44*67e74705SXin Li // CHECK-ASAN-LABEL: @_Z13member_access
member_access(S * p)45*67e74705SXin Li void member_access(S *p) {
46*67e74705SXin Li // (1a) Check 'p' is appropriately sized and aligned for member access.
47*67e74705SXin Li
48*67e74705SXin Li // CHECK: icmp ne {{.*}}, null
49*67e74705SXin Li
50*67e74705SXin Li // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
51*67e74705SXin Li // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
52*67e74705SXin Li
53*67e74705SXin Li // CHECK: %[[PTRINT:.*]] = ptrtoint
54*67e74705SXin Li // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
55*67e74705SXin Li // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
56*67e74705SXin Li
57*67e74705SXin Li // (1b) Check that 'p' actually points to an 'S'.
58*67e74705SXin Li
59*67e74705SXin Li // CHECK: %[[VPTRADDR:.*]] = bitcast {{.*}} to i64*
60*67e74705SXin Li // CHECK-NEXT: %[[VPTR:.*]] = load i64, i64* %[[VPTRADDR]]
61*67e74705SXin Li //
62*67e74705SXin Li // hash_16_bytes:
63*67e74705SXin Li //
64*67e74705SXin Li // If this number changes, it indicates that either the mangled name of ::S
65*67e74705SXin Li // has changed, or that LLVM's hashing function has changed. The latter case
66*67e74705SXin Li // is OK if the hashing function is still stable.
67*67e74705SXin Li //
68*67e74705SXin Li // The two hash values are for 64- and 32-bit Clang binaries, respectively.
69*67e74705SXin Li // FIXME: We should produce a 64-bit value either way.
70*67e74705SXin Li //
71*67e74705SXin Li // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}}, %[[VPTR]]
72*67e74705SXin Li // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
73*67e74705SXin Li // CHECK-NEXT: lshr i64 {{.*}}, 47
74*67e74705SXin Li // CHECK-NEXT: xor i64
75*67e74705SXin Li // CHECK-NEXT: xor i64 %[[VPTR]]
76*67e74705SXin Li // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
77*67e74705SXin Li // CHECK-NEXT: lshr i64 {{.*}}, 47
78*67e74705SXin Li // CHECK-NEXT: xor i64
79*67e74705SXin Li // CHECK-NEXT: %[[HASH:.*]] = mul i64 {{.*}}, -7070675565921424023
80*67e74705SXin Li //
81*67e74705SXin Li // Check the hash against the table:
82*67e74705SXin Li //
83*67e74705SXin Li // CHECK-NEXT: %[[IDX:.*]] = and i64 %{{.*}}, 127
84*67e74705SXin Li // CHECK-NEXT: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %[[IDX]]
85*67e74705SXin Li // CHECK-NEXT: %[[CACHEVAL:.*]] = load i64, i64*
86*67e74705SXin Li // CHECK-NEXT: icmp eq i64 %[[CACHEVAL]], %[[HASH]]
87*67e74705SXin Li // CHECK-NEXT: br i1
88*67e74705SXin Li
89*67e74705SXin Li // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %[[HASH]])
90*67e74705SXin Li // CHECK-NOT: unreachable
91*67e74705SXin Li // CHECK: {{.*}}:
92*67e74705SXin Li
93*67e74705SXin Li // (2) Check 'p->b' is appropriately sized and aligned for a load.
94*67e74705SXin Li
95*67e74705SXin Li // FIXME: Suppress this in the trivial case of a member access, because we
96*67e74705SXin Li // know we've just checked the member access expression itself.
97*67e74705SXin Li
98*67e74705SXin Li // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
99*67e74705SXin Li // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
100*67e74705SXin Li
101*67e74705SXin Li // CHECK: %[[PTRINT:.*]] = ptrtoint
102*67e74705SXin Li // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
103*67e74705SXin Li // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
104*67e74705SXin Li int k = p->b;
105*67e74705SXin Li
106*67e74705SXin Li // (3a) Check 'p' is appropriately sized and aligned for member function call.
