1 // RUN: %clang_cc1 -std=c++11 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -fsanitize-recover=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s
2 // RUN: %clang_cc1 -std=c++11 -fsanitize=vptr,address -fsanitize-recover=vptr,address -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=CHECK-ASAN
3 // RUN: %clang_cc1 -std=c++11 -fsanitize=vptr -fsanitize-recover=vptr -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=DOWNCAST-NULL
4 // RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple x86_64-linux-gnux32 | FileCheck %s --check-prefix=CHECK-X32
5 // RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple i386-linux-gnu | FileCheck %s --check-prefix=CHECK-X86
6 
7 struct S {
8   double d;
9   int a, b;
10   virtual int f();
11 };
12 
13 // Check that type descriptor global is not modified by ASan.
14 // CHECK-ASAN: [[TYPE_DESCR:@[0-9]+]] = private unnamed_addr constant { i16, i16, [4 x i8] } { i16 -1, i16 0, [4 x i8] c"'S'\00" }
15 
16 // Check that type mismatch handler is not modified by ASan.
17 // CHECK-ASAN: private unnamed_addr global { { [{{.*}} x i8]*, i32, i32 }, { i16, i16, [4 x i8] }*, i8*, i8 } { {{.*}}, { i16, i16, [4 x i8] }* [[TYPE_DESCR]], {{.*}} }
18 
19 struct T : S {};
20 
21 // CHECK-LABEL: @_Z17reference_binding
22 void reference_binding(int *p, S *q) {
23   // C++ core issue 453: If an lvalue to which a reference is directly bound
24   // designates neither an existing object or function of an appropriate type,
25   // nor a region of storage of suitable size and alignment to contain an object
26   // of the reference's type, the behavior is undefined.
27 
28   // CHECK: icmp ne {{.*}}, null
29 
30   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
31   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
32 
33   // CHECK: %[[PTRINT:.*]] = ptrtoint
34   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
35   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
36   int &r = *p;
37 
38   // A reference is not required to refer to an object within its lifetime.
39   // CHECK-NOT: __ubsan_handle_dynamic_type_cache_miss
40   S &r2 = *q;
41 }
42 
43 // CHECK-LABEL: @_Z13member_access
44 // CHECK-ASAN-LABEL: @_Z13member_access
45 void member_access(S *p) {
46   // (1a) Check 'p' is appropriately sized and aligned for member access.
47 
48   // CHECK: icmp ne {{.*}}, null
49 
50   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
51   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
52 
53   // CHECK: %[[PTRINT:.*]] = ptrtoint
54   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
55   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
56 
57   // (1b) Check that 'p' actually points to an 'S'.
58 
59   // CHECK: %[[VPTRADDR:.*]] = bitcast {{.*}} to i64*
60   // CHECK-NEXT: %[[VPTR:.*]] = load i64, i64* %[[VPTRADDR]]
61   //
62   // hash_16_bytes:
63   //
64   // If this number changes, it indicates that either the mangled name of ::S
65   // has changed, or that LLVM's hashing function has changed. The latter case
66   // is OK if the hashing function is still stable.
67   //
68   // The two hash values are for 64- and 32-bit Clang binaries, respectively.
69   // FIXME: We should produce a 64-bit value either way.
70   //
71   // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}}, %[[VPTR]]
72   // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
73   // CHECK-NEXT: lshr i64 {{.*}}, 47
74   // CHECK-NEXT: xor i64
75   // CHECK-NEXT: xor i64 %[[VPTR]]
76   // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
77   // CHECK-NEXT: lshr i64 {{.*}}, 47
78   // CHECK-NEXT: xor i64
79   // CHECK-NEXT: %[[HASH:.*]] = mul i64 {{.*}}, -7070675565921424023
80   //
81   // Check the hash against the table:
82   //
83   // CHECK-NEXT: %[[IDX:.*]] = and i64 %{{.*}}, 127
84   // CHECK-NEXT: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %[[IDX]]
85   // CHECK-NEXT: %[[CACHEVAL:.*]] = load i64, i64*
86   // CHECK-NEXT: icmp eq i64 %[[CACHEVAL]], %[[HASH]]
87   // CHECK-NEXT: br i1
88 
89   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %[[HASH]])
90   // CHECK-NOT: unreachable
91   // CHECK: {{.*}}:
92 
93   // (2) Check 'p->b' is appropriately sized and aligned for a load.
94 
95   // FIXME: Suppress this in the trivial case of a member access, because we
96   // know we've just checked the member access expression itself.
