1 //===--- CGClass.cpp - Emit LLVM Code for C++ classes -----------*- C++ -*-===// 2 // 3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions. 4 // See https://llvm.org/LICENSE.txt for license information. 5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception 6 // 7 //===----------------------------------------------------------------------===// 8 // 9 // This contains code dealing with C++ code generation of classes 10 // 11 //===----------------------------------------------------------------------===// 12 13 #include "CGBlocks.h" 14 #include "CGCXXABI.h" 15 #include "CGDebugInfo.h" 16 #include "CGRecordLayout.h" 17 #include "CodeGenFunction.h" 18 #include "TargetInfo.h" 19 #include "clang/AST/Attr.h" 20 #include "clang/AST/CXXInheritance.h" 21 #include "clang/AST/CharUnits.h" 22 #include "clang/AST/DeclTemplate.h" 23 #include "clang/AST/EvaluatedExprVisitor.h" 24 #include "clang/AST/RecordLayout.h" 25 #include "clang/AST/StmtCXX.h" 26 #include "clang/Basic/CodeGenOptions.h" 27 #include "clang/Basic/TargetBuiltins.h" 28 #include "clang/CodeGen/CGFunctionInfo.h" 29 #include "llvm/IR/Intrinsics.h" 30 #include "llvm/IR/Metadata.h" 31 #include "llvm/Transforms/Utils/SanitizerStats.h" 32 33 using namespace clang; 34 using namespace CodeGen; 35 36 /// Return the best known alignment for an unknown pointer to a 37 /// particular class. 38 CharUnits CodeGenModule::getClassPointerAlignment(const CXXRecordDecl *RD) { 39 if (!RD->hasDefinition()) 40 return CharUnits::One(); // Hopefully won't be used anywhere. 41 42 auto &layout = getContext().getASTRecordLayout(RD); 43 44 // If the class is final, then we know that the pointer points to an 45 // object of that type and can use the full alignment. 46 if (RD->isEffectivelyFinal()) 47 return layout.getAlignment(); 48 49 // Otherwise, we have to assume it could be a subclass. 50 return layout.getNonVirtualAlignment(); 51 } 52 53 /// Return the smallest possible amount of storage that might be allocated 54 /// starting from the beginning of an object of a particular class. 55 /// 56 /// This may be smaller than sizeof(RD) if RD has virtual base classes. 57 CharUnits CodeGenModule::getMinimumClassObjectSize(const CXXRecordDecl *RD) { 58 if (!RD->hasDefinition()) 59 return CharUnits::One(); 60 61 auto &layout = getContext().getASTRecordLayout(RD); 62 63 // If the class is final, then we know that the pointer points to an 64 // object of that type and can use the full alignment. 65 if (RD->isEffectivelyFinal()) 66 return layout.getSize(); 67 68 // Otherwise, we have to assume it could be a subclass. 69 return std::max(layout.getNonVirtualSize(), CharUnits::One()); 70 } 71 72 /// Return the best known alignment for a pointer to a virtual base, 73 /// given the alignment of a pointer to the derived class. 74 CharUnits CodeGenModule::getVBaseAlignment(CharUnits actualDerivedAlign, 75 const CXXRecordDecl *derivedClass, 76 const CXXRecordDecl *vbaseClass) { 77 // The basic idea here is that an underaligned derived pointer might 78 // indicate an underaligned base pointer. 79 80 assert(vbaseClass->isCompleteDefinition()); 81 auto &baseLayout = getContext().getASTRecordLayout(vbaseClass); 82 CharUnits expectedVBaseAlign = baseLayout.getNonVirtualAlignment(); 83 84 return getDynamicOffsetAlignment(actualDerivedAlign, derivedClass, 85 expectedVBaseAlign); 86 } 87 88 CharUnits 89 CodeGenModule::getDynamicOffsetAlignment(CharUnits actualBaseAlign, 90 const CXXRecordDecl *baseDecl, 91 CharUnits expectedTargetAlign) { 92 // If the base is an incomplete type (which is, alas, possible with 93 // member pointers), be pessimistic. 94 if (!baseDecl->isCompleteDefinition()) 95 return std::min(actualBaseAlign, expectedTargetAlign); 96 97 auto &baseLayout = getContext().getASTRecordLayout(baseDecl); 98 CharUnits expectedBaseAlign = baseLayout.getNonVirtualAlignment(); 99 100 // If the class is properly aligned, assume the target offset is, too. 101 // 102 // This actually isn't necessarily the right thing to do --- if the 103 // class is a complete object, but it's only properly aligned for a 104 // base subobject, then the alignments of things relative to it are 105 // probably off as well. (Note that this requires the alignment of 106 // the target to be greater than the NV alignment of the derived 107 // class.) 108 // 109 // However, our approach to this kind of under-alignment can only 110 // ever be best effort; after all, we're never going to propagate 111 // alignments through variables or parameters. Note, in particular, 112 // that constructing a polymorphic type in an address that's less 113 // than pointer-aligned will generally trap in the constructor, 114 // unless we someday add some sort of attribute to change the 115 // assumed alignment of 'this'. So our goal here is pretty much 116 // just to allow the user to explicitly say that a pointer is 117 // under-aligned and then safely access its fields and vtables. 118 if (actualBaseAlign >= expectedBaseAlign) { 119 return expectedTargetAlign; 120 } 121 122 // Otherwise, we might be offset by an arbitrary multiple of the 123 // actual alignment. The correct adjustment is to take the min of 124 // the two alignments. 125 return std::min(actualBaseAlign, expectedTargetAlign); 126 } 127 128 Address CodeGenFunction::LoadCXXThisAddress() { 129 assert(CurFuncDecl && "loading 'this' without a func declaration?"); 130 assert(isa<CXXMethodDecl>(CurFuncDecl)); 131 132 // Lazily compute CXXThisAlignment. 133 if (CXXThisAlignment.isZero()) { 134 // Just use the best known alignment for the parent. 135 // TODO: if we're currently emitting a complete-object ctor/dtor, 136 // we can always use the complete-object alignment. 137 auto RD = cast<CXXMethodDecl>(CurFuncDecl)->getParent(); 138 CXXThisAlignment = CGM.getClassPointerAlignment(RD); 139 } 140 141 return Address(LoadCXXThis(), CXXThisAlignment); 142 } 143 144 /// Emit the address of a field using a member data pointer. 145 /// 146 /// \param E Only used for emergency diagnostics 147 Address 148 CodeGenFunction::EmitCXXMemberDataPointerAddress(const Expr *E, Address base, 149 llvm::Value *memberPtr, 150 const MemberPointerType *memberPtrType, 151 LValueBaseInfo *BaseInfo, 152 TBAAAccessInfo *TBAAInfo) { 153 // Ask the ABI to compute the actual address. 154 llvm::Value *ptr = 155 CGM.getCXXABI().EmitMemberDataPointerAddress(*this, E, base, 156 memberPtr, memberPtrType); 157 158 QualType memberType = memberPtrType->getPointeeType(); 159 CharUnits memberAlign = 160 CGM.getNaturalTypeAlignment(memberType, BaseInfo, TBAAInfo); 161 memberAlign = 162 CGM.getDynamicOffsetAlignment(base.getAlignment(), 163 memberPtrType->getClass()->getAsCXXRecordDecl(), 164 memberAlign); 165 return Address(ptr, memberAlign); 166 } 167 168 CharUnits CodeGenModule::computeNonVirtualBaseClassOffset( 169 const CXXRecordDecl *DerivedClass, CastExpr::path_const_iterator Start, 170 CastExpr::path_const_iterator End) { 171 CharUnits Offset = CharUnits::Zero(); 172 173 const ASTContext &Context = getContext(); 174 const CXXRecordDecl *RD = DerivedClass; 175 176 for (CastExpr::path_const_iterator I = Start; I != End; ++I) { 177 const CXXBaseSpecifier *Base = *I; 178 assert(!Base->isVirtual() && "Should not see virtual bases here!"); 179 180 // Get the layout. 181 const ASTRecordLayout &Layout = Context.getASTRecordLayout(RD); 182 183 const auto *BaseDecl = 184 cast<CXXRecordDecl>(Base->getType()->castAs<RecordType>()->getDecl()); 185 186 // Add the offset. 187 Offset += Layout.getBaseClassOffset(BaseDecl); 188 189 RD = BaseDecl; 190 } 191 192 return Offset; 193 } 194 195 llvm::Constant * 196 CodeGenModule::GetNonVirtualBaseClassOffset(const CXXRecordDecl *ClassDecl, 197 CastExpr::path_const_iterator PathBegin, 198 CastExpr::path_const_iterator PathEnd) { 199 assert(PathBegin != PathEnd && "Base path should not be empty!"); 200 201 CharUnits Offset = 202 computeNonVirtualBaseClassOffset(ClassDecl, PathBegin, PathEnd); 203 if (Offset.isZero()) 204 return nullptr; 205 206 llvm::Type *PtrDiffTy = 207 Types.ConvertType(getContext().getPointerDiffType()); 208 209 return llvm::ConstantInt::get(PtrDiffTy, Offset.getQuantity()); 210 } 211 212 /// Gets the address of a direct base class within a complete object. 213 /// This should only be used for (1) non-virtual bases or (2) virtual bases 214 /// when the type is known to be complete (e.g. in complete destructors). 215 /// 216 /// The object pointed to by 'This' is assumed to be non-null. 217 Address 218 CodeGenFunction::GetAddressOfDirectBaseInCompleteClass(Address This, 219 const CXXRecordDecl *Derived, 220 const CXXRecordDecl *Base, 221 bool BaseIsVirtual) { 222 // 'this' must be a pointer (in some address space) to Derived. 223 assert(This.getElementType() == ConvertType(Derived)); 224 225 // Compute the offset of the virtual base. 226 CharUnits Offset; 227 const ASTRecordLayout &Layout = getContext().getASTRecordLayout(Derived); 228 if (BaseIsVirtual) 229 Offset = Layout.getVBaseClassOffset(Base); 230 else 231 Offset = Layout.getBaseClassOffset(Base); 232 233 // Shift and cast down to the base type. 234 // TODO: for complete types, this should be possible with a GEP. 235 Address V = This; 236 if (!Offset.isZero()) { 237 V = Builder.CreateElementBitCast(V, Int8Ty); 238 V = Builder.CreateConstInBoundsByteGEP(V, Offset); 239 } 240 V = Builder.CreateElementBitCast(V, ConvertType(Base)); 241 242 return V; 243 } 244 245 static Address 246 ApplyNonVirtualAndVirtualOffset(CodeGenFunction &CGF, Address addr, 247 CharUnits nonVirtualOffset, 248 llvm::Value *virtualOffset, 249 const CXXRecordDecl *derivedClass, 250 const CXXRecordDecl *nearestVBase) { 251 // Assert that we have something to do. 252 assert(!nonVirtualOffset.isZero() || virtualOffset != nullptr); 253 254 // Compute the offset from the static and dynamic components. 255 llvm::Value *baseOffset; 256 if (!nonVirtualOffset.isZero()) { 257 llvm::Type *OffsetType = 258 (CGF.CGM.getTarget().getCXXABI().isItaniumFamily() && 259 CGF.CGM.getItaniumVTableContext().isRelativeLayout()) 260 ? CGF.Int32Ty 261 : CGF.PtrDiffTy; 262 baseOffset = 263 llvm::ConstantInt::get(OffsetType, nonVirtualOffset.getQuantity()); 264 if (virtualOffset) { 265 baseOffset = CGF.Builder.CreateAdd(virtualOffset, baseOffset); 266 } 267 } else { 268 baseOffset = virtualOffset; 269 } 270 271 // Apply the base offset. 272 llvm::Value *ptr = addr.getPointer(); 273 unsigned AddrSpace = ptr->getType()->getPointerAddressSpace(); 274 ptr = CGF.Builder.CreateBitCast(ptr, CGF.Int8Ty->getPointerTo(AddrSpace)); 275 ptr = CGF.Builder.CreateInBoundsGEP(CGF.Int8Ty, ptr, baseOffset, "add.ptr"); 276 277 // If we have a virtual component, the alignment of the result will 278 // be relative only to the known alignment of that vbase. 279 CharUnits alignment; 280 if (virtualOffset) { 281 assert(nearestVBase && "virtual offset without vbase?"); 282 alignment = CGF.CGM.getVBaseAlignment(addr.getAlignment(), 283 derivedClass, nearestVBase); 284 } else { 285 alignment = addr.getAlignment(); 286 } 287 alignment = alignment.alignmentAtOffset(nonVirtualOffset); 288 289 return Address(ptr, alignment); 290 } 291 292 Address CodeGenFunction::GetAddressOfBaseClass( 293 Address Value, const CXXRecordDecl *Derived, 294 CastExpr::path_const_iterator PathBegin, 295 CastExpr::path_const_iterator PathEnd, bool NullCheckValue, 296 SourceLocation Loc) { 297 assert(PathBegin != PathEnd && "Base path should not be empty!"); 298 299 CastExpr::path_const_iterator Start = PathBegin; 300 const CXXRecordDecl *VBase = nullptr; 301 302 // Sema has done some convenient canonicalization here: if the 303 // access path involved any virtual steps, the conversion path will 304 // *start* with a step down to the correct virtual base subobject, 305 // and hence will not require any further steps. 306 if ((*Start)->isVirtual()) { 307 VBase = cast<CXXRecordDecl>( 308 (*Start)->getType()->castAs<RecordType>()->getDecl()); 309 ++Start; 310 } 311 312 // Compute the static offset of the ultimate destination within its 313 // allocating subobject (the virtual base, if there is one, or else 314 // the "complete" object that we see). 315 CharUnits NonVirtualOffset = CGM.computeNonVirtualBaseClassOffset( 316 VBase ? VBase : Derived, Start, PathEnd); 317 318 // If there's a virtual step, we can sometimes "devirtualize" it. 319 // For now, that's limited to when the derived type is final. 320 // TODO: "devirtualize" this for accesses to known-complete objects. 321 if (VBase && Derived->hasAttr<FinalAttr>()) { 322 const ASTRecordLayout &layout = getContext().getASTRecordLayout(Derived); 323 CharUnits vBaseOffset = layout.getVBaseClassOffset(VBase); 324 NonVirtualOffset += vBaseOffset; 325 VBase = nullptr; // we no longer have a virtual step 326 } 327 328 // Get the base pointer type. 329 llvm::Type *BasePtrTy = 330 ConvertType((PathEnd[-1])->getType()) 331 ->getPointerTo(Value.getType()->getPointerAddressSpace()); 332 333 QualType DerivedTy = getContext().getRecordType(Derived); 334 CharUnits DerivedAlign = CGM.getClassPointerAlignment(Derived); 335 336 // If the static offset is zero and we don't have a virtual step, 337 // just do a bitcast; null checks are unnecessary. 338 if (NonVirtualOffset.isZero() && !VBase) { 339 if (sanitizePerformTypeCheck()) { 340 SanitizerSet SkippedChecks; 341 SkippedChecks.set(SanitizerKind::Null, !NullCheckValue); 342 EmitTypeCheck(TCK_Upcast, Loc, Value.getPointer(), 343 DerivedTy, DerivedAlign, SkippedChecks); 344 } 345 return Builder.CreateBitCast(Value, BasePtrTy); 346 } 347 348 llvm::BasicBlock *origBB = nullptr; 349 llvm::BasicBlock *endBB = nullptr; 350 351 // Skip over the offset (and the vtable load) if we're supposed to 352 // null-check the pointer. 353 if (NullCheckValue) { 354 origBB = Builder.GetInsertBlock(); 355 llvm::BasicBlock *notNullBB = createBasicBlock("cast.notnull"); 356 endBB = createBasicBlock("cast.end"); 357 358 llvm::Value *isNull = Builder.CreateIsNull(Value.getPointer()); 359 Builder.CreateCondBr(isNull, endBB, notNullBB); 360 EmitBlock(notNullBB); 361 } 362 363 if (sanitizePerformTypeCheck()) { 364 SanitizerSet SkippedChecks; 365 SkippedChecks.set(SanitizerKind::Null, true); 366 EmitTypeCheck(VBase ? TCK_UpcastToVirtualBase : TCK_Upcast, Loc, 367 Value.getPointer(), DerivedTy, DerivedAlign, SkippedChecks); 368 } 369 370 // Compute the virtual offset. 