[UBSAN] Suppress an error report with given type information

[byoungyoung]

Summary

For UBSan vptr, suppress an error report with given type information.

The suppression list is provided with the file (UBSAN_OPTIONS=suppressions=SUPP_FILENAME), and an error report is suppressed if the type of an actual object is in the suppression list.

[samsonov]

Sergey, Dmitry

Is there a reason that "suppressions" flag is not in sanitizer_common, and we have separate methods for accessing/parsing suppression context in LSan/TSan? Does it make sense to have this code in sanitizer_common instead?

For example, now we work on adding suppressions to UBSan. Note that there is a "supported" mode where we run ASan+LSan+UBSan together. Having separate set of suppressions for LSan and UBSan would be really unconvenient.

lib/sanitizer_common/sanitizer_suppressions.cc

27

Let the bikeshedding begin. I'd actually vote to exclude tool name from suppression type. Currently suppression names seem to correspond to the error type ("leak", "race", "deadlock"). Let's stick to this way and use smth. like "vptr_check" or "invalid_cast".

lib/sanitizer_common/tests/sanitizer_suppressions_test.cc

75

Actually update the test to include new suppression name, as this comment recommends.

lib/ubsan/ubsan_flags.cc

26 ↗

(On Diff #11967)

Let's use empty string for consistency with another sanitizers defining this flag.

33 ↗

(On Diff #11967)

I find this flag description confusing.

lib/ubsan/ubsan_handlers_cxx.cc

29

It probably makes more sense to put suppression context into ubsan_diag and implement proper set of methods to access it.

47

I believe you should put this check before acquiring the SourceLocation above. Otherwise, if two errors happen consecutively and have the same source location, and the first error is suppressed, then you won't report the second one. It would be nice to have a test for it.

51

Note that suppression context may not yet be initialized at this point (if InitIfNecessary() hasn't run yet, which is barely possible on Linux, where we use preinit_array, but probably may happen on other platforms).

lib/ubsan/ubsan_init.cc

32

It's sad to see the duplicated code here. Let me raise a discussion about having common suppression context in sanitizer_common.

[earthdok]

+1 to Dima's email reply. (Let's move the flag to common flags, and drop "ubsan" from the suppression type.)

[byoungyoung]

Thanks Alexey for the detailed comments! This patch resolved the comments by Alexey.

[samsonov]

lib/ubsan/ubsan_diag.cc

313

No, I believe we must first move the code for initializing suppression context into sanitizer_common and make "suppressions" a common runtime flag. I will work on it soon. I've submitted the first patch for that in r214334.

lib/ubsan/ubsan_handlers_cxx.cc

38

// Check if error report is suppressed.

test/ubsan/TestCases/TypeCheck/vptr.cpp

15

Remove stray echo " "

175

LSan shouldn't be a problem after r214149 I've submitted recently.

[samsonov]

lib/ubsan/ubsan_diag.cc

313

I think this should be done as of r214344.

[byoungyoung]

Resolved comments by Alexey. Please note this patch does NOT pass ubsan testcases, but I'm uploading this to ask why it fails.

The failing test is

Failing Tests (1):

UndefinedBehaviorSanitizer-AddressSanitizer :: TestCases/TypeCheck/vptr.cpp

with CHECK-LOC-SUPPRESS check. I've checked this case manually, and everything looks fine. But not sure why cmake test complains this specific case went wrong (only for UBSAN+ASAN).

[samsonov]

lib/ubsan/ubsan_diag.cc

21

Revise new #includes you need.

318

I'd prefer to skip check for suppressions common flag and assume that suppression context is always properly initialized (but can be empty).

322

just introduce SuppressionContext::InitIfNecessary()

326

As you're encapsulating access to SuppressionContext, you may provide a superior interface, so that callers of MatchSuppressions() won't have to know about the enum "SuppressionVptrCheck". E.g. you can introduce a simple function

bool __ubsan::TypeIsSuppressed(const char *TypeName);

329

you can plain if() here:

if (!SANITIZER_CAN_USE_PREINIT_ARRAY)
  InitIfNecessary();

please add a comment describing why you need this.

