summaryrefslogtreecommitdiffstats
path: root/clang/test/CodeGen/catch-undef-behavior.c
Commit message (Collapse)AuthorAgeFilesLines
* Treat the range of representable values of floating-point types as [-inf, ↵Richard Smith2019-07-061-34/+8
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | +inf] not as [-max, +max]. Summary: Prior to r329065, we used [-max, max] as the range of representable values because LLVM's `fptrunc` did not guarantee defined behavior when truncating from a larger floating-point type to a smaller one. Now that has been fixed, we can make clang follow normal IEEE 754 semantics in this regard and take the larger range [-inf, +inf] as the range of representable values. In practice, this affects two parts of the frontend: * the constant evaluator no longer treats floating-point evaluations that result in +-inf as being undefined (because they no longer leave the range of representable values of the type) * UBSan no longer treats conversions to floating-point type that are outside the [-max, +max] range as being undefined In passing, also remove the float-divide-by-zero sanitizer from -fsanitize=undefined, on the basis that while it's undefined per C++ rules (and we disallow it in constant expressions for that reason), it is defined by Clang / LLVM / IEEE 754. Reviewers: rnk, BillyONeal Subscribers: cfe-commits Tags: #clang Differential Revision: https://reviews.llvm.org/D63793 llvm-svn: 365272
* Add a 'dynamic' parameter to the objectsize intrinsicErik Pilkington2019-01-301-1/+1
| | | | | | | | | | | | | | This is meant to be used with clang's __builtin_dynamic_object_size. When 'true' is passed to this parameter, the intrinsic has the potential to be folded into instructions that will be evaluated at run time. When 'false', the objectsize intrinsic behaviour is unchanged. rdar://32212419 Differential revision: https://reviews.llvm.org/D56761 llvm-svn: 352664
* [ubsan] Save a ptrtoint when emitting alignment checksVedant Kumar2017-10-031-2/+1
| | | | | | | The alignment check emits a ptrtoint instruction which can be reused in the call to the diagnostic handler. llvm-svn: 314749
* [ubsan] Skip alignment checks on allocas with known alignmentVedant Kumar2017-04-261-7/+1
| | | | | | | | | | | | | | | | | | | | It's possible to determine the alignment of an alloca at compile-time. Use this information to skip emitting some runtime alignment checks. Testing: check-clang, check-ubsan. This significantly reduces the amount of alignment checks we emit when compiling X86ISelLowering.cpp. Here are the numbers from patched/unpatched clangs based on r301361. ------------------------------------------ | Setup | # of alignment checks | ------------------------------------------ | unpatched, -O0 | 47195 | | patched, -O0 | 30876 | (-34.6%) ------------------------------------------ llvm-svn: 301377
* Let llvm.objectsize be conservative with null pointersGeorge Burgess IV2017-03-211-1/+1
| | | | | | | D28494 adds another parameter to @llvm.objectsize. Clang needs to be sure to pass that third arg whenever applicable. llvm-svn: 298431
* Retry^2: [ubsan] Reduce null checking of C++ object pointers (PR27581)Vedant Kumar2017-02-171-15/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch teaches ubsan to insert exactly one null check for the 'this' pointer per method/lambda. Previously, given a load of a member variable from an instance method ('this->x'), ubsan would insert a null check for 'this', and another null check for '&this->x', before allowing the load to occur. Similarly, given a call to a method from another method bound to the same instance ('this->foo()'), ubsan would a redundant null check for 'this'. There is also a redundant null check in the case where the object pointer is a reference ('Ref.foo()'). This patch teaches ubsan to remove the redundant null checks identified above. Testing: check-clang, check-ubsan, and a stage2 ubsan build. I also compiled X86FastISel.cpp with -fsanitize=null using patched/unpatched clangs based on r293572. Here are the number of null checks emitted: ------------------------------------- | Setup | # of null checks | ------------------------------------- | unpatched, -O0 | 21767 | | patched, -O0 | 10758 | ------------------------------------- Changes since the initial commit: - Don't introduce any unintentional object-size or alignment checks. - Don't rely on IRGen of C labels in the test. Differential Revision: https://reviews.llvm.org/D29530 llvm-svn: 295515