97 
98   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
99   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
100 
101   // CHECK: %[[PTRINT:.*]] = ptrtoint
102   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
103   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
104   int k = p->b;
105 
106   // (3a) Check 'p' is appropriately sized and aligned for member function call.
107 
108   // CHECK: icmp ne {{.*}}, null
109 
110   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
111   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
112 
113   // CHECK: %[[PTRINT:.*]] = ptrtoint
114   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
115   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
116 
117   // (3b) Check that 'p' actually points to an 'S'
118 
119   // CHECK: load i64, i64*
120   // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}},
121   // [...]
122   // CHECK: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %
123   // CHECK: br i1
124   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %{{.*}})
125   // CHECK-NOT: unreachable
126   // CHECK: {{.*}}:
127 
128   k = p->f();
129 }
130 
131 // CHECK-LABEL: @_Z12lsh_overflow
132 int lsh_overflow(int a, int b) {
133   // CHECK: %[[INBOUNDS:.*]] = icmp ule i32 %[[RHS:.*]], 31
134   // CHECK-NEXT: br i1 %[[INBOUNDS]]
135 
136   // CHECK: %[[SHIFTED_OUT_WIDTH:.*]] = sub nuw nsw i32 31, %[[RHS]]
137   // CHECK-NEXT: %[[SHIFTED_OUT:.*]] = lshr i32 %[[LHS:.*]], %[[SHIFTED_OUT_WIDTH]]
138 
139   // This is present for C++11 but not for C: C++ core issue 1457 allows a '1'
140   // to be shifted into the sign bit, but not out of it.
141   // CHECK-NEXT: %[[SHIFTED_OUT_NOT_SIGN:.*]] = lshr i32 %[[SHIFTED_OUT]], 1
142 
143   // CHECK-NEXT: %[[NO_OVERFLOW:.*]] = icmp eq i32 %[[SHIFTED_OUT_NOT_SIGN]], 0
144 
145   // CHECK: %[[VALID:.*]] = phi i1 [ %[[INBOUNDS]], {{.*}} ], [ %[[NO_OVERFLOW]], {{.*}} ]
146   // CHECK-NEXT: br i1 %[[VALID]]
147 
148   // CHECK: call void @__ubsan_handle_shift_out_of_bounds
149   // CHECK-NOT: call void @__ubsan_handle_shift_out_of_bounds
150 
151   // CHECK: %[[RET:.*]] = shl i32 %[[LHS]], %[[RHS]]
152   // CHECK-NEXT: ret i32 %[[RET]]
153   return a << b;
154 }
155 
156 // CHECK-LABEL: @_Z9no_return
157 int no_return() {
158   // CHECK:      call void @__ubsan_handle_missing_return(i8* bitcast ({{.*}}* @{{.*}} to i8*)) [[NR_NUW:#[0-9]+]]
159   // CHECK-NEXT: unreachable
160 }
161 
162 // CHECK-LABEL: @_Z9sour_bool
163 bool sour_bool(bool *p) {
164   // CHECK: %[[OK:.*]] = icmp ule i8 {{.*}}, 1
165   // CHECK: br i1 %[[OK]]
166   // CHECK: call void @__ubsan_handle_load_invalid_value(i8* bitcast ({{.*}}), i64 {{.*}})
167   return *p;
168 }
169 
170 enum E1 { e1a = 0, e1b = 127 } e1;
171 enum E2 { e2a = -1, e2b = 64 } e2;
172 enum E3 { e3a = (1u << 31) - 1 } e3;
173 
174 // CHECK-LABEL: @_Z14bad_enum_value
175 int bad_enum_value() {
176   // CHECK: %[[E1:.*]] = icmp ule i32 {{.*}}, 127
177   // CHECK: br i1 %[[E1]]
178   // CHECK: call void @__ubsan_handle_load_invalid_value(
179   int a = e1;
180 
181   // CHECK: %[[E2HI:.*]] = icmp sle i32 {{.*}}, 127
182   // CHECK: %[[E2LO:.*]] = icmp sge i32 {{.*}}, -128
183   // CHECK: %[[E2:.*]] = and i1 %[[E2HI]], %[[E2LO]]
184   // CHECK: br i1 %[[E2]]
185   // CHECK: call void @__ubsan_handle_load_invalid_value(
186   int b = e2;
187 
188   // CHECK: %[[E3:.*]] = icmp ule i32 {{.*}}, 2147483647
189   // CHECK: br i1 %[[E3]]
190   // CHECK: call void @__ubsan_handle_load_invalid_value(
191   int c = e3;
192   return a + b + c;
193 }
194 
195 // CHECK-LABEL: @_Z20bad_downcast_pointer
196 // DOWNCAST-NULL-LABEL: @_Z20bad_downcast_pointer
197 void bad_downcast_pointer(S *p) {
198   // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
199   // CHECK: br i1 %[[NONNULL]],
200 
201   // A null poiner access is guarded without -fsanitize=null.