107*67e74705SXin Li
108*67e74705SXin Li // CHECK: icmp ne {{.*}}, null
109*67e74705SXin Li
110*67e74705SXin Li // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
111*67e74705SXin Li // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
112*67e74705SXin Li
113*67e74705SXin Li // CHECK: %[[PTRINT:.*]] = ptrtoint
114*67e74705SXin Li // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
115*67e74705SXin Li // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
116*67e74705SXin Li
117*67e74705SXin Li // (3b) Check that 'p' actually points to an 'S'
118*67e74705SXin Li
119*67e74705SXin Li // CHECK: load i64, i64*
120*67e74705SXin Li // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}},
121*67e74705SXin Li // [...]
122*67e74705SXin Li // CHECK: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %
123*67e74705SXin Li // CHECK: br i1
124*67e74705SXin Li // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %{{.*}})
125*67e74705SXin Li // CHECK-NOT: unreachable
126*67e74705SXin Li // CHECK: {{.*}}:
127*67e74705SXin Li
128*67e74705SXin Li k = p->f();
129*67e74705SXin Li }
130*67e74705SXin Li
131*67e74705SXin Li // CHECK-LABEL: @_Z12lsh_overflow
lsh_overflow(int a,int b)132*67e74705SXin Li int lsh_overflow(int a, int b) {
133*67e74705SXin Li // CHECK: %[[RHS_INBOUNDS:.*]] = icmp ule i32 %[[RHS:.*]], 31
134*67e74705SXin Li // CHECK-NEXT: br i1 %[[RHS_INBOUNDS]], label %[[CHECK_BB:.*]], label %[[CONT_BB:.*]],
135*67e74705SXin Li
136*67e74705SXin Li // CHECK: [[CHECK_BB]]:
137*67e74705SXin Li // CHECK-NEXT: %[[SHIFTED_OUT_WIDTH:.*]] = sub nuw nsw i32 31, %[[RHS]]
138*67e74705SXin Li // CHECK-NEXT: %[[SHIFTED_OUT:.*]] = lshr i32 %[[LHS:.*]], %[[SHIFTED_OUT_WIDTH]]
139*67e74705SXin Li
140*67e74705SXin Li // This is present for C++11 but not for C: C++ core issue 1457 allows a '1'
141*67e74705SXin Li // to be shifted into the sign bit, but not out of it.
142*67e74705SXin Li // CHECK-NEXT: %[[SHIFTED_OUT_NOT_SIGN:.*]] = lshr i32 %[[SHIFTED_OUT]], 1
143*67e74705SXin Li
144*67e74705SXin Li // CHECK-NEXT: %[[NO_OVERFLOW:.*]] = icmp eq i32 %[[SHIFTED_OUT_NOT_SIGN]], 0
145*67e74705SXin Li // CHECK-NEXT: br label %[[CONT_BB]]
146*67e74705SXin Li
147*67e74705SXin Li // CHECK: [[CONT_BB]]:
148*67e74705SXin Li // CHECK-NEXT: %[[VALID_BASE:.*]] = phi i1 [ true, {{.*}} ], [ %[[NO_OVERFLOW]], %[[CHECK_BB]] ]
149*67e74705SXin Li // CHECK-NEXT: %[[VALID:.*]] = and i1 %[[RHS_INBOUNDS]], %[[VALID_BASE]]
150*67e74705SXin Li // CHECK-NEXT: br i1 %[[VALID]]
151*67e74705SXin Li
152*67e74705SXin Li // CHECK: call void @__ubsan_handle_shift_out_of_bounds
153*67e74705SXin Li // CHECK-NOT: call void @__ubsan_handle_shift_out_of_bounds
