Update and improve compiler-rt tests for -mllvm -asan_use_after_return=(never|[runtime]|always).

[kda]

Summary

In addition:

• optionally add global flag to capture compile intent for UAR: __asan_detect_use_after_return_always. The global is a SANITIZER_WEAK_ATTRIBUTE.

for issue: https://github.com/google/sanitizers/issues/1394

[vitalybuka]

compiler-rt/lib/asan/asan_fake_stack.cpp

196–197

Flawless change should be in a separate patch.

Also this is slow pass, one per thread. I don't think we care about performance of this branch, so I would prefer we avoid extending API where unnecessary.

compiler-rt/lib/asan/asan_rtl.cpp

26 ↗

(On Diff #348465)

why it's moved?

46 ↗

(On Diff #348465)

we use __asan_... for interface functions names

I assume none will call it outside of this file
so should be CamelCase and static

Maybe rename it InitAsanDetectUAROption() and move

entire switch here?

compiler-rt/test/asan/TestCases/heavy_uar_test.cpp

4

-O2?

[kda]

Improvements based on feedback.

[kda]

remove commmented out lines.

compiler-rt/lib/asan/asan_rtl.cpp

26 ↗

(On Diff #348465)

I'm guessing the linter ordered it... as it is now alphabetical.

[vitalybuka]

LGTM

compiler-rt/lib/asan/asan_rtl.cpp

26 ↗

(On Diff #348465)

:) somehow I didn't notice that it's ordered now

46 ↗

(On Diff #348465)

you can move this few lines below, or even better closer to the call and remove __asan:: prefixes

[vitalybuka]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

2650

what we are going to do if different modules inserted the global with different values?

[kda]

move InitAsanOptionDetectStackUseAfterReturn.

[vitalybuka]

and then
asan_use_after_return_mode -> asan_use_after_return_always

[kda]

compiler-rt/lib/asan/asan_rtl.cpp

46 ↗

(On Diff #348465)

Moved to just above AsanInitInternal.

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

2650

I don't know. I'm open to ideas.
How is it solved elsewhere?
Although, this is a very specific global.

[vitalybuka]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

2650

BTW, it changes pass so we need some IR test in llvm/tests

[vitalybuka]

Also there is alternative to Lazy allocate stack in runtime. Would you like to try?

[kda]

add test for global generation.

[kda]

In D103304#2792211, @vitalybuka wrote:

Also there is alternative to Lazy allocate stack in runtime. Would you like to try?

Not this time around. I would rather finish this round, then attempt to "lazy allocate".

[kda]

In D103304#2791456, @vitalybuka wrote:

and then
asan_use_after_return_mode -> asan_use_after_return_always

Are you suggesting renaming this flag now or later?
The new name seems boolean, but this is a tri-state.

[kda]

bring back lost changes.

[kda]

• Optionally create weak variable __asan_detect_use_after_return_always to resolve conflicting compilations.

[kda]

compiler-rt/lib/asan/asan_interface.inc

17

I don't think this is right, but I could not determine a better course of action.

[morehouse]

compiler-rt/lib/asan/asan_rtl.cpp

402 ↗

(On Diff #349208)

According to the comment above, we should not override the runtime flag when this is 1.

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

2650

I guess currently the linker would arbitrarily pick one value.

The question is when would we expect to compile modules with different values of the -asan_use_after_return flag? If this is a valid and common use case, we might want to address it in DFSan as well.

2656

The constant value 1 is also inconsistent with the comment in the runtime (should be 2).

[kda]

compiler-rt/lib/asan/asan_rtl.cpp

402 ↗

(On Diff #349208)

Check the code in AddressSanitizer, this global (__asan_detect_use_after_return_always) is only created when ClUseAfterReturn is set to 2.

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

2656

I could change it if you felt it made the code clearer. __asan_detect_use_after_return_always is functionally a boolean. It is only created if ClUseAfterReturn is equal to Always (2).

[morehouse]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

2656

Maybe just change the comment in asan_rtl.cpp. Seems simplest.

[eugenis]

__asan_detect_use_after_return, any variant of it, is not entirely correct. First, using the presence of the global is better than its value, because the linker will pick a random instance in case they disagree, while &(...) != nullptr gives reliable OR semantics.

Second, this does not handle dlopen out of the box. It can be almost fixed by calling something from a library constructor (like __asan_init) and passing the address/value of the UAR setting, but even that is not 100% correct as code from a library may run before any of that library's constructors. It will also require late-initialization of fake stack on all existing threads at the time of dlopen.

Lazy init would work, but need to make sure that fake stack init is async signal safe, because the first use in a thread may be in a signal context. Another option is to make sure that unused fake stack is cheap, and initialize it always. I don't know if that is the case right now.

Having said all this, the implementation in this revision will kind of work in most cases, and the worst consequence of a mistake is some performance loss, so I'm fine with the change as is.

[vitalybuka]

Other then comment at asan_rtl.cpp:39 LGTM

In D103304#2794683, @eugenis wrote:

__asan_detect_use_after_return, any variant of it, is not entirely correct. First, using the presence of the global is better than its value, because the linker will pick a random instance in case they disagree, while &(...) != nullptr gives reliable OR semantics.

Second, this does not handle dlopen out of the box. It can be almost fixed by calling something from a library constructor (like __asan_init) and passing the address/value of the UAR setting, but even that is not 100% correct as code from a library may run before any of that library's constructors. It will also require late-initialization of fake stack on all existing threads at the time of dlopen.

Lazy init would work, but need to make sure that fake stack init is async signal safe, because the first use in a thread may be in a signal context. Another option is to make sure that unused fake stack is cheap, and initialize it always. I don't know if that is the case right now.

Having said all this, the implementation in this revision will kind of work in most cases, and the worst consequence of a mistake is some performance loss, so I'm fine with the change as is.