202   // DOWNCAST-NULL: %[[NONNULL:.*]] = icmp ne {{.*}}, null
203   // DOWNCAST-NULL: br i1 %[[NONNULL]],
204 
205   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
206   // CHECK: %[[E1:.*]] = icmp uge i64 %[[SIZE]], 24
207   // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
208   // CHECK: %[[E2:.*]] = icmp eq i64 %[[MISALIGN]], 0
209   // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
210   // CHECK: br i1 %[[E12]],
211 
212   // CHECK: call void @__ubsan_handle_type_mismatch
213   // CHECK: br label
214 
215   // CHECK: br i1 %{{.*}},
216 
217   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
218   // CHECK: br label
219   (void) static_cast<T*>(p);
220 }
221 
222 // CHECK-LABEL: @_Z22bad_downcast_reference
223 void bad_downcast_reference(S &p) {
224   // CHECK: %[[E1:.*]] = icmp ne {{.*}}, null
225   // CHECK-NOT: br i1
226 
227   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
228   // CHECK: %[[E2:.*]] = icmp uge i64 %[[SIZE]], 24
229 
230   // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
231   // CHECK: %[[E3:.*]] = icmp eq i64 %[[MISALIGN]], 0
232 
233   // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
234   // CHECK: %[[E123:.*]] = and i1 %[[E12]], %[[E3]]
235   // CHECK: br i1 %[[E123]],
236 
237   // CHECK: call void @__ubsan_handle_type_mismatch
238   // CHECK: br label
239 
240   // CHECK: br i1 %{{.*}},
241 
242   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
243   // CHECK: br label
244   (void) static_cast<T&>(p);
245 }
246 
247 // CHECK-LABEL: @_Z11array_index
248 int array_index(const int (&a)[4], int n) {
249   // CHECK: %[[K1_OK:.*]] = icmp ult i64 %{{.*}}, 4
250   // CHECK: br i1 %[[K1_OK]]
251   // CHECK: call void @__ubsan_handle_out_of_bounds(
252   int k1 = a[n];
253 
254   // CHECK: %[[R1_OK:.*]] = icmp ule i64 %{{.*}}, 4
255   // CHECK: br i1 %[[R1_OK]]
256   // CHECK: call void @__ubsan_handle_out_of_bounds(
257   const int *r1 = &a[n];
258 
259   // CHECK: %[[K2_OK:.*]] = icmp ult i64 %{{.*}}, 8
260   // CHECK: br i1 %[[K2_OK]]
261   // CHECK: call void @__ubsan_handle_out_of_bounds(
262   int k2 = ((const int(&)[8])a)[n];
263 
264   // CHECK: %[[K3_OK:.*]] = icmp ult i64 %{{.*}}, 4
265   // CHECK: br i1 %[[K3_OK]]
266   // CHECK: call void @__ubsan_handle_out_of_bounds(
267   int k3 = n[a];
268 
269   return k1 + *r1 + k2;
270 }
271 
272 // CHECK-LABEL: @_Z17multi_array_index
273 int multi_array_index(int n, int m) {
274   int arr[4][6];
275 
276   // CHECK: %[[IDX2_OK:.*]] = icmp ult i64 %{{.*}}, 6
277   // CHECK: br i1 %[[IDX2_OK]]
278   // CHECK: call void @__ubsan_handle_out_of_bounds(
279 
280   // CHECK: %[[IDX1_OK:.*]] = icmp ult i64 %{{.*}}, 4
281   // CHECK: br i1 %[[IDX1_OK]]
282   // CHECK: call void @__ubsan_handle_out_of_bounds(
283   return arr[n][m];
284 }
285 
286 // CHECK-LABEL: @_Z11array_arith
287 int array_arith(const int (&a)[4], int n) {
288   // CHECK: %[[K1_OK:.*]] = icmp ule i64 %{{.*}}, 4
289   // CHECK: br i1 %[[K1_OK]]
290   // CHECK: call void @__ubsan_handle_out_of_bounds(
291   const int *k1 = a + n;
292 
293   // CHECK: %[[K2_OK:.*]] = icmp ule i64 %{{.*}}, 8
294   // CHECK: br i1 %[[K2_OK]]
295   // CHECK: call void @__ubsan_handle_out_of_bounds(
296   const int *k2 = (const int(&)[8])a + n;
297 
298   return *k1 + *k2;
299 }