154*67e74705SXin Li
155*67e74705SXin Li // CHECK: %[[RET:.*]] = shl i32 %[[LHS]], %[[RHS]]
156*67e74705SXin Li // CHECK-NEXT: ret i32 %[[RET]]
157*67e74705SXin Li return a << b;
158*67e74705SXin Li }
159*67e74705SXin Li
160*67e74705SXin Li // CHECK-LABEL: @_Z9no_return
no_return()161*67e74705SXin Li int no_return() {
162*67e74705SXin Li // CHECK: call void @__ubsan_handle_missing_return(i8* bitcast ({{.*}}* @{{.*}} to i8*)) [[NR_NUW:#[0-9]+]]
163*67e74705SXin Li // CHECK-NEXT: unreachable
164*67e74705SXin Li }
165*67e74705SXin Li
166*67e74705SXin Li // CHECK-LABEL: @_Z9sour_bool
sour_bool(bool * p)167*67e74705SXin Li bool sour_bool(bool *p) {
168*67e74705SXin Li // CHECK: %[[OK:.*]] = icmp ule i8 {{.*}}, 1
169*67e74705SXin Li // CHECK: br i1 %[[OK]]
170*67e74705SXin Li // CHECK: call void @__ubsan_handle_load_invalid_value(i8* bitcast ({{.*}}), i64 {{.*}})
171*67e74705SXin Li return *p;
172*67e74705SXin Li }
173*67e74705SXin Li
174*67e74705SXin Li enum E1 { e1a = 0, e1b = 127 } e1;
175*67e74705SXin Li enum E2 { e2a = -1, e2b = 64 } e2;
176*67e74705SXin Li enum E3 { e3a = (1u << 31) - 1 } e3;
177*67e74705SXin Li
178*67e74705SXin Li // CHECK-LABEL: @_Z14bad_enum_value
bad_enum_value()179*67e74705SXin Li int bad_enum_value() {
180*67e74705SXin Li // CHECK: %[[E1:.*]] = icmp ule i32 {{.*}}, 127
181*67e74705SXin Li // CHECK: br i1 %[[E1]]
182*67e74705SXin Li // CHECK: call void @__ubsan_handle_load_invalid_value(
183*67e74705SXin Li int a = e1;
184*67e74705SXin Li
185*67e74705SXin Li // CHECK: %[[E2HI:.*]] = icmp sle i32 {{.*}}, 127
186*67e74705SXin Li // CHECK: %[[E2LO:.*]] = icmp sge i32 {{.*}}, -128
187*67e74705SXin Li // CHECK: %[[E2:.*]] = and i1 %[[E2HI]], %[[E2LO]]
188*67e74705SXin Li // CHECK: br i1 %[[E2]]
189*67e74705SXin Li // CHECK: call void @__ubsan_handle_load_invalid_value(
190*67e74705SXin Li int b = e2;
191*67e74705SXin Li
192*67e74705SXin Li // CHECK: %[[E3:.*]] = icmp ule i32 {{.*}}, 2147483647
193*67e74705SXin Li // CHECK: br i1 %[[E3]]
194*67e74705SXin Li // CHECK: call void @__ubsan_handle_load_invalid_value(
195*67e74705SXin Li int c = e3;
196*67e74705SXin Li return a + b + c;
197*67e74705SXin Li }
198*67e74705SXin Li
199*67e74705SXin Li // CHECK-LABEL: @_Z20bad_downcast_pointer
200*67e74705SXin Li // DOWNCAST-NULL-LABEL: @_Z20bad_downcast_pointer
bad_downcast_pointer(S * p)201*67e74705SXin Li void bad_downcast_pointer(S *p) {
202*67e74705SXin Li // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
203*67e74705SXin Li // CHECK: br i1 %[[NONNULL]],
204*67e74705SXin Li
205*67e74705SXin Li // A null poiner access is guarded without -fsanitize=null.