* Revert "Retry: [ubsan] Reduce null checking of C++ object pointers (PR27581)"Vedant Kumar2017-02-171-4/+15
| | | | | | | | This reverts commit r295401. It breaks the ubsan self-host. It inserts object size checks once per C++ method which fire when the structure is empty. llvm-svn: 295494
* Retry: [ubsan] Reduce null checking of C++ object pointers (PR27581)Vedant Kumar2017-02-171-15/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch teaches ubsan to insert exactly one null check for the 'this' pointer per method/lambda. Previously, given a load of a member variable from an instance method ('this->x'), ubsan would insert a null check for 'this', and another null check for '&this->x', before allowing the load to occur. Similarly, given a call to a method from another method bound to the same instance ('this->foo()'), ubsan would a redundant null check for 'this'. There is also a redundant null check in the case where the object pointer is a reference ('Ref.foo()'). This patch teaches ubsan to remove the redundant null checks identified above. Testing: check-clang and check-ubsan. I also compiled X86FastISel.cpp with -fsanitize=null using patched/unpatched clangs based on r293572. Here are the number of null checks emitted: ------------------------------------- | Setup | # of null checks | ------------------------------------- | unpatched, -O0 | 21767 | | patched, -O0 | 10758 | ------------------------------------- Changes since the initial commit: don't rely on IRGen of C labels in the test. Differential Revision: https://reviews.llvm.org/D29530 llvm-svn: 295401
* Revert "[ubsan] Reduce null checking of C++ object pointers (PR27581)"Vedant Kumar2017-02-171-4/+15
| | | | | | | | | | This reverts commit r295391. It breaks this bot: http://lab.llvm.org:8011/builders/clang-with-thin-lto-ubuntu/builds/1898 I need to not rely on labels in the IR test. llvm-svn: 295396
* [ubsan] Reduce null checking of C++ object pointers (PR27581)Vedant Kumar2017-02-171-15/+4
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | This patch teaches ubsan to insert exactly one null check for the 'this' pointer per method/lambda. Previously, given a load of a member variable from an instance method ('this->x'), ubsan would insert a null check for 'this', and another null check for '&this->x', before allowing the load to occur. Similarly, given a call to a method from another method bound to the same instance ('this->foo()'), ubsan would a redundant null check for 'this'. There is also a redundant null check in the case where the object pointer is a reference ('Ref.foo()'). This patch teaches ubsan to remove the redundant null checks identified above. Testing: check-clang and check-ubsan. I also compiled X86FastISel.cpp with -fsanitize=null using patched/unpatched clangs based on r293572. Here are the number of null checks emitted: ------------------------------------- | Setup | # of null checks | ------------------------------------- | unpatched, -O0 | 21767 | | patched, -O0 | 10758 | ------------------------------------- Differential Revision: https://reviews.llvm.org/D29530 llvm-svn: 295391
* [ubsan] Minimize size of data for type_mismatch (Redo of D19667)Filipe Cabecinhas2017-01-061-11/+11
| | | | | | | | | | | | | | | | | | Summary: This patch makes the type_mismatch static data 7 bytes smaller (and it ends up being 16 bytes smaller due to alignment restrictions, at least on some x86-64 environments). It revs up the type_mismatch handler version since we're breaking binary compatibility. I will soon post a patch for the compiler-rt side. Reviewers: rsmith, kcc, vitalybuka, pgousseau, gbedwell Subscribers: llvm-commits Differential Revision: https://reviews.llvm.org/D28242 llvm-svn: 291236