We discussed this disadvantages with @kda already offline.
I guess patch like this does not add any difficulties to switch to Lazy one after we we investigate signal safety or other possible implications.

compiler-rt/lib/asan/asan_rtl.cpp

402 ↗

(On Diff #349208)

I guess @morehouse comment is about comment on the line 39.
It makes impression that value stored makes a difference, but as we discussed before only presence matters.
I would put there just:
if __asan_detect_use_after_return_always is defined, runtime must not check detect_stack_use_after_return and create FakeStack

We don't expect 0 there

if (&__asan_detect_use_after_return_always) {
  CHECK_EQ(1, __asan_detect_use_after_return_always);

[morehouse]

compiler-rt/lib/asan/asan_rtl.cpp

402 ↗

(On Diff #349208)

Yes my main concern was the inaccurate comment.

But my understanding was that @kda wanted 3 options: always, never, and decided-by-runtime-flag. In that case, we *do* expect a zero value to indicate the "never" option.

[kda]

• improved comments and validated state, instead of checking.

compiler-rt/lib/asan/asan_interface.inc

17

No one complained. I'm leaving it.

compiler-rt/lib/asan/asan_rtl.cpp

402 ↗

(On Diff #349208)

Okay, I tried to clear up the comments above. and purged the test for non-zero.

[vitalybuka]

compiler-rt/lib/asan/asan_rtl.cpp

39–48 ↗

(On Diff #349585)

This comment explain more instrumented code.
I'd rather inverted it:
asan_detect_use_after_return_always is undefined: all instrumented modules either compiled with asan_use_after_return 1 or 0
asan_detect_use_after_return_always is defined: at least one of modules compiled with asan_use_after_return 2

[kda]

• Revised comment according to feedback.

[delcypher]

@kda This change has broken our internal builds on macOS. I'm not sure why it hasn't broken the public ones. If you add a new weak symbol it needs to be added to lib/asan/weak_symbols.txt so that the linker on macOS knowns it's okay for the symbol to not be defined. We'll put up a patch to fix this shortly.

[thakis]

Hi, this seems to not build on macOS, see http://45.33.8.238/macm1/10715/step_4.txt or http://45.33.8.238/mac/32177/summary.html

Please take a look and revert for now if it takes a while to fix.

[thakis]

Oh, I see that that was already reported over an hour ago. Reverted for now in 5c600dc6d4b75bc71dc3033f37ea187b3fd454d7

[delcypher]

In D103304#2797889, @thakis wrote:

Oh, I see that that was already reported over an hour ago. Reverted for now in 5c600dc6d4b75bc71dc3033f37ea187b3fd454d7

@thakis Thanks for reverting.

[delcypher]

In D103304#2797811, @delcypher wrote:

@kda This change has broken our internal builds on macOS. I'm not sure why it hasn't broken the public ones. If you add a new weak symbol it needs to be added to lib/asan/weak_symbols.txt so that the linker on macOS knowns it's okay for the symbol to not be defined. We'll put up a patch to fix this shortly.

@kda Seeing as this patch was reverted it doesn't make sense for me to put up a patch to fix it. If you try to reland this please update lib/asan/weak_symbols.txt as I mentioned in previous comments.

[mstorsjo]

FWIW, this patch also broke building for windows. Weak symbols overall is a tricky area on windows, and I don't think this particular usage (the asan lib having a weak undefined symbol, which the executable may or may not proivide) works with windows DLLs at all.

[kda]

In D103304#2798480, @mstorsjo wrote:

FWIW, this patch also broke building for windows. Weak symbols overall is a tricky area on windows, and I don't think this particular usage (the asan lib having a weak undefined symbol, which the executable may or may not proivide) works with windows DLLs at all.

@mstorsjo Is there a short-term work around?
FYI: I do plan to follow with a late-initialization solution.

[mstorsjo]

In D103304#2799816, @kda wrote:

In D103304#2798480, @mstorsjo wrote:

FWIW, this patch also broke building for windows. Weak symbols overall is a tricky area on windows, and I don't think this particular usage (the asan lib having a weak undefined symbol, which the executable may or may not proivide) works with windows DLLs at all.

@mstorsjo Is there a short-term work around?
FYI: I do plan to follow with a late-initialization solution.

I'm not well versed in the asan internals to know all the tricks that are used so far, but if this mechanism is a new thing and we've done without it so far and seems hard to do, can we just ifdef it out on windows and keep doing things like they were before there?

[kda]

In an attempt to fix for macOS and Windows.

[kda]

• Remove weak variable from Windows implementation.

[thakis]

Looks like this relanded. It still doesn't build on mac: http://45.33.8.238/macm1/10837/step_4.txt

Please take a look and revert for now if it takes a while to fix.

[thakis]

Wait, this might be a bot config problem this time, looking

[thakis]

Yes, it was a problem on my end, all good now.

Why is this a weak symbol? Most asan symbols aren't, and it looks like the mac and win troubles are due to you making this a weak symbol.

[kda]

discussion begins: https://reviews.llvm.org/D103304#2794683
tl;dr: modules can be built with different flag settings, weak symbol
allows resolution in runtime. Long term (in 2 weeks) solution, late
initialization of fake stack.

[vitalybuka]

Upload the last reverted version

[vitalybuka]

I looked at Lazy approach and it's simpler then I thought. Asan already contains all needed pieces.
Considering that we have not idea how to handle Windows and Darwin we should do that in this patch.