333

Collapse

if (condition)
  return true;
return false;

to

return condition;

lib/ubsan/ubsan_flags.cc

17 ↗

(On Diff #12066)

accidental include?

lib/ubsan/ubsan_handlers_cxx.cc

39

you can save DTI.getMostDerivedTypeName() in a variable (it's called several times in this function).

test/ubsan/TestCases/TypeCheck/vptr.cpp

15

remove stray (echo " ")

[samsonov]

The problem could be difference in environment options. E.g. UBSan+ASan tests setup ASAN_OPTIONS=detect_leaks=0 (which overrides the default). Note that it is important, as LSan also supports suppressions, and creates/parses suppression context only if detect_leaks is setup to true.

[byoungyoung]

Thanks for the details comments, Alexey! Addressed the comments, and now it can pass ubsan tests.

[samsonov]

lib/ubsan/ubsan_diag.cc

317

You may now get rid of this function and call SuppressionContext::InitIfNecessary() from __ubsan::InitIfNecessary() directly.

lib/ubsan/ubsan_handlers_cxx.cc

37

why not create and pass MangledName around?

test/ubsan/TestCases/TypeCheck/vptr.cpp

15

echo ""; remains a mystery for me.

[byoungyoung]

lib/sanitizer_common/sanitizer_suppressions.cc

27

done

lib/sanitizer_common/tests/sanitizer_suppressions_test.cc

75

Done

lib/ubsan/ubsan_diag.cc

313

When UBSan is running together with LSan, it seems LSan initializes SuppressionContext() before UBSan. I guess this has to be handled in the SuppressionContext(), but right now I simple implemented SuppressionContext::GetOrNull() to avoid the issue as I'm not sure whether my logic is correct.

317

I just wanted to keep the encapsulation as it would require ubsan_init to see SuppressionContext, but let me get rid of this wrapper function.

lib/ubsan/ubsan_flags.cc

26 ↗

(On Diff #11967)

done

33 ↗

(On Diff #11967)

I think I improved the description, but not sure whether it is clear enough :(

lib/ubsan/ubsan_handlers_cxx.cc

29

Done, now all suppressions are implemented in ubsan_diag

37

As the mangled name was not straight forward to us to blacklist (or suppress here), we actually wanted to bring up the discussion to see whether it's possible to use un-mangled name. But let me fix this as you suggest as it clearly breaks the consistency.

38

Done.

47

Ah! I've added the test but it may not be clean enough. Please comment if you have a better idea.

51

Can we safely assume that InitIfNecessary() is called if preinit_array is defined? Now InitIfNecessary() is enforced only if preinit_array is not defined. I think we may simply always call InitIfNecessary() as well because this matching function would not be invoked a lot (at least for vptr).

lib/ubsan/ubsan_init.cc

32

Thanks, let me leave the code as it is until then.

test/ubsan/TestCases/TypeCheck/vptr.cpp

15

Since running this test generates empty outputs, FileCheck complains about it. I may add one simple printf(), or is there any options for FileCheck to handle empty output cases?

15

Oh I misunderstood the meaning of stray :( Fixed now.

15

It seems my previous comments were not properly sent to you. These echo commands were prepended to generate non-empty outputs, because FileCheck complains otherwise due to the empty outputs.

16

Please note that these redundant options (ASAN_OPTIONS and UBSAN_OPTIONS) are given to pass both UBsan tests and UBsan + Asan tests. When UBSan+Asan is running, suppressions flag in UBSAN_OPTIONS is not parsed.

24

This check fails for UBSAN+ASAN while it worked fine when I manually tested. Could you please take a look why this fails?

24

Let me also keep debugging this issue in the meantime !