* Make clang/test/CodeGen/catch-undef-behavior.c* capable of -Asserts with ↵NAKAMURA Takumi2015-09-151-3/+2
| | | | | | | | "opt -instnamer". It reverts r231717. llvm-svn: 247667
* Compute and preserve alignment more faithfully in IR-generation.John McCall2015-09-081-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | | Introduce an Address type to bundle a pointer value with an alignment. Introduce APIs on CGBuilderTy to work with Address values. Change core APIs on CGF/CGM to traffic in Address where appropriate. Require alignments to be non-zero. Update a ton of code to compute and propagate alignment information. As part of this, I've promoted CGBuiltin's EmitPointerWithAlignment helper function to CGF and made use of it in a number of places in the expression emitter. The end result is that we should now be significantly more correct when performing operations on objects that are locally known to be under-aligned. Since alignment is not reliably tracked in the type system, there are inherent limits to this, but at least we are no longer confused by standard operations like derived-to-base conversions and array-to-pointer decay. I've also fixed a large number of bugs where we were applying the complete-object alignment to a pointer instead of the non-virtual alignment, although most of these were hidden by the very conservative approach we took with member alignment. Also, because IRGen now reliably asserts on zero alignments, we should no longer be subject to an absurd but frustrating recurring bug where an incomplete type would report a zero alignment and then we'd naively do a alignmentAtOffset on it and emit code using an alignment equal to the largest power-of-two factor of the offset. We should also now be emitting much more aggressive alignment attributes in the presence of over-alignment. In particular, field access now uses alignmentAtOffset instead of min. Several times in this patch, I had to change the existing code-generation pattern in order to more effectively use the Address APIs. For the most part, this seems to be a strict improvement, like doing pointer arithmetic with GEPs instead of ptrtoint. That said, I've tried very hard to not change semantics, but it is likely that I've failed in a few places, for which I apologize. ABIArgInfo now always carries the assumed alignment of indirect and indirect byval arguments. In order to cut down on what was already a dauntingly large patch, I changed the code to never set align attributes in the IR on non-byval indirect arguments. That is, we still generate code which assumes that indirect arguments have the given alignment, but we don't express this information to the backend except where it's semantically required (i.e. on byvals). This is likely a minor regression for those targets that did provide this information, but it'll be trivial to add it back in a later patch. I partially punted on applying this work to CGBuiltin. Please do not add more uses of the CreateDefaultAligned{Load,Store} APIs; they will be going away eventually. llvm-svn: 246985
* Propagate SourceLocations through to get a Loc on float_cast_overflowFilipe Cabecinhas2015-08-111-7/+25
| | | | | | | | | | | | | | | Summary: float_cast_overflow is the only UBSan check without a source location attached. This patch propagates SourceLocations where necessary to get them to the EmitCheck() call. Reviewers: rsmith, ABataev, rjmccall Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D11757 llvm-svn: 244568
* Introduce -fsanitize-trap= flag.Peter Collingbourne2015-06-181-1/+1
