1 // RUN: %clang_cc1 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s
2 
3 struct S {
4   double d;
5   int a, b;
6   virtual int f();
7 };
8 
9 // CHECK: @_Z17reference_binding
10 void reference_binding(int *p, S *q) {
11   // C++ core issue 453: If an lvalue to which a reference is directly bound
12   // designates neither an existing object or function of an appropriate type,
13   // nor a region of storage of suitable size and alignment to contain an object
14   // of the reference's type, the behavior is undefined.
15 
16   // CHECK: icmp ne {{.*}}, null
17 
18   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
19   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
20 
21   // CHECK: %[[PTRINT:.*]] = ptrtoint
22   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
23   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
24   int &r = *p;
25 
26   // A reference is not required to refer to an object within its lifetime.
27   // CHECK-NOT: __ubsan_handle_dynamic_type_cache_miss
28   S &r2 = *q;
29 }
30 
31 // CHECK: @_Z13member_access
32 void member_access(S *p) {
33   // (1a) Check 'p' is appropriately sized and aligned for member access.
34 
35   // CHECK: icmp ne {{.*}}, null
36 
37   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
38   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
39 
40   // CHECK: %[[PTRINT:.*]] = ptrtoint
41   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
42   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
43 
44   // (1b) Check that 'p' actually points to an 'S'.
45 
46   // CHECK: %[[VPTRADDR:.*]] = bitcast {{.*}} to i64*
47   // CHECK-NEXT: %[[VPTR:.*]] = load i64* %[[VPTRADDR]]
48   //
49   // hash_16_bytes:
50   //
51   // If this number changes, it indicates that either the mangled name of ::S
52   // has changed, or that LLVM's hashing function has changed. The latter case
53   // is OK if the hashing function is still stable.
54   //
55   // The two hash values are for 64- and 32-bit Clang binaries, respectively.
56   // FIXME: We should produce a 64-bit value either way.
57   //
58   // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}}, %[[VPTR]]
59   // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
60   // CHECK-NEXT: lshr i64 {{.*}}, 47
61   // CHECK-NEXT: xor i64
62   // CHECK-NEXT: xor i64 %[[VPTR]]
63   // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
64   // CHECK-NEXT: lshr i64 {{.*}}, 47
65   // CHECK-NEXT: xor i64
66   // CHECK-NEXT: %[[HASH:.*]] = mul i64 {{.*}}, -7070675565921424023
67   //
68   // Check the hash against the table:
69   //
70   // CHECK-NEXT: %[[IDX:.*]] = and i64 %{{.*}}, 127
71   // CHECK-NEXT: getelementptr inbounds [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %[[IDX]]
72   // CHECK-NEXT: %[[CACHEVAL:.*]] = load i64*
73   // CHECK-NEXT: icmp eq i64 %[[CACHEVAL]], %[[HASH]]
74   // CHECK-NEXT: br i1
75 
76   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %[[HASH]])
77   // CHECK-NOT: unreachable
78   // CHECK: {{.*}}:
79 
80   // (2) Check 'p->b' is appropriately sized and aligned for a load.
81 
82   // FIXME: Suppress this in the trivial case of a member access, because we
83   // know we've just checked the member access expression itself.
84 
85   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
86   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
87 
88   // CHECK: %[[PTRINT:.*]] = ptrtoint
89   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
90   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
91   int k = p->b;
92 
93   // (3a) Check 'p' is appropriately sized and aligned for member function call.
94 
95   // CHECK: icmp ne {{.*}}, null
96 
97   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
98   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
99 
100   // CHECK: %[[PTRINT:.*]] = ptrtoint
101   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
102   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
103 
104   // (3b) Check that 'p' actually points to an 'S'
105 
106   // CHECK: load i64*
107   // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}},
108   // [...]
109   // CHECK: getelementptr inbounds [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %
110   // CHECK: br i1
111   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %{{.*}})
112   // CHECK-NOT: unreachable
113   // CHECK: {{.*}}:
114 
115   k = p->f();
116 }
117 
118 // CHECK: @_Z12lsh_overflow
119 int lsh_overflow(int a, int b) {
120   // CHECK: %[[INBOUNDS:.*]] = icmp ule i32 %[[RHS:.*]], 31
121   // CHECK-NEXT: br i1 %[[INBOUNDS]]
122 
123   // CHECK: %[[SHIFTED_OUT_WIDTH:.*]] = sub nuw nsw i32 31, %[[RHS]]
124   // CHECK-NEXT: %[[SHIFTED_OUT:.*]] = lshr i32 %[[LHS:.*]], %[[SHIFTED_OUT_WIDTH]]
125 
126   // This is present for C++11 but not for C: C++ core issue 1457 allows a '1'
127   // to be shifted into the sign bit, but not out of it.
128   // CHECK-NEXT: %[[SHIFTED_OUT_NOT_SIGN:.*]] = lshr i32 %[[SHIFTED_OUT]], 1
129 
130   // CHECK-NEXT: %[[NO_OVERFLOW:.*]] = icmp eq i32 %[[SHIFTED_OUT_NOT_SIGN]], 0
131   // CHECK-NEXT: br i1 %[[NO_OVERFLOW]]
132 
133   // CHECK: %[[RET:.*]] = shl i32 %[[LHS]], %[[RHS]]
134   // CHECK-NEXT: ret i32 %[[RET]]
135   return a << b;
136 }
137 
138 // CHECK: @_Z9no_return
139 int no_return() {
140   // CHECK:      call void @__ubsan_handle_missing_return(i8* bitcast ({{.*}}* @{{.*}} to i8*)) noreturn nounwind
141   // CHECK-NEXT: unreachable
142 }
143 
144 // CHECK: @_Z9sour_bool
145 bool sour_bool(bool *p) {
146   // CHECK: %[[OK:.*]] = icmp ule i8 {{.*}}, 1
147   // CHECK: br i1 %[[OK]]
148   // CHECK: call void @__ubsan_handle_load_invalid_value(i8* bitcast ({{.*}}), i64 {{.*}})
149   return *p;
150 }
151 
152 enum E1 { e1a = 0, e1b = 127 } e1;
153 enum E2 { e2a = -1, e2b = 64 } e2;
154 enum E3 { e3a = (1u << 31) - 1 } e3;
155 
156 // CHECK: @_Z14bad_enum_value
157 int bad_enum_value() {
158   // CHECK: %[[E1:.*]] = icmp ule i32 {{.*}}, 127
159   // CHECK: br i1 %[[E1]]
160   // CHECK: call void @__ubsan_handle_load_invalid_value(
161   int a = e1;
162 
163   // CHECK: %[[E2HI:.*]] = icmp sle i32 {{.*}}, 127
164   // CHECK: %[[E2LO:.*]] = icmp sge i32 {{.*}}, -128
165   // CHECK: %[[E2:.*]] = and i1 %[[E2HI]], %[[E2LO]]
166   // CHECK: br i1 %[[E2]]
167   // CHECK: call void @__ubsan_handle_load_invalid_value(
168   int b = e2;
169 
170   // CHECK: %[[E3:.*]] = icmp ule i32 {{.*}}, 2147483647
171   // CHECK: br i1 %[[E3]]
172   // CHECK: call void @__ubsan_handle_load_invalid_value(
173   int c = e3;
174   return a + b + c;
175 }
176