175

There were strange issues in testing UndefinedBehaviorSanitizer-AddressSanitizer, and let me describe more in the updated patch.

[samsonov]

lib/ubsan/ubsan_handlers_cxx.cc

37

I mean, use the "MangledName" object, which is a strong typedef for "const char *".
But, yes, I believe that we should eventually be able to blacklist/suppress *demangled* names. That's a different issue, though.

test/ubsan/TestCases/TypeCheck/vptr.cpp

15

Oh god. Consider the following approach: build the code with -fno-sanitize-recover and simply execute the binaries, without piping the output to FileCheck (i.e. just check that a binary executes successfully and returns zero exit code).

[byoungyoung]

Sorry for the delay as I had troubles to access my computer. I hope this patch resolves your concerns.

lib/ubsan/ubsan_handlers_cxx.cc

37

Fixed as commented --- introduced MDTMangledName variable.

test/ubsan/TestCases/TypeCheck/vptr.cpp

15

Ughh... I didn't know what this "RUN" was actually doing and checking. I'm sorry for the mess.

[samsonov]

OK, landing this now.

[samsonov]

Landed (with a few modifications) as r214833. Thanks for working on this!

lib/sanitizer_common/sanitizer_suppressions.h

enum SuppressionType {
   SuppressionNone,
   SuppressionRace,
   SuppressionMutex,
   SuppressionThread,
   SuppressionSignal,
   SuppressionLeak,
   SuppressionLib,
   SuppressionDeadlock,
+  SuppressionVptrCheck,
   SuppressionTypeCount
 };
 
 struct Suppression {
   SuppressionType type;
   char *templ;
   unsigned hit_count;
   uptr weight;
 };
 
 class SuppressionContext {
  public:
   void Parse(const char *str);
   bool Match(const char* str, SuppressionType type, Suppression **s);
   uptr SuppressionCount() const;
   const Suppression *SuppressionAt(uptr i) const;
   void GetMatched(InternalMmapVector<Suppression *> *matched);
 
   // Create a SuppressionContext singleton. Not thread safe. Must be called
   // early during initialization.
   static void Init();
+
+  // Initialize a SuppressionContext singleton only if necessary.
+  static void InitIfNecessary();
+
   // Returns a SuppressionContext singleton.
   static SuppressionContext *Get();
 
  private:
   SuppressionContext() : suppressions_(1), can_parse_(true) {}
   InternalMmapVector<Suppression> suppressions_;
   bool can_parse_;
 

lib/sanitizer_common/sanitizer_suppressions.cc

 #include "sanitizer_common.h"
 #include "sanitizer_flags.h"
 #include "sanitizer_libc.h"
 #include "sanitizer_placement_new.h"
 
 namespace __sanitizer {
 
 static const char *const kTypeStrings[SuppressionTypeCount] = {
-    "none",   "race", "mutex",           "thread",
-    "signal", "leak", "called_from_lib", "deadlock"};
+    "none",       "race", "mutex",           "thread",
+    "signal",     "leak", "called_from_lib", "deadlock",
+    "vptr_check"};
 
 bool TemplateMatch(char *templ, const char *str) {
   if (str == 0 || str[0] == 0)
     return false;
   bool start = false;
   if (templ && templ[0] == '^') {
     start = true;
     templ++;

 ALIGNED(64) static char placeholder[sizeof(SuppressionContext)];
 static SuppressionContext *suppression_ctx = 0;
 
 SuppressionContext *SuppressionContext::Get() {
   CHECK(suppression_ctx);
   return suppression_ctx;
 }
 