| | | | | | | | | | | | | | | | | | | | | | | | This flag controls whether a given sanitizer traps upon detecting an error. It currently only supports UBSan. The existing flag -fsanitize-undefined-trap-on-error has been made an alias of -fsanitize-trap=undefined. This change also cleans up some awkward behavior around the combination of -fsanitize-trap=undefined and -fsanitize=undefined. Previously we would reject command lines containing the combination of these two flags, as -fsanitize=vptr is not compatible with trapping. This required the creation of -fsanitize=undefined-trap, which excluded -fsanitize=vptr (and -fsanitize=function, but this seems like an oversight). Now, -fsanitize=undefined is an alias for -fsanitize=undefined-trap, and if -fsanitize-trap=undefined is specified, we treat -fsanitize=vptr as an "unsupported" flag, which means that we error out if the flag is specified explicitly, but implicitly disable it if the flag was implied by -fsanitize=undefined. Differential Revision: http://reviews.llvm.org/D10464 llvm-svn: 240105
* ubsan: Check for null pointers given to certain builtins, suchNuno Lopes2015-05-301-0/+28
| | | | | | | | | | as memcpy, memset, memmove, and bzero. Reviewed by: Richard Smith Differential Revision: http://reviews.llvm.org/D9673 llvm-svn: 238657
* [opaque pointer types] Explicit non-pointer type for call expressionsDavid Blaikie2015-04-161-1/+1
| | | | | | (migration for recent LLVM change to textual IR for calls) llvm-svn: 235147
* Suppress a couple of tests, clang/test/CodeGen/catch-undef-behavior.c and ↵NAKAMURA Takumi2015-03-091-0/+1
| | | | | | one, for -Asserts for now. They were introduced in r231711. llvm-svn: 231717
* [UBSan] Split -fsanitize=shift into -fsanitize=shift-base and ↵Alexey Samsonov2015-03-091-8/+12
| | | | | | | | | | | | | | | | -fsanitize=shift-exponent. This is a recommit of r231150, reverted in r231409. Turns out that -fsanitize=shift-base check implementation only works if the shift exponent is valid, otherwise it contains undefined behavior itself. Make sure we check that exponent is valid before we proceed to check the base. Make sure that we actually report invalid values of base or exponent if -fsanitize=shift-base or -fsanitize=shift-exponent is specified, respectively. llvm-svn: 231711
* Revert "[UBSan] Split -fsanitize=shift into -fsanitize=shift-base and ↵Alexey Samsonov2015-03-051-6/+9
| | | | | | | | | | | -fsanitize=shift-exponent." It's not that easy. If we're only checking -fsanitize=shift-base we still need to verify that exponent has sane value, otherwise UBSan-inserted checks for base will contain undefined behavior themselves. llvm-svn: 231409
* [UBSan] Split -fsanitize=shift into -fsanitize=shift-base and ↵Alexey Samsonov2015-03-031-9/+6
| | | | | | | | | | | | | | | | | | | | | -fsanitize=shift-exponent. -fsanitize=shift is now a group that includes both these checks, so exisiting users should not be affected. This change introduces two new UBSan kinds that sanitize only left-hand side and right-hand side of shift operation. In practice, invalid exponent value (negative or too large) tends to cause more portability problems, including inconsistencies between different compilers, crashes and inadequeate results on non-x86 architectures etc. That is, -fsanitize=shift-exponent failures should generally be addressed first. As a bonus, this change simplifies CodeGen implementation for emitting left shift (separate checks for base and exponent are now merged by the existing generic logic in EmitCheck()), and LLVM IR for these checks (the number of basic blocks is reduced). llvm-svn: 231150
* Reimplement -fsanitize-recover family of flags.Alexey Samsonov2015-01-121-3/+3
| | | | | | | | | | | | | | | | | | | | | | | | Introduce the following -fsanitize-recover flags: - -fsanitize-recover=<list>: Enable recovery for selected checks or group of checks. It is forbidden to explicitly list unrecoverable sanitizers here (that is, "address", "unreachable", "return"). - -fno-sanitize-recover=<list>: Disable recovery for selected checks or group of checks. - -f(no-)?sanitize-recover is now a synonym for -f(no-)?sanitize-recover=undefined,integer and will soon be deprecated. These flags are parsed left to right, and mask of "recoverable" sanitizer is updated accordingly, much like what we do for -fsanitize= flags. -fsanitize= and -fsanitize-recover= flag families are independent. CodeGen change: If there is a single UBSan handler function, responsible for implementing multiple checks, which have different recoverable setting, then we emit two handler calls instead of one: the first one for the set of "unrecoverable" checks, another one - for set of "recoverable" checks. If all checks implemented by a handler have the same recoverability setting, then the generated code will be the same. llvm-svn: 225719