371 llvm::Value *VirtualOffset = nullptr; 372 if (VBase) { 373 VirtualOffset = 374 CGM.getCXXABI().GetVirtualBaseClassOffset(*this, Value, Derived, VBase); 375 } 376 377 // Apply both offsets. 378 Value = ApplyNonVirtualAndVirtualOffset(*this, Value, NonVirtualOffset, 379 VirtualOffset, Derived, VBase); 380 381 // Cast to the destination type. 382 Value = Builder.CreateBitCast(Value, BasePtrTy); 383 384 // Build a phi if we needed a null check. 385 if (NullCheckValue) { 386 llvm::BasicBlock *notNullBB = Builder.GetInsertBlock(); 387 Builder.CreateBr(endBB); 388 EmitBlock(endBB); 389 390 llvm::PHINode *PHI = Builder.CreatePHI(BasePtrTy, 2, "cast.result"); 391 PHI->addIncoming(Value.getPointer(), notNullBB); 392 PHI->addIncoming(llvm::Constant::getNullValue(BasePtrTy), origBB); 393 Value = Address(PHI, Value.getAlignment()); 394 } 395 396 return Value; 397 } 398 399 Address 400 CodeGenFunction::GetAddressOfDerivedClass(Address BaseAddr, 401 const CXXRecordDecl *Derived, 402 CastExpr::path_const_iterator PathBegin, 403 CastExpr::path_const_iterator PathEnd, 404 bool NullCheckValue) { 405 assert(PathBegin != PathEnd && "Base path should not be empty!"); 406 407 QualType DerivedTy = 408 getContext().getCanonicalType(getContext().getTagDeclType(Derived)); 409 unsigned AddrSpace = 410 BaseAddr.getPointer()->getType()->getPointerAddressSpace(); 411 llvm::Type *DerivedPtrTy = ConvertType(DerivedTy)->getPointerTo(AddrSpace); 412 413 llvm::Value *NonVirtualOffset = 414 CGM.GetNonVirtualBaseClassOffset(Derived, PathBegin, PathEnd); 415 416 if (!NonVirtualOffset) { 417 // No offset, we can just cast back. 418 return Builder.CreateBitCast(BaseAddr, DerivedPtrTy); 419 } 420 421 llvm::BasicBlock *CastNull = nullptr; 422 llvm::BasicBlock *CastNotNull = nullptr; 423 llvm::BasicBlock *CastEnd = nullptr; 424 425 if (NullCheckValue) { 426 CastNull = createBasicBlock("cast.null"); 427 CastNotNull = createBasicBlock("cast.notnull"); 428 CastEnd = createBasicBlock("cast.end"); 429 430 llvm::Value *IsNull = Builder.CreateIsNull(BaseAddr.getPointer()); 431 Builder.CreateCondBr(IsNull, CastNull, CastNotNull); 432 EmitBlock(CastNotNull); 433 } 434 435 // Apply the offset. 436 llvm::Value *Value = Builder.CreateBitCast(BaseAddr.getPointer(), Int8PtrTy); 437 Value = Builder.CreateInBoundsGEP( 438 Int8Ty, Value, Builder.CreateNeg(NonVirtualOffset), "sub.ptr"); 439 440 // Just cast. 441 Value = Builder.CreateBitCast(Value, DerivedPtrTy); 442 443 // Produce a PHI if we had a null-check. 444 if (NullCheckValue) { 445 Builder.CreateBr(CastEnd); 446 EmitBlock(CastNull); 447 Builder.CreateBr(CastEnd); 448 EmitBlock(CastEnd); 449 450 llvm::PHINode *PHI = Builder.CreatePHI(Value->getType(), 2); 451 PHI->addIncoming(Value, CastNotNull); 452 PHI->addIncoming(llvm::Constant::getNullValue(Value->getType()), CastNull); 453 Value = PHI; 454 } 455 456 return Address(Value, CGM.getClassPointerAlignment(Derived)); 457 } 458 459 llvm::Value *CodeGenFunction::GetVTTParameter(GlobalDecl GD, 460 bool ForVirtualBase, 461 bool Delegating) { 462 if (!CGM.getCXXABI().NeedsVTTParameter(GD)) { 463 // This constructor/destructor does not need a VTT parameter. 464 return nullptr; 465 } 466 467 const CXXRecordDecl *RD = cast<CXXMethodDecl>(CurCodeDecl)->getParent(); 468 const CXXRecordDecl *Base = cast<CXXMethodDecl>(GD.getDecl())->getParent(); 469 470 uint64_t SubVTTIndex; 471 472 if (Delegating) { 473 // If this is a delegating constructor call, just load the VTT. 474 return LoadCXXVTT(); 475 } else if (RD == Base) { 476 // If the record matches the base, this is the complete ctor/dtor 477 // variant calling the base variant in a class with virtual bases. 478 assert(!CGM.getCXXABI().NeedsVTTParameter(CurGD) && 479 "doing no-op VTT offset in base dtor/ctor?"); 480 assert(!ForVirtualBase && "Can't have same class as virtual base!"); 481 SubVTTIndex = 0; 482 } else { 483 const ASTRecordLayout &Layout = getContext().getASTRecordLayout(RD); 484 CharUnits BaseOffset = ForVirtualBase ? 485 Layout.getVBaseClassOffset(Base) : 486 Layout.getBaseClassOffset(Base); 487 488 SubVTTIndex = 489 CGM.getVTables().getSubVTTIndex(RD, BaseSubobject(Base, BaseOffset)); 490 assert(SubVTTIndex != 0 && "Sub-VTT index must be greater than zero!"); 491 } 492 493 if (CGM.getCXXABI().NeedsVTTParameter(CurGD)) { 494 // A VTT parameter was passed to the constructor, use it. 495 llvm::Value *VTT = LoadCXXVTT(); 496 return Builder.CreateConstInBoundsGEP1_64(VTT, SubVTTIndex); 497 } else { 498 // We're the complete constructor, so get the VTT by name. 499 llvm::GlobalValue *VTT = CGM.getVTables().GetAddrOfVTT(RD); 500 return Builder.CreateConstInBoundsGEP2_64( 501 VTT->getValueType(), VTT, 0, SubVTTIndex); 502 } 503 } 504 505 namespace { 506 /// Call the destructor for a direct base class. 507 struct CallBaseDtor final : EHScopeStack::Cleanup { 508 const CXXRecordDecl *BaseClass; 509 bool BaseIsVirtual; 510 CallBaseDtor(const CXXRecordDecl *Base, bool BaseIsVirtual) 511 : BaseClass(Base), BaseIsVirtual(BaseIsVirtual) {} 512 513 void Emit(CodeGenFunction &CGF, Flags flags) override { 514 const CXXRecordDecl *DerivedClass = 515 cast<CXXMethodDecl>(CGF.CurCodeDecl)->getParent(); 516 517 const CXXDestructorDecl *D = BaseClass->getDestructor(); 518 // We are already inside a destructor, so presumably the object being 519 // destroyed should have the expected type. 520 QualType ThisTy = D->getThisObjectType(); 521 Address Addr = 522 CGF.GetAddressOfDirectBaseInCompleteClass(CGF.LoadCXXThisAddress(), 523 DerivedClass, BaseClass, 524 BaseIsVirtual); 525 CGF.EmitCXXDestructorCall(D, Dtor_Base, BaseIsVirtual, 526 /*Delegating=*/false, Addr, ThisTy); 527 } 528 }; 529 530 /// A visitor which checks whether an initializer uses 'this' in a 531 /// way which requires the vtable to be properly set. 532 struct DynamicThisUseChecker : ConstEvaluatedExprVisitor<DynamicThisUseChecker> { 533 typedef ConstEvaluatedExprVisitor<DynamicThisUseChecker> super; 534 535 bool UsesThis; 536 537 DynamicThisUseChecker(const ASTContext &C) : super(C), UsesThis(false) {} 538 539 // Black-list all explicit and implicit references to 'this'. 540 // 541 // Do we need to worry about external references to 'this' derived 542 // from arbitrary code? If so, then anything which runs arbitrary 543 // external code might potentially access the vtable. 544 void VisitCXXThisExpr(const CXXThisExpr *E) { UsesThis = true; } 545 }; 546 } // end anonymous namespace 547 548 static bool BaseInitializerUsesThis(ASTContext &C, const Expr *Init) { 549 DynamicThisUseChecker Checker(C); 550 Checker.Visit(Init); 551 return Checker.UsesThis; 552 } 553 554 static void EmitBaseInitializer(CodeGenFunction &CGF, 555 const CXXRecordDecl *ClassDecl, 556 CXXCtorInitializer *BaseInit) { 557 assert(BaseInit->isBaseInitializer() && 558 "Must have base initializer!"); 559 560 Address ThisPtr = CGF.LoadCXXThisAddress(); 561 562 const Type *BaseType = BaseInit->getBaseClass(); 563 const auto *BaseClassDecl = 564 cast<CXXRecordDecl>(BaseType->castAs<RecordType>()->getDecl()); 565 566 bool isBaseVirtual = BaseInit->isBaseVirtual(); 567 568 // If the initializer for the base (other than the constructor 569 // itself) accesses 'this' in any way, we need to initialize the 570 // vtables. 571 if (BaseInitializerUsesThis(CGF.getContext(), BaseInit->getInit())) 572 CGF.InitializeVTablePointers(ClassDecl); 573 574 // We can pretend to be a complete class because it only matters for 575 // virtual bases, and we only do virtual bases for complete ctors. 576 Address V = 577 CGF.GetAddressOfDirectBaseInCompleteClass(ThisPtr, ClassDecl, 578 BaseClassDecl, 579 isBaseVirtual); 580 AggValueSlot AggSlot = 581 AggValueSlot::forAddr( 582 V, Qualifiers(), 583 AggValueSlot::IsDestructed, 584 AggValueSlot::DoesNotNeedGCBarriers, 585 AggValueSlot::IsNotAliased, 586 CGF.getOverlapForBaseInit(ClassDecl, BaseClassDecl, isBaseVirtual)); 587 588 CGF.EmitAggExpr(BaseInit->getInit(), AggSlot); 589 590 if (CGF.CGM.getLangOpts().Exceptions && 591 !BaseClassDecl->hasTrivialDestructor()) 592 CGF.EHStack.pushCleanup<CallBaseDtor>(EHCleanup, BaseClassDecl, 593 isBaseVirtual); 594 } 595 596 static bool isMemcpyEquivalentSpecialMember(const CXXMethodDecl *D) { 597 auto *CD = dyn_cast<CXXConstructorDecl>(D); 598 if (!(CD && CD->isCopyOrMoveConstructor()) && 599 !D->isCopyAssignmentOperator() && !D->isMoveAssignmentOperator()) 600 return false; 601 602 // We can emit a memcpy for a trivial copy or move constructor/assignment. 603 if (D->isTrivial() && !D->getParent()->mayInsertExtraPadding()) 604 return true; 605 606 // We *must* emit a memcpy for a defaulted union copy or move op. 607 if (D->getParent()->isUnion() && D->isDefaulted()) 608 return true; 609 610 return false; 611 } 612 613 static void EmitLValueForAnyFieldInitialization(CodeGenFunction &CGF, 614 CXXCtorInitializer *MemberInit, 615 LValue &LHS) { 616 FieldDecl *Field = MemberInit->getAnyMember(); 617 if (MemberInit->isIndirectMemberInitializer()) { 618 // If we are initializing an anonymous union field, drill down to the field. 619 IndirectFieldDecl *IndirectField = MemberInit->getIndirectMember(); 620 for (const auto *I : IndirectField->chain()) 621 LHS = CGF.EmitLValueForFieldInitialization(LHS, cast<FieldDecl>(I)); 622 } else { 623 LHS = CGF.EmitLValueForFieldInitialization(LHS, Field); 624 } 625 } 626 627 static void EmitMemberInitializer(CodeGenFunction &CGF, 628 const CXXRecordDecl *ClassDecl, 629 CXXCtorInitializer *MemberInit, 630 const CXXConstructorDecl *Constructor, 631 FunctionArgList &Args) { 632 ApplyDebugLocation Loc(CGF, MemberInit->getSourceLocation()); 633 assert(MemberInit->isAnyMemberInitializer() && 634 "Must have member initializer!"); 635 assert(MemberInit->getInit() && "Must have initializer!"); 636 637 // non-static data member initializers. 638 FieldDecl *Field = MemberInit->getAnyMember(); 639 QualType FieldType = Field->getType(); 640 641 llvm::Value *ThisPtr = CGF.LoadCXXThis(); 642 QualType RecordTy = CGF.getContext().getTypeDeclType(ClassDecl); 643 LValue LHS; 644 645 // If a base constructor is being emitted, create an LValue that has the 646 // non-virtual alignment. 647 if (CGF.CurGD.getCtorType() == Ctor_Base) 648 LHS = CGF.MakeNaturalAlignPointeeAddrLValue(ThisPtr, RecordTy); 649 else 650 LHS = CGF.MakeNaturalAlignAddrLValue(ThisPtr, RecordTy); 651 652 EmitLValueForAnyFieldInitialization(CGF, MemberInit, LHS); 653 654 // Special case: if we are in a copy or move constructor, and we are copying 655 // an array of PODs or classes with trivial copy constructors, ignore the 656 // AST and perform the copy we know is equivalent. 657 // FIXME: This is hacky at best... if we had a bit more explicit information 658 // in the AST, we could generalize it more easily. 659 const ConstantArrayType *Array 660 = CGF.getContext().getAsConstantArrayType(FieldType); 661 if (Array && Constructor->isDefaulted() && 662 Constructor->isCopyOrMoveConstructor()) { 663 QualType BaseElementTy = CGF.getContext().getBaseElementType(Array); 664 CXXConstructExpr *CE = dyn_cast<CXXConstructExpr>(MemberInit->getInit()); 665 if (BaseElementTy.isPODType(CGF.getContext()) || 666 (CE && isMemcpyEquivalentSpecialMember(CE->getConstructor()))) { 667 unsigned SrcArgIndex = 668 CGF.CGM.getCXXABI().getSrcArgforCopyCtor(Constructor, Args); 669 llvm::Value *SrcPtr 670 = CGF.Builder.CreateLoad(CGF.GetAddrOfLocalVar(Args[SrcArgIndex])); 671 LValue ThisRHSLV = CGF.MakeNaturalAlignAddrLValue(SrcPtr, RecordTy); 672 LValue Src = CGF.EmitLValueForFieldInitialization(ThisRHSLV, Field); 673 674 // Copy the aggregate. 675 CGF.EmitAggregateCopy(LHS, Src, FieldType, CGF.getOverlapForFieldInit(Field), 676 LHS.isVolatileQualified()); 677 // Ensure that we destroy the objects if an exception is thrown later in 678 // the constructor. 679 QualType::DestructionKind dtorKind = FieldType.isDestructedType(); 680 if (CGF.needsEHCleanup(dtorKind)) 681 CGF.pushEHDestroy(dtorKind, LHS.getAddress(CGF), FieldType); 682 return; 683 } 684 } 685 686 CGF.EmitInitializerForField(Field, LHS, MemberInit->getInit()); 687 } 688 689 void CodeGenFunction::EmitInitializerForField(FieldDecl *Field, LValue LHS, 690 Expr *Init) { 691 QualType FieldType = Field->getType(); 692 switch (getEvaluationKind(FieldType)) { 693 case TEK_Scalar: 694 if (LHS.isSimple()) { 695 EmitExprAsInit(Init, Field, LHS, false); 696 } else { 697 RValue RHS = RValue::get(EmitScalarExpr(Init)); 698 EmitStoreThroughLValue(RHS, LHS); 699 } 700 break; 701 case TEK_Complex: 702 EmitComplexExprIntoLValue(Init, LHS, /*isInit*/ true); 703 break; 704 case TEK_Aggregate: { 705 AggValueSlot Slot = AggValueSlot::forLValue( 706 LHS, *this, AggValueSlot::IsDestructed, 707 AggValueSlot::DoesNotNeedGCBarriers, AggValueSlot::IsNotAliased, 708 getOverlapForFieldInit(Field), AggValueSlot::IsNotZeroed, 709 // Checks are made by the code that calls constructor. 710 AggValueSlot::IsSanitizerChecked); 711 EmitAggExpr(Init, Slot); 712 break; 713 } 714 } 715 716 // Ensure that we destroy this object if an exception is thrown 717 // later in the constructor. 718 QualType::DestructionKind dtorKind = FieldType.isDestructedType(); 719 if (needsEHCleanup(dtorKind)) 720 pushEHDestroy(dtorKind, LHS.getAddress(*this), FieldType); 721 } 722 723 /// Checks whether the given constructor is a valid subject for the 724 /// complete-to-base constructor delegation optimization, i.e. 725 /// emitting the complete constructor as a simple call to the base 726 /// constructor. 727 bool CodeGenFunction::IsConstructorDelegationValid( 728 const CXXConstructorDecl *Ctor) { 729 730 // Currently we disable the optimization for classes with virtual 731 // bases because (1) the addresses of parameter variables need to be 732 // consistent across all initializers but (2) the delegate function 733 // call necessarily creates a second copy of the parameter variable. 734 // 735 // The limiting example (purely theoretical AFAIK): 736 // struct A { A(int &c) { c++; } }; 737 // struct B : virtual A { 738 // B(int count) : A(count) { printf("%d\n", count); } 739 // }; 740 // ...although even this example could in principle be emitted as a 741 // delegation since the address of the parameter doesn't escape. 