1 // RUN: %clang_cc1 -std=c++11 -triple x86_64-unknown-linux -emit-llvm -fsanitize=null %s -o - | FileCheck %s --check-prefix=CHECK-NULL --check-prefix=ITANIUM 2 // RUN: %clang_cc1 -std=c++11 -triple x86_64-windows -emit-llvm -fsanitize=null %s -o - | FileCheck %s --check-prefix=CHECK-NULL --check-prefix=MSABI 3 // RUN: %clang_cc1 -std=c++11 -triple x86_64-unknown-linux -emit-llvm -fsanitize=null,vptr %s -o - | FileCheck %s --check-prefix=CHECK-VPTR --check-prefix=ITANIUM 4 // RUN: %clang_cc1 -std=c++11 -triple x86_64-windows -emit-llvm -fsanitize=null,vptr %s -o - | FileCheck %s --check-prefix=CHECK-VPTR --check-prefix=MSABI --check-prefix=CHECK-VPTR-MS 5 // RUN: %clang_cc1 -std=c++11 -triple arm64e-ios-13 -emit-llvm -fptrauth-intrinsics -fptrauth-calls -fptrauth-vtable-pointer-type-discrimination -fptrauth-vtable-pointer-address-discrimination -fsanitize=null,vptr %s -o - | FileCheck %s --check-prefix=CHECK-VPTR --check-prefix=ITANIUM --check-prefix=CHECK-PTRAUTH 6 // RUN: %clang_cc1 -std=c++11 -triple aarch64-unknown-linux -emit-llvm -fptrauth-intrinsics -fptrauth-calls -fptrauth-vtable-pointer-type-discrimination -fptrauth-vtable-pointer-address-discrimination -fsanitize=null,vptr %s -o - | FileCheck %s --check-prefix=CHECK-VPTR --check-prefix=ITANIUM --check-prefix=CHECK-PTRAUTH 7 8 struct T { 9 virtual ~T() {} 10 virtual int v() { return 1; } 11 }; 12 13 struct U : T { 14 ~U(); 15 virtual int v() { return 2; } 16 }; 17 18 U::~U() {} 19 20 // CHECK-VPTR-MS: @__ubsan_vptr_type_cache = external dso_local 21 22 // ITANIUM: define{{.*}} i32 @_Z5get_vP1T 23 // MSABI: define dso_local noundef i32 @"?get_v 24 int get_v(T* t) { 25 // First, we check that vtable is not loaded before a type check. 26 // CHECK-NULL-NOT: load {{.*}} (ptr{{.*}})**, {{.*}} (ptr{{.*}})*** 27 // CHECK-NULL: [[UBSAN_CMP_RES:%[0-9]+]] = icmp ne ptr %{{[_a-z0-9]+}}, null 28 // CHECK-NULL-NEXT: br i1 [[UBSAN_CMP_RES]], label %{{.*}}, label %{{.*}} 29 // CHECK-NULL: call void @__ubsan_handle_type_mismatch_v1_abort 30 // Second, we check that vtable is actually loaded once the type check is done. 31 // CHECK-NULL: load ptr, ptr {{.*}} 32 33 // CHECK-PTRAUTH: [[CAST_VTABLE:%.*]] = ptrtoint ptr %vtable to i64 34 // CHECK-PTRAUTH: [[STRIPPED_VTABLE:%.*]] = call i64 @llvm.ptrauth.strip(i64 [[CAST_VTABLE]], i32 0), !nosanitize 35 // CHECK-PTRAUTH: [[STRIPPED_PTR:%.*]] = inttoptr i64 [[STRIPPED_VTABLE]] to ptr 36 // CHECK-PTRAUTH: [[STRIPPED_INT:%.*]] = ptrtoint ptr [[STRIPPED_PTR]] to i64 37 // Make sure authed vtable pointer feeds into hashing 38 // CHECK-PTRAUTH: {{%.*}} = mul i64 [[STRIPPED_INT]], {{.*}} 39 40 // Verify that we authenticate for the actual vcall 41 // CHECK-PTRAUTH: [[BLENDED:%.*]] = call i64 @llvm.ptrauth.blend(i64 {{%.*}}, i64 17113) 42 // CHECK-PTRAUTH: [[CAST_VTABLE:%.*]] = ptrtoint ptr %vtable2 to i64 43 // CHECK-PTRAUTH: [[AUTHED_INT:%.*]] = call i64 @llvm.ptrauth.auth(i64 [[CAST_VTABLE]], i32 2, i64 [[BLENDED]]) 44 // CHECK-PTRAUTH: [[AUTHED_PTR:%.*]] = inttoptr i64 [[AUTHED_INT]] to ptr 45 // CHECK-PTRAUTH: {{%.*}} = getelementptr inbounds ptr, ptr [[AUTHED_PTR]], i64 2 46 return t->v(); 47 } 48 49 // ITANIUM: define{{.