206*67e74705SXin Li // DOWNCAST-NULL: %[[NONNULL:.*]] = icmp ne {{.*}}, null
207*67e74705SXin Li // DOWNCAST-NULL: br i1 %[[NONNULL]],
208*67e74705SXin Li
209*67e74705SXin Li // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
210*67e74705SXin Li // CHECK: %[[E1:.*]] = icmp uge i64 %[[SIZE]], 24
211*67e74705SXin Li // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
212*67e74705SXin Li // CHECK: %[[E2:.*]] = icmp eq i64 %[[MISALIGN]], 0
213*67e74705SXin Li // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
214*67e74705SXin Li // CHECK: br i1 %[[E12]],
215*67e74705SXin Li
216*67e74705SXin Li // CHECK: call void @__ubsan_handle_type_mismatch
217*67e74705SXin Li // CHECK: br label
218*67e74705SXin Li
219*67e74705SXin Li // CHECK: br i1 %{{.*}},
220*67e74705SXin Li
221*67e74705SXin Li // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
222*67e74705SXin Li // CHECK: br label
223*67e74705SXin Li (void) static_cast<T*>(p);
224*67e74705SXin Li }
225*67e74705SXin Li
226*67e74705SXin Li // CHECK-LABEL: @_Z22bad_downcast_reference
bad_downcast_reference(S & p)227*67e74705SXin Li void bad_downcast_reference(S &p) {
228*67e74705SXin Li // CHECK: %[[E1:.*]] = icmp ne {{.*}}, null
229*67e74705SXin Li // CHECK-NOT: br i1
230*67e74705SXin Li
231*67e74705SXin Li // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
232*67e74705SXin Li // CHECK: %[[E2:.*]] = icmp uge i64 %[[SIZE]], 24
233*67e74705SXin Li
234*67e74705SXin Li // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
235*67e74705SXin Li // CHECK: %[[E3:.*]] = icmp eq i64 %[[MISALIGN]], 0
236*67e74705SXin Li
237*67e74705SXin Li // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
238*67e74705SXin Li // CHECK: %[[E123:.*]] = and i1 %[[E12]], %[[E3]]
239*67e74705SXin Li // CHECK: br i1 %[[E123]],
240*67e74705SXin Li
241*67e74705SXin Li // CHECK: call void @__ubsan_handle_type_mismatch
242*67e74705SXin Li // CHECK: br label
243*67e74705SXin Li
244*67e74705SXin Li // CHECK: br i1 %{{.*}},
245*67e74705SXin Li
246*67e74705SXin Li // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
247*67e74705SXin Li // CHECK: br label
248*67e74705SXin Li (void) static_cast<T&>(p);
249*67e74705SXin Li }
250*67e74705SXin Li
251*67e74705SXin Li // CHECK-LABEL: @_Z11array_index
array_index(const int (& a)[4],int n)252*67e74705SXin Li int array_index(const int (&a)[4], int n) {
253*67e74705SXin Li // CHECK: %[[K1_OK:.*]] = icmp ult i64 %{{.*}}, 4
254*67e74705SXin Li // CHECK: br i1 %[[K1_OK]]
255*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
256*67e74705SXin Li int k1 = a[n];
257*67e74705SXin Li
258*67e74705SXin Li // CHECK: %[[R1_OK:.*]] = icmp ule i64 %{{.*}}, 4
259*67e74705SXin Li // CHECK: br i1 %[[R1_OK]]
260*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
261*67e74705SXin Li const int *r1 = &a[n];
262*67e74705SXin Li
263*67e74705SXin Li // CHECK: %[[K2_OK:.*]] = icmp ult i64 %{{.*}}, 8
264*67e74705SXin Li // CHECK: br i1 %[[K2_OK]]
265*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
266*67e74705SXin Li int k2 = ((const int(&)[8])a)[n];
267*67e74705SXin Li
268*67e74705SXin Li // CHECK: %[[K3_OK:.*]] = icmp ult i64 %{{.*}}, 4
269*67e74705SXin Li // CHECK: br i1 %[[K3_OK]]