742 if (Ctor->getParent()->getNumVBases()) { 743 // TODO: white-list trivial vbase initializers. This case wouldn't 744 // be subject to the restrictions below. 745 746 // TODO: white-list cases where: 747 // - there are no non-reference parameters to the constructor 748 // - the initializers don't access any non-reference parameters 749 // - the initializers don't take the address of non-reference 750 // parameters 751 // - etc. 752 // If we ever add any of the above cases, remember that: 753 // - function-try-blocks will always exclude this optimization 754 // - we need to perform the constructor prologue and cleanup in 755 // EmitConstructorBody. 756 757 return false; 758 } 759 760 // We also disable the optimization for variadic functions because 761 // it's impossible to "re-pass" varargs. 762 if (Ctor->getType()->castAs<FunctionProtoType>()->isVariadic()) 763 return false; 764 765 // FIXME: Decide if we can do a delegation of a delegating constructor. 766 if (Ctor->isDelegatingConstructor()) 767 return false; 768 769 return true; 770 } 771 772 // Emit code in ctor (Prologue==true) or dtor (Prologue==false) 773 // to poison the extra field paddings inserted under 774 // -fsanitize-address-field-padding=1|2. 775 void CodeGenFunction::EmitAsanPrologueOrEpilogue(bool Prologue) { 776 ASTContext &Context = getContext(); 777 const CXXRecordDecl *ClassDecl = 778 Prologue ? cast<CXXConstructorDecl>(CurGD.getDecl())->getParent() 779 : cast<CXXDestructorDecl>(CurGD.getDecl())->getParent(); 780 if (!ClassDecl->mayInsertExtraPadding()) return; 781 782 struct SizeAndOffset { 783 uint64_t Size; 784 uint64_t Offset; 785 }; 786 787 unsigned PtrSize = CGM.getDataLayout().getPointerSizeInBits(); 788 const ASTRecordLayout &Info = Context.getASTRecordLayout(ClassDecl); 789 790 // Populate sizes and offsets of fields. 791 SmallVector<SizeAndOffset, 16> SSV(Info.getFieldCount()); 792 for (unsigned i = 0, e = Info.getFieldCount(); i != e; ++i) 793 SSV[i].Offset = 794 Context.toCharUnitsFromBits(Info.getFieldOffset(i)).getQuantity(); 795 796 size_t NumFields = 0; 797 for (const auto *Field : ClassDecl->fields()) { 798 const FieldDecl *D = Field; 799 auto FieldInfo = Context.getTypeInfoInChars(D->getType()); 800 CharUnits FieldSize = FieldInfo.Width; 801 assert(NumFields < SSV.size()); 802 SSV[NumFields].Size = D->isBitField() ? 0 : FieldSize.getQuantity(); 803 NumFields++; 804 } 805 assert(NumFields == SSV.size()); 806 if (SSV.size() <= 1) return; 807 808 // We will insert calls to __asan_* run-time functions. 809 // LLVM AddressSanitizer pass may decide to inline them later. 810 llvm::Type *Args[2] = {IntPtrTy, IntPtrTy}; 811 llvm::FunctionType *FTy = 812 llvm::FunctionType::get(CGM.VoidTy, Args, false); 813 llvm::FunctionCallee F = CGM.CreateRuntimeFunction( 814 FTy, Prologue ? "__asan_poison_intra_object_redzone" 815 : "__asan_unpoison_intra_object_redzone"); 816 817 llvm::Value *ThisPtr = LoadCXXThis(); 818 ThisPtr = Builder.CreatePtrToInt(ThisPtr, IntPtrTy); 819 uint64_t TypeSize = Info.getNonVirtualSize().getQuantity(); 820 // For each field check if it has sufficient padding, 821 // if so (un)poison it with a call. 822 for (size_t i = 0; i < SSV.size(); i++) { 823 uint64_t AsanAlignment = 8; 824 uint64_t NextField = i == SSV.size() - 1 ? TypeSize : SSV[i + 1].Offset; 825 uint64_t PoisonSize = NextField - SSV[i].Offset - SSV[i].Size; 826 uint64_t EndOffset = SSV[i].Offset + SSV[i].Size; 827 if (PoisonSize < AsanAlignment || !SSV[i].Size || 828 (NextField % AsanAlignment) != 0) 829 continue; 830 Builder.CreateCall( 831 F, {Builder.CreateAdd(ThisPtr, Builder.getIntN(PtrSize, EndOffset)), 832 Builder.getIntN(PtrSize, PoisonSize)}); 833 } 834 } 835 836 /// EmitConstructorBody - Emits the body of the current constructor. 837 void CodeGenFunction::EmitConstructorBody(FunctionArgList &Args) { 838 EmitAsanPrologueOrEpilogue(true); 839 const CXXConstructorDecl *Ctor = cast<CXXConstructorDecl>(CurGD.getDecl()); 840 CXXCtorType CtorType = CurGD.getCtorType(); 841 842 assert((CGM.getTarget().getCXXABI().hasConstructorVariants() || 843 CtorType == Ctor_Complete) && 844 "can only generate complete ctor for this ABI"); 845 846 // Before we go any further, try the complete->base constructor 847 // delegation optimization. 848 if (CtorType == Ctor_Complete && IsConstructorDelegationValid(Ctor) && 849 CGM.getTarget().getCXXABI().hasConstructorVariants()) { 850 EmitDelegateCXXConstructorCall(Ctor, Ctor_Base, Args, Ctor->getEndLoc()); 851 return; 852 } 853 854 const FunctionDecl *Definition = nullptr; 855 Stmt *Body = Ctor->getBody(Definition); 856 assert(Definition == Ctor && "emitting wrong constructor body"); 857 858 // Enter the function-try-block before the constructor prologue if 859 // applicable. 860 bool IsTryBody = (Body && isa<CXXTryStmt>(Body)); 861 if (IsTryBody) 862 EnterCXXTryStmt(*cast<CXXTryStmt>(Body), true); 863 864 incrementProfileCounter(Body); 865 866 RunCleanupsScope RunCleanups(*this); 867 868 // TODO: in restricted cases, we can emit the vbase initializers of 869 // a complete ctor and then delegate to the base ctor. 870 871 // Emit the constructor prologue, i.e. the base and member 872 // initializers. 873 EmitCtorPrologue(Ctor, CtorType, Args); 874 875 // Emit the body of the statement. 876 if (IsTryBody) 877 EmitStmt(cast<CXXTryStmt>(Body)->getTryBlock()); 878 else if (Body) 879 EmitStmt(Body); 880 881 // Emit any cleanup blocks associated with the member or base 882 // initializers, which includes (along the exceptional path) the 883 // destructors for those members and bases that were fully 884 // constructed. 885 RunCleanups.ForceCleanup(); 886 887 if (IsTryBody) 888 ExitCXXTryStmt(*cast<CXXTryStmt>(Body), true); 889 } 890 891 namespace { 892 /// RAII object to indicate that codegen is copying the value representation 893 /// instead of the object representation. Useful when copying a struct or 894 /// class which has uninitialized members and we're only performing 895 /// lvalue-to-rvalue conversion on the object but not its members. 896 class CopyingValueRepresentation { 897 public: 898 explicit CopyingValueRepresentation(CodeGenFunction &CGF) 899 : CGF(CGF), OldSanOpts(CGF.SanOpts) { 900 CGF.SanOpts.set(SanitizerKind::Bool, false); 901 CGF.SanOpts.set(SanitizerKind::Enum, false); 902 } 903 ~CopyingValueRepresentation() { 904 CGF.SanOpts = OldSanOpts; 905 } 906 private: 907 CodeGenFunction &CGF; 908 SanitizerSet OldSanOpts; 909 }; 910 } // end anonymous namespace 911 912 namespace { 913 class FieldMemcpyizer { 914 public: 915 FieldMemcpyizer(CodeGenFunction &CGF, const CXXRecordDecl *ClassDecl, 916 const VarDecl *SrcRec) 917 : CGF(CGF), ClassDecl(ClassDecl), SrcRec(SrcRec), 918 RecLayout(CGF.getContext().getASTRecordLayout(ClassDecl)), 919 FirstField(nullptr), LastField(nullptr), FirstFieldOffset(0), 920 LastFieldOffset(0), LastAddedFieldIndex(0) {} 921 922 bool isMemcpyableField(FieldDecl *F) const { 923 // Never memcpy fields when we are adding poisoned paddings. 924 if (CGF.getContext().getLangOpts().SanitizeAddressFieldPadding) 925 return false; 926 Qualifiers Qual = F->getType().getQualifiers(); 927 if (Qual.hasVolatile() || Qual.hasObjCLifetime()) 928 return false; 929 return true; 930 } 931 932 void addMemcpyableField(FieldDecl *F) { 933 if (F->isZeroSize(CGF.getContext())) 934 return; 935 if (!FirstField) 936 addInitialField(F); 937 else 938 addNextField(F); 939 } 940 941 CharUnits getMemcpySize(uint64_t FirstByteOffset) const { 942 ASTContext &Ctx = CGF.getContext(); 943 unsigned LastFieldSize = 944 LastField->isBitField() 945 ? LastField->getBitWidthValue(Ctx) 946 : Ctx.toBits( 947 Ctx.getTypeInfoDataSizeInChars(LastField->getType()).Width); 948 uint64_t MemcpySizeBits = LastFieldOffset + LastFieldSize - 949 FirstByteOffset + Ctx.getCharWidth() - 1; 950 CharUnits MemcpySize = Ctx.toCharUnitsFromBits(MemcpySizeBits); 951 return MemcpySize; 952 } 953 954 void emitMemcpy() { 955 // Give the subclass a chance to bail out if it feels the memcpy isn't 956 // worth it (e.g. Hasn't aggregated enough data). 957 if (!FirstField) { 958 return; 959 } 960 961 uint64_t FirstByteOffset; 962 if (FirstField->isBitField()) { 963 const CGRecordLayout &RL = 964 CGF.getTypes().getCGRecordLayout(FirstField->getParent()); 965 const CGBitFieldInfo &BFInfo = RL.getBitFieldInfo(FirstField); 966 // FirstFieldOffset is not appropriate for bitfields, 967 // we need to use the storage offset instead. 968 FirstByteOffset = CGF.getContext().toBits(BFInfo.StorageOffset); 969 } else { 970 FirstByteOffset = FirstFieldOffset; 971 } 972 973 CharUnits MemcpySize = getMemcpySize(FirstByteOffset); 974 QualType RecordTy = CGF.getContext().getTypeDeclType(ClassDecl); 975 Address ThisPtr = CGF.LoadCXXThisAddress(); 976 LValue DestLV = CGF.MakeAddrLValue(ThisPtr, RecordTy); 977 LValue Dest = CGF.EmitLValueForFieldInitialization(DestLV, FirstField); 978 llvm::Value *SrcPtr = CGF.Builder.CreateLoad(CGF.GetAddrOfLocalVar(SrcRec)); 979 LValue SrcLV = CGF.MakeNaturalAlignAddrLValue(SrcPtr, RecordTy); 980 LValue Src = CGF.EmitLValueForFieldInitialization(SrcLV, FirstField); 981 982 emitMemcpyIR( 983 Dest.isBitField() ? Dest.getBitFieldAddress() : Dest.getAddress(CGF), 984 Src.isBitField() ? Src.getBitFieldAddress() : Src.getAddress(CGF), 985 MemcpySize); 986 reset(); 987 } 988 989 void reset() { 990 FirstField = nullptr; 991 } 992 993 protected: 994 CodeGenFunction &CGF; 995 const CXXRecordDecl *ClassDecl; 996 997 private: 998 void emitMemcpyIR(Address DestPtr, Address SrcPtr, CharUnits Size) { 999 llvm::PointerType *DPT = DestPtr.getType(); 1000 llvm::Type *DBP = 1001 llvm::Type::getInt8PtrTy(CGF.getLLVMContext(), DPT->getAddressSpace()); 1002 DestPtr = CGF.Builder.CreateBitCast(DestPtr, DBP); 1003 1004 llvm::PointerType *SPT = SrcPtr.getType(); 1005 llvm::Type *SBP = 1006 llvm::Type::getInt8PtrTy(CGF.getLLVMContext(), SPT->getAddressSpace()); 1007 SrcPtr = CGF.Builder.CreateBitCast(SrcPtr, SBP); 1008 1009 CGF.Builder.CreateMemCpy(DestPtr, SrcPtr, Size.getQuantity()); 1010 } 1011 1012 void addInitialField(FieldDecl *F) { 1013 FirstField = F; 1014 LastField = F; 1015 FirstFieldOffset = RecLayout.getFieldOffset(F->getFieldIndex()); 1016 LastFieldOffset = FirstFieldOffset; 1017 LastAddedFieldIndex = F->getFieldIndex(); 1018 } 1019 1020 void addNextField(FieldDecl *F) { 1021 // For the most part, the following invariant will hold: 1022 // F->getFieldIndex() == LastAddedFieldIndex + 1 1023 // The one exception is that Sema won't add a copy-initializer for an 1024 // unnamed bitfield, which will show up here as a gap in the sequence. 1025 assert(F->getFieldIndex() >= LastAddedFieldIndex + 1 && 1026 "Cannot aggregate fields out of order."); 1027 LastAddedFieldIndex = F->getFieldIndex(); 1028 1029 // The 'first' and 'last' fields are chosen by offset, rather than field 1030 // index. This allows the code to support bitfields, as well as regular 1031 // fields. 1032 uint64_t FOffset = RecLayout.getFieldOffset(F->getFieldIndex()); 1033 if (FOffset < FirstFieldOffset) { 1034 FirstField = F; 1035 FirstFieldOffset = FOffset; 1036 } else if (FOffset >= LastFieldOffset) { 1037 LastField = F; 1038 LastFieldOffset = FOffset; 1039 } 1040 } 1041 1042 const VarDecl *SrcRec; 1043 const ASTRecordLayout &RecLayout; 1044 FieldDecl *FirstField; 1045 FieldDecl *LastField; 1046 uint64_t FirstFieldOffset, LastFieldOffset; 1047 unsigned LastAddedFieldIndex; 1048 }; 1049 1050 class ConstructorMemcpyizer : public FieldMemcpyizer { 1051 private: 1052 /// Get source argument for copy constructor. Returns null if not a copy 1053 /// constructor. 1054 static const VarDecl *getTrivialCopySource(CodeGenFunction &CGF, 1055 const CXXConstructorDecl *CD, 1056 FunctionArgList &Args) { 1057 if (CD->isCopyOrMoveConstructor() && CD->isDefaulted()) 1058 return Args[CGF.CGM.getCXXABI().getSrcArgforCopyCtor(CD, Args)]; 1059 return nullptr; 1060 } 1061 1062 // Returns true if a CXXCtorInitializer represents a member initialization 1063 // that can be rolled into a memcpy. 1064 bool isMemberInitMemcpyable(CXXCtorInitializer *MemberInit) const { 1065 if (!MemcpyableCtor) 1066 return false; 1067 FieldDecl *Field = MemberInit->getMember(); 1068 assert(Field && "No field for member init."); 1069 QualType FieldType = Field->getType(); 1070 CXXConstructExpr *CE = dyn_cast<CXXConstructExpr>(MemberInit->getInit()); 1071 1072 // Bail out on non-memcpyable, not-trivially-copyable members. 1073 if (!(CE && isMemcpyEquivalentSpecialMember(CE->getConstructor())) && 1074 !(FieldType.isTriviallyCopyableType(CGF.getContext()) || 1075 FieldType->isReferenceType())) 1076 return false; 1077 1078 // Bail out on volatile fields. 1079 if (!isMemcpyableField(Field)) 1080 return false; 1081 1082 // Otherwise we're good. 1083 return true; 1084 } 1085 1086 public: 1087 ConstructorMemcpyizer(CodeGenFunction &CGF, const CXXConstructorDecl *CD, 1088 FunctionArgList &Args) 1089 : FieldMemcpyizer(CGF, CD->getParent(), getTrivialCopySource(CGF, CD, Args)), 1090 ConstructorDecl(CD), 1091 MemcpyableCtor(CD->isDefaulted() && 1092 CD->isCopyOrMoveConstructor() && 1093 CGF.getLangOpts().getGC() == LangOptions::NonGC), 1094 Args(Args) { } 1095 1096 void addMemberInitializer(CXXCtorInitializer *MemberInit) { 1097 if (isMemberInitMemcpyable(MemberInit)) { 1098 AggregatedInits.push_back(MemberInit); 1099 addMemcpyableField(MemberInit->getMember()); 1100 } else { 1101 emitAggregatedInits(); 1102 EmitMemberInitializer(CGF, ConstructorDecl->getParent(), MemberInit, 1103 ConstructorDecl, Args); 1104 } 1105 } 1106 1107 void emitAggregatedInits() { 1108 if (AggregatedInits.size() <= 1) { 1109 // This memcpy is too small to be worthwhile. Fall back on default 1110 // codegen. 