+void SuppressionContext::InitIfNecessary() {
+  if (!suppression_ctx)
+    Init();
+}
+
 void SuppressionContext::Init() {
   CHECK(!suppression_ctx);
   suppression_ctx = new(placeholder) SuppressionContext;
   char *suppressions_from_file;
   uptr buffer_size;
   uptr contents_size =
       ReadFileToBuffer(common_flags()->suppressions, &suppressions_from_file,
                        &buffer_size, 1 << 26 /* max_len */);

lib/sanitizer_common/tests/sanitizer_suppressions_test.cc

 TEST(Suppressions, TypeStrings) {
   CHECK(!internal_strcmp(SuppressionTypeString(SuppressionNone), "none"));
   CHECK(!internal_strcmp(SuppressionTypeString(SuppressionRace), "race"));
   CHECK(!internal_strcmp(SuppressionTypeString(SuppressionMutex), "mutex"));
   CHECK(!internal_strcmp(SuppressionTypeString(SuppressionThread), "thread"));
   CHECK(!internal_strcmp(SuppressionTypeString(SuppressionSignal), "signal"));
   CHECK(!internal_strcmp(SuppressionTypeString(SuppressionLeak), "leak"));
   CHECK(!internal_strcmp(SuppressionTypeString(SuppressionLib),
                          "called_from_lib"));
-  CHECK(
-      !internal_strcmp(SuppressionTypeString(SuppressionDeadlock), "deadlock"));
+  CHECK(!internal_strcmp(SuppressionTypeString(SuppressionDeadlock),
+                         "deadlock"));
+  CHECK(!internal_strcmp(SuppressionTypeString(SuppressionVptrCheck),
+                         "vptr_check"));
   // Ensure this test is up-to-date when suppression types are added.
-  CHECK_EQ(SuppressionTypeCount, 8);
+  CHECK_EQ(SuppressionTypeCount, 9);
 }
 
 class SuppressionContextTest : public ::testing::Test {
  public:
   virtual void SetUp() { ctx_ = new(placeholder_) SuppressionContext; }
   virtual void TearDown() { ctx_->~SuppressionContext(); }
 
  protected:

lib/ubsan/ubsan_diag.h

 class ScopedReport {
   bool DieAfterReport;
 
 public:
   ScopedReport(bool DieAfterReport);
   ~ScopedReport();
 };
 
+bool TypeIsSuppressed(const char *TypeName);
+
 } // namespace __ubsan
 
 #endif // UBSAN_DIAG_H

lib/ubsan/ubsan_diag.cc

 //===----------------------------------------------------------------------===//
 
 #include "ubsan_diag.h"
 #include "ubsan_init.h"
 #include "ubsan_flags.h"
 #include "sanitizer_common/sanitizer_report_decorator.h"
 #include "sanitizer_common/sanitizer_stacktrace.h"
 #include "sanitizer_common/sanitizer_symbolizer.h"
+#include "sanitizer_common/sanitizer_suppressions.h"
 #include <stdio.h>
 
 using namespace __ubsan;
 
 void __ubsan::MaybePrintStackTrace(uptr pc, uptr bp) {
   // We assume that flags are already parsed: InitIfNecessary
   // will definitely be called when we print the first diagnostics message.
   if (!flags()->print_stacktrace)
     return;

 ScopedReport::ScopedReport(bool DieAfterReport)
     : DieAfterReport(DieAfterReport) {
   InitIfNecessary();
   CommonSanitizerReportMutex.Lock();
 }
 
 ScopedReport::~ScopedReport() {
   CommonSanitizerReportMutex.Unlock();
   if (DieAfterReport)
     Die();
 }
+
+static bool MatchSuppressions(const char *Str, SuppressionType Type) {
+  Suppression *s;
+
+  // If .preinit_array is not used, it is possible that the UBSan runtime is not
+  // initialized.
+  if (!SANITIZER_CAN_USE_PREINIT_ARRAY)
+    InitIfNecessary();
+
+  return SuppressionContext::Get()->Match(Str, Type, &s);
+}
+
+bool __ubsan::TypeIsSuppressed(const char *TypeName) {
+  return MatchSuppressions(TypeName, SuppressionVptrCheck);
+}

lib/ubsan/ubsan_handlers_cxx.cc

 
 using namespace __sanitizer;
 using namespace __ubsan;
 
 namespace __ubsan {
   extern const char *TypeCheckKinds[];
 }
 
 static void HandleDynamicTypeCacheMiss(
     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash,
     bool Abort, uptr pc, uptr bp) {
   if (checkDynamicType((void*)Pointer, Data->TypeInfo, Hash))
     // Just a cache miss. The type matches after all.
     return;
 