Cloning of GetFakeStackFast -> GetFakeStackFastAlways which does not check __asan_option_detect_stack_use_after_return should be enough.

static FakeStack *GetFakeStackFast() {
  if (FakeStack *fs = GetTLSFakeStack())
    return fs;
  if (!__asan_option_detect_stack_use_after_return)
    return nullptr;
  return GetFakeStack();
}


static FakeStack *GetFakeStackFastAlways() {
  if (FakeStack *fs = GetTLSFakeStack())
    return fs;
  return GetFakeStack();
}

And same for all callers.
Anything __asan_detect_use_after_return_always related can be reverted.

[vitalybuka]

rebase

[vitalybuka]

Oh, I missed

Yes, it was a problem on my end, all good now.

I'll re-land reverted changes back.

[kda]

Regarding below, I had this previously: https://reviews.llvm.org/differential/changeset/?ref=2601358

The problem I don't know how to navigate is that GetFakeStackFast is only called from one place (at runtime, the other is for testing only).
That call is in OnMalloc. Which, in turn, is only called from one place: __asan_stack_malloc_<##class_id>

How do I have the runtime code pick the Always version of GetFakeStackFast without examining the global?
Do I inject the function ptr when generating the call to __asan_stack_malloc?

In D103304#2800596, @vitalybuka wrote:

I looked at Lazy approach and it's simpler then I thought. Asan already contains all needed pieces.
Considering that we have not idea how to handle Windows and Darwin we should do that in this patch.

Cloning of GetFakeStackFast -> GetFakeStackFastAlways which does not check __asan_option_detect_stack_use_after_return should be enough.

static FakeStack *GetFakeStackFast() {
  if (FakeStack *fs = GetTLSFakeStack())
    return fs;
  if (!__asan_option_detect_stack_use_after_return)
    return nullptr;
  return GetFakeStack();
}


static FakeStack *GetFakeStackFastAlways() {
  if (FakeStack *fs = GetTLSFakeStack())
    return fs;
  return GetFakeStack();
}

And same for all callers.
Anything __asan_detect_use_after_return_always related can be reverted.

[vitalybuka]

In D103304#2800789, @kda wrote:

Regarding below, I had this previously: https://reviews.llvm.org/differential/changeset/?ref=2601358

Correct, at that time I thought we are doing WEAK asan_use_after_return_mode, for which new fictions are not needed.
Sorry, we'd save some time if I asked to drop asan_use_after_return_mode instead.
If you are going to recover that one I'd recommencement Flagless -> Always to be consistent with naming?

The problem I don't know how to navigate is that GetFakeStackFast is only called from one place (at runtime, the other is for testing only).
That call is in OnMalloc. Which, in turn, is only called from one place: __asan_stack_malloc_<##class_id>

How do I have the runtime code pick the Always version of GetFakeStackFast without examining the global?
Do I inject the function ptr when generating the call to __asan_stack_malloc?

No, AddressSanitizer.cpp Always branch will call only __asan_stack_malloc_always_<class_id> functions Runtime branch will continue to call __asan_stack_malloc_<class_id>

In D103304#2800596, @vitalybuka wrote:

I looked at Lazy approach and it's simpler then I thought. Asan already contains all needed pieces.
Considering that we have not idea how to handle Windows and Darwin we should do that in this patch.

Cloning of GetFakeStackFast -> GetFakeStackFastAlways which does not check __asan_option_detect_stack_use_after_return should be enough.

static FakeStack *GetFakeStackFast() {
  if (FakeStack *fs = GetTLSFakeStack())
    return fs;
  if (!__asan_option_detect_stack_use_after_return)
    return nullptr;
  return GetFakeStack();
}


static FakeStack *GetFakeStackFastAlways() {
  if (FakeStack *fs = GetTLSFakeStack())
    return fs;
  return GetFakeStack();
}

And same for all callers.
Anything __asan_detect_use_after_return_always related can be reverted.

[kda]

• change from flagless to always in function names.
• fix up tests, add TOOD for removing unnecessary method.

[kda]

Alright, please give it another look.

[vitalybuka]

Thanks. LGTM with some nits.

compiler-rt/lib/asan/asan_fake_stack.cpp

219

static ALWAYS_INLINE
siblings as well.

246

Just insert 3rd one here, and please clang format

llvm/test/Instrumentation/AddressSanitizer/stack-poisoning.ll

1–2

You can add now into =never cases "FileCheck ... --implicit-check-not __asan_stack_malloc"

[kda]

• a little clean-up: static methods, formatting, improved tests

[kda]

compiler-rt/lib/asan/asan_fake_stack.cpp

219

Although, with ALWAYS_INLINE, I'm not sure 'static' makes any difference, as the code is already local to the call point.

[vitalybuka]

compiler-rt/lib/asan/asan_fake_stack.cpp

219

with inline it still need needs provide external version of the symbol

219

with "inline-no-static" it still need needs provide external version of the symbol

241

I asked to remove DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID and just have:

using namespace __asan;
#define DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(class_id)                       \
  extern "C" SANITIZER_INTERFACE_ATTRIBUTE uptr                                \
      __asan_stack_malloc_##class_id(uptr size) {                              \
    return OnMalloc(class_id, size);                                           \
  }                                                                            \
  extern "C" SANITIZER_INTERFACE_ATTRIBUTE void __asan_stack_free_##class_id(  \
      uptr ptr, uptr size) {                                                   \
    OnFree(ptr, class_id, size);                                               \
  }
  extern "C" SANITIZER_INTERFACE_ATTRIBUTE uptr            \
      __asan_stack_malloc_always_##class_id(uptr size) {   \
    return OnMallocAlways(class_id, size);                 \
  }

DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(0)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(1)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(2)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(3)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(4)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(5)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(6)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(7)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(8)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(9)
DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(10)

[kda]

compiler-rt/lib/asan/asan_fake_stack.cpp

241

Sent https://reviews.llvm.org/D103965.