1111 if (!AggregatedInits.empty()) { 1112 CopyingValueRepresentation CVR(CGF); 1113 EmitMemberInitializer(CGF, ConstructorDecl->getParent(), 1114 AggregatedInits[0], ConstructorDecl, Args); 1115 AggregatedInits.clear(); 1116 } 1117 reset(); 1118 return; 1119 } 1120 1121 pushEHDestructors(); 1122 emitMemcpy(); 1123 AggregatedInits.clear(); 1124 } 1125 1126 void pushEHDestructors() { 1127 Address ThisPtr = CGF.LoadCXXThisAddress(); 1128 QualType RecordTy = CGF.getContext().getTypeDeclType(ClassDecl); 1129 LValue LHS = CGF.MakeAddrLValue(ThisPtr, RecordTy); 1130 1131 for (unsigned i = 0; i < AggregatedInits.size(); ++i) { 1132 CXXCtorInitializer *MemberInit = AggregatedInits[i]; 1133 QualType FieldType = MemberInit->getAnyMember()->getType(); 1134 QualType::DestructionKind dtorKind = FieldType.isDestructedType(); 1135 if (!CGF.needsEHCleanup(dtorKind)) 1136 continue; 1137 LValue FieldLHS = LHS; 1138 EmitLValueForAnyFieldInitialization(CGF, MemberInit, FieldLHS); 1139 CGF.pushEHDestroy(dtorKind, FieldLHS.getAddress(CGF), FieldType); 1140 } 1141 } 1142 1143 void finish() { 1144 emitAggregatedInits(); 1145 } 1146 1147 private: 1148 const CXXConstructorDecl *ConstructorDecl; 1149 bool MemcpyableCtor; 1150 FunctionArgList &Args; 1151 SmallVector<CXXCtorInitializer*, 16> AggregatedInits; 1152 }; 1153 1154 class AssignmentMemcpyizer : public FieldMemcpyizer { 1155 private: 1156 // Returns the memcpyable field copied by the given statement, if one 1157 // exists. Otherwise returns null. 1158 FieldDecl *getMemcpyableField(Stmt *S) { 1159 if (!AssignmentsMemcpyable) 1160 return nullptr; 1161 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(S)) { 1162 // Recognise trivial assignments. 1163 if (BO->getOpcode() != BO_Assign) 1164 return nullptr; 1165 MemberExpr *ME = dyn_cast<MemberExpr>(BO->getLHS()); 1166 if (!ME) 1167 return nullptr; 1168 FieldDecl *Field = dyn_cast<FieldDecl>(ME->getMemberDecl()); 1169 if (!Field || !isMemcpyableField(Field)) 1170 return nullptr; 1171 Stmt *RHS = BO->getRHS(); 1172 if (ImplicitCastExpr *EC = dyn_cast<ImplicitCastExpr>(RHS)) 1173 RHS = EC->getSubExpr(); 1174 if (!RHS) 1175 return nullptr; 1176 if (MemberExpr *ME2 = dyn_cast<MemberExpr>(RHS)) { 1177 if (ME2->getMemberDecl() == Field) 1178 return Field; 1179 } 1180 return nullptr; 1181 } else if (CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(S)) { 1182 CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(MCE->getCalleeDecl()); 1183 if (!(MD && isMemcpyEquivalentSpecialMember(MD))) 1184 return nullptr; 1185 MemberExpr *IOA = dyn_cast<MemberExpr>(MCE->getImplicitObjectArgument()); 1186 if (!IOA) 1187 return nullptr; 1188 FieldDecl *Field = dyn_cast<FieldDecl>(IOA->getMemberDecl()); 1189 if (!Field || !isMemcpyableField(Field)) 1190 return nullptr; 1191 MemberExpr *Arg0 = dyn_cast<MemberExpr>(MCE->getArg(0)); 1192 if (!Arg0 || Field != dyn_cast<FieldDecl>(Arg0->getMemberDecl())) 1193 return nullptr; 1194 return Field; 1195 } else if (CallExpr *CE = dyn_cast<CallExpr>(S)) { 1196 FunctionDecl *FD = dyn_cast<FunctionDecl>(CE->getCalleeDecl()); 1197 if (!FD || FD->getBuiltinID() != Builtin::BI__builtin_memcpy) 1198 return nullptr; 1199 Expr *DstPtr = CE->getArg(0); 1200 if (ImplicitCastExpr *DC = dyn_cast<ImplicitCastExpr>(DstPtr)) 1201 DstPtr = DC->getSubExpr(); 1202 UnaryOperator *DUO = dyn_cast<UnaryOperator>(DstPtr); 1203 if (!DUO || DUO->getOpcode() != UO_AddrOf) 1204 return nullptr; 1205 MemberExpr *ME = dyn_cast<MemberExpr>(DUO->getSubExpr()); 1206 if (!ME) 1207 return nullptr; 1208 FieldDecl *Field = dyn_cast<FieldDecl>(ME->getMemberDecl()); 1209 if (!Field || !isMemcpyableField(Field)) 1210 return nullptr; 1211 Expr *SrcPtr = CE->getArg(1); 1212 if (ImplicitCastExpr *SC = dyn_cast<ImplicitCastExpr>(SrcPtr)) 1213 SrcPtr = SC->getSubExpr(); 1214 UnaryOperator *SUO = dyn_cast<UnaryOperator>(SrcPtr); 1215 if (!SUO || SUO->getOpcode() != UO_AddrOf) 1216 return nullptr; 1217 MemberExpr *ME2 = dyn_cast<MemberExpr>(SUO->getSubExpr()); 1218 if (!ME2 || Field != dyn_cast<FieldDecl>(ME2->getMemberDecl())) 1219 return nullptr; 1220 return Field; 1221 } 1222 1223 return nullptr; 1224 } 1225 1226 bool AssignmentsMemcpyable; 1227 SmallVector<Stmt*, 16> AggregatedStmts; 1228 1229 public: 1230 AssignmentMemcpyizer(CodeGenFunction &CGF, const CXXMethodDecl *AD, 1231 FunctionArgList &Args) 1232 : FieldMemcpyizer(CGF, AD->getParent(), Args[Args.size() - 1]), 1233 AssignmentsMemcpyable(CGF.getLangOpts().getGC() == LangOptions::NonGC) { 1234 assert(Args.size() == 2); 1235 } 1236 1237 void emitAssignment(Stmt *S) { 1238 FieldDecl *F = getMemcpyableField(S); 1239 if (F) { 1240 addMemcpyableField(F); 1241 AggregatedStmts.push_back(S); 1242 } else { 1243 emitAggregatedStmts(); 1244 CGF.EmitStmt(S); 1245 } 1246 } 1247 1248 void emitAggregatedStmts() { 1249 if (AggregatedStmts.size() <= 1) { 1250 if (!AggregatedStmts.empty()) { 1251 CopyingValueRepresentation CVR(CGF); 1252 CGF.EmitStmt(AggregatedStmts[0]); 1253 } 1254 reset(); 1255 } 1256 1257 emitMemcpy(); 1258 AggregatedStmts.clear(); 1259 } 1260 1261 void finish() { 1262 emitAggregatedStmts(); 1263 } 1264 }; 1265 } // end anonymous namespace 1266 1267 static bool isInitializerOfDynamicClass(const CXXCtorInitializer *BaseInit) { 1268 const Type *BaseType = BaseInit->getBaseClass(); 1269 const auto *BaseClassDecl = 1270 cast<CXXRecordDecl>(BaseType->castAs<RecordType>()->getDecl()); 1271 return BaseClassDecl->isDynamicClass(); 1272 } 1273 1274 /// EmitCtorPrologue - This routine generates necessary code to initialize 1275 /// base classes and non-static data members belonging to this constructor. 1276 void CodeGenFunction::EmitCtorPrologue(const CXXConstructorDecl *CD, 1277 CXXCtorType CtorType, 1278 FunctionArgList &Args) { 1279 if (CD->isDelegatingConstructor()) 1280 return EmitDelegatingCXXConstructorCall(CD, Args); 1281 1282 const CXXRecordDecl *ClassDecl = CD->getParent(); 1283 1284 CXXConstructorDecl::init_const_iterator B = CD->init_begin(), 1285 E = CD->init_end(); 1286 1287 // Virtual base initializers first, if any. They aren't needed if: 1288 // - This is a base ctor variant 1289 // - There are no vbases 1290 // - The class is abstract, so a complete object of it cannot be constructed 1291 // 1292 // The check for an abstract class is necessary because sema may not have 1293 // marked virtual base destructors referenced. 1294 bool ConstructVBases = CtorType != Ctor_Base && 1295 ClassDecl->getNumVBases() != 0 && 1296 !ClassDecl->isAbstract(); 1297 1298 // In the Microsoft C++ ABI, there are no constructor variants. Instead, the 1299 // constructor of a class with virtual bases takes an additional parameter to 1300 // conditionally construct the virtual bases. Emit that check here. 1301 llvm::BasicBlock *BaseCtorContinueBB = nullptr; 1302 if (ConstructVBases && 1303 !CGM.getTarget().getCXXABI().hasConstructorVariants()) { 1304 BaseCtorContinueBB = 1305 CGM.getCXXABI().EmitCtorCompleteObjectHandler(*this, ClassDecl); 1306 assert(BaseCtorContinueBB); 1307 } 1308 1309 llvm::Value *const OldThis = CXXThisValue; 1310 for (; B != E && (*B)->isBaseInitializer() && (*B)->isBaseVirtual(); B++) { 1311 if (!ConstructVBases) 1312 continue; 1313 if (CGM.getCodeGenOpts().StrictVTablePointers && 1314 CGM.getCodeGenOpts().OptimizationLevel > 0 && 1315 isInitializerOfDynamicClass(*B)) 1316 CXXThisValue = Builder.CreateLaunderInvariantGroup(LoadCXXThis()); 1317 EmitBaseInitializer(*this, ClassDecl, *B); 1318 } 1319 1320 if (BaseCtorContinueBB) { 1321 // Complete object handler should continue to the remaining initializers. 1322 Builder.CreateBr(BaseCtorContinueBB); 1323 EmitBlock(BaseCtorContinueBB); 1324 } 1325 1326 // Then, non-virtual base initializers. 1327 for (; B != E && (*B)->isBaseInitializer(); B++) { 1328 assert(!(*B)->isBaseVirtual()); 1329 1330 if (CGM.getCodeGenOpts().StrictVTablePointers && 1331 CGM.getCodeGenOpts().OptimizationLevel > 0 && 1332 isInitializerOfDynamicClass(*B)) 1333 CXXThisValue = Builder.CreateLaunderInvariantGroup(LoadCXXThis()); 1334 EmitBaseInitializer(*this, ClassDecl, *B); 1335 } 1336 1337 CXXThisValue = OldThis; 1338 1339 InitializeVTablePointers(ClassDecl); 1340 1341 // And finally, initialize class members. 1342 FieldConstructionScope FCS(*this, LoadCXXThisAddress()); 1343 ConstructorMemcpyizer CM(*this, CD, Args); 1344 for (; B != E; B++) { 1345 CXXCtorInitializer *Member = (*B); 1346 assert(!Member->isBaseInitializer()); 1347 assert(Member->isAnyMemberInitializer() && 1348 "Delegating initializer on non-delegating constructor"); 1349 CM.addMemberInitializer(Member); 1350 } 1351 CM.finish(); 1352 } 1353 1354 static bool 1355 FieldHasTrivialDestructorBody(ASTContext &Context, const FieldDecl *Field); 1356 1357 static bool 1358 HasTrivialDestructorBody(ASTContext &Context, 1359 const CXXRecordDecl *BaseClassDecl, 1360 const CXXRecordDecl *MostDerivedClassDecl) 1361 { 1362 // If the destructor is trivial we don't have to check anything else. 1363 if (BaseClassDecl->hasTrivialDestructor()) 1364 return true; 1365 1366 if (!BaseClassDecl->getDestructor()->hasTrivialBody()) 1367 return false; 1368 1369 // Check fields. 1370 for (const auto *Field : BaseClassDecl->fields()) 1371 if (!FieldHasTrivialDestructorBody(Context, Field)) 1372 return false; 1373 1374 // Check non-virtual bases. 1375 for (const auto &I : BaseClassDecl->bases()) { 1376 if (I.isVirtual()) 1377 continue; 1378 1379 const CXXRecordDecl *NonVirtualBase = 1380 cast<CXXRecordDecl>(I.getType()->castAs<RecordType>()->getDecl()); 1381 if (!HasTrivialDestructorBody(Context, NonVirtualBase, 1382 MostDerivedClassDecl)) 1383 return false; 1384 } 1385 1386 if (BaseClassDecl == MostDerivedClassDecl) { 1387 // Check virtual bases. 1388 for (const auto &I : BaseClassDecl->vbases()) { 1389 const CXXRecordDecl *VirtualBase = 1390 cast<CXXRecordDecl>(I.getType()->castAs<RecordType>()->getDecl()); 1391 if (!HasTrivialDestructorBody(Context, VirtualBase, 1392 MostDerivedClassDecl)) 1393 return false; 1394 } 1395 } 1396 1397 return true; 1398 } 1399 1400 static bool 1401 FieldHasTrivialDestructorBody(ASTContext &Context, 1402 const FieldDecl *Field) 1403 { 1404 QualType FieldBaseElementType = Context.getBaseElementType(Field->getType()); 1405 1406 const RecordType *RT = FieldBaseElementType->getAs<RecordType>(); 1407 if (!RT) 1408 return true; 1409 1410 CXXRecordDecl *FieldClassDecl = cast<CXXRecordDecl>(RT->getDecl()); 1411 1412 // The destructor for an implicit anonymous union member is never invoked. 1413 if (FieldClassDecl->isUnion() && FieldClassDecl->isAnonymousStructOrUnion()) 1414 return false; 1415 1416 return HasTrivialDestructorBody(Context, FieldClassDecl, FieldClassDecl); 1417 } 1418 1419 /// CanSkipVTablePointerInitialization - Check whether we need to initialize 1420 /// any vtable pointers before calling this destructor. 1421 static bool CanSkipVTablePointerInitialization(CodeGenFunction &CGF, 1422 const CXXDestructorDecl *Dtor) { 1423 const CXXRecordDecl *ClassDecl = Dtor->getParent(); 1424 if (!ClassDecl->isDynamicClass()) 1425 return true; 1426 1427 if (!Dtor->hasTrivialBody()) 1428 return false; 1429 1430 // Check the fields. 1431 for (const auto *Field : ClassDecl->fields()) 1432 if (!FieldHasTrivialDestructorBody(CGF.getContext(), Field)) 1433 return false; 1434 1435 return true; 1436 } 1437 1438 /// EmitDestructorBody - Emits the body of the current destructor. 1439 void CodeGenFunction::EmitDestructorBody(FunctionArgList &Args) { 1440 const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CurGD.getDecl()); 1441 CXXDtorType DtorType = CurGD.getDtorType(); 1442 1443 // For an abstract class, non-base destructors are never used (and can't 1444 // be emitted in general, because vbase dtors may not have been validated 1445 // by Sema), but the Itanium ABI doesn't make them optional and Clang may 1446 // in fact emit references to them from other compilations, so emit them 1447 // as functions containing a trap instruction. 1448 if (DtorType != Dtor_Base && Dtor->getParent()->isAbstract()) { 1449 llvm::CallInst *TrapCall = EmitTrapCall(llvm::Intrinsic::trap); 1450 TrapCall->setDoesNotReturn(); 1451 TrapCall->setDoesNotThrow(); 1452 Builder.CreateUnreachable(); 1453 Builder.ClearInsertionPoint(); 1454 return; 1455 } 1456 1457 Stmt *Body = Dtor->getBody(); 1458 if (Body) 1459 incrementProfileCounter(Body); 1460 1461 // The call to operator delete in a deleting destructor happens 1462 // outside of the function-try-block, which means it's always 1463 // possible to delegate the destructor body to the complete 1464 // destructor. Do so. 1465 if (DtorType == Dtor_Deleting) { 1466 RunCleanupsScope DtorEpilogue(*this); 1467 EnterDtorCleanups(Dtor, Dtor_Deleting); 1468 if (HaveInsertPoint()) { 1469 QualType ThisTy = Dtor->getThisObjectType(); 1470 EmitCXXDestructorCall(Dtor, Dtor_Complete, /*ForVirtualBase=*/false, 1471 /*Delegating=*/false, LoadCXXThisAddress(), ThisTy); 1472 } 1473 return; 1474 } 1475 1476 // If the body is a function-try-block, enter the try before 1477 // anything else. 1478 bool isTryBody = (Body && isa<CXXTryStmt>(Body)); 1479 if (isTryBody) 1480 EnterCXXTryStmt(*cast<CXXTryStmt>(Body), true); 1481 EmitAsanPrologueOrEpilogue(false); 1482 1483 // Enter the epilogue cleanups. 1484 RunCleanupsScope DtorEpilogue(*this); 1485 1486 // If this is the complete variant, just invoke the base variant; 1487 // the epilogue will destruct the virtual bases. But we can't do 1488 // this optimization if the body is a function-try-block, because 1489 // we'd introduce *two* handler blocks. In the Microsoft ABI, we 1490 // always delegate because we might not have a definition in this TU. 1491 switch (DtorType) { 1492 case Dtor_Comdat: llvm_unreachable("not expecting a COMDAT"); 1493 case Dtor_Deleting: llvm_unreachable("already handled deleting case"); 1494 1495 case Dtor_Complete: 1496 assert((Body || getTarget().getCXXABI().isMicrosoft()) && 1497 "can't emit a dtor without a body for non-Microsoft ABIs"); 1498 1499 // Enter the cleanup scopes for virtual bases. 1500 EnterDtorCleanups(Dtor, Dtor_Complete); 1501 1502 if (!isTryBody) { 1503 QualType ThisTy = Dtor->getThisObjectType(); 1504 EmitCXXDestructorCall(Dtor, Dtor_Base, /*ForVirtualBase=*/false, 1505 /*Delegating=*/false, LoadCXXThisAddress(), ThisTy); 1506 break; 1507 } 1508 1509 // Fallthrough: act like we're in the base variant. 1510 LLVM_FALLTHROUGH; 1511 1512 case Dtor_Base: 1513 assert(Body); 1514 1515 // Enter the cleanup scopes for fields and non-virtual bases. 