300 
301 struct ArrayMembers {
302   int a1[5];
303   int a2[1];
304 };
305 // CHECK-LABEL: @_Z18struct_array_index
306 int struct_array_index(ArrayMembers *p, int n) {
307   // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 5
308   // CHECK: br i1 %[[IDX_OK]]
309   // CHECK: call void @__ubsan_handle_out_of_bounds(
310   return p->a1[n];
311 }
312 
313 // CHECK-LABEL: @_Z16flex_array_index
314 int flex_array_index(ArrayMembers *p, int n) {
315   // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
316   return p->a2[n];
317 }
318 
319 extern int incomplete[];
320 // CHECK-LABEL: @_Z22incomplete_array_index
321 int incomplete_array_index(int n) {
322   // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
323   return incomplete[n];
324 }
325 
326 typedef __attribute__((ext_vector_type(4))) int V4I;
327 // CHECK-LABEL: @_Z12vector_index
328 int vector_index(V4I v, int n) {
329   // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 4
330   // CHECK: br i1 %[[IDX_OK]]
331   // CHECK: call void @__ubsan_handle_out_of_bounds(
332   return v[n];
333 }
334 
335 // CHECK-LABEL: @_Z12string_index
336 char string_index(int n) {
337   // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 6
338   // CHECK: br i1 %[[IDX_OK]]
339   // CHECK: call void @__ubsan_handle_out_of_bounds(
340   return "Hello"[n];
341 }
342 
343 class A // align=4
344 {
345   int a1, a2, a3;
346 };
347 
348 class B // align=8
349 {
350   long b1, b2;
351 };
352 
353 class C : public A, public B // align=16
354 {
355   alignas(16) int c1;
356 };
357 
358 // Make sure we check the alignment of the pointer after subtracting any
359 // offset. The pointer before subtraction doesn't need to be aligned for
360 // the destination type.
361 
362 // CHECK-LABEL: define void @_Z16downcast_pointerP1B(%class.B* %b)
363 void downcast_pointer(B *b) {
364   (void) static_cast<C*>(b);
365   // Alignment check from EmitTypeCheck(TCK_DowncastPointer, ...)
366   // CHECK: [[SUB:%[.a-z0-9]*]] = getelementptr i8, i8* {{.*}}, i64 -16
367   // CHECK-NEXT: [[C:%[0-9]*]] = bitcast i8* [[SUB]] to %class.C*
368   // null check goes here
369   // CHECK: [[FROM_PHI:%[0-9]*]] = phi %class.C* [ [[C]], {{.*}} ], {{.*}}
370   // Objectsize check goes here
371   // CHECK: [[C_INT:%[0-9]*]] = ptrtoint %class.C* [[FROM_PHI]] to i64
372   // CHECK-NEXT: [[MASKED:%[0-9]*]] = and i64 [[C_INT]], 15
373   // CHECK-NEXT: [[TEST:%[0-9]*]] = icmp eq i64 [[MASKED]], 0
374   // AND the alignment test with the objectsize test.
375   // CHECK-NEXT: [[AND:%[0-9]*]] = and i1 {{.*}}, [[TEST]]
376   // CHECK-NEXT: br i1 [[AND]]
377 }
378 
379 // CHECK-LABEL: define void @_Z18downcast_referenceR1B(%class.B* dereferenceable({{[0-9]+}}) %b)
380 void downcast_reference(B &b) {
381   (void) static_cast<C&>(b);
382   // Alignment check from EmitTypeCheck(TCK_DowncastReference, ...)
383   // CHECK:      [[SUB:%[.a-z0-9]*]] = getelementptr i8, i8* {{.*}}, i64 -16
384   // CHECK-NEXT: [[C:%[0-9]*]] = bitcast i8* [[SUB]] to %class.C*
385   // Objectsize check goes here
386   // CHECK:      [[C_INT:%[0-9]*]] = ptrtoint %class.C* [[C]] to i64
387   // CHECK-NEXT: [[MASKED:%[0-9]*]] = and i64 [[C_INT]], 15
388   // CHECK-NEXT: [[TEST:%[0-9]*]] = icmp eq i64 [[MASKED]], 0
389   // AND the alignment test with the objectsize test.