compiler-rt/lib/asan/asan_fake_stack.cpp

static FakeStack *GetFakeStack() {
   AsanThread *t = GetCurrentThread();
   if (!t) return nullptr;
   return t->get_or_create_fake_stack();
 }
 
 static FakeStack *GetFakeStackFast() {
   if (FakeStack *fs = GetTLSFakeStack())
     return fs;
   if (!__asan_option_detect_stack_use_after_return)
     return nullptr;
   return GetFakeStack();
 }
 
-ALWAYS_INLINE uptr OnMalloc(uptr class_id, uptr size) {
+static FakeStack *GetFakeStackFastAlways() {
+  if (FakeStack *fs = GetTLSFakeStack())
+    return fs;
+  return GetFakeStack();
+}
+
+static ALWAYS_INLINE uptr OnMalloc(uptr class_id, uptr size) {
   FakeStack *fs = GetFakeStackFast();
   if (!fs) return 0;
   uptr local_stack;
   uptr real_stack = reinterpret_cast<uptr>(&local_stack);
   FakeFrame *ff = fs->Allocate(fs->stack_size_log(), class_id, real_stack);
   if (!ff) return 0;  // Out of fake stack.
   uptr ptr = reinterpret_cast<uptr>(ff);
   SetShadow(ptr, size, class_id, 0);
   return ptr;
 }
 
-ALWAYS_INLINE void OnFree(uptr ptr, uptr class_id, uptr size) {
+static ALWAYS_INLINE uptr OnMallocAlways(uptr class_id, uptr size) {
+  FakeStack *fs = GetFakeStackFastAlways();
+  if (!fs)
+    return 0;
+  uptr local_stack;
+  uptr real_stack = reinterpret_cast<uptr>(&local_stack);
+  FakeFrame *ff = fs->Allocate(fs->stack_size_log(), class_id, real_stack);
+  if (!ff)
+    return 0;  // Out of fake stack.
+  uptr ptr = reinterpret_cast<uptr>(ff);
+  SetShadow(ptr, size, class_id, 0);
+  return ptr;
+}
+
+static ALWAYS_INLINE void OnFree(uptr ptr, uptr class_id, uptr size) {
   FakeStack::Deallocate(ptr, class_id);
   SetShadow(ptr, size, class_id, kMagic8);
 }
 
 } // namespace __asan
 
 // ---------------------- Interface ---------------- {{{1
 using namespace __asan;
 #define DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(class_id)                       \
   extern "C" SANITIZER_INTERFACE_ATTRIBUTE uptr                                \
       __asan_stack_malloc_##class_id(uptr size) {                              \
     return OnMalloc(class_id, size);                                           \
   }                                                                            \
   extern "C" SANITIZER_INTERFACE_ATTRIBUTE void __asan_stack_free_##class_id(  \
       uptr ptr, uptr size) {                                                   \
     OnFree(ptr, class_id, size);                                               \
   }
+#define DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(class_id) \
+  extern "C" SANITIZER_INTERFACE_ATTRIBUTE uptr            \
+      __asan_stack_malloc_always_##class_id(uptr size) {   \
+    return OnMallocAlways(class_id, size);                 \
+  }
 
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(0)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(1)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(2)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(3)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(4)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(5)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(6)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(7)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(8)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(9)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(10)
+
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(0)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(1)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(2)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(3)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(4)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(5)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(6)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(7)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(8)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(9)
+DEFINE_STACK_MALLOC_ALWAYS_WITH_CLASS_ID(10)
+
 extern "C" {
+// TODO: remove this method and fix tests that use it by setting
+// -asan-use-after-return=never, after modal UAR flag lands
+// (https://github.com/google/sanitizers/issues/1394)
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__asan_get_current_fake_stack() { return GetFakeStackFast(); }
 
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__asan_addr_is_in_fake_stack(void *fake_stack, void *addr, void **beg,
                                    void **end) {
   FakeStack *fs = reinterpret_cast<FakeStack*>(fake_stack);
   if (!fs) return nullptr;

compiler-rt/lib/asan/asan_interface.inc

 //===-- asan_interface.inc ------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 // Asan interface list.
 //===----------------------------------------------------------------------===//
 INTERFACE_FUNCTION(__asan_addr_is_in_fake_stack)
 INTERFACE_FUNCTION(__asan_address_is_poisoned)
 INTERFACE_FUNCTION(__asan_after_dynamic_init)
 INTERFACE_FUNCTION(__asan_alloca_poison)
 INTERFACE_FUNCTION(__asan_allocas_unpoison)
 INTERFACE_FUNCTION(__asan_before_dynamic_init)
 INTERFACE_FUNCTION(__asan_describe_address)
 INTERFACE_FUNCTION(__asan_exp_load1)
 INTERFACE_FUNCTION(__asan_exp_load2)
 INTERFACE_FUNCTION(__asan_exp_load4)
 INTERFACE_FUNCTION(__asan_exp_load8)
 INTERFACE_FUNCTION(__asan_exp_load16)
 INTERFACE_FUNCTION(__asan_exp_loadN)
 INTERFACE_FUNCTION(__asan_exp_store1)
 INTERFACE_FUNCTION(__asan_exp_store2)
 INTERFACE_FUNCTION(__asan_exp_store4)

