Disabling speculative loads under asan.

[aizatsky]

Summary

While instrumenting std::string with asan I discovered that speculative load might load data from poisoned region. Disabling all speculative loads for asan-annotated functions.

Performance tests of asan with spec_cpu2006 didn't show any significant difference due to high variance of results.

Corresponding CL in compiler-rt: http://reviews.llvm.org/D13265

[aizatsky]

rebase

[kcc]

This will need an llvm-ir .lit test (in addition to http://reviews.llvm.org/D13265)

lib/Analysis/ValueTracking.cpp

3191

clang-format, please

[aizatsky]

• ir-based test

[aizatsky]

• clang-format

[aizatsky]

Added IR test.

[kcc]

LGTM
Let me commit it

[kcc]

Oh, I did not mean clang-format the entire file. This created too many white-space changes.
NP for now, but next time just do local clang-format, please.

[kcc]

r250259.

lib/Analysis/ValueTracking.cpp

for (auto *CmpU : Cmp->users()) {
       BranchInst *BI = dyn_cast<BranchInst>(CmpU);
       if (!BI || BI->isUnconditional())
         continue;
       // We're looking for conditions that are guaranteed to hold at the
       // context instruction.  Finding a condition where one path dominates
       // the context isn't enough because both the true and false cases could
       // merge before the context instruction we're actually interested in.
       // Instead, we need to ensure that the taken *edge* dominates the context
-      // instruction. 
+      // instruction.
       BasicBlock *BB0 = BI->getSuccessor(0);
       BasicBlockEdge Edge(BI->getParent(), BB0);
       if (!Edge.isSingleEdge() || !Q.DT->dominates(Edge, Q.CxtI->getParent()))
         continue;
 
       computeKnownBitsFromTrueCondition(V, Cmp, KnownZero, KnownOne, DL, Depth,
                                         Q);
     }
bool isKnownNonZero(Value *V, const DataLayout &DL, unsigned Depth,
 
   // The remaining tests are all recursive, so bail out if we hit the limit.
   if (Depth++ >= MaxDepth)
     return false;
 
   // Check for pointer simplifications.
   if (V->getType()->isPointerTy()) {
     if (isKnownNonNull(V))
-      return true; 
+      return true;
     if (GEPOperator *GEP = dyn_cast<GEPOperator>(V))
       if (isGEPKnownNonNull(GEP, DL, Depth, Q))
         return true;
   }
 
   unsigned BitWidth = getBitWidth(V->getType()->getScalarType(), DL);
 
   // X | Y != 0 if X != 0 or Y != 0.
bool llvm::CannotBeOrderedLessThanZero(const Value *V, unsigned Depth) {
 
   const Operator *I = dyn_cast<Operator>(V);
   if (!I) return false;
 
   switch (I->getOpcode()) {
   default: break;
   case Instruction::FMul:
     // x*x is always non-negative or a NaN.
-    if (I->getOperand(0) == I->getOperand(1)) 
+    if (I->getOperand(0) == I->getOperand(1))
       return true;
     // Fall through
   case Instruction::FAdd:
   case Instruction::FDiv:
   case Instruction::FRem:
     return CannotBeOrderedLessThanZero(I->getOperand(0), Depth+1) &&
            CannotBeOrderedLessThanZero(I->getOperand(1), Depth+1);
   case Instruction::FPExt:
   case Instruction::FPTrunc:
     // Widening/narrowing never change sign.
     return CannotBeOrderedLessThanZero(I->getOperand(0), Depth+1);
-  case Instruction::Call: 
-    if (const IntrinsicInst *II = dyn_cast<IntrinsicInst>(I)) 
+  case Instruction::Call:
+    if (const IntrinsicInst *II = dyn_cast<IntrinsicInst>(I))
       switch (II->getIntrinsicID()) {
       default: break;
       case Intrinsic::exp:
       case Intrinsic::exp2:
       case Intrinsic::fabs:
       case Intrinsic::sqrt:
         return true;
-      case Intrinsic::powi: 
+      case Intrinsic::powi:
         if (ConstantInt *CI = dyn_cast<ConstantInt>(I->getOperand(1))) {
           // powi(x,n) is non-negative if n is even.
           if (CI->getBitWidth() <= 64 && CI->getSExtValue() % 2u == 0)
             return true;
         }
         return CannotBeOrderedLessThanZero(I->getOperand(0), Depth+1);
       case Intrinsic::fma:
       case Intrinsic::fmuladd:
         // x*x+y is non-negative if y is non-negative.
-        return I->getOperand(0) == I->getOperand(1) && 
+        return I->getOperand(0) == I->getOperand(1) &&
                CannotBeOrderedLessThanZero(I->getOperand(2), Depth+1);
       }
     break;
   }
-  return false; 
+  return false;
 }
 