1516 EnterDtorCleanups(Dtor, Dtor_Base); 1517 1518 // Initialize the vtable pointers before entering the body. 1519 if (!CanSkipVTablePointerInitialization(*this, Dtor)) { 1520 // Insert the llvm.launder.invariant.group intrinsic before initializing 1521 // the vptrs to cancel any previous assumptions we might have made. 1522 if (CGM.getCodeGenOpts().StrictVTablePointers && 1523 CGM.getCodeGenOpts().OptimizationLevel > 0) 1524 CXXThisValue = Builder.CreateLaunderInvariantGroup(LoadCXXThis()); 1525 InitializeVTablePointers(Dtor->getParent()); 1526 } 1527 1528 if (isTryBody) 1529 EmitStmt(cast<CXXTryStmt>(Body)->getTryBlock()); 1530 else if (Body) 1531 EmitStmt(Body); 1532 else { 1533 assert(Dtor->isImplicit() && "bodyless dtor not implicit"); 1534 // nothing to do besides what's in the epilogue 1535 } 1536 // -fapple-kext must inline any call to this dtor into 1537 // the caller's body. 1538 if (getLangOpts().AppleKext) 1539 CurFn->addFnAttr(llvm::Attribute::AlwaysInline); 1540 1541 break; 1542 } 1543 1544 // Jump out through the epilogue cleanups. 1545 DtorEpilogue.ForceCleanup(); 1546 1547 // Exit the try if applicable. 1548 if (isTryBody) 1549 ExitCXXTryStmt(*cast<CXXTryStmt>(Body), true); 1550 } 1551 1552 void CodeGenFunction::emitImplicitAssignmentOperatorBody(FunctionArgList &Args) { 1553 const CXXMethodDecl *AssignOp = cast<CXXMethodDecl>(CurGD.getDecl()); 1554 const Stmt *RootS = AssignOp->getBody(); 1555 assert(isa<CompoundStmt>(RootS) && 1556 "Body of an implicit assignment operator should be compound stmt."); 1557 const CompoundStmt *RootCS = cast<CompoundStmt>(RootS); 1558 1559 LexicalScope Scope(*this, RootCS->getSourceRange()); 1560 1561 incrementProfileCounter(RootCS); 1562 AssignmentMemcpyizer AM(*this, AssignOp, Args); 1563 for (auto *I : RootCS->body()) 1564 AM.emitAssignment(I); 1565 AM.finish(); 1566 } 1567 1568 namespace { 1569 llvm::Value *LoadThisForDtorDelete(CodeGenFunction &CGF, 1570 const CXXDestructorDecl *DD) { 1571 if (Expr *ThisArg = DD->getOperatorDeleteThisArg()) 1572 return CGF.EmitScalarExpr(ThisArg); 1573 return CGF.LoadCXXThis(); 1574 } 1575 1576 /// Call the operator delete associated with the current destructor. 1577 struct CallDtorDelete final : EHScopeStack::Cleanup { 1578 CallDtorDelete() {} 1579 1580 void Emit(CodeGenFunction &CGF, Flags flags) override { 1581 const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CGF.CurCodeDecl); 1582 const CXXRecordDecl *ClassDecl = Dtor->getParent(); 1583 CGF.EmitDeleteCall(Dtor->getOperatorDelete(), 1584 LoadThisForDtorDelete(CGF, Dtor), 1585 CGF.getContext().getTagDeclType(ClassDecl)); 1586 } 1587 }; 1588 1589 void EmitConditionalDtorDeleteCall(CodeGenFunction &CGF, 1590 llvm::Value *ShouldDeleteCondition, 1591 bool ReturnAfterDelete) { 1592 llvm::BasicBlock *callDeleteBB = CGF.createBasicBlock("dtor.call_delete"); 1593 llvm::BasicBlock *continueBB = CGF.createBasicBlock("dtor.continue"); 1594 llvm::Value *ShouldCallDelete 1595 = CGF.Builder.CreateIsNull(ShouldDeleteCondition); 1596 CGF.Builder.CreateCondBr(ShouldCallDelete, continueBB, callDeleteBB); 1597 1598 CGF.EmitBlock(callDeleteBB); 1599 const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CGF.CurCodeDecl); 1600 const CXXRecordDecl *ClassDecl = Dtor->getParent(); 1601 CGF.EmitDeleteCall(Dtor->getOperatorDelete(), 1602 LoadThisForDtorDelete(CGF, Dtor), 1603 CGF.getContext().getTagDeclType(ClassDecl)); 1604 assert(Dtor->getOperatorDelete()->isDestroyingOperatorDelete() == 1605 ReturnAfterDelete && 1606 "unexpected value for ReturnAfterDelete"); 1607 if (ReturnAfterDelete) 1608 CGF.EmitBranchThroughCleanup(CGF.ReturnBlock); 1609 else 1610 CGF.Builder.CreateBr(continueBB); 1611 1612 CGF.EmitBlock(continueBB); 1613 } 1614 1615 struct CallDtorDeleteConditional final : EHScopeStack::Cleanup { 1616 llvm::Value *ShouldDeleteCondition; 1617 1618 public: 1619 CallDtorDeleteConditional(llvm::Value *ShouldDeleteCondition) 1620 : ShouldDeleteCondition(ShouldDeleteCondition) { 1621 assert(ShouldDeleteCondition != nullptr); 1622 } 1623 1624 void Emit(CodeGenFunction &CGF, Flags flags) override { 1625 EmitConditionalDtorDeleteCall(CGF, ShouldDeleteCondition, 1626 /*ReturnAfterDelete*/false); 1627 } 1628 }; 1629 1630 class DestroyField final : public EHScopeStack::Cleanup { 1631 const FieldDecl *field; 1632 CodeGenFunction::Destroyer *destroyer; 1633 bool useEHCleanupForArray; 1634 1635 public: 1636 DestroyField(const FieldDecl *field, CodeGenFunction::Destroyer *destroyer, 1637 bool useEHCleanupForArray) 1638 : field(field), destroyer(destroyer), 1639 useEHCleanupForArray(useEHCleanupForArray) {} 1640 1641 void Emit(CodeGenFunction &CGF, Flags flags) override { 1642 // Find the address of the field. 1643 Address thisValue = CGF.LoadCXXThisAddress(); 1644 QualType RecordTy = CGF.getContext().getTagDeclType(field->getParent()); 1645 LValue ThisLV = CGF.MakeAddrLValue(thisValue, RecordTy); 1646 LValue LV = CGF.EmitLValueForField(ThisLV, field); 1647 assert(LV.isSimple()); 1648 1649 CGF.emitDestroy(LV.getAddress(CGF), field->getType(), destroyer, 1650 flags.isForNormalCleanup() && useEHCleanupForArray); 1651 } 1652 }; 1653 1654 static void EmitSanitizerDtorCallback(CodeGenFunction &CGF, llvm::Value *Ptr, 1655 CharUnits::QuantityType PoisonSize) { 1656 CodeGenFunction::SanitizerScope SanScope(&CGF); 1657 // Pass in void pointer and size of region as arguments to runtime 1658 // function 1659 llvm::Value *Args[] = {CGF.Builder.CreateBitCast(Ptr, CGF.VoidPtrTy), 1660 llvm::ConstantInt::get(CGF.SizeTy, PoisonSize)}; 1661 1662 llvm::Type *ArgTypes[] = {CGF.VoidPtrTy, CGF.SizeTy}; 1663 1664 llvm::FunctionType *FnType = 1665 llvm::FunctionType::get(CGF.VoidTy, ArgTypes, false); 1666 llvm::FunctionCallee Fn = 1667 CGF.CGM.CreateRuntimeFunction(FnType, "__sanitizer_dtor_callback"); 1668 CGF.EmitNounwindRuntimeCall(Fn, Args); 1669 } 1670 1671 class SanitizeDtorMembers final : public EHScopeStack::Cleanup { 1672 const CXXDestructorDecl *Dtor; 1673 1674 public: 1675 SanitizeDtorMembers(const CXXDestructorDecl *Dtor) : Dtor(Dtor) {} 1676 1677 // Generate function call for handling object poisoning. 1678 // Disables tail call elimination, to prevent the current stack frame 1679 // from disappearing from the stack trace. 1680 void Emit(CodeGenFunction &CGF, Flags flags) override { 1681 const ASTRecordLayout &Layout = 1682 CGF.getContext().getASTRecordLayout(Dtor->getParent()); 1683 1684 // Nothing to poison. 1685 if (Layout.getFieldCount() == 0) 1686 return; 1687 1688 // Prevent the current stack frame from disappearing from the stack trace. 1689 CGF.CurFn->addFnAttr("disable-tail-calls", "true"); 1690 1691 // Construct pointer to region to begin poisoning, and calculate poison 1692 // size, so that only members declared in this class are poisoned. 1693 ASTContext &Context = CGF.getContext(); 1694 1695 const RecordDecl *Decl = Dtor->getParent(); 1696 auto Fields = Decl->fields(); 1697 auto IsTrivial = [&](const FieldDecl *F) { 1698 return FieldHasTrivialDestructorBody(Context, F); 1699 }; 1700 1701 auto IsZeroSize = [&](const FieldDecl *F) { 1702 return F->isZeroSize(Context); 1703 }; 1704 1705 // Poison blocks of fields with trivial destructors making sure that block 1706 // begin and end do not point to zero-sized fields. They don't have 1707 // correct offsets so can't be used to calculate poisoning range. 1708 for (auto It = Fields.begin(); It != Fields.end();) { 1709 It = std::find_if(It, Fields.end(), [&](const FieldDecl *F) { 1710 return IsTrivial(F) && !IsZeroSize(F); 1711 }); 1712 if (It == Fields.end()) 1713 break; 1714 auto Start = It++; 1715 It = std::find_if(It, Fields.end(), [&](const FieldDecl *F) { 1716 return !IsTrivial(F) && !IsZeroSize(F); 1717 }); 1718 1719 PoisonMembers(CGF, (*Start)->getFieldIndex(), 1720 It == Fields.end() ? -1 : (*It)->getFieldIndex()); 1721 } 1722 } 1723 1724 private: 1725 /// \param layoutStartOffset index of the ASTRecordLayout field to 1726 /// start poisoning (inclusive) 1727 /// \param layoutEndOffset index of the ASTRecordLayout field to 1728 /// end poisoning (exclusive) 1729 void PoisonMembers(CodeGenFunction &CGF, unsigned layoutStartOffset, 1730 unsigned layoutEndOffset) { 1731 ASTContext &Context = CGF.getContext(); 1732 const ASTRecordLayout &Layout = 1733 Context.getASTRecordLayout(Dtor->getParent()); 1734 1735 // It's a first trivia field so it should be at the begining of char, 1736 // still round up start offset just in case. 1737 CharUnits PoisonStart = 1738 Context.toCharUnitsFromBits(Layout.getFieldOffset(layoutStartOffset) + 1739 Context.getCharWidth() - 1); 1740 llvm::ConstantInt *OffsetSizePtr = 1741 llvm::ConstantInt::get(CGF.SizeTy, PoisonStart.getQuantity()); 1742 1743 llvm::Value *OffsetPtr = CGF.Builder.CreateGEP( 1744 CGF.Builder.CreateBitCast(CGF.LoadCXXThis(), CGF.Int8PtrTy), 1745 OffsetSizePtr); 1746 1747 CharUnits PoisonEnd; 1748 if (layoutEndOffset >= Layout.getFieldCount()) { 1749 PoisonEnd = Layout.getNonVirtualSize(); 1750 } else { 1751 PoisonEnd = 1752 Context.toCharUnitsFromBits(Layout.getFieldOffset(layoutEndOffset)); 1753 } 1754 CharUnits PoisonSize = PoisonEnd - PoisonStart; 1755 if (!PoisonSize.isPositive()) 1756 return; 1757 1758 EmitSanitizerDtorCallback(CGF, OffsetPtr, PoisonSize.getQuantity()); 1759 } 1760 }; 1761 1762 class SanitizeDtorVTable final : public EHScopeStack::Cleanup { 1763 const CXXDestructorDecl *Dtor; 1764 1765 public: 1766 SanitizeDtorVTable(const CXXDestructorDecl *Dtor) : Dtor(Dtor) {} 1767 1768 // Generate function call for handling vtable pointer poisoning. 1769 void Emit(CodeGenFunction &CGF, Flags flags) override { 1770 assert(Dtor->getParent()->isDynamicClass()); 1771 (void)Dtor; 1772 ASTContext &Context = CGF.getContext(); 1773 // Poison vtable and vtable ptr if they exist for this class. 1774 llvm::Value *VTablePtr = CGF.LoadCXXThis(); 1775 1776 CharUnits::QuantityType PoisonSize = 1777 Context.toCharUnitsFromBits(CGF.PointerWidthInBits).getQuantity(); 1778 // Pass in void pointer and size of region as arguments to runtime 1779 // function 1780 EmitSanitizerDtorCallback(CGF, VTablePtr, PoisonSize); 1781 } 1782 }; 1783 } // end anonymous namespace 1784 1785 /// Emit all code that comes at the end of class's 1786 /// destructor. This is to call destructors on members and base classes 1787 /// in reverse order of their construction. 1788 /// 1789 /// For a deleting destructor, this also handles the case where a destroying 1790 /// operator delete completely overrides the definition. 1791 void CodeGenFunction::EnterDtorCleanups(const CXXDestructorDecl *DD, 1792 CXXDtorType DtorType) { 1793 assert((!DD->isTrivial() || DD->hasAttr<DLLExportAttr>()) && 1794 "Should not emit dtor epilogue for non-exported trivial dtor!"); 1795 1796 // The deleting-destructor phase just needs to call the appropriate 1797 // operator delete that Sema picked up. 1798 if (DtorType == Dtor_Deleting) { 1799 assert(DD->getOperatorDelete() && 1800 "operator delete missing - EnterDtorCleanups"); 1801 if (CXXStructorImplicitParamValue) { 1802 // If there is an implicit param to the deleting dtor, it's a boolean 1803 // telling whether this is a deleting destructor. 1804 if (DD->getOperatorDelete()->isDestroyingOperatorDelete()) 1805 EmitConditionalDtorDeleteCall(*this, CXXStructorImplicitParamValue, 1806 /*ReturnAfterDelete*/true); 1807 else 1808 EHStack.pushCleanup<CallDtorDeleteConditional>( 1809 NormalAndEHCleanup, CXXStructorImplicitParamValue); 1810 } else { 1811 if (DD->getOperatorDelete()->isDestroyingOperatorDelete()) { 1812 const CXXRecordDecl *ClassDecl = DD->getParent(); 1813 EmitDeleteCall(DD->getOperatorDelete(), 1814 LoadThisForDtorDelete(*this, DD), 1815 getContext().getTagDeclType(ClassDecl)); 1816 EmitBranchThroughCleanup(ReturnBlock); 1817 } else { 1818 EHStack.pushCleanup<CallDtorDelete>(NormalAndEHCleanup); 1819 } 1820 } 1821 return; 1822 } 1823 1824 const CXXRecordDecl *ClassDecl = DD->getParent(); 1825 1826 // Unions have no bases and do not call field destructors. 1827 if (ClassDecl->isUnion()) 1828 return; 1829 1830 // The complete-destructor phase just destructs all the virtual bases. 1831 if (DtorType == Dtor_Complete) { 1832 // Poison the vtable pointer such that access after the base 1833 // and member destructors are invoked is invalid. 1834 if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor && 1835 SanOpts.has(SanitizerKind::Memory) && ClassDecl->getNumVBases() && 1836 ClassDecl->isPolymorphic()) 1837 EHStack.pushCleanup<SanitizeDtorVTable>(NormalAndEHCleanup, DD); 1838 1839 // We push them in the forward order so that they'll be popped in 1840 // the reverse order. 1841 for (const auto &Base : ClassDecl->vbases()) { 1842 auto *BaseClassDecl = 1843 cast<CXXRecordDecl>(Base.getType()->castAs<RecordType>()->getDecl()); 1844 1845 // Ignore trivial destructors. 1846 if (BaseClassDecl->hasTrivialDestructor()) 1847 continue; 1848 1849 EHStack.pushCleanup<CallBaseDtor>(NormalAndEHCleanup, 1850 BaseClassDecl, 1851 /*BaseIsVirtual*/ true); 1852 } 1853 1854 return; 1855 } 1856 1857 assert(DtorType == Dtor_Base); 1858 // Poison the vtable pointer if it has no virtual bases, but inherits 1859 // virtual functions. 1860 if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor && 1861 SanOpts.has(SanitizerKind::Memory) && !ClassDecl->getNumVBases() && 1862 ClassDecl->isPolymorphic()) 1863 EHStack.pushCleanup<SanitizeDtorVTable>(NormalAndEHCleanup, DD); 1864 1865 // Destroy non-virtual bases. 1866 for (const auto &Base : ClassDecl->bases()) { 1867 // Ignore virtual bases. 1868 if (Base.isVirtual()) 1869 continue; 1870 1871 CXXRecordDecl *BaseClassDecl = Base.getType()->getAsCXXRecordDecl(); 1872 1873 // Ignore trivial destructors. 1874 if (BaseClassDecl->hasTrivialDestructor()) 1875 continue; 1876 1877 EHStack.pushCleanup<CallBaseDtor>(NormalAndEHCleanup, 1878 BaseClassDecl, 1879 /*BaseIsVirtual*/ false); 1880 } 1881 1882 // Poison fields such that access after their destructors are 1883 // invoked, and before the base class destructor runs, is invalid. 1884 if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor && 1885 SanOpts.has(SanitizerKind::Memory)) 1886 EHStack.pushCleanup<SanitizeDtorMembers>(NormalAndEHCleanup, DD); 1887 1888 // Destroy direct fields. 1889 for (const auto *Field : ClassDecl->fields()) { 1890 QualType type = Field->getType(); 1891 QualType::DestructionKind dtorKind = type.isDestructedType(); 1892 if (!dtorKind) continue; 1893 1894 // Anonymous union members do not have their destructors called. 