 INTERFACE_FUNCTION(__asan_stack_malloc_3)
 INTERFACE_FUNCTION(__asan_stack_malloc_4)
 INTERFACE_FUNCTION(__asan_stack_malloc_5)
 INTERFACE_FUNCTION(__asan_stack_malloc_6)
 INTERFACE_FUNCTION(__asan_stack_malloc_7)
 INTERFACE_FUNCTION(__asan_stack_malloc_8)
 INTERFACE_FUNCTION(__asan_stack_malloc_9)
 INTERFACE_FUNCTION(__asan_stack_malloc_10)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_0)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_1)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_2)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_3)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_4)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_5)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_6)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_7)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_8)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_9)
+INTERFACE_FUNCTION(__asan_stack_malloc_always_10)
 INTERFACE_FUNCTION(__asan_store1)
 INTERFACE_FUNCTION(__asan_store2)
 INTERFACE_FUNCTION(__asan_store4)
 INTERFACE_FUNCTION(__asan_store8)
 INTERFACE_FUNCTION(__asan_store16)
 INTERFACE_FUNCTION(__asan_storeN)
 INTERFACE_FUNCTION(__asan_store1_noabort)
 INTERFACE_FUNCTION(__asan_store2_noabort)

compiler-rt/test/asan/TestCases/Linux/uar_signals.cpp

 // This test checks that the implementation of use-after-return
 // is async-signal-safe.
 // RUN: %clangxx_asan -std=c++11 -O1 %s -o %t -pthread && %run %t
+// RUN: %clangxx_asan -std=c++11 -O1 %s -o %t -pthread -mllvm -asan-use-after-return=never && %run %t
+// RUN: %clangxx_asan -std=c++11 -O1 %s -o %t -pthread -mllvm -asan-use-after-return=always && %run %t
 // REQUIRES: stable-runtime
 #include <signal.h>
 #include <stdlib.h>
 #include <stdio.h>
 #include <sys/time.h>
 #include <pthread.h>
 #include <initializer_list>
 

compiler-rt/test/asan/TestCases/Posix/stack-use-after-return.cpp

 // RUN: %clangxx_asan  -O0 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O1 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O2 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O3 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t
+// RUN: %clangxx_asan  -O0 %s -pthread -o %t -mllvm -asan-use-after-return=always && not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan  -O1 %s -pthread -o %t -mllvm -asan-use-after-return=always && not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan  -O2 %s -pthread -o %t -mllvm -asan-use-after-return=always && not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan  -O3 %s -pthread -o %t -mllvm -asan-use-after-return=always && not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan  -O3 %s -pthread -o %t -mllvm -asan-use-after-return=never && %run %t
 // Regression test for a CHECK failure with small stack size and large frame.
 // RUN: %clangxx_asan  -O3 %s -pthread -o %t -DkSize=10000 -DUseThread -DkStackSize=131072 && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck --check-prefix=THREAD %s
+// RUN: %clangxx_asan  -O3 %s -pthread -o %t -DkSize=10000 -DUseThread -DkStackSize=131072 -mllvm -asan-use-after-return=always && not %run %t 2>&1 | FileCheck --check-prefix=THREAD %s
 //
-// Test that we can find UAR in a thread other than main:
+// Test that we can find UAR in a thread other than main (UAR mode: runtime):
 // RUN: %clangxx_asan  -DUseThread -O2 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck --check-prefix=THREAD %s
 //
 // Test the max_uar_stack_size_log/min_uar_stack_size_log flag.
+// (uses the previous)
 //
 // RUN: %env_asan_opts=detect_stack_use_after_return=1:max_uar_stack_size_log=20:verbosity=1 not %run %t 2>&1 | FileCheck --check-prefix=CHECK-20 %s
 // RUN: %env_asan_opts=detect_stack_use_after_return=1:min_uar_stack_size_log=24:max_uar_stack_size_log=24:verbosity=1 not %run %t 2>&1 | FileCheck --check-prefix=CHECK-24 %s
+//
+// Test that we can find UAR in a thread other than main (UAR mode: always):
+// RUN: %clangxx_asan  -DUseThread -O2 %s -pthread -o %t -mllvm -asan-use-after-return=always && not %run %t 2>&1 | FileCheck --check-prefix=THREAD %s
+//
+// Test the max_uar_stack_size_log/min_uar_stack_size_log flag.
+// (uses the previous)
+//
+// RUN: %env_asan_opts=max_uar_stack_size_log=20:verbosity=1 not %run %t 2>&1 | FileCheck --check-prefix=CHECK-20 %s
+// RUN: %env_asan_opts=min_uar_stack_size_log=24:max_uar_stack_size_log=24:verbosity=1 not %run %t 2>&1 | FileCheck --check-prefix=CHECK-24 %s
 
 // This test runs out of stack on AArch64.
 // UNSUPPORTED: aarch64
 // stack size log lower than expected
 // XFAIL: freebsd,netbsd
 
 // FIXME: Fix this test for dynamic runtime on arm linux.
 // UNSUPPORTED: (arm-linux || armhf-linux) && asan-dynamic-runtime
#ifdef PTHREAD_STACK_MIN
     }
 #endif
 
     int ret = pthread_attr_setstacksize(&attr, desired_stack_size);
     if (ret != 0) {
       fprintf(stderr, "pthread_attr_setstacksize returned %d\n", ret);
       abort();
     }
-    
     size_t stacksize_check;
     ret = pthread_attr_getstacksize(&attr, &stacksize_check);
     if (ret != 0) {
       fprintf(stderr, "pthread_attr_getstacksize returned %d\n", ret);
       abort();
     }
 
     if (stacksize_check != desired_stack_size) {
       fprintf(stderr, "Unable to set stack size to %d, the stack size is %d.\n",
               (int)desired_stack_size, (int)stacksize_check);
-      abort(); 
+      abort();
     }
   }
   pthread_t t;
   pthread_create(&t, &attr, Thread, 0);
   pthread_attr_destroy(&attr);
   pthread_join(t, 0);
 #else
   Func2(Func1());
 #endif
   return 0;
 }

compiler-rt/test/asan/TestCases/Windows/dll_stack_use_after_return.cpp

 // RUN: %clang_cl_asan -Od %p/dll_host.cpp -Fe%t
 // RUN: %clang_cl_asan -LD -Od %s -Fe%t.dll
 // RUN: %env_asan_opts=detect_stack_use_after_return=1 not %run %t %t.dll 2>&1 | FileCheck %s
+// RUN: %clang_cl_asan -LD -Od %s -Fe%t.dll -mllvm -asan-use-after-return=always
+// RUN: not %run %t %t.dll 2>&1 | FileCheck %s
 