+  DynamicTypeInfo DTI = getDynamicTypeInfo((void*)Pointer);
+  MangledName MDTMangledName = MangledName(DTI.getMostDerivedTypeName());
+
+  // Check if an error report is suppressed.
+  if (TypeIsSuppressed(MDTMangledName.getName()))
+    return;
+
   SourceLocation Loc = Data->Loc.acquire();
   if (Loc.isDisabled())
     return;
 
   ScopedReport R(Abort);
 
   Diag(Loc, DL_Error,
        "%0 address %1 which does not point to an object of type %2")
     << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
 
   // If possible, say what type it actually points to.
-  DynamicTypeInfo DTI = getDynamicTypeInfo((void*)Pointer);
   if (!DTI.isValid())
     Diag(Pointer, DL_Note, "object has invalid vptr")
-      << MangledName(DTI.getMostDerivedTypeName())
+      << MDTMangledName
       << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
   else if (!DTI.getOffset())
     Diag(Pointer, DL_Note, "object is of type %0")
-      << MangledName(DTI.getMostDerivedTypeName())
+      << MDTMangledName
       << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
   else
     // FIXME: Find the type at the specified offset, and include that
     //        in the note.
     Diag(Pointer - DTI.getOffset(), DL_Note,
          "object is base class subobject at offset %0 within object of type %1")
-      << DTI.getOffset() << MangledName(DTI.getMostDerivedTypeName())
+      << DTI.getOffset() << MDTMangledName
       << MangledName(DTI.getSubobjectTypeName())
       << Range(Pointer, Pointer + sizeof(uptr), "vptr for %2 base class of %1");
 
   MaybePrintStackTrace(pc, bp);
 }
 
 void __ubsan::__ubsan_handle_dynamic_type_cache_miss(
     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
   GET_CALLER_PC_BP;
   HandleDynamicTypeCacheMiss(Data, Pointer, Hash, false, pc, bp);
 }
 void __ubsan::__ubsan_handle_dynamic_type_cache_miss_abort(
     DynamicTypeCacheMissData *Data, ValueHandle Pointer, ValueHandle Hash) {
   GET_CALLER_PC_BP;
   HandleDynamicTypeCacheMiss(Data, Pointer, Hash, true, pc, bp);
 }

lib/ubsan/ubsan_init.cc

 //===----------------------------------------------------------------------===//
 
 #include "ubsan_init.h"
 #include "ubsan_flags.h"
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_libc.h"
 #include "sanitizer_common/sanitizer_mutex.h"
 #include "sanitizer_common/sanitizer_symbolizer.h"
+#include "sanitizer_common/sanitizer_suppressions.h"
 
 using namespace __ubsan;
 
 static bool ubsan_inited;
 
 void __ubsan::InitIfNecessary() {
 #if !SANITIZER_CAN_USE_PREINIT_ARRAY
   // No need to lock mutex if we're initializing from preinit array.
   static StaticSpinMutex init_mu;
   SpinMutexLock l(&init_mu);
 #endif
   if (LIKELY(ubsan_inited))
    return;
   if (0 == internal_strcmp(SanitizerToolName, "SanitizerTool")) {
     // WARNING: If this condition holds, then either UBSan runs in a standalone
     // mode, or initializer for another sanitizer hasn't run yet. In a latter
     // case, another sanitizer will overwrite "SanitizerToolName" and reparse
     // common flags. It means, that we are not allowed to *use* common flags
     // in this function.
     SanitizerToolName = "UndefinedBehaviorSanitizer";
     InitializeCommonFlags();
     Symbolizer::GetOrInit();
   }
   // Initialize UBSan-specific flags.
   InitializeFlags();
+  SuppressionContext::InitIfNecessary();
   ubsan_inited = true;
 }
 