* IR: Make metadata typeless in assembly, clang sideDuncan P. N. Exon Smith2014-12-151-1/+1
| | | | | | Match LLVM changes from r224257. llvm-svn: 224259
* Bundle conditions checked by UBSan with sanitizer kinds they implement.Alexey Samsonov2014-11-111-2/+3
| | | | | | | | | | | | | | | | | | | | | | | | Summary: This change makes CodeGenFunction::EmitCheck() take several conditions that needs to be checked (all of them need to be true), together with sanitizer kinds these checks are for. This would allow to split one call into UBSan runtime into several calls in case different sanitizer kinds would have different recoverability settings. Tests should be fixed accordingly, I'm working on it. Test Plan: regression test suite. Reviewers: rsmith Reviewed By: rsmith Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D6219 llvm-svn: 221716
* Simplify the test by using multiple --check-prefix argumentsAlexey Samsonov2014-11-111-253/+160
| | | | llvm-svn: 221713
* Implement nonnull-attribute sanitizerAlexey Samsonov2014-09-081-2/+27
| | | | | | | | | | | | | | | | | | | | | | | | Summary: This patch implements a new UBSan check, which verifies that function arguments declared to be nonnull with __attribute__((nonnull)) are actually nonnull in runtime. To implement this check, we pass FunctionDecl to CodeGenFunction::EmitCallArgs (where applicable) and if function declaration has nonnull attribute specified for a certain formal parameter, we compare the corresponding RValue to null as soon as it's calculated. Test Plan: regression test suite Reviewers: rsmith Reviewed By: rsmith Subscribers: cfe-commits, rnk Differential Revision: http://reviews.llvm.org/D5082 llvm-svn: 217389
* [UBSan] Add returns-nonnull sanitizer.Alexey Samsonov2014-08-131-2/+16
| | | | | | | | | | | | | | | | | | | | Summary: This patch adds a runtime check verifying that functions annotated with "returns_nonnull" attribute do in fact return nonnull pointers. It is based on suggestion by Jakub Jelinek: http://lists.cs.uiuc.edu/pipermail/llvm-commits/Week-of-Mon-20140623/223693.html. Test Plan: regression test suite Reviewers: rsmith Reviewed By: rsmith Subscribers: cfe-commits Differential Revision: http://reviews.llvm.org/D4849 llvm-svn: 215485
* Check-labelize ubsan testsAlexey Samsonov2014-07-171-39/+39
| | | | llvm-svn: 213334
* [UBSan] Add !nosanitize metadata to the code generated by UBSan.Alexey Samsonov2014-07-171-2/+2
| | | | | | | | | | This is used to mark the instructions emitted by Clang to implement variety of UBSan checks. Generally, we don't want to instrument these instructions with another sanitizers (like ASan). Reviewed in http://reviews.llvm.org/D4544 llvm-svn: 213291
* Fix objectsize tests after r192117Matt Arsenault2013-10-071-2/+2
| | | | llvm-svn: 192120
* UBSan: Don't diagnose inf/nan conversions between floating-point types. It's ↵Richard Smith2013-03-271-5/+8
| | | | | | far from clear whether these have undefined behavior, and these checks are helping no-one. Keep the double->float overflow warnings, though, since those are useful in practice, even though it's unclear whether such operations have defined behavior. llvm-svn: 178194
* ubsan: Pass floating-point arguments to the runtime by value if they fit theRichard Smith2013-03-221-1/+26
| | | | | | value argument. If not, be sure we don't accidentally use a dynamic alloca. llvm-svn: 177690
* PR15383: When -fsanitize=float-cast-overflow checks a float-to-int conversion,Richard Smith2013-03-191-12/+12