270*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
271*67e74705SXin Li int k3 = n[a];
272*67e74705SXin Li
273*67e74705SXin Li return k1 + *r1 + k2;
274*67e74705SXin Li }
275*67e74705SXin Li
276*67e74705SXin Li // CHECK-LABEL: @_Z17multi_array_index
multi_array_index(int n,int m)277*67e74705SXin Li int multi_array_index(int n, int m) {
278*67e74705SXin Li int arr[4][6];
279*67e74705SXin Li
280*67e74705SXin Li // CHECK: %[[IDX2_OK:.*]] = icmp ult i64 %{{.*}}, 6
281*67e74705SXin Li // CHECK: br i1 %[[IDX2_OK]]
282*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
283*67e74705SXin Li
284*67e74705SXin Li // CHECK: %[[IDX1_OK:.*]] = icmp ult i64 %{{.*}}, 4
285*67e74705SXin Li // CHECK: br i1 %[[IDX1_OK]]
286*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
287*67e74705SXin Li return arr[n][m];
288*67e74705SXin Li }
289*67e74705SXin Li
290*67e74705SXin Li // CHECK-LABEL: @_Z11array_arith
array_arith(const int (& a)[4],int n)291*67e74705SXin Li int array_arith(const int (&a)[4], int n) {
292*67e74705SXin Li // CHECK: %[[K1_OK:.*]] = icmp ule i64 %{{.*}}, 4
293*67e74705SXin Li // CHECK: br i1 %[[K1_OK]]
294*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
295*67e74705SXin Li const int *k1 = a + n;
296*67e74705SXin Li
297*67e74705SXin Li // CHECK: %[[K2_OK:.*]] = icmp ule i64 %{{.*}}, 8
298*67e74705SXin Li // CHECK: br i1 %[[K2_OK]]
299*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
300*67e74705SXin Li const int *k2 = (const int(&)[8])a + n;
301*67e74705SXin Li
302*67e74705SXin Li return *k1 + *k2;
303*67e74705SXin Li }
304*67e74705SXin Li
305*67e74705SXin Li struct ArrayMembers {
306*67e74705SXin Li int a1[5];
307*67e74705SXin Li int a2[1];
308*67e74705SXin Li };
309*67e74705SXin Li // CHECK-LABEL: @_Z18struct_array_index
struct_array_index(ArrayMembers * p,int n)310*67e74705SXin Li int struct_array_index(ArrayMembers *p, int n) {
311*67e74705SXin Li // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 5
312*67e74705SXin Li // CHECK: br i1 %[[IDX_OK]]
313*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
314*67e74705SXin Li return p->a1[n];
315*67e74705SXin Li }
316*67e74705SXin Li
317*67e74705SXin Li // CHECK-LABEL: @_Z16flex_array_index
flex_array_index(ArrayMembers * p,int n)318*67e74705SXin Li int flex_array_index(ArrayMembers *p, int n) {
319*67e74705SXin Li // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
320*67e74705SXin Li return p->a2[n];
321*67e74705SXin Li }
322*67e74705SXin Li
323*67e74705SXin Li extern int incomplete[];
324*67e74705SXin Li // CHECK-LABEL: @_Z22incomplete_array_index
incomplete_array_index(int n)325*67e74705SXin Li int incomplete_array_index(int n) {
326*67e74705SXin Li // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
327*67e74705SXin Li return incomplete[n];
328*67e74705SXin Li }
329*67e74705SXin Li
330*67e74705SXin Li typedef __attribute__((ext_vector_type(4))) int V4I;
331*67e74705SXin Li // CHECK-LABEL: @_Z12vector_index
vector_index(V4I v,int n)332*67e74705SXin Li int vector_index(V4I v, int n) {
333*67e74705SXin Li // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 4
334*67e74705SXin Li // CHECK: br i1 %[[IDX_OK]]