1895 const RecordType *RT = type->getAsUnionType(); 1896 if (RT && RT->getDecl()->isAnonymousStructOrUnion()) continue; 1897 1898 CleanupKind cleanupKind = getCleanupKind(dtorKind); 1899 EHStack.pushCleanup<DestroyField>(cleanupKind, Field, 1900 getDestroyer(dtorKind), 1901 cleanupKind & EHCleanup); 1902 } 1903 } 1904 1905 /// EmitCXXAggrConstructorCall - Emit a loop to call a particular 1906 /// constructor for each of several members of an array. 1907 /// 1908 /// \param ctor the constructor to call for each element 1909 /// \param arrayType the type of the array to initialize 1910 /// \param arrayBegin an arrayType* 1911 /// \param zeroInitialize true if each element should be 1912 /// zero-initialized before it is constructed 1913 void CodeGenFunction::EmitCXXAggrConstructorCall( 1914 const CXXConstructorDecl *ctor, const ArrayType *arrayType, 1915 Address arrayBegin, const CXXConstructExpr *E, bool NewPointerIsChecked, 1916 bool zeroInitialize) { 1917 QualType elementType; 1918 llvm::Value *numElements = 1919 emitArrayLength(arrayType, elementType, arrayBegin); 1920 1921 EmitCXXAggrConstructorCall(ctor, numElements, arrayBegin, E, 1922 NewPointerIsChecked, zeroInitialize); 1923 } 1924 1925 /// EmitCXXAggrConstructorCall - Emit a loop to call a particular 1926 /// constructor for each of several members of an array. 1927 /// 1928 /// \param ctor the constructor to call for each element 1929 /// \param numElements the number of elements in the array; 1930 /// may be zero 1931 /// \param arrayBase a T*, where T is the type constructed by ctor 1932 /// \param zeroInitialize true if each element should be 1933 /// zero-initialized before it is constructed 1934 void CodeGenFunction::EmitCXXAggrConstructorCall(const CXXConstructorDecl *ctor, 1935 llvm::Value *numElements, 1936 Address arrayBase, 1937 const CXXConstructExpr *E, 1938 bool NewPointerIsChecked, 1939 bool zeroInitialize) { 1940 // It's legal for numElements to be zero. This can happen both 1941 // dynamically, because x can be zero in 'new A[x]', and statically, 1942 // because of GCC extensions that permit zero-length arrays. There 1943 // are probably legitimate places where we could assume that this 1944 // doesn't happen, but it's not clear that it's worth it. 1945 llvm::BranchInst *zeroCheckBranch = nullptr; 1946 1947 // Optimize for a constant count. 1948 llvm::ConstantInt *constantCount 1949 = dyn_cast<llvm::ConstantInt>(numElements); 1950 if (constantCount) { 1951 // Just skip out if the constant count is zero. 1952 if (constantCount->isZero()) return; 1953 1954 // Otherwise, emit the check. 1955 } else { 1956 llvm::BasicBlock *loopBB = createBasicBlock("new.ctorloop"); 1957 llvm::Value *iszero = Builder.CreateIsNull(numElements, "isempty"); 1958 zeroCheckBranch = Builder.CreateCondBr(iszero, loopBB, loopBB); 1959 EmitBlock(loopBB); 1960 } 1961 1962 // Find the end of the array. 1963 llvm::Type *elementType = arrayBase.getElementType(); 1964 llvm::Value *arrayBegin = arrayBase.getPointer(); 1965 llvm::Value *arrayEnd = Builder.CreateInBoundsGEP( 1966 elementType, arrayBegin, numElements, "arrayctor.end"); 1967 1968 // Enter the loop, setting up a phi for the current location to initialize. 1969 llvm::BasicBlock *entryBB = Builder.GetInsertBlock(); 1970 llvm::BasicBlock *loopBB = createBasicBlock("arrayctor.loop"); 1971 EmitBlock(loopBB); 1972 llvm::PHINode *cur = Builder.CreatePHI(arrayBegin->getType(), 2, 1973 "arrayctor.cur"); 1974 cur->addIncoming(arrayBegin, entryBB); 1975 1976 // Inside the loop body, emit the constructor call on the array element. 1977 1978 // The alignment of the base, adjusted by the size of a single element, 1979 // provides a conservative estimate of the alignment of every element. 1980 // (This assumes we never start tracking offsetted alignments.) 1981 // 1982 // Note that these are complete objects and so we don't need to 1983 // use the non-virtual size or alignment. 1984 QualType type = getContext().getTypeDeclType(ctor->getParent()); 1985 CharUnits eltAlignment = 1986 arrayBase.getAlignment() 1987 .alignmentOfArrayElement(getContext().getTypeSizeInChars(type)); 1988 Address curAddr = Address(cur, eltAlignment); 1989 1990 // Zero initialize the storage, if requested. 1991 if (zeroInitialize) 1992 EmitNullInitialization(curAddr, type); 1993 1994 // C++ [class.temporary]p4: 1995 // There are two contexts in which temporaries are destroyed at a different 1996 // point than the end of the full-expression. The first context is when a 1997 // default constructor is called to initialize an element of an array. 1998 // If the constructor has one or more default arguments, the destruction of 1999 // every temporary created in a default argument expression is sequenced 2000 // before the construction of the next array element, if any. 2001 2002 { 2003 RunCleanupsScope Scope(*this); 2004 2005 // Evaluate the constructor and its arguments in a regular 2006 // partial-destroy cleanup. 2007 if (getLangOpts().Exceptions && 2008 !ctor->getParent()->hasTrivialDestructor()) { 2009 Destroyer *destroyer = destroyCXXObject; 2010 pushRegularPartialArrayCleanup(arrayBegin, cur, type, eltAlignment, 2011 *destroyer); 2012 } 2013 auto currAVS = AggValueSlot::forAddr( 2014 curAddr, type.getQualifiers(), AggValueSlot::IsDestructed, 2015 AggValueSlot::DoesNotNeedGCBarriers, AggValueSlot::IsNotAliased, 2016 AggValueSlot::DoesNotOverlap, AggValueSlot::IsNotZeroed, 2017 NewPointerIsChecked ? AggValueSlot::IsSanitizerChecked 2018 : AggValueSlot::IsNotSanitizerChecked); 2019 EmitCXXConstructorCall(ctor, Ctor_Complete, /*ForVirtualBase=*/false, 2020 /*Delegating=*/false, currAVS, E); 2021 } 2022 2023 // Go to the next element. 2024 llvm::Value *next = Builder.CreateInBoundsGEP( 2025 elementType, cur, llvm::ConstantInt::get(SizeTy, 1), "arrayctor.next"); 2026 cur->addIncoming(next, Builder.GetInsertBlock()); 2027 2028 // Check whether that's the end of the loop. 2029 llvm::Value *done = Builder.CreateICmpEQ(next, arrayEnd, "arrayctor.done"); 2030 llvm::BasicBlock *contBB = createBasicBlock("arrayctor.cont"); 2031 Builder.CreateCondBr(done, contBB, loopBB); 2032 2033 // Patch the earlier check to skip over the loop. 2034 if (zeroCheckBranch) zeroCheckBranch->setSuccessor(0, contBB); 2035 2036 EmitBlock(contBB); 2037 } 2038 2039 void CodeGenFunction::destroyCXXObject(CodeGenFunction &CGF, 2040 Address addr, 2041 QualType type) { 2042 const RecordType *rtype = type->castAs<RecordType>(); 2043 const CXXRecordDecl *record = cast<CXXRecordDecl>(rtype->getDecl()); 2044 const CXXDestructorDecl *dtor = record->getDestructor(); 2045 assert(!dtor->isTrivial()); 2046 CGF.EmitCXXDestructorCall(dtor, Dtor_Complete, /*for vbase*/ false, 2047 /*Delegating=*/false, addr, type); 2048 } 2049 2050 void CodeGenFunction::EmitCXXConstructorCall(const CXXConstructorDecl *D, 2051 CXXCtorType Type, 2052 bool ForVirtualBase, 2053 bool Delegating, 2054 AggValueSlot ThisAVS, 2055 const CXXConstructExpr *E) { 2056 CallArgList Args; 2057 Address This = ThisAVS.getAddress(); 2058 LangAS SlotAS = ThisAVS.getQualifiers().getAddressSpace(); 2059 QualType ThisType = D->getThisType(); 2060 LangAS ThisAS = ThisType.getTypePtr()->getPointeeType().getAddressSpace(); 2061 llvm::Value *ThisPtr = This.getPointer(); 2062 2063 if (SlotAS != ThisAS) { 2064 unsigned TargetThisAS = getContext().getTargetAddressSpace(ThisAS); 2065 llvm::Type *NewType = 2066 ThisPtr->getType()->getPointerElementType()->getPointerTo(TargetThisAS); 2067 ThisPtr = getTargetHooks().performAddrSpaceCast(*this, This.getPointer(), 2068 ThisAS, SlotAS, NewType); 2069 } 2070 2071 // Push the this ptr. 2072 Args.add(RValue::get(ThisPtr), D->getThisType()); 2073 2074 // If this is a trivial constructor, emit a memcpy now before we lose 2075 // the alignment information on the argument. 2076 // FIXME: It would be better to preserve alignment information into CallArg. 2077 if (isMemcpyEquivalentSpecialMember(D)) { 2078 assert(E->getNumArgs() == 1 && "unexpected argcount for trivial ctor"); 2079 2080 const Expr *Arg = E->getArg(0); 2081 LValue Src = EmitLValue(Arg); 2082 QualType DestTy = getContext().getTypeDeclType(D->getParent()); 2083 LValue Dest = MakeAddrLValue(This, DestTy); 2084 EmitAggregateCopyCtor(Dest, Src, ThisAVS.mayOverlap()); 2085 return; 2086 } 2087 2088 // Add the rest of the user-supplied arguments. 2089 const FunctionProtoType *FPT = D->getType()->castAs<FunctionProtoType>(); 2090 EvaluationOrder Order = E->isListInitialization() 2091 ? EvaluationOrder::ForceLeftToRight 2092 : EvaluationOrder::Default; 2093 EmitCallArgs(Args, FPT, E->arguments(), E->getConstructor(), 2094 /*ParamsToSkip*/ 0, Order); 2095 2096 EmitCXXConstructorCall(D, Type, ForVirtualBase, Delegating, This, Args, 2097 ThisAVS.mayOverlap(), E->getExprLoc(), 2098 ThisAVS.isSanitizerChecked()); 2099 } 2100 2101 static bool canEmitDelegateCallArgs(CodeGenFunction &CGF, 2102 const CXXConstructorDecl *Ctor, 2103 CXXCtorType Type, CallArgList &Args) { 2104 // We can't forward a variadic call. 2105 if (Ctor->isVariadic()) 2106 return false; 2107 2108 if (CGF.getTarget().getCXXABI().areArgsDestroyedLeftToRightInCallee()) { 2109 // If the parameters are callee-cleanup, it's not safe to forward. 2110 for (auto *P : Ctor->parameters()) 2111 if (P->needsDestruction(CGF.getContext())) 2112 return false; 2113 2114 // Likewise if they're inalloca. 2115 const CGFunctionInfo &Info = 2116 CGF.CGM.getTypes().arrangeCXXConstructorCall(Args, Ctor, Type, 0, 0); 2117 if (Info.usesInAlloca()) 2118 return false; 2119 } 2120 2121 // Anything else should be OK. 2122 return true; 2123 } 2124 2125 void CodeGenFunction::EmitCXXConstructorCall(const CXXConstructorDecl *D, 2126 CXXCtorType Type, 2127 bool ForVirtualBase, 2128 bool Delegating, 2129 Address This, 2130 CallArgList &Args, 2131 AggValueSlot::Overlap_t Overlap, 2132 SourceLocation Loc, 2133 bool NewPointerIsChecked) { 2134 const CXXRecordDecl *ClassDecl = D->getParent(); 2135 2136 if (!NewPointerIsChecked) 2137 EmitTypeCheck(CodeGenFunction::TCK_ConstructorCall, Loc, This.getPointer(), 2138 getContext().getRecordType(ClassDecl), CharUnits::Zero()); 2139 2140 if (D->isTrivial() && D->isDefaultConstructor()) { 2141 assert(Args.size() == 1 && "trivial default ctor with args"); 2142 return; 2143 } 2144 2145 // If this is a trivial constructor, just emit what's needed. If this is a 2146 // union copy constructor, we must emit a memcpy, because the AST does not 2147 // model that copy. 2148 if (isMemcpyEquivalentSpecialMember(D)) { 2149 assert(Args.size() == 2 && "unexpected argcount for trivial ctor"); 2150 2151 QualType SrcTy = D->getParamDecl(0)->getType().getNonReferenceType(); 2152 Address Src(Args[1].getRValue(*this).getScalarVal(), 2153 CGM.getNaturalTypeAlignment(SrcTy)); 2154 LValue SrcLVal = MakeAddrLValue(Src, SrcTy); 2155 QualType DestTy = getContext().getTypeDeclType(ClassDecl); 2156 LValue DestLVal = MakeAddrLValue(This, DestTy); 2157 EmitAggregateCopyCtor(DestLVal, SrcLVal, Overlap); 2158 return; 2159 } 2160 2161 bool PassPrototypeArgs = true; 2162 // Check whether we can actually emit the constructor before trying to do so. 2163 if (auto Inherited = D->getInheritedConstructor()) { 2164 PassPrototypeArgs = getTypes().inheritingCtorHasParams(Inherited, Type); 2165 if (PassPrototypeArgs && !canEmitDelegateCallArgs(*this, D, Type, Args)) { 2166 EmitInlinedInheritingCXXConstructorCall(D, Type, ForVirtualBase, 2167 Delegating, Args); 2168 return; 2169 } 2170 } 2171 2172 // Insert any ABI-specific implicit constructor arguments. 2173 CGCXXABI::AddedStructorArgCounts ExtraArgs = 2174 CGM.getCXXABI().addImplicitConstructorArgs(*this, D, Type, ForVirtualBase, 2175 Delegating, Args); 2176 2177 // Emit the call. 2178 llvm::Constant *CalleePtr = CGM.getAddrOfCXXStructor(GlobalDecl(D, Type)); 2179 const CGFunctionInfo &Info = CGM.getTypes().arrangeCXXConstructorCall( 2180 Args, D, Type, ExtraArgs.Prefix, ExtraArgs.Suffix, PassPrototypeArgs); 2181 CGCallee Callee = CGCallee::forDirect(CalleePtr, GlobalDecl(D, Type)); 2182 EmitCall(Info, Callee, ReturnValueSlot(), Args, nullptr, false, Loc); 2183 2184 // Generate vtable assumptions if we're constructing a complete object 2185 // with a vtable. We don't do this for base subobjects for two reasons: 2186 // first, it's incorrect for classes with virtual bases, and second, we're 2187 // about to overwrite the vptrs anyway. 2188 // We also have to make sure if we can refer to vtable: 2189 // - Otherwise we can refer to vtable if it's safe to speculatively emit. 2190 // FIXME: If vtable is used by ctor/dtor, or if vtable is external and we are 2191 // sure that definition of vtable is not hidden, 2192 // then we are always safe to refer to it. 2193 // FIXME: It looks like InstCombine is very inefficient on dealing with 2194 // assumes. Make assumption loads require -fstrict-vtable-pointers temporarily. 2195 if (CGM.getCodeGenOpts().OptimizationLevel > 0 && 2196 ClassDecl->isDynamicClass() && Type != Ctor_Base && 2197 CGM.getCXXABI().canSpeculativelyEmitVTable(ClassDecl) && 2198 CGM.getCodeGenOpts().StrictVTablePointers) 2199 EmitVTableAssumptionLoads(ClassDecl, This); 2200 } 2201 2202 void CodeGenFunction::EmitInheritedCXXConstructorCall( 2203 const CXXConstructorDecl *D, bool ForVirtualBase, Address This, 2204 bool InheritedFromVBase, const CXXInheritedCtorInitExpr *E) { 2205 CallArgList Args; 2206 CallArg ThisArg(RValue::get(This.getPointer()), D->getThisType()); 2207 2208 // Forward the parameters. 2209 if (InheritedFromVBase && 2210 CGM.getTarget().getCXXABI().hasConstructorVariants()) { 2211 // Nothing to do; this construction is not responsible for constructing 2212 // the base class containing the inherited constructor. 2213 // FIXME: Can we just pass undef's for the remaining arguments if we don't 2214 // have constructor variants? 2215 Args.push_back(ThisArg); 2216 } else if (!CXXInheritedCtorInitExprArgs.empty()) { 2217 // The inheriting constructor was inlined; just inject its arguments. 2218 assert(CXXInheritedCtorInitExprArgs.size() >= D->getNumParams() && 2219 "wrong number of parameters for inherited constructor call"); 2220 Args = CXXInheritedCtorInitExprArgs; 2221 Args[0] = ThisArg; 2222 } else { 2223 // The inheriting constructor was not inlined. Emit delegating arguments. 