 #include <malloc.h>
 
 char *x;
 
 void foo() {
   char stack_buffer[42];
   x = &stack_buffer[13];

compiler-rt/test/asan/TestCases/Windows/stack_use_after_return.cpp

 // RUN: %clang_cl_asan -Od %s -Fe%t
 // RUN: %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
+// RUN: %clang_cl_asan -Od %s -Fe%t -mllvm -asan-use-after-return=always
+// RUN: not %run %t 2>&1 | FileCheck %s
 
 char *x;
 
 void foo() {
   char stack_buffer[42];
   x = &stack_buffer[13];
 }
 

compiler-rt/test/asan/TestCases/heavy_uar_test.cpp

 // RUN: %clangxx_asan -O0 %s -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan -O2 %s -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan -O0 %s -o %t -mllvm -asan-use-after-return=always && not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan -O2 %s -o %t -mllvm -asan-use-after-return=always && not %run %t 2>&1 | FileCheck %s
 // XFAIL: windows-msvc
 
 // FIXME: Fix this test under GCC.
 // REQUIRES: Clang
 
 // FIXME: Fix this test for dynamic runtime on arm linux.
 // UNSUPPORTED: (arm-linux || armhf-linux) && asan-dynamic-runtime
 

compiler-rt/test/asan/TestCases/pass-struct-byval-uar.cpp

 // Test that use-after-return works with arguments passed by value.
 // RUN: %clangxx_asan -O0 %s -o %t
 // RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t 2>&1 | \
 // RUN:     FileCheck --check-prefix=CHECK-NO-UAR %s
 // RUN: not %env_asan_opts=detect_stack_use_after_return=1 %run %t 2>&1 | \
 // RUN:     FileCheck --check-prefix=CHECK-UAR %s
+// RUN: %clangxx_asan -O0 %s -o %t -mllvm -asan-use-after-return=never && \
+// RUN:     %run %t 2>&1 | FileCheck --check-prefix=CHECK-NO-UAR %s
+// RUN: %clangxx_asan -O0 %s -o %t -mllvm -asan-use-after-return=always && \
+// RUN:     not %run %t 2>&1 | FileCheck --check-prefix=CHECK-UAR %s
 //
 // On several architectures, the IR does not use byval arguments for foo() and
 // instead creates a copy in main() and gives foo() a pointer to the copy.  In
 // that case, ASAN has nothing to poison on return from foo() and will not
 // detect the UAR.
 // REQUIRES: x86_64-target-arch, linux, !android
 
 #include <cstdio>

compiler-rt/test/asan/TestCases/scariness_score_test.cpp

 // Test how we produce the scariness score.
 
+// UAR Mode: runtime
 // RUN: %clangxx_asan -O0 %s -o %t
 // On OSX and Windows, alloc_dealloc_mismatch=1 isn't 100% reliable, so it's
 // off by default. It's safe for these tests, though, so we turn it on.
 // RUN: export %env_asan_opts=detect_stack_use_after_return=1:handle_abort=1:print_scariness=1:alloc_dealloc_mismatch=1
 // Make sure the stack is limited (may not be the default under GNU make)
 // RUN: ulimit -s 4096
 // RUN: not %run %t  1 2>&1 | FileCheck %s --check-prefix=CHECK1
 // RUN: not %run %t  2 2>&1 | FileCheck %s --check-prefix=CHECK2

 // RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20
 // RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21
 // RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22
 // RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23
 // RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24
 // RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25
 // RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26
 // RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27
+//
+// UAR Mode: always
+// RUN: %clangxx_asan -O0 %s -o %t -mllvm -asan-use-after-return=always
+// On OSX and Windows, alloc_dealloc_mismatch=1 isn't 100% reliable, so it's
+// off by default. It's safe for these tests, though, so we turn it on.
+// RUN: export %env_asan_opts=handle_abort=1:print_scariness=1:alloc_dealloc_mismatch=1
+// Make sure the stack is limited (may not be the default under GNU make)
+// RUN: ulimit -s 4096
+// RUN: not %run %t  1 2>&1 | FileCheck %s --check-prefix=CHECK1
+// RUN: not %run %t  2 2>&1 | FileCheck %s --check-prefix=CHECK2
+// RUN: not %run %t  3 2>&1 | FileCheck %s --check-prefix=CHECK3
+// RUN: not %run %t  4 2>&1 | FileCheck %s --check-prefix=CHECK4
+// RUN: not %run %t  5 2>&1 | FileCheck %s --check-prefix=CHECK5
+// RUN: not %run %t  6 2>&1 | FileCheck %s --check-prefix=CHECK6
+// RUN: not %run %t  7 2>&1 | FileCheck %s --check-prefix=CHECK7
+// RUN: not %run %t  8 2>&1 | FileCheck %s --check-prefix=CHECK8
+// RUN: not %run %t  9 2>&1 | FileCheck %s --check-prefix=CHECK9
+// RUN: not %run %t 10 2>&1 | FileCheck %s --check-prefix=CHECK10
+// RUN: not %run %t 11 2>&1 | FileCheck %s --check-prefix=CHECK11
+// RUN: not %run %t 12 2>&1 | FileCheck %s --check-prefix=CHECK12
+// RUN: not %run %t 13 2>&1 | FileCheck %s --check-prefix=CHECK13
+// RUN: not %run %t 14 2>&1 | FileCheck %s --check-prefix=CHECK14
+// RUN: not %run %t 15 2>&1 | FileCheck %s --check-prefix=CHECK15
+// RUN: not %run %t 16 2>&1 | FileCheck %s --check-prefix=CHECK16
+// RUN: not %run %t 17 2>&1 | FileCheck %s --check-prefix=CHECK17
+// RUN: not %run %t 18 2>&1 | FileCheck %s --check-prefix=CHECK18
+// RUN: not %run %t 19 2>&1 | FileCheck %s --check-prefix=CHECK19
+// RUN: not %run %t 20 2>&1 | FileCheck %s --check-prefix=CHECK20
+// RUN: not %run %t 21 2>&1 | FileCheck %s --check-prefix=CHECK21
+// RUN: not %run %t 22 2>&1 | FileCheck %s --check-prefix=CHECK22
+// RUN: not %run %t 23 2>&1 | FileCheck %s --check-prefix=CHECK23
+// RUN: not %run %t 24 2>&1 | FileCheck %s --check-prefix=CHECK24
+// RUN: not %run %t 25 2>&1 | FileCheck %s --check-prefix=CHECK25
+// RUN: not %run %t 26 2>&1 | FileCheck %s --check-prefix=CHECK26
+// RUN: not %run %t 27 2>&1 | FileCheck %s --check-prefix=CHECK27
 // Parts of the test are too platform-specific:
 // REQUIRES: x86_64-target-arch
 // REQUIRES: shell
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 #include <algorithm>
 