335*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
336*67e74705SXin Li return v[n];
337*67e74705SXin Li }
338*67e74705SXin Li
339*67e74705SXin Li // CHECK-LABEL: @_Z12string_index
string_index(int n)340*67e74705SXin Li char string_index(int n) {
341*67e74705SXin Li // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 6
342*67e74705SXin Li // CHECK: br i1 %[[IDX_OK]]
343*67e74705SXin Li // CHECK: call void @__ubsan_handle_out_of_bounds(
344*67e74705SXin Li return "Hello"[n];
345*67e74705SXin Li }
346*67e74705SXin Li
347*67e74705SXin Li class A // align=4
348*67e74705SXin Li {
349*67e74705SXin Li int a1, a2, a3;
350*67e74705SXin Li };
351*67e74705SXin Li
352*67e74705SXin Li class B // align=8
353*67e74705SXin Li {
354*67e74705SXin Li long b1, b2;
355*67e74705SXin Li };
356*67e74705SXin Li
357*67e74705SXin Li class C : public A, public B // align=16
358*67e74705SXin Li {
359*67e74705SXin Li alignas(16) int c1;
360*67e74705SXin Li };
361*67e74705SXin Li
362*67e74705SXin Li // Make sure we check the alignment of the pointer after subtracting any
363*67e74705SXin Li // offset. The pointer before subtraction doesn't need to be aligned for
364*67e74705SXin Li // the destination type.
365*67e74705SXin Li
366*67e74705SXin Li // CHECK-LABEL: define void @_Z16downcast_pointerP1B(%class.B* %b)
downcast_pointer(B * b)367*67e74705SXin Li void downcast_pointer(B *b) {
368*67e74705SXin Li (void) static_cast<C*>(b);
369*67e74705SXin Li // Alignment check from EmitTypeCheck(TCK_DowncastPointer, ...)
370*67e74705SXin Li // CHECK: [[SUB:%[.a-z0-9]*]] = getelementptr i8, i8* {{.*}}, i64 -16
371*67e74705SXin Li // CHECK-NEXT: [[C:%.+]] = bitcast i8* [[SUB]] to %class.C*
372*67e74705SXin Li // null check goes here
373*67e74705SXin Li // CHECK: [[FROM_PHI:%.+]] = phi %class.C* [ [[C]], {{.*}} ], {{.*}}
374*67e74705SXin Li // Objectsize check goes here
375*67e74705SXin Li // CHECK: [[C_INT:%.+]] = ptrtoint %class.C* [[FROM_PHI]] to i64
376*67e74705SXin Li // CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
377*67e74705SXin Li // CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
378*67e74705SXin Li // AND the alignment test with the objectsize test.
379*67e74705SXin Li // CHECK-NEXT: [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
380*67e74705SXin Li // CHECK-NEXT: br i1 [[AND]]
381*67e74705SXin Li }
382*67e74705SXin Li
383*67e74705SXin Li // CHECK-LABEL: define void @_Z18downcast_referenceR1B(%class.B* dereferenceable({{[0-9]+}}) %b)
downcast_reference(B & b)384*67e74705SXin Li void downcast_reference(B &b) {
385*67e74705SXin Li (void) static_cast<C&>(b);
386*67e74705SXin Li // Alignment check from EmitTypeCheck(TCK_DowncastReference, ...)
387*67e74705SXin Li // CHECK: [[SUB:%[.a-z0-9]*]] = getelementptr i8, i8* {{.*}}, i64 -16
388*67e74705SXin Li // CHECK-NEXT: [[C:%.+]] = bitcast i8* [[SUB]] to %class.C*
389*67e74705SXin Li // Objectsize check goes here
390*67e74705SXin Li // CHECK: [[C_INT:%.+]] = ptrtoint %class.C* [[C]] to i64
391*67e74705SXin Li // CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
392*67e74705SXin Li // CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
393*67e74705SXin Li // AND the alignment test with the objectsize test.