390   // CHECK:      [[AND:%[0-9]*]] = and i1 {{.*}}, [[TEST]]
391   // CHECK-NEXT: br i1 [[AND]]
392 }
393 
394 // CHECK-LABEL: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413876459, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
395 // CHECK-X32: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413875435, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
396 // CHECK-X86: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413875435, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
397 void indirect_function_call(void (*p)(int)) {
398   // CHECK: [[PTR:%[0-9]*]] = bitcast void (i32)* {{.*}} to <{ i32, i8* }>*
399 
400   // Signature check
401   // CHECK-NEXT: [[SIGPTR:%[0-9]*]] = getelementptr <{ i32, i8* }>, <{ i32, i8* }>* [[PTR]], i32 0, i32 0
402   // CHECK-NEXT: [[SIG:%[0-9]*]] = load i32, i32* [[SIGPTR]]
403   // CHECK-NEXT: [[SIGCMP:%[0-9]*]] = icmp eq i32 [[SIG]], 1413876459
404   // CHECK-NEXT: br i1 [[SIGCMP]]
405 
406   // RTTI pointer check
407   // CHECK: [[RTTIPTR:%[0-9]*]] = getelementptr <{ i32, i8* }>, <{ i32, i8* }>* [[PTR]], i32 0, i32 1
408   // CHECK-NEXT: [[RTTI:%[0-9]*]] = load i8*, i8** [[RTTIPTR]]
409   // CHECK-NEXT: [[RTTICMP:%[0-9]*]] = icmp eq i8* [[RTTI]], bitcast ({ i8*, i8* }* @_ZTIFviE to i8*)
410   // CHECK-NEXT: br i1 [[RTTICMP]]
411   p(42);
412 }
413 
414 namespace UpcastPointerTest {
415 struct S {};
416 struct T : S { double d; };
417 struct V : virtual S {};
418 
419 // CHECK-LABEL: upcast_pointer
420 S* upcast_pointer(T* t) {
421   // Check for null pointer
422   // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
423   // CHECK: br i1 %[[NONNULL]]
424 
425   // Check alignment
426   // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
427   // CHECK: icmp eq i64 %[[MISALIGN]], 0
428 
429   // CHECK: call void @__ubsan_handle_type_mismatch
430   return t;
431 }
432 
433 V getV();
434 
435 // CHECK-LABEL: upcast_to_vbase
436 void upcast_to_vbase() {
437   // No need to check for null here, as we have a temporary here.
438 
439   // CHECK-NOT: br i1
440 
441   // CHECK: call i64 @llvm.objectsize
442   // CHECK: call void @__ubsan_handle_type_mismatch
443   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
444   const S& s = getV();
445 }
446 }
447 
448 namespace CopyValueRepresentation {
449   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S3aSERKS0_
450   // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
451   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S4aSEOS0_
452   // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
453   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S1C2ERKS0_
454   // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
455   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S2C2ERKS0_
456   // CHECK: __ubsan_handle_load_invalid_value
457   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S5C2ERKS0_
458   // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
459 
460   struct CustomCopy { CustomCopy(); CustomCopy(const CustomCopy&); };
461   struct S1 {
462     CustomCopy CC;
463     bool b;
464   };
465   void callee1(S1);
466   void test1() {
467     S1 s11;
468     callee1(s11);
469     S1 s12;
470     s12 = s11;
471   }
472 
473   static bool some_global_bool;
474   struct ExprCopy {
475     ExprCopy();
476     ExprCopy(const ExprCopy&, bool b = some_global_bool);
477   };
478   struct S2 {
479     ExprCopy EC;
480     bool b;
481   };
482   void callee2(S2);
483   void test2(void) {
484     S2 s21;
485     callee2(s21);
486     S2 s22;
487     s22 = s21;
488   }
489 
490   struct CustomAssign { CustomAssign &operator=(const CustomAssign&); };
491   struct S3 {
492     CustomAssign CA;
493     bool b;
494   };
495   void test3() {
496     S3 x, y;
497     x = y;
498   }
499 
500   struct CustomMove {
501     CustomMove();
502     CustomMove(const CustomMove&&);
503     CustomMove &operator=(const CustomMove&&);
504   };
505   struct S4 {
506     CustomMove CM;
507     bool b;
508   };
509   void test4() {
510     S4 x, y;
511     x = static_cast<S4&&>(y);
512   }
513 
514   struct EnumCustomCopy {
515     EnumCustomCopy();
516     EnumCustomCopy(const EnumCustomCopy&);
517   };
518   struct S5 {
519     EnumCustomCopy ECC;
520     bool b;
521   };
522   void callee5(S5);
523   void test5() {
524     S5 s51;
525     callee5(s51);
526     S5 s52;
527     s52 = s51;
528   }
529 }
530 
531 // CHECK: attributes [[NR_NUW]] = { noreturn nounwind }
532