compiler-rt/test/asan/TestCases/uar_and_exceptions.cpp

 // Test that use-after-return works with exceptions.
 // RUN: %clangxx_asan -O0 %s -o %t
 // RUN: %env_asan_opts=detect_stack_use_after_return=1 %run %t
+// RUN: %clangxx_asan -O0 %s -o %t -mllvm -asan-use-after-return=always
+// RUN: %run %t
 
 #include <stdio.h>
 
 volatile char *g;
 
 #ifndef FRAME_SIZE
 # define FRAME_SIZE 100
 #endif

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

 const char kAsanUnpoisonGlobalsName[] = "__asan_after_dynamic_init";
 const char kAsanInitName[] = "__asan_init";
 const char kAsanVersionCheckNamePrefix[] = "__asan_version_mismatch_check_v";
 const char kAsanPtrCmp[] = "__sanitizer_ptr_cmp";
 const char kAsanPtrSub[] = "__sanitizer_ptr_sub";
 const char kAsanHandleNoReturnName[] = "__asan_handle_no_return";
 static const int kMaxAsanStackMallocSizeClass = 10;
 const char kAsanStackMallocNameTemplate[] = "__asan_stack_malloc_";
+const char kAsanStackMallocAlwaysNameTemplate[] =
+    "__asan_stack_malloc_always_";
 const char kAsanStackFreeNameTemplate[] = "__asan_stack_free_";
 const char kAsanGenPrefix[] = "___asan_gen_";
 const char kODRGenPrefix[] = "__odr_asan_gen_";
 const char kSanCovGenPrefix[] = "__sancov_gen_";
 const char kAsanSetShadowPrefix[] = "__asan_set_shadow_";
 const char kAsanPoisonStackMemoryName[] = "__asan_poison_stack_memory";
 const char kAsanUnpoisonStackMemoryName[] = "__asan_unpoison_stack_memory";
 
if (AsanDtorFunction) {
       appendToGlobalDtors(M, AsanDtorFunction, Priority, AsanDtorFunction);
     }
   } else {
     appendToGlobalCtors(M, AsanCtorFunction, Priority);
     if (AsanDtorFunction)
       appendToGlobalDtors(M, AsanDtorFunction, Priority);
   }
 
   return true;
 }
 
 void AddressSanitizer::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(*C);
   // Create __asan_report* callbacks.
   // IsWrite, TypeSize and Exp are encoded in the function name.
   for (int Exp = 0; Exp < 2; Exp++) {
     for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) {
       const std::string TypeStr = AccessIsWrite ? "store" : "load";
       const std::string ExpStr = Exp ? "exp_" : "";
       const std::string EndingStr = Recover ? "_noabort" : "";
 
       SmallVector<Type *, 3> Args2 = {IntptrTy, IntptrTy};
       SmallVector<Type *, 2> Args1{1, IntptrTy};
bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) {
   if (!CI || !CI->isInlineAsm()) return false;
   if (CI->getNumArgOperands() <= 5) return false;
   // We have inline assembly with quite a few arguments.
   return true;
 }
 
 void FunctionStackPoisoner::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(*C);
+  switch (ClUseAfterReturn) {
+  case AsanDetectStackUseAfterReturnMode::Always:
+    for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) {
+      std::string Suffix = itostr(i);
+      AsanStackMallocFunc[i] = M.getOrInsertFunction(
+          kAsanStackMallocAlwaysNameTemplate + Suffix, IntptrTy, IntptrTy);
+      AsanStackFreeFunc[i] =
+          M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix,
+                                IRB.getVoidTy(), IntptrTy, IntptrTy);
+    }
+    break;
+  case AsanDetectStackUseAfterReturnMode::Runtime:
     for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) {
       std::string Suffix = itostr(i);
       AsanStackMallocFunc[i] = M.getOrInsertFunction(
           kAsanStackMallocNameTemplate + Suffix, IntptrTy, IntptrTy);
       AsanStackFreeFunc[i] =
           M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix,
                                 IRB.getVoidTy(), IntptrTy, IntptrTy);
     }
+    break;
+  case AsanDetectStackUseAfterReturnMode::Never:
+    // Do Nothing
+    break;
+  case AsanDetectStackUseAfterReturnMode::Invalid:
+    // Do Nothing
+    break;
+  }
   if (ASan.UseAfterScope) {
     AsanPoisonStackMemoryFunc = M.getOrInsertFunction(
         kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy);
     AsanUnpoisonStackMemoryFunc = M.getOrInsertFunction(
         kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy);
   }
 