394*67e74705SXin Li // CHECK: [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
395*67e74705SXin Li // CHECK-NEXT: br i1 [[AND]]
396*67e74705SXin Li }
397*67e74705SXin Li
398*67e74705SXin Li // CHECK-LABEL: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413876459, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
399*67e74705SXin Li // CHECK-X32: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413875435, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
400*67e74705SXin Li // CHECK-X86: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413875435, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
indirect_function_call(void (* p)(int))401*67e74705SXin Li void indirect_function_call(void (*p)(int)) {
402*67e74705SXin Li // CHECK: [[PTR:%.+]] = bitcast void (i32)* {{.*}} to <{ i32, i8* }>*
403*67e74705SXin Li
404*67e74705SXin Li // Signature check
405*67e74705SXin Li // CHECK-NEXT: [[SIGPTR:%.+]] = getelementptr <{ i32, i8* }>, <{ i32, i8* }>* [[PTR]], i32 0, i32 0
406*67e74705SXin Li // CHECK-NEXT: [[SIG:%.+]] = load i32, i32* [[SIGPTR]]
407*67e74705SXin Li // CHECK-NEXT: [[SIGCMP:%.+]] = icmp eq i32 [[SIG]], 1413876459
408*67e74705SXin Li // CHECK-NEXT: br i1 [[SIGCMP]]
409*67e74705SXin Li
410*67e74705SXin Li // RTTI pointer check
411*67e74705SXin Li // CHECK: [[RTTIPTR:%.+]] = getelementptr <{ i32, i8* }>, <{ i32, i8* }>* [[PTR]], i32 0, i32 1
412*67e74705SXin Li // CHECK-NEXT: [[RTTI:%.+]] = load i8*, i8** [[RTTIPTR]]
413*67e74705SXin Li // CHECK-NEXT: [[RTTICMP:%.+]] = icmp eq i8* [[RTTI]], bitcast ({ i8*, i8* }* @_ZTIFviE to i8*)
414*67e74705SXin Li // CHECK-NEXT: br i1 [[RTTICMP]]
415*67e74705SXin Li p(42);
416*67e74705SXin Li }
417*67e74705SXin Li
418*67e74705SXin Li namespace UpcastPointerTest {
419*67e74705SXin Li struct S {};
420*67e74705SXin Li struct T : S { double d; };
421*67e74705SXin Li struct V : virtual S {};
422*67e74705SXin Li
423*67e74705SXin Li // CHECK-LABEL: upcast_pointer
upcast_pointer(T * t)424*67e74705SXin Li S* upcast_pointer(T* t) {
425*67e74705SXin Li // Check for null pointer
426*67e74705SXin Li // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
427*67e74705SXin Li // CHECK: br i1 %[[NONNULL]]
428*67e74705SXin Li
429*67e74705SXin Li // Check alignment
430*67e74705SXin Li // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
431*67e74705SXin Li // CHECK: icmp eq i64 %[[MISALIGN]], 0
432*67e74705SXin Li
433*67e74705SXin Li // CHECK: call void @__ubsan_handle_type_mismatch
434*67e74705SXin Li return t;
435*67e74705SXin Li }
436*67e74705SXin Li
437*67e74705SXin Li V getV();
438*67e74705SXin Li
439*67e74705SXin Li // CHECK-LABEL: upcast_to_vbase
upcast_to_vbase()440*67e74705SXin Li void upcast_to_vbase() {
441*67e74705SXin Li // No need to check for null here, as we have a temporary here.