*}} void @_Z9delete_itP1T 50 // MSABI: define dso_local void @"?delete_it 51 void delete_it(T *t) { 52 // CHECK-VPTR-NOT: load {{.*}} (ptr{{.*}})**, {{.*}} (ptr{{.*}})*** 53 // CHECK-VPTR: br i1 {{.*}} label %{{.*}} 54 // CHECK-VPTR: call void @__ubsan_handle_type_mismatch_v1_abort 55 // Second, we check that vtable is actually loaded once the type check is done. 56 // CHECK-VPTR: load ptr, ptr {{.*}} 57 58 // First, we check that vtable is not loaded before a type check. 59 // CHECK-PTRAUTH: ptrtoint ptr {{%.*}} to i64 60 // CHECK-PTRAUTH: [[CAST_VTABLE:%.*]] = ptrtoint ptr [[VTABLE:%.*]] to i64 61 // CHECK-PTRAUTH: [[STRIPPED_VTABLE:%.*]] = call i64 @llvm.ptrauth.strip(i64 [[CAST_VTABLE]], i32 0) 62 // CHECK-PTRAUTH: [[STRIPPED_PTR:%.*]] = inttoptr i64 [[STRIPPED_VTABLE]] to ptr 63 // CHECK-PTRAUTH: [[STRIPPED_INT:%.*]] = ptrtoint ptr [[STRIPPED_PTR]] to i64 64 // CHECK-PTRAUTH: {{%.*}} = mul i64 [[STRIPPED_INT]], {{.*}} 65 // CHECK-PTRAUTH: call void @__ubsan_handle_dynamic_type_cache_miss_abort( 66 // Second, we check that vtable is actually loaded once the type check is done. 67 // ptrauth for the virtual function load 68 // CHECK-PTRAUTH: [[VTABLE2:%.*]] = load ptr, ptr {{.*}} 69 // CHECK-PTRAUTH: [[BLENDED:%.*]] = call i64 @llvm.ptrauth.blend(i64 %{{.*}}, i64 17113) 70 // CHECK-PTRAUTH: [[CAST_VTABLE:%.*]] = ptrtoint ptr [[VTABLE2]] to i64 71 // CHECK-PTRAUTH: [[AUTHED_INT:%.*]] = call i64 @llvm.ptrauth.auth(i64 [[CAST_VTABLE]], i32 2, i64 [[BLENDED]]) 72 // CHECK-PTRAUTH: [[AUTHED_PTR:%.*]] = inttoptr i64 [[AUTHED_INT]] to ptr 73 // CHECK-PTRAUTH: getelementptr inbounds ptr, ptr 74 // CHECK-PTRAUTH {{%.*}} = getelementptr inbounds ptr, ptr [[AUTHED_PTR]], i64 1 75 delete t; 76 } 77 78 // ITANIUM: define{{.*}} ptr @_Z7dyncastP1T 79 // MSABI: define dso_local noundef ptr @"?dyncast 80 U* dyncast(T *t) { 81 // First, we check that dynamic_cast is not called before a type check. 82 // CHECK-VPTR-NOT: call ptr @__{{dynamic_cast|RTDynamicCast}} 83 // CHECK-VPTR: br i1 {{.*}} label %{{.*}} 84 // CHECK-PTRAUTH: [[V0:%.*]] = ptrtoint ptr {{%.*}} to i64 85 // CHECK-PTRAUTH: [[BLENDED:%.*]] = call i64 @llvm.ptrauth.blend(i64 [[V0]], i64 17113) 86 // CHECK-PTRAUTH: [[CAST_VTABLE:%.*]] = ptrtoint ptr {{%.*}} to i64 87 // CHECK-PTRAUTH: [[STRIPPED_VTABLE:%.*]] = call i64 @llvm.ptrauth.strip(i64 [[CAST_VTABLE]], i32 0) 88 // CHECK-PTRAUTH: [[STRIPPED_PTR:%.*]] = inttoptr i64 [[STRIPPED_VTABLE]] to ptr 89 // CHECK-PTRAUTH: [[STRIPPED_INT:%.*]] = ptrtoint ptr [[STRIPPED_PTR]] to i64 90 // CHECK-PTRAUTH: {{%.*}} = mul i64 [[STRIPPED_INT]], {{.*}} 91 // CHECK-VPTR: call void @__ubsan_handle_dynamic_type_cache_miss_abort 92 // CHECK-PTRAUTH: [[BLENDED:%.*]] = call i64 @llvm.ptrauth.blend(i64 {{%.*}}, i64 17113) 93 // CHECK-PTRAUTH: [[CAST_VTABLE:%.*]] = ptrtoint ptr %vtable1 to i64 94 // CHECK-PTRAUTH: [[AUTHED_INT:%.*]] = call i64 @llvm.ptrauth.auth(i64 [[CAST_VTABLE]], i32 2, i64 [[BLENDED]]) 95 // CHECK-PTRAUTH: [[AUTHED_PTR:%.*]] = inttoptr i64 [[AUTHED_INT]] to ptr 96 // CHECK-PTRAUTH: {{%.*}} = load volatile i8, ptr [[AUTHED_PTR]], align 8 97 // Second, we check that dynamic_cast is actually called once the type check is done. 98 // CHECK-VPTR: call ptr @__{{dynamic_cast|RTDynamicCast}} 99 return dynamic_cast<U*>(t); 100 } 101