 /// If the specified value can be set by repeating the same byte in memory,
 /// return the i8 value that it is represented with.  This is
 /// true for all i8 values obviously, but is also true for i32 0, i32 -1,
 /// i16 0xF0F0, double 0.0 etc.  If the value can't be handled with a repeated
 /// byte store (e.g. i16 0x1234), return null.
 Value *llvm::isBytewiseValue(Value *V) {

 
 static bool isDereferenceableFromAttribute(const Value *BV, APInt Offset,
                                            Type *Ty, const DataLayout &DL,
                                            const Instruction *CtxI,
                                            const DominatorTree *DT,
                                            const TargetLibraryInfo *TLI) {
   assert(Offset.isNonNegative() && "offset can't be negative");
   assert(Ty->isSized() && "must be sized");
-  
   APInt DerefBytes(Offset.getBitWidth(), 0);
   bool CheckForNonNull = false;
   if (const Argument *A = dyn_cast<Argument>(BV)) {
     DerefBytes = A->getDereferenceableBytes();
     if (!DerefBytes.getBoolValue()) {
       DerefBytes = A->getDereferenceableOrNullBytes();
       CheckForNonNull = true;
     }
   } else if (auto CS = ImmutableCallSite(BV)) {
     DerefBytes = CS.getDereferenceableBytes(0);
     if (!DerefBytes.getBoolValue()) {
       DerefBytes = CS.getDereferenceableOrNullBytes(0);
       CheckForNonNull = true;
     }
   } else if (const LoadInst *LI = dyn_cast<LoadInst>(BV)) {
     if (MDNode *MD = LI->getMetadata(LLVMContext::MD_dereferenceable)) {
       ConstantInt *CI = mdconst::extract<ConstantInt>(MD->getOperand(0));
       DerefBytes = CI->getLimitedValue();
     }
     if (!DerefBytes.getBoolValue()) {
-      if (MDNode *MD = 
+      if (MDNode *MD =
               LI->getMetadata(LLVMContext::MD_dereferenceable_or_null)) {
         ConstantInt *CI = mdconst::extract<ConstantInt>(MD->getOperand(0));
         DerefBytes = CI->getLimitedValue();
       }
       CheckForNonNull = true;
     }
   }
-  
   if (DerefBytes.getBoolValue())
     if (DerefBytes.uge(Offset + DL.getTypeStoreSize(Ty)))
       if (!CheckForNonNull || isKnownNonNullAt(BV, CtxI, DT, TLI))
         return true;
 
   return false;
 }
 
 static bool isDereferenceableFromAttribute(const Value *V, const DataLayout &DL,
                                            const Instruction *CtxI,
                                            const DominatorTree *DT,
                                            const TargetLibraryInfo *TLI) {
   Type *VTy = V->getType();
   Type *Ty = VTy->getPointerElementType();
   if (!Ty->isSized())
     return false;
-  
   APInt Offset(DL.getTypeStoreSizeInBits(VTy), 0);
   return isDereferenceableFromAttribute(V, Offset, Ty, DL, CtxI, DT, TLI);
 }
 
 static bool isAligned(const Value *Base, APInt Offset, unsigned Align,
                       const DataLayout &DL) {
   APInt BaseAlign(Offset.getBitWidth(), getAlignment(Base, DL));
 
if (const GEPOperator *GEP = dyn_cast<GEPOperator>(V)) {
     if (!GEP->accumulateConstantOffset(DL, Offset))
       return false;
 
     // Check if the load is within the bounds of the underlying object
     // and offset is aligned.
     uint64_t LoadSize = DL.getTypeStoreSize(Ty);
     Type *BaseType = Base->getType()->getPointerElementType();
     assert(isPowerOf2_32(Align) && "must be a power of 2!");
-    return (Offset + LoadSize).ule(DL.getTypeAllocSize(BaseType)) && 
+    return (Offset + LoadSize).ule(DL.getTypeAllocSize(BaseType)) &&
            !(Offset & APInt(Offset.getBitWidth(), Align-1));
   }
 
   // For gc.relocate, look through relocations
   if (const IntrinsicInst *I = dyn_cast<IntrinsicInst>(V))
     if (I->getIntrinsicID() == Intrinsic::experimental_gc_relocate) {
       GCRelocateOperands RelocateInst(I);
       return isDereferenceableAndAlignedPointer(
if (match(Inst->getOperand(0), m_APInt(Numerator)))
       return !Numerator->isMinSignedValue();
     // The numerator *might* be MinSignedValue.
     return false;
   }
   case Instruction::Load: {
     const LoadInst *LI = cast<LoadInst>(Inst);
     if (!LI->isUnordered() ||
         // Speculative load may create a race that did not exist in the source.
-        LI->getParent()->getParent()->hasFnAttribute(Attribute::SanitizeThread))
+        LI->getParent()->getParent()->hasFnAttribute(
+            Attribute::SanitizeThread) ||
+        // Speculative load may load data from dirty regions.
+        LI->getParent()->getParent()->hasFnAttribute(
+            Attribute::SanitizeAddress))
       return false;
     const DataLayout &DL = LI->getModule()->getDataLayout();
     return isDereferenceableAndAlignedPointer(
         LI->getPointerOperand(), LI->getAlignment(), DL, CtxI, DT, TLI);
   }
   case Instruction::Call: {
     if (const IntrinsicInst *II = dyn_cast<IntrinsicInst>(Inst)) {
       switch (II->getIntrinsicID()) {
bool llvm::isKnownNonNull(const Value *V, const TargetLibraryInfo *TLI) {
 