 #if SANITIZER_CAN_USE_PREINIT_ARRAY
 __attribute__((section(".preinit_array"), used))
 void (*__local_ubsan_preinit)(void) = __ubsan::InitIfNecessary;
 #else
 // Use a dynamic initializer.
 class UbsanInitializer {
  public:
   UbsanInitializer() {
     InitIfNecessary();
   }
 };
 static UbsanInitializer ubsan_initializer;
 #endif  // SANITIZER_CAN_USE_PREINIT_ARRAY

test/ubsan/TestCases/TypeCheck/vptr.cpp

 // RUN: %clangxx -fsanitize=vptr -g %s -O3 -o %t
 // RUN: %run %t rT && %run %t mT && %run %t fT && %run %t cT
 // RUN: %run %t rU && %run %t mU && %run %t fU && %run %t cU
 // RUN: %run %t rS && %run %t rV && %run %t oV
 // RUN: UBSAN_OPTIONS=print_stacktrace=1 %run %t mS 2>&1 | FileCheck %s --check-prefix=CHECK-MEMBER --strict-whitespace
 // RUN: UBSAN_OPTIONS=print_stacktrace=1 %run %t fS 2>&1 | FileCheck %s --check-prefix=CHECK-MEMFUN --strict-whitespace
 // RUN: UBSAN_OPTIONS=print_stacktrace=1 %run %t cS 2>&1 | FileCheck %s --check-prefix=CHECK-DOWNCAST --strict-whitespace
 // RUN: UBSAN_OPTIONS=print_stacktrace=1 %run %t mV 2>&1 | FileCheck %s --check-prefix=CHECK-MEMBER --strict-whitespace
 // RUN: UBSAN_OPTIONS=print_stacktrace=1 %run %t fV 2>&1 | FileCheck %s --check-prefix=CHECK-MEMFUN --strict-whitespace
 // RUN: UBSAN_OPTIONS=print_stacktrace=1 %run %t cV 2>&1 | FileCheck %s --check-prefix=CHECK-DOWNCAST --strict-whitespace
 // RUN: UBSAN_OPTIONS=print_stacktrace=1 %run %t oU 2>&1 | FileCheck %s --check-prefix=CHECK-OFFSET --strict-whitespace
 // RUN: UBSAN_OPTIONS=print_stacktrace=1 %run %t m0 2>&1 | FileCheck %s --check-prefix=CHECK-NULL-MEMBER --strict-whitespace
 
+// RUN: echo "vptr_check:S" > %t.loc-supp
+// RUN: ASAN_OPTIONS="$ASAN_OPTIONS suppressions=%t.loc-supp" UBSAN_OPTIONS=suppressions=%t.loc-supp %run %t x- 2>&1 | FileCheck %s --check-prefix=CHECK-LOC-SUPPRESS
+
+// RUN: %clangxx -fsanitize=vptr -fno-sanitize-recover -g %s -O3 -o %t
+// RUN: (echo "vptr_check:S"; echo "vptr_check:T"; echo "vptr_check:U") > %t.supp
+// RUN: ASAN_OPTIONS="$ASAN_OPTIONS suppressions=%t.supp" UBSAN_OPTIONS=suppressions=%t.supp %run %t mS 2>&1
+// RUN: ASAN_OPTIONS="$ASAN_OPTIONS suppressions=%t.supp" UBSAN_OPTIONS=suppressions=%t.supp %run %t fS 2>&1
+// RUN: ASAN_OPTIONS="$ASAN_OPTIONS suppressions=%