| | | | | | | | it wasn't taking into account that the float should be truncated *before* the range check happens. Thus (unsigned)-0.99 and (unsigned char)255.9 have defined behavior and should not be trapped. llvm-svn: 177362
* [ubsan] Emit single check for left shift.Will Dietz2013-02-251-16/+16
| | | | | | Avoids warning twice on same shift. llvm-svn: 176056
* Update to use references to attribute groups instead of listing the ↵Bill Wendling2013-02-221-17/+19
| | | | | | attributes on the call/invoke instructions. llvm-svn: 175878
* [ubsan] Implement the -fcatch-undefined-behavior flag using a trappingChad Rosier2013-01-291-0/+149
| | | | | | | | | | | implementation; this is much more inline with the original implementation (i.e., pre-ubsan) and does not require run-time library support. The trapping implementation can be invoked using either '-fcatch-undefined-behavior' or '-fsanitize=undefined-trap -fsanitize-undefined-trap-on-error', with the latter being preferred. Eventually, the -fcatch-undefined-behavior' flag will be removed. llvm-svn: 173848
* [ubsan] Make static check data non-const so it can be used for deduplication.Will Dietz2013-01-091-2/+2
| | | | llvm-svn: 171947
* Scalar shifts in the OpenCL specification (as of v. 1.2) are defined to beDavid Tweed2013-01-071-1/+1
| | | | | | | | | | with respect to the lower "left-hand-side bitwidth" bits, even when negative); see OpenCL spec 6.3j. This patch both implements this behaviour in the code generator and "constant folding" bits of Sema, and also prevents tests to detect undefinedness in terms of the weaker C99 or C++ specifications from being applied. llvm-svn: 171755
* [ubsan] Recover by default, use -fno-sanitize-recover to disable.Will Dietz2012-12-301-18/+18
| | | | llvm-svn: 171264
* [ubsan] Emit branch weight metadata to hint towards common case.Will Dietz2012-12-151-2/+4
| | | | | | | Results in better block placement that helps close the performance gap when making ubsan checks recoverable. llvm-svn: 170263
* ubsan: Add -fsanitize=bool and -fsanitize=enum, which check for loads ofRichard Smith2012-12-131-1/+9
| | | | | | | bit-patterns which are not valid values for enumerated or boolean types. These checks are the ubsan analogue of !range metadata. llvm-svn: 170108
* [ubsan] Add flag to enable recovery from checks when possible.Will Dietz2012-12-021-17/+17
| | | | llvm-svn: 169114
* Add -fsanitize=integer for reporting suspicious integer behaviors.Will Dietz2012-11-271-1/+1
| | | | | | Introduces new sanitizer "unsigned-integer-overflow". llvm-svn: 168701
* Classify the INT_MIN/-1 check as -fsanitize=signed-integer-overflow, not as ↵Richard Smith2012-11-061-1/+26
| | | | | | -fsanitize=divide-by-zero. llvm-svn: 167433
* Use the individual -fsanitize=<...> arguments to control which of the UBSanRichard Smith2012-11-051-1/+12
| | | | | | | checks to enable. Remove frontend support for -fcatch-undefined-behavior, -faddress-sanitizer and -fthread-sanitizer now that they don't do anything. llvm-svn: 167413
* -fcatch-undefined-behavior: Start checking loads and stores for null pointers.Richard Smith2012-11-011-3/+13
| | | | | | | | We want the diagnostic, and if the load is optimized away, we still want to trap it. Stop checking non-default address spaces; that doesn't work in general. llvm-svn: 167219
* -fcatch-undefined-behavior: Trap undefined behavior due to conversions to orRichard Smith2012-10-121-0/+59
| | | | | | | from a floating-point type where the source value is not in the range of representable values of the destination type. llvm-svn: 165843
* -fcatch-undefined-behavior: catch a VLA bound which evalutes to a ↵Richard Smith2012-10-101-0/+11
| | | | | | non-positive value. llvm-svn: 165583
* Fix test broken by r165572.Richard Smith2012-10-101-4/+2
| | | | llvm-svn: 165581
* -fcatch-undefined-behavior: emit calls to the runtime library whenever one ↵Richard Smith2012-10-091-10/+90
| | | | | | of the checks fails. llvm-svn: 165536
OpenPOWER on IntegriCloud