2224 Args.push_back(ThisArg); 2225 const auto *OuterCtor = cast<CXXConstructorDecl>(CurCodeDecl); 2226 assert(OuterCtor->getNumParams() == D->getNumParams()); 2227 assert(!OuterCtor->isVariadic() && "should have been inlined"); 2228 2229 for (const auto *Param : OuterCtor->parameters()) { 2230 assert(getContext().hasSameUnqualifiedType( 2231 OuterCtor->getParamDecl(Param->getFunctionScopeIndex())->getType(), 2232 Param->getType())); 2233 EmitDelegateCallArg(Args, Param, E->getLocation()); 2234 2235 // Forward __attribute__(pass_object_size). 2236 if (Param->hasAttr<PassObjectSizeAttr>()) { 2237 auto *POSParam = SizeArguments[Param]; 2238 assert(POSParam && "missing pass_object_size value for forwarding"); 2239 EmitDelegateCallArg(Args, POSParam, E->getLocation()); 2240 } 2241 } 2242 } 2243 2244 EmitCXXConstructorCall(D, Ctor_Base, ForVirtualBase, /*Delegating*/false, 2245 This, Args, AggValueSlot::MayOverlap, 2246 E->getLocation(), /*NewPointerIsChecked*/true); 2247 } 2248 2249 void CodeGenFunction::EmitInlinedInheritingCXXConstructorCall( 2250 const CXXConstructorDecl *Ctor, CXXCtorType CtorType, bool ForVirtualBase, 2251 bool Delegating, CallArgList &Args) { 2252 GlobalDecl GD(Ctor, CtorType); 2253 InlinedInheritingConstructorScope Scope(*this, GD); 2254 ApplyInlineDebugLocation DebugScope(*this, GD); 2255 RunCleanupsScope RunCleanups(*this); 2256 2257 // Save the arguments to be passed to the inherited constructor. 2258 CXXInheritedCtorInitExprArgs = Args; 2259 2260 FunctionArgList Params; 2261 QualType RetType = BuildFunctionArgList(CurGD, Params); 2262 FnRetTy = RetType; 2263 2264 // Insert any ABI-specific implicit constructor arguments. 2265 CGM.getCXXABI().addImplicitConstructorArgs(*this, Ctor, CtorType, 2266 ForVirtualBase, Delegating, Args); 2267 2268 // Emit a simplified prolog. We only need to emit the implicit params. 2269 assert(Args.size() >= Params.size() && "too few arguments for call"); 2270 for (unsigned I = 0, N = Args.size(); I != N; ++I) { 2271 if (I < Params.size() && isa<ImplicitParamDecl>(Params[I])) { 2272 const RValue &RV = Args[I].getRValue(*this); 2273 assert(!RV.isComplex() && "complex indirect params not supported"); 2274 ParamValue Val = RV.isScalar() 2275 ? ParamValue::forDirect(RV.getScalarVal()) 2276 : ParamValue::forIndirect(RV.getAggregateAddress()); 2277 EmitParmDecl(*Params[I], Val, I + 1); 2278 } 2279 } 2280 2281 // Create a return value slot if the ABI implementation wants one. 2282 // FIXME: This is dumb, we should ask the ABI not to try to set the return 2283 // value instead. 2284 if (!RetType->isVoidType()) 2285 ReturnValue = CreateIRTemp(RetType, "retval.inhctor"); 2286 2287 CGM.getCXXABI().EmitInstanceFunctionProlog(*this); 2288 CXXThisValue = CXXABIThisValue; 2289 2290 // Directly emit the constructor initializers. 2291 EmitCtorPrologue(Ctor, CtorType, Params); 2292 } 2293 2294 void CodeGenFunction::EmitVTableAssumptionLoad(const VPtr &Vptr, Address This) { 2295 llvm::Value *VTableGlobal = 2296 CGM.getCXXABI().getVTableAddressPoint(Vptr.Base, Vptr.VTableClass); 2297 if (!VTableGlobal) 2298 return; 2299 2300 // We can just use the base offset in the complete class. 2301 CharUnits NonVirtualOffset = Vptr.Base.getBaseOffset(); 2302 2303 if (!NonVirtualOffset.isZero()) 2304 This = 2305 ApplyNonVirtualAndVirtualOffset(*this, This, NonVirtualOffset, nullptr, 2306 Vptr.VTableClass, Vptr.NearestVBase); 2307 2308 llvm::Value *VPtrValue = 2309 GetVTablePtr(This, VTableGlobal->getType(), Vptr.VTableClass); 2310 llvm::Value *Cmp = 2311 Builder.CreateICmpEQ(VPtrValue, VTableGlobal, "cmp.vtables"); 2312 Builder.CreateAssumption(Cmp); 2313 } 2314 2315 void CodeGenFunction::EmitVTableAssumptionLoads(const CXXRecordDecl *ClassDecl, 2316 Address This) { 2317 if (CGM.getCXXABI().doStructorsInitializeVPtrs(ClassDecl)) 2318 for (const VPtr &Vptr : getVTablePointers(ClassDecl)) 2319 EmitVTableAssumptionLoad(Vptr, This); 2320 } 2321 2322 void 2323 CodeGenFunction::EmitSynthesizedCXXCopyCtorCall(const CXXConstructorDecl *D, 2324 Address This, Address Src, 2325 const CXXConstructExpr *E) { 2326 const FunctionProtoType *FPT = D->getType()->castAs<FunctionProtoType>(); 2327 2328 CallArgList Args; 2329 2330 // Push the this ptr. 2331 Args.add(RValue::get(This.getPointer()), D->getThisType()); 2332 2333 // Push the src ptr. 2334 QualType QT = *(FPT->param_type_begin()); 2335 llvm::Type *t = CGM.getTypes().ConvertType(QT); 2336 Src = Builder.CreateBitCast(Src, t); 2337 Args.add(RValue::get(Src.getPointer()), QT); 2338 2339 // Skip over first argument (Src). 2340 EmitCallArgs(Args, FPT, drop_begin(E->arguments(), 1), E->getConstructor(), 2341 /*ParamsToSkip*/ 1); 2342 2343 EmitCXXConstructorCall(D, Ctor_Complete, /*ForVirtualBase*/false, 2344 /*Delegating*/false, This, Args, 2345 AggValueSlot::MayOverlap, E->getExprLoc(), 2346 /*NewPointerIsChecked*/false); 2347 } 2348 2349 void 2350 CodeGenFunction::EmitDelegateCXXConstructorCall(const CXXConstructorDecl *Ctor, 2351 CXXCtorType CtorType, 2352 const FunctionArgList &Args, 2353 SourceLocation Loc) { 2354 CallArgList DelegateArgs; 2355 2356 FunctionArgList::const_iterator I = Args.begin(), E = Args.end(); 2357 assert(I != E && "no parameters to constructor"); 2358 2359 // this 2360 Address This = LoadCXXThisAddress(); 2361 DelegateArgs.add(RValue::get(This.getPointer()), (*I)->getType()); 2362 ++I; 2363 2364 // FIXME: The location of the VTT parameter in the parameter list is 2365 // specific to the Itanium ABI and shouldn't be hardcoded here. 2366 if (CGM.getCXXABI().NeedsVTTParameter(CurGD)) { 2367 assert(I != E && "cannot skip vtt parameter, already done with args"); 2368 assert((*I)->getType()->isPointerType() && 2369 "skipping parameter not of vtt type"); 2370 ++I; 2371 } 2372 2373 // Explicit arguments. 2374 for (; I != E; ++I) { 2375 const VarDecl *param = *I; 2376 // FIXME: per-argument source location 2377 EmitDelegateCallArg(DelegateArgs, param, Loc); 2378 } 2379 2380 EmitCXXConstructorCall(Ctor, CtorType, /*ForVirtualBase=*/false, 2381 /*Delegating=*/true, This, DelegateArgs, 2382 AggValueSlot::MayOverlap, Loc, 2383 /*NewPointerIsChecked=*/true); 2384 } 2385 2386 namespace { 2387 struct CallDelegatingCtorDtor final : EHScopeStack::Cleanup { 2388 const CXXDestructorDecl *Dtor; 2389 Address Addr; 2390 CXXDtorType Type; 2391 2392 CallDelegatingCtorDtor(const CXXDestructorDecl *D, Address Addr, 2393 CXXDtorType Type) 2394 : Dtor(D), Addr(Addr), Type(Type) {} 2395 2396 void Emit(CodeGenFunction &CGF, Flags flags) override { 2397 // We are calling the destructor from within the constructor. 2398 // Therefore, "this" should have the expected type. 2399 QualType ThisTy = Dtor->getThisObjectType(); 2400 CGF.EmitCXXDestructorCall(Dtor, Type, /*ForVirtualBase=*/false, 2401 /*Delegating=*/true, Addr, ThisTy); 2402 } 2403 }; 2404 } // end anonymous namespace 2405 2406 void 2407 CodeGenFunction::EmitDelegatingCXXConstructorCall(const CXXConstructorDecl *Ctor, 2408 const FunctionArgList &Args) { 2409 assert(Ctor->isDelegatingConstructor()); 2410 2411 Address ThisPtr = LoadCXXThisAddress(); 2412 2413 AggValueSlot AggSlot = 2414 AggValueSlot::forAddr(ThisPtr, Qualifiers(), 2415 AggValueSlot::IsDestructed, 2416 AggValueSlot::DoesNotNeedGCBarriers, 2417 AggValueSlot::IsNotAliased, 2418 AggValueSlot::MayOverlap, 2419 AggValueSlot::IsNotZeroed, 2420 // Checks are made by the code that calls constructor. 2421 AggValueSlot::IsSanitizerChecked); 2422 2423 EmitAggExpr(Ctor->init_begin()[0]->getInit(), AggSlot); 2424 2425 const CXXRecordDecl *ClassDecl = Ctor->getParent(); 2426 if (CGM.getLangOpts().Exceptions && !ClassDecl->hasTrivialDestructor()) { 2427 CXXDtorType Type = 2428 CurGD.getCtorType() == Ctor_Complete ? Dtor_Complete : Dtor_Base; 2429 2430 EHStack.pushCleanup<CallDelegatingCtorDtor>(EHCleanup, 2431 ClassDecl->getDestructor(), 2432 ThisPtr, Type); 2433 } 2434 } 2435 2436 void CodeGenFunction::EmitCXXDestructorCall(const CXXDestructorDecl *DD, 2437 CXXDtorType Type, 2438 bool ForVirtualBase, 2439 bool Delegating, Address This, 2440 QualType ThisTy) { 2441 CGM.getCXXABI().EmitDestructorCall(*this, DD, Type, ForVirtualBase, 2442 Delegating, This, ThisTy); 2443 } 2444 2445 namespace { 2446 struct CallLocalDtor final : EHScopeStack::Cleanup { 2447 const CXXDestructorDecl *Dtor; 2448 Address Addr; 2449 QualType Ty; 2450 2451 CallLocalDtor(const CXXDestructorDecl *D, Address Addr, QualType Ty) 2452 : Dtor(D), Addr(Addr), Ty(Ty) {} 2453 2454 void Emit(CodeGenFunction &CGF, Flags flags) override { 2455 CGF.EmitCXXDestructorCall(Dtor, Dtor_Complete, 2456 /*ForVirtualBase=*/false, 2457 /*Delegating=*/false, Addr, Ty); 2458 } 2459 }; 2460 } // end anonymous namespace 2461 2462 void CodeGenFunction::PushDestructorCleanup(const CXXDestructorDecl *D, 2463 QualType T, Address Addr) { 2464 EHStack.pushCleanup<CallLocalDtor>(NormalAndEHCleanup, D, Addr, T); 2465 } 2466 2467 void CodeGenFunction::PushDestructorCleanup(QualType T, Address Addr) { 2468 CXXRecordDecl *ClassDecl = T->getAsCXXRecordDecl(); 2469 if (!ClassDecl) return; 2470 if (ClassDecl->hasTrivialDestructor()) return; 2471 2472 const CXXDestructorDecl *D = ClassDecl->getDestructor(); 2473 assert(D && D->isUsed() && "destructor not marked as used!"); 2474 PushDestructorCleanup(D, T, Addr); 2475 } 2476 2477 void CodeGenFunction::InitializeVTablePointer(const VPtr &Vptr) { 2478 // Compute the address point. 2479 llvm::Value *VTableAddressPoint = 2480 CGM.getCXXABI().getVTableAddressPointInStructor( 2481 *this, Vptr.VTableClass, Vptr.Base, Vptr.NearestVBase); 2482 2483 if (!VTableAddressPoint) 2484 return; 2485 2486 // Compute where to store the address point. 2487 llvm::Value *VirtualOffset = nullptr; 2488 CharUnits NonVirtualOffset = CharUnits::Zero(); 2489 2490 if (CGM.getCXXABI().isVirtualOffsetNeededForVTableField(*this, Vptr)) { 2491 // We need to use the virtual base offset offset because the virtual base 2492 // might have a different offset in the most derived class. 2493 2494 VirtualOffset = CGM.getCXXABI().GetVirtualBaseClassOffset( 2495 *this, LoadCXXThisAddress(), Vptr.VTableClass, Vptr.NearestVBase); 2496 NonVirtualOffset = Vptr.OffsetFromNearestVBase; 2497 } else { 2498 // We can just use the base offset in the complete class. 2499 NonVirtualOffset = Vptr.Base.getBaseOffset(); 2500 } 2501 2502 // Apply the offsets. 2503 Address VTableField = LoadCXXThisAddress(); 2504 2505 if (!NonVirtualOffset.isZero() || VirtualOffset) 2506 VTableField = ApplyNonVirtualAndVirtualOffset( 2507 *this, VTableField, NonVirtualOffset, VirtualOffset, Vptr.VTableClass, 2508 Vptr.NearestVBase); 2509 2510 // Finally, store the address point. Use the same LLVM types as the field to 2511 // support optimization. 2512 unsigned GlobalsAS = CGM.getDataLayout().getDefaultGlobalsAddressSpace(); 2513 unsigned ProgAS = CGM.getDataLayout().getProgramAddressSpace(); 2514 llvm::Type *VTablePtrTy = 2515 llvm::FunctionType::get(CGM.Int32Ty, /*isVarArg=*/true) 2516 ->getPointerTo(ProgAS) 2517 ->getPointerTo(GlobalsAS); 2518 // vtable field is is derived from `this` pointer, therefore it should be in 2519 // default address space. 2520 VTableField = Builder.CreatePointerBitCastOrAddrSpaceCast( 2521 VTableField, VTablePtrTy->getPointerTo()); 2522 VTableAddressPoint = Builder.CreatePointerBitCastOrAddrSpaceCast( 2523 VTableAddressPoint, VTablePtrTy); 2524 2525 llvm::StoreInst *Store = Builder.CreateStore(VTableAddressPoint, VTableField); 2526 TBAAAccessInfo TBAAInfo = CGM.getTBAAVTablePtrAccessInfo(VTablePtrTy); 2527 CGM.DecorateInstructionWithTBAA(Store, TBAAInfo); 2528 if (CGM.getCodeGenOpts().OptimizationLevel > 0 && 2529 CGM.getCodeGenOpts().StrictVTablePointers) 2530 CGM.DecorateInstructionWithInvariantGroup(Store, Vptr.VTableClass); 2531 } 2532 2533 CodeGenFunction::VPtrsVector 2534 CodeGenFunction::getVTablePointers(const CXXRecordDecl *VTableClass) { 2535 CodeGenFunction::VPtrsVector VPtrsResult; 2536 VisitedVirtualBasesSetTy VBases; 2537 getVTablePointers(BaseSubobject(VTableClass, CharUnits::Zero()), 2538 /*NearestVBase=*/nullptr, 2539 /*OffsetFromNearestVBase=*/CharUnits::Zero(), 2540 /*BaseIsNonVirtualPrimaryBase=*/false, VTableClass, VBases, 2541 VPtrsResult); 2542 return VPtrsResult; 2543 } 2544 2545 void CodeGenFunction::getVTablePointers(BaseSubobject Base, 2546 const CXXRecordDecl *NearestVBase, 2547 CharUnits OffsetFromNearestVBase, 2548 bool BaseIsNonVirtualPrimaryBase, 2549 const CXXRecordDecl *VTableClass, 2550 VisitedVirtualBasesSetTy &VBases, 2551 VPtrsVector &Vptrs) { 2552 // If this base is a non-virtual primary base the address point has already 2553 // been set. 2554 if (!BaseIsNonVirtualPrimaryBase) { 2555 // Initialize the vtable pointer for this base. 2556 VPtr Vptr = {Base, NearestVBase, OffsetFromNearestVBase, VTableClass}; 2557 Vptrs.push_back(Vptr); 2558 } 2559 2560 const CXXRecordDecl *RD = Base.getBase(); 2561 2562 // Traverse bases. 2563 for (const auto &I : RD->bases()) { 2564 auto *BaseDecl = 2565 cast<CXXRecordDecl>(I.getType()->castAs<RecordType>()->getDecl()); 2566 2567 // Ignore classes without a vtable. 2568 if (!BaseDecl->isDynamicClass()) 2569 continue; 2570 2571 CharUnits BaseOffset; 2572 CharUnits BaseOffsetFromNearestVBase; 2573 bool BaseDeclIsNonVirtualPrimaryBase; 2574 2575 if (I.isVirtual()) { 2576 // Check if we've visited this virtual base before. 2577 if (!VBases.insert(BaseDecl).second) 2578 continue; 2579 2580 const ASTRecordLayout &Layout = 2581 getContext().getASTRecordLayout(VTableClass); 2582 2583 BaseOffset = Layout.getVBaseClassOffset(BaseDecl); 2584 BaseOffsetFromNearestVBase = CharUnits::Zero(); 2585 BaseDeclIsNonVirtualPrimaryBase = false; 2586 } else { 2587 const ASTRecordLayout &Layout = getContext().getASTRecordLayout(RD); 2588 2589 BaseOffset = Base.getBaseOffset() + Layout.getBaseClassOffset(BaseDecl); 2590 BaseOffsetFromNearestVBase = 2591 OffsetFromNearestVBase + Layout.getBaseClassOffset(BaseDecl); 2592 BaseDeclIsNonVirtualPrimaryBase = Layout.getPrimaryBase() == BaseDecl; 2593 } 2594 2595 getVTablePointers( 2596 BaseSubobject(BaseDecl, BaseOffset), 2597 I.isVirtual() ? BaseDecl : NearestVBase, BaseOffsetFromNearestVBase, 2598 BaseDeclIsNonVirtualPrimaryBase, VTableClass, VBases, Vptrs); 2599 } 2600 } 2601 2602 void CodeGenFunction::InitializeVTablePointers(const CXXRecordDecl *RD) { 2603 // Ignore classes without a vtable. 