1 // NOTE: Assertions have been autogenerated by utils/update_cc_test_checks.py UTC_ARGS: --version 4 2 // RUN: %clang_cc1 -triple x86_64-unknown-linux-gnu -O2 -Wno-missing-declarations -emit-llvm -o - %s | FileCheck %s 3 4 // See #110385 5 // Based on reproducer from Kees Cook: 6 // https://lore.kernel.org/all/202409170436.C3C6E7F7A@keescook/ 7 8 struct variable { 9 int a; 10 int b; 11 int length; 12 short array[] __attribute__((counted_by(length))); 13 }; 14 15 struct bucket { 16 int a; 17 struct variable *growable; 18 int b; 19 }; 20 21 struct bucket2 { 22 int a; 23 struct variable growable; 24 }; 25 26 void init(void * __attribute__((pass_dynamic_object_size(0)))); 27 28 // CHECK-LABEL: define dso_local void @test1( 29 // CHECK-SAME: ptr noundef readonly captures(none) [[FOO:%.*]]) local_unnamed_addr #[[ATTR0:[0-9]+]] { 30 // CHECK-NEXT: entry: 31 // CHECK-NEXT: [[GROWABLE:%.*]] = getelementptr inbounds nuw i8, ptr [[FOO]], i64 8 32 // CHECK-NEXT: [[TMP0:%.*]] = load ptr, ptr [[GROWABLE]], align 8, !tbaa [[TBAA2:![0-9]+]] 33 // CHECK-NEXT: [[ARRAY:%.*]] = getelementptr inbounds nuw i8, ptr [[TMP0]], i64 12 34 // CHECK-NEXT: [[COUNTED_BY_GEP:%.*]] = getelementptr inbounds nuw i8, ptr [[TMP0]], i64 8 35 // CHECK-NEXT: [[COUNTED_BY_LOAD:%.*]] = load i32, ptr [[COUNTED_BY_GEP]], align 4 36 // CHECK-NEXT: [[TMP1:%.*]] = sext i32 [[COUNTED_BY_LOAD]] to i64 37 // CHECK-NEXT: [[TMP2:%.*]] = shl nsw i64 [[TMP1]], 1 38 // CHECK-NEXT: [[TMP3:%.*]] = icmp sgt i32 [[COUNTED_BY_LOAD]], -1 39 // CHECK-NEXT: [[TMP4:%.*]] = select i1 [[TMP3]], i64 [[TMP2]], i64 0 40 // CHECK-NEXT: tail call void @init(ptr noundef nonnull [[ARRAY]], i64 noundef [[TMP4]]) #[[ATTR2:[0-9]+]] 41 // CHECK-NEXT: ret void 42 // 43 void test1(struct bucket *foo) { 44 init(foo->growable->array); 45 } 46 47 // CHECK-LABEL: define dso_local void @test2( 48 // CHECK-SAME: ptr noundef [[FOO:%.*]]) local_unnamed_addr #[[ATTR0]] { 49 // CHECK-NEXT: entry: 50 // CHECK-NEXT: [[ARRAY:%.*]] = getelementptr inbounds nuw i8, ptr [[FOO]], i64 16 51 // CHECK-NEXT: [[COUNTED_BY_GEP:%.*]] = getelementptr inbounds nuw i8, ptr [[FOO]], i64 12 52 // CHECK-NEXT: [[COUNTED_BY_LOAD:%.*]] = load i32, ptr [[COUNTED_BY_GEP]], align 4 53 // CHECK-NEXT: [[TMP0:%.*]] = sext i32 [[COUNTED_BY_LOAD]] to i64 54 // CHECK-NEXT: [[TMP1:%.*]] = shl nsw i64 [[TMP0]], 1 55 // CHECK-NEXT: [[TMP2:%.*]] = icmp sgt i32 [[COUNTED_BY_LOAD]], -1 56 // CHECK-NEXT: [[TMP3:%.*]] = select i1 [[TMP2]], i64 [[TMP1]], i64 0 57 // CHECK-NEXT: tail call void @init(ptr noundef nonnull [[ARRAY]], i64 noundef [[TMP3]]) #[[ATTR2]] 58 // CHECK-NEXT: ret void 59 // 60 void test2(struct bucket2 *foo) { 61 init(foo->growable.array); 62 } 63 //. 64 // CHECK: [[TBAA2]] = !{[[META3:![0-9]+]], [[META7:![0-9]+]], i64 8} 65 // CHECK: [[META3]] = !{!"bucket", [[META4:![0-9]+]], i64 0, [[META7]], i64 8, [[META4]], i64 16} 66 // CHECK: [[META4]] = !{!"int", [[META5:![0-9]+]], i64 0} 67 // CHECK: [[META5]] = !{!"omnipotent char", [[META6:![0-9]+]], i64 0} 68 // CHECK: [[META6]] = !{!"Simple C/C++ TBAA"} 69 // CHECK: [[META7]] = !{!"p1 _ZTS8variable", [[META8:![0-9]+]], i64 0} 70 // CHECK: [[META8]] = !{!"any pointer", [[META5]], i64 0} 71 //. 72