442*67e74705SXin Li
443*67e74705SXin Li // CHECK-NOT: br i1
444*67e74705SXin Li
445*67e74705SXin Li // CHECK: call i64 @llvm.objectsize
446*67e74705SXin Li // CHECK: call void @__ubsan_handle_type_mismatch
447*67e74705SXin Li // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
448*67e74705SXin Li const S& s = getV();
449*67e74705SXin Li }
450*67e74705SXin Li }
451*67e74705SXin Li
452*67e74705SXin Li namespace CopyValueRepresentation {
453*67e74705SXin Li // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S3aSERKS0_
454*67e74705SXin Li // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
455*67e74705SXin Li // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S4aSEOS0_
456*67e74705SXin Li // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
457*67e74705SXin Li // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S1C2ERKS0_
458*67e74705SXin Li // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
459*67e74705SXin Li // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S2C2ERKS0_
460*67e74705SXin Li // CHECK: __ubsan_handle_load_invalid_value
461*67e74705SXin Li // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S5C2ERKS0_
462*67e74705SXin Li // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
463*67e74705SXin Li
464*67e74705SXin Li struct CustomCopy { CustomCopy(); CustomCopy(const CustomCopy&); };
465*67e74705SXin Li struct S1 {
466*67e74705SXin Li CustomCopy CC;
467*67e74705SXin Li bool b;
468*67e74705SXin Li };
469*67e74705SXin Li void callee1(S1);
test1()470*67e74705SXin Li void test1() {
471*67e74705SXin Li S1 s11;
472*67e74705SXin Li callee1(s11);
473*67e74705SXin Li S1 s12;
474*67e74705SXin Li s12 = s11;
475*67e74705SXin Li }
476*67e74705SXin Li
477*67e74705SXin Li static bool some_global_bool;
478*67e74705SXin Li struct ExprCopy {
479*67e74705SXin Li ExprCopy();
480*67e74705SXin Li ExprCopy(const ExprCopy&, bool b = some_global_bool);
481*67e74705SXin Li };
482*67e74705SXin Li struct S2 {
483*67e74705SXin Li ExprCopy EC;
484*67e74705SXin Li bool b;
485*67e74705SXin Li };
486*67e74705SXin Li void callee2(S2);
test2(void)487*67e74705SXin Li void test2(void) {
488*67e74705SXin Li S2 s21;
489*67e74705SXin Li callee2(s21);
490*67e74705SXin Li S2 s22;
491*67e74705SXin Li s22 = s21;
492*67e74705SXin Li }
493*67e74705SXin Li
494*67e74705SXin Li struct CustomAssign { CustomAssign &operator=(const CustomAssign&); };
495*67e74705SXin Li struct S3 {
496*67e74705SXin Li CustomAssign CA;
497*67e74705SXin Li bool b;
498*67e74705SXin Li };
test3()499*67e74705SXin Li void test3() {
500*67e74705SXin Li S3 x, y;
501*67e74705SXin Li x = y;
502*67e74705SXin Li }
503*67e74705SXin Li
504*67e74705SXin Li struct CustomMove {
505*67e74705SXin Li CustomMove();
506*67e74705SXin Li CustomMove(const CustomMove&&);
507*67e74705SXin Li CustomMove &operator=(const CustomMove&&);
508*67e74705SXin Li };
509*67e74705SXin Li struct S4 {
510*67e74705SXin Li CustomMove CM;
511*67e74705SXin Li bool b;
512*67e74705SXin Li };
test4()513*67e74705SXin Li void test4() {
514*67e74705SXin Li S4 x, y;
515*67e74705SXin Li x = static_cast<S4&&>(y);
516*67e74705SXin Li }
517*67e74705SXin Li
518*67e74705SXin Li struct EnumCustomCopy {
519*67e74705SXin Li EnumCustomCopy();
520*67e74705SXin Li EnumCustomCopy(const EnumCustomCopy&);
521*67e74705SXin Li };
522*67e74705SXin Li struct S5 {
523*67e74705SXin Li EnumCustomCopy ECC;
524*67e74705SXin Li bool b;
525*67e74705SXin Li };
526*67e74705SXin Li void callee5(S5);
test5()527*67e74705SXin Li void test5() {
528*67e74705SXin Li S5 s51;
529*67e74705SXin Li callee5(s51);
530*67e74705SXin Li S5 s52;
531*67e74705SXin Li s52 = s51;
532*67e74705SXin Li }
533*67e74705SXin Li }
534*67e74705SXin Li
535*67e74705SXin Li // CHECK: attributes [[NR_NUW]] = { noreturn nounwind }
536