2604 if (!RD->isDynamicClass()) 2605 return; 2606 2607 // Initialize the vtable pointers for this class and all of its bases. 2608 if (CGM.getCXXABI().doStructorsInitializeVPtrs(RD)) 2609 for (const VPtr &Vptr : getVTablePointers(RD)) 2610 InitializeVTablePointer(Vptr); 2611 2612 if (RD->getNumVBases()) 2613 CGM.getCXXABI().initializeHiddenVirtualInheritanceMembers(*this, RD); 2614 } 2615 2616 llvm::Value *CodeGenFunction::GetVTablePtr(Address This, 2617 llvm::Type *VTableTy, 2618 const CXXRecordDecl *RD) { 2619 Address VTablePtrSrc = Builder.CreateElementBitCast(This, VTableTy); 2620 llvm::Instruction *VTable = Builder.CreateLoad(VTablePtrSrc, "vtable"); 2621 TBAAAccessInfo TBAAInfo = CGM.getTBAAVTablePtrAccessInfo(VTableTy); 2622 CGM.DecorateInstructionWithTBAA(VTable, TBAAInfo); 2623 2624 if (CGM.getCodeGenOpts().OptimizationLevel > 0 && 2625 CGM.getCodeGenOpts().StrictVTablePointers) 2626 CGM.DecorateInstructionWithInvariantGroup(VTable, RD); 2627 2628 return VTable; 2629 } 2630 2631 // If a class has a single non-virtual base and does not introduce or override 2632 // virtual member functions or fields, it will have the same layout as its base. 2633 // This function returns the least derived such class. 2634 // 2635 // Casting an instance of a base class to such a derived class is technically 2636 // undefined behavior, but it is a relatively common hack for introducing member 2637 // functions on class instances with specific properties (e.g. llvm::Operator) 2638 // that works under most compilers and should not have security implications, so 2639 // we allow it by default. It can be disabled with -fsanitize=cfi-cast-strict. 2640 static const CXXRecordDecl * 2641 LeastDerivedClassWithSameLayout(const CXXRecordDecl *RD) { 2642 if (!RD->field_empty()) 2643 return RD; 2644 2645 if (RD->getNumVBases() != 0) 2646 return RD; 2647 2648 if (RD->getNumBases() != 1) 2649 return RD; 2650 2651 for (const CXXMethodDecl *MD : RD->methods()) { 2652 if (MD->isVirtual()) { 2653 // Virtual member functions are only ok if they are implicit destructors 2654 // because the implicit destructor will have the same semantics as the 2655 // base class's destructor if no fields are added. 2656 if (isa<CXXDestructorDecl>(MD) && MD->isImplicit()) 2657 continue; 2658 return RD; 2659 } 2660 } 2661 2662 return LeastDerivedClassWithSameLayout( 2663 RD->bases_begin()->getType()->getAsCXXRecordDecl()); 2664 } 2665 2666 void CodeGenFunction::EmitTypeMetadataCodeForVCall(const CXXRecordDecl *RD, 2667 llvm::Value *VTable, 2668 SourceLocation Loc) { 2669 if (SanOpts.has(SanitizerKind::CFIVCall)) 2670 EmitVTablePtrCheckForCall(RD, VTable, CodeGenFunction::CFITCK_VCall, Loc); 2671 else if (CGM.getCodeGenOpts().WholeProgramVTables && 2672 // Don't insert type test assumes if we are forcing public std 2673 // visibility. 2674 !CGM.HasLTOVisibilityPublicStd(RD)) { 2675 llvm::Metadata *MD = 2676 CGM.CreateMetadataIdentifierForType(QualType(RD->getTypeForDecl(), 0)); 2677 llvm::Value *TypeId = 2678 llvm::MetadataAsValue::get(CGM.getLLVMContext(), MD); 2679 2680 llvm::Value *CastedVTable = Builder.CreateBitCast(VTable, Int8PtrTy); 2681 llvm::Value *TypeTest = 2682 Builder.CreateCall(CGM.getIntrinsic(llvm::Intrinsic::type_test), 2683 {CastedVTable, TypeId}); 2684 Builder.CreateCall(CGM.getIntrinsic(llvm::Intrinsic::assume), TypeTest); 2685 } 2686 } 2687 2688 void CodeGenFunction::EmitVTablePtrCheckForCall(const CXXRecordDecl *RD, 2689 llvm::Value *VTable, 2690 CFITypeCheckKind TCK, 2691 SourceLocation Loc) { 2692 if (!SanOpts.has(SanitizerKind::CFICastStrict)) 2693 RD = LeastDerivedClassWithSameLayout(RD); 2694 2695 EmitVTablePtrCheck(RD, VTable, TCK, Loc); 2696 } 2697 2698 void CodeGenFunction::EmitVTablePtrCheckForCast(QualType T, 2699 llvm::Value *Derived, 2700 bool MayBeNull, 2701 CFITypeCheckKind TCK, 2702 SourceLocation Loc) { 2703 if (!getLangOpts().CPlusPlus) 2704 return; 2705 2706 auto *ClassTy = T->getAs<RecordType>(); 2707 if (!ClassTy) 2708 return; 2709 2710 const CXXRecordDecl *ClassDecl = cast<CXXRecordDecl>(ClassTy->getDecl()); 2711 2712 if (!ClassDecl->isCompleteDefinition() || !ClassDecl->isDynamicClass()) 2713 return; 2714 2715 if (!SanOpts.has(SanitizerKind::CFICastStrict)) 2716 ClassDecl = LeastDerivedClassWithSameLayout(ClassDecl); 2717 2718 llvm::BasicBlock *ContBlock = nullptr; 2719 2720 if (MayBeNull) { 2721 llvm::Value *DerivedNotNull = 2722 Builder.CreateIsNotNull(Derived, "cast.nonnull"); 2723 2724 llvm::BasicBlock *CheckBlock = createBasicBlock("cast.check"); 2725 ContBlock = createBasicBlock("cast.cont"); 2726 2727 Builder.CreateCondBr(DerivedNotNull, CheckBlock, ContBlock); 2728 2729 EmitBlock(CheckBlock); 2730 } 2731 2732 llvm::Value *VTable; 2733 std::tie(VTable, ClassDecl) = CGM.getCXXABI().LoadVTablePtr( 2734 *this, Address(Derived, getPointerAlign()), ClassDecl); 2735 2736 EmitVTablePtrCheck(ClassDecl, VTable, TCK, Loc); 2737 2738 if (MayBeNull) { 2739 Builder.CreateBr(ContBlock); 2740 EmitBlock(ContBlock); 2741 } 2742 } 2743 2744 void CodeGenFunction::EmitVTablePtrCheck(const CXXRecordDecl *RD, 2745 llvm::Value *VTable, 2746 CFITypeCheckKind TCK, 2747 SourceLocation Loc) { 2748 if (!CGM.getCodeGenOpts().SanitizeCfiCrossDso && 2749 !CGM.HasHiddenLTOVisibility(RD)) 2750 return; 2751 2752 SanitizerMask M; 2753 llvm::SanitizerStatKind SSK; 2754 switch (TCK) { 2755 case CFITCK_VCall: 2756 M = SanitizerKind::CFIVCall; 2757 SSK = llvm::SanStat_CFI_VCall; 2758 break; 2759 case CFITCK_NVCall: 2760 M = SanitizerKind::CFINVCall; 2761 SSK = llvm::SanStat_CFI_NVCall; 2762 break; 2763 case CFITCK_DerivedCast: 2764 M = SanitizerKind::CFIDerivedCast; 2765 SSK = llvm::SanStat_CFI_DerivedCast; 2766 break; 2767 case CFITCK_UnrelatedCast: 2768 M = SanitizerKind::CFIUnrelatedCast; 2769 SSK = llvm::SanStat_CFI_UnrelatedCast; 2770 break; 2771 case CFITCK_ICall: 2772 case CFITCK_NVMFCall: 2773 case CFITCK_VMFCall: 2774 llvm_unreachable("unexpected sanitizer kind"); 2775 } 2776 2777 std::string TypeName = RD->getQualifiedNameAsString(); 2778 if (getContext().getNoSanitizeList().containsType(M, TypeName)) 2779 return; 2780 2781 SanitizerScope SanScope(this); 2782 EmitSanitizerStatReport(SSK); 2783 2784 llvm::Metadata *MD = 2785 CGM.CreateMetadataIdentifierForType(QualType(RD->getTypeForDecl(), 0)); 2786 llvm::Value *TypeId = llvm::MetadataAsValue::get(getLLVMContext(), MD); 2787 2788 llvm::Value *CastedVTable = Builder.CreateBitCast(VTable, Int8PtrTy); 2789 llvm::Value *TypeTest = Builder.CreateCall( 2790 CGM.getIntrinsic(llvm::Intrinsic::type_test), {CastedVTable, TypeId}); 2791 2792 llvm::Constant *StaticData[] = { 2793 llvm::ConstantInt::get(Int8Ty, TCK), 2794 EmitCheckSourceLocation(Loc), 2795 EmitCheckTypeDescriptor(QualType(RD->getTypeForDecl(), 0)), 2796 }; 2797 2798 auto CrossDsoTypeId = CGM.CreateCrossDsoCfiTypeId(MD); 2799 if (CGM.getCodeGenOpts().SanitizeCfiCrossDso && CrossDsoTypeId) { 2800 EmitCfiSlowPathCheck(M, TypeTest, CrossDsoTypeId, CastedVTable, StaticData); 2801 return; 2802 } 2803 2804 if (CGM.getCodeGenOpts().SanitizeTrap.has(M)) { 2805 EmitTrapCheck(TypeTest, SanitizerHandler::CFICheckFail); 2806 return; 2807 } 2808 2809 llvm::Value *AllVtables = llvm::MetadataAsValue::get( 2810 CGM.getLLVMContext(), 2811 llvm::MDString::get(CGM.getLLVMContext(), "all-vtables")); 2812 llvm::Value *ValidVtable = Builder.CreateCall( 2813 CGM.getIntrinsic(llvm::Intrinsic::type_test), {CastedVTable, AllVtables}); 2814 EmitCheck(std::make_pair(TypeTest, M), SanitizerHandler::CFICheckFail, 2815 StaticData, {CastedVTable, ValidVtable}); 2816 } 2817 2818 bool CodeGenFunction::ShouldEmitVTableTypeCheckedLoad(const CXXRecordDecl *RD) { 2819 if (!CGM.getCodeGenOpts().WholeProgramVTables || 2820 !CGM.HasHiddenLTOVisibility(RD)) 2821 return false; 2822 2823 if (CGM.getCodeGenOpts().VirtualFunctionElimination) 2824 return true; 2825 2826 if (!SanOpts.has(SanitizerKind::CFIVCall) || 2827 !CGM.getCodeGenOpts().SanitizeTrap.has(SanitizerKind::CFIVCall)) 2828 return false; 2829 2830 std::string TypeName = RD->getQualifiedNameAsString(); 2831 return !getContext().getNoSanitizeList().containsType(SanitizerKind::CFIVCall, 2832 TypeName); 2833 } 2834 2835 llvm::Value *CodeGenFunction::EmitVTableTypeCheckedLoad( 2836 const CXXRecordDecl *RD, llvm::Value *VTable, uint64_t VTableByteOffset) { 2837 SanitizerScope SanScope(this); 2838 2839 EmitSanitizerStatReport(llvm::SanStat_CFI_VCall); 2840 2841 llvm::Metadata *MD = 2842 CGM.CreateMetadataIdentifierForType(QualType(RD->getTypeForDecl(), 0)); 2843 llvm::Value *TypeId = llvm::MetadataAsValue::get(CGM.getLLVMContext(), MD); 2844 2845 llvm::Value *CastedVTable = Builder.CreateBitCast(VTable, Int8PtrTy); 2846 llvm::Value *CheckedLoad = Builder.CreateCall( 2847 CGM.getIntrinsic(llvm::Intrinsic::type_checked_load), 2848 {CastedVTable, llvm::ConstantInt::get(Int32Ty, VTableByteOffset), 2849 TypeId}); 2850 llvm::Value *CheckResult = Builder.CreateExtractValue(CheckedLoad, 1); 2851 2852 std::string TypeName = RD->getQualifiedNameAsString(); 2853 if (SanOpts.has(SanitizerKind::CFIVCall) && 2854 !getContext().getNoSanitizeList().containsType(SanitizerKind::CFIVCall, 2855 TypeName)) { 2856 EmitCheck(std::make_pair(CheckResult, SanitizerKind::CFIVCall), 2857 SanitizerHandler::CFICheckFail, {}, {}); 2858 } 2859 2860 return Builder.CreateBitCast( 2861 Builder.CreateExtractValue(CheckedLoad, 0), 2862 cast<llvm::PointerType>(VTable->getType())->getElementType()); 2863 } 2864 2865 void CodeGenFunction::EmitForwardingCallToLambda( 2866 const CXXMethodDecl *callOperator, 2867 CallArgList &callArgs) { 2868 // Get the address of the call operator. 2869 const CGFunctionInfo &calleeFnInfo = 2870 CGM.getTypes().arrangeCXXMethodDeclaration(callOperator); 2871 llvm::Constant *calleePtr = 2872 CGM.GetAddrOfFunction(GlobalDecl(callOperator), 2873 CGM.getTypes().GetFunctionType(calleeFnInfo)); 2874 2875 // Prepare the return slot. 2876 const FunctionProtoType *FPT = 2877 callOperator->getType()->castAs<FunctionProtoType>(); 2878 QualType resultType = FPT->getReturnType(); 2879 ReturnValueSlot returnSlot; 2880 if (!resultType->isVoidType() && 2881 calleeFnInfo.getReturnInfo().getKind() == ABIArgInfo::Indirect && 2882 !hasScalarEvaluationKind(calleeFnInfo.getReturnType())) 2883 returnSlot = 2884 ReturnValueSlot(ReturnValue, resultType.isVolatileQualified(), 2885 /*IsUnused=*/false, /*IsExternallyDestructed=*/true); 2886 2887 // We don't need to separately arrange the call arguments because 2888 // the call can't be variadic anyway --- it's impossible to forward 2889 // variadic arguments. 2890 2891 // Now emit our call. 2892 auto callee = CGCallee::forDirect(calleePtr, GlobalDecl(callOperator)); 2893 RValue RV = EmitCall(calleeFnInfo, callee, returnSlot, callArgs); 2894 2895 // If necessary, copy the returned value into the slot. 2896 if (!resultType->isVoidType() && returnSlot.isNull()) { 2897 if (getLangOpts().ObjCAutoRefCount && resultType->isObjCRetainableType()) { 2898 RV = RValue::get(EmitARCRetainAutoreleasedReturnValue(RV.getScalarVal())); 2899 } 2900 EmitReturnOfRValue(RV, resultType); 2901 } else 2902 EmitBranchThroughCleanup(ReturnBlock); 2903 } 2904 2905 void CodeGenFunction::EmitLambdaBlockInvokeBody() { 2906 const BlockDecl *BD = BlockInfo->getBlockDecl(); 2907 const VarDecl *variable = BD->capture_begin()->getVariable(); 2908 const CXXRecordDecl *Lambda = variable->getType()->getAsCXXRecordDecl(); 2909 const CXXMethodDecl *CallOp = Lambda->getLambdaCallOperator(); 2910 2911 if (CallOp->isVariadic()) { 2912 // FIXME: Making this work correctly is nasty because it requires either 2913 // cloning the body of the call operator or making the call operator 2914 // forward. 2915 CGM.ErrorUnsupported(CurCodeDecl, "lambda conversion to variadic function"); 2916 return; 2917 } 2918 2919 // Start building arguments for forwarding call 2920 CallArgList CallArgs; 2921 2922 QualType ThisType = getContext().getPointerType(getContext().getRecordType(Lambda)); 2923 Address ThisPtr = GetAddrOfBlockDecl(variable); 2924 CallArgs.add(RValue::get(ThisPtr.getPointer()), ThisType); 2925 2926 // Add the rest of the parameters. 2927 for (auto param : BD->parameters()) 2928 EmitDelegateCallArg(CallArgs, param, param->getBeginLoc()); 2929 2930 assert(!Lambda->isGenericLambda() && 2931 "generic lambda interconversion to block not implemented"); 2932 EmitForwardingCallToLambda(CallOp, CallArgs); 2933 } 2934 2935 void CodeGenFunction::EmitLambdaDelegatingInvokeBody(const CXXMethodDecl *MD) { 2936 const CXXRecordDecl *Lambda = MD->getParent(); 2937 2938 // Start building arguments for forwarding call 2939 CallArgList CallArgs; 2940 2941 QualType ThisType = getContext().getPointerType(getContext().getRecordType(Lambda)); 2942 llvm::Value *ThisPtr = llvm::UndefValue::get(getTypes().ConvertType(ThisType)); 2943 CallArgs.add(RValue::get(ThisPtr), ThisType); 2944 2945 // Add the rest of the parameters. 2946 for (auto Param : MD->parameters()) 2947 EmitDelegateCallArg(CallArgs, Param, Param->getBeginLoc()); 2948 2949 const CXXMethodDecl *CallOp = Lambda->getLambdaCallOperator(); 2950 // For a generic lambda, find the corresponding call operator specialization 2951 // to which the call to the static-invoker shall be forwarded. 2952 if (Lambda->isGenericLambda()) { 2953 assert(MD->isFunctionTemplateSpecialization()); 2954 const TemplateArgumentList *TAL = MD->getTemplateSpecializationArgs(); 2955 FunctionTemplateDecl *CallOpTemplate = CallOp->getDescribedFunctionTemplate(); 2956 void *InsertPos = nullptr; 2957 FunctionDecl *CorrespondingCallOpSpecialization = 2958 CallOpTemplate->findSpecialization(TAL->asArray(), InsertPos); 2959 assert(CorrespondingCallOpSpecialization); 2960 CallOp = cast<CXXMethodDecl>(CorrespondingCallOpSpecialization); 2961 } 2962 EmitForwardingCallToLambda(CallOp, CallArgs); 2963 } 2964 2965 void CodeGenFunction::EmitLambdaStaticInvokeBody(const CXXMethodDecl *MD) { 2966 if (MD->isVariadic()) { 2967 // FIXME: Making this work correctly is nasty because it requires either 2968 // cloning the body of the call operator or making the call operator forward. 2969 CGM.ErrorUnsupported(MD, "lambda conversion to variadic function"); 2970 return; 2971 } 2972 2973 EmitLambdaDelegatingInvokeBody(MD); 2974 } 2975