   for (size_t Val : {0x00, 0xf1, 0xf2, 0xf3, 0xf5, 0xf8}) {

llvm/test/Instrumentation/AddressSanitizer/fake-stack.ll

 ; RUNTIME-NEXT:    store i64 0, i64* [[TMP32]], align 1
 ; RUNTIME-NEXT:    br label [[TMP33]]
 ; RUNTIME:       33:
 ; RUNTIME-NEXT:    ret void
 ;
 ; ALWAYS-LABEL: @Simple(
 ; ALWAYS-NEXT:  entry:
 ; ALWAYS-NEXT:    [[ASAN_LOCAL_STACK_BASE:%.*]] = alloca i64, align 8
-; ALWAYS-NEXT:    [[TMP0:%.*]] = call i64 @__asan_stack_malloc_0(i64 64)
+; ALWAYS-NEXT:    [[TMP0:%.*]] = call i64 @__asan_stack_malloc_always_0(i64 64)
 ; ALWAYS-NEXT:    [[TMP1:%.*]] = icmp eq i64 [[TMP0]], 0
 ; ALWAYS-NEXT:    br i1 [[TMP1]], label [[TMP2:%.*]], label [[TMP4:%.*]]
 ; ALWAYS:       2:
 ; ALWAYS-NEXT:    [[MYALLOCA:%.*]] = alloca i8, i64 64, align 32
 ; ALWAYS-NEXT:    [[TMP3:%.*]] = ptrtoint i8* [[MYALLOCA]] to i64
 ; ALWAYS-NEXT:    br label [[TMP4]]
 ; ALWAYS:       4:
 ; ALWAYS-NEXT:    [[TMP5:%.*]] = phi i64 [ [[TMP0]], [[ENTRY:%.*]] ], [ [[TMP3]], [[TMP2]] ]

llvm/test/Instrumentation/AddressSanitizer/stack-poisoning.ll

-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -S | FileCheck --check-prefix=CHECK-PLAIN %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -S | FileCheck --check-prefix=CHECK-PLAIN %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -S | FileCheck --check-prefix=CHECK-PLAIN --implicit-check-not=__asan_stack_malloc %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -S | FileCheck --check-prefix=CHECK-PLAIN --implicit-check-not=__asan_stack_malloc %s
 ; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -S | FileCheck --check-prefixes=CHECK-UAR,CHECK-UAR-RUNTIME %s
 ; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -S | FileCheck --check-prefixes=CHECK-UAR,CHECK-UAR-RUNTIME %s
 ; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -S \
 ; RUN:        | FileCheck --check-prefixes=CHECK-UAR --implicit-check-not=__asan_option_detect_stack_use_after_return %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -S | FileCheck --check-prefix=CHECK-UAR %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -S | FileCheck --check-prefixes=CHECK-UAR,CHECK-UAR-ALWAYS %s
 target datalayout = "e-i64:64-f80:128-s:64-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 declare void @Foo(i8*)
 
 define void @Bar() uwtable sanitize_address {
 entry:
 ; CHECK-PLAIN-LABEL: Bar
 ; CHECK-PLAIN-NOT: label
 ; CHECK-PLAIN: ret void
 
 ; CHECK-UAR-LABEL: Bar
 ; CHECK-UAR-RUNTIME: load i32, i32* @__asan_option_detect_stack_use_after_return
 ; CHECK-UAR-RUNTIME: label
-; CHECK-UAR: call i64 @__asan_stack_malloc_4
+; CHECK-UAR-RUNTIME: call i64 @__asan_stack_malloc_4
+; CHECK-UAR-ALWAYS: call i64 @__asan_stack_malloc_always_4
 ; CHECK-UAR-RUNTIME: label
 ; Poison red zones.
 ; CHECK-UAR: store i64 -1007680412564983311
 ; CHECK-UAR: store i64 72057598113936114
 ; CHECK-UAR: store i32 -218959118
 ; CHECK-UAR: store i64 -868082074056920316
 ; CHECK-UAR: store i16 -3085
 ; CHECK-UAR: call void @Foo

llvm/test/Instrumentation/AddressSanitizer/stack_dynamic_alloca.ll

 entry:
 ; CHECK-LABEL: Func1
 
 ; CHECK: entry:
 ; CHECK-RUNTIME: load i32, i32* @__asan_option_detect_stack_use_after_return
 ; COM: CHECK-NORUNTIME-NOT: load i32, i32* @__asan_option_detect_stack_use_after_return
 
 ; CHECK-RUNTIME: [[UAR_ENABLED_BB:^[0-9]+]]:
-; CHECK: [[FAKE_STACK_RT:%[0-9]+]] = call i64 @__asan_stack_malloc_
+; CHECK-RUNTIME: [[FAKE_STACK_RT:%[0-9]+]] = call i64 @__asan_stack_malloc_
+; CHECK-ALWAYS: [[FAKE_STACK_RT:%[0-9]+]] = call i64 @__asan_stack_malloc_always_
 
 ; CHECK-RUNTIME: [[FAKE_STACK_BB:^[0-9]+]]:
 ; CHECK-RUNTIME: [[FAKE_STACK:%[0-9]+]] = phi i64 [ 0, %entry ], [ [[FAKE_STACK_RT]], %[[UAR_ENABLED_BB]] ]
 ; CHECK-RUNTIME: icmp eq i64 [[FAKE_STACK]], 0
 ; CHECK-ALWAYS: icmp eq i64 [[FAKE_STACK_RT]], 0
 
 ; CHECK: [[NO_FAKE_STACK_BB:^[0-9]+]]:
 ; CHECK: %MyAlloca = alloca i8, i64