   // A global variable in address space 0 is non null unless extern weak.
   // Other address spaces may have null as a valid address for a global,
   // so we can't assume anything.
   if (const GlobalValue *GV = dyn_cast<GlobalValue>(V))
     return !GV->hasExternalWeakLinkage() &&
            GV->getType()->getAddressSpace() == 0;
 
-  // A Load tagged w/nonnull metadata is never null. 
+  // A Load tagged w/nonnull metadata is never null.
   if (const LoadInst *LI = dyn_cast<LoadInst>(V))
     return LI->getMetadata(LLVMContext::MD_nonnull);
 
   if (auto CS = ImmutableCallSite(V))
     if (CS.isReturnNonNull())
       return true;
 
   // operator new never returns null.
for (auto U : V->users()) {
 
     if (DomConditionsSingleCmpUse && !Cmp->hasOneUse())
       continue;
 
     for (auto *CmpU : Cmp->users()) {
       const BranchInst *BI = dyn_cast<BranchInst>(CmpU);
       if (!BI)
         continue;
-      
       assert(BI->isConditional() && "uses a comparison!");
 
       BasicBlock *NonNullSuccessor = nullptr;
       CmpInst::Predicate Pred;
 
       if (match(const_cast<ICmpInst*>(Cmp),
                 m_c_ICmp(Pred, m_Specific(V), m_Zero()))) {
         if (Pred == ICmpInst::ICMP_EQ)
if ((CmpLHS == TrueVal && match(FalseVal, m_Neg(m_Specific(CmpLHS)))) ||
       }
 
       // ABS(X) ==> (X <s 0) ? -X : X and (X <s 1) ? -X : X
       // NABS(X) ==> (X <s 0) ? X : -X and (X <s 1) ? X : -X
       if (Pred == ICmpInst::ICMP_SLT && (C1->isZero() || C1->isOne())) {
         return {(CmpLHS == FalseVal) ? SPF_ABS : SPF_NABS, SPNB_NA, false};
       }
     }
-    
     // Y >s C ? ~Y : ~C == ~Y <s ~C ? ~Y : ~C = SMIN(~Y, ~C)
     if (const auto *C2 = dyn_cast<ConstantInt>(FalseVal)) {
       if (C1->getType() == C2->getType() && ~C1->getValue() == C2->getValue() &&
           (match(TrueVal, m_Not(m_Specific(CmpLHS))) ||
            match(CmpLHS, m_Not(m_Specific(TrueVal))))) {
         LHS = TrueVal;
         RHS = FalseVal;
         return {SPF_SMIN, SPNB_NA, false};

test/Transforms/SimplifyCFG/no_speculative_loads_with_asan.ll

+; RUN: opt -simplifycfg -S %s | FileCheck %s
+; Make sure we don't speculate loads under AddressSanitizer.
+@g = global i32 0, align 4
+
+define i32 @TestNoAsan(i32 %cond) nounwind readonly uwtable {
+entry:
+  %tobool = icmp eq i32 %cond, 0
+  br i1 %tobool, label %return, label %if.then
+
+if.then:                                          ; preds = %entry
+  %0 = load i32, i32* @g, align 4
+  br label %return
+
+return:                                           ; preds = %entry, %if.then
+  %retval = phi i32 [ %0, %if.then ], [ 0, %entry ]
+  ret i32 %retval
+; CHECK-LABEL: @TestNoAsan
+; CHECK: %[[LOAD:[^ ]*]] = load
+; CHECK: select{{.*}}[[LOAD]]
+; CHECK: ret i32
+}
+
+define i32 @TestAsan(i32 %cond) nounwind readonly uwtable sanitize_address {
+entry:
+  %tobool = icmp eq i32 %cond, 0
+  br i1 %tobool, label %return, label %if.then
+
+if.then:                                          ; preds = %entry
+  %0 = load i32, i32* @g, align 4
+  br label %return
+
+return:                                           ; preds = %entry, %if.then
+  %retval = phi i32 [ %0, %if.then ], [ 0, %entry ]
+  ret i32 %retval
+; CHECK-LABEL: @TestAsan
+; CHECK: br i1
+; CHECK: load i32, i32* @g
+; CHECK: br label
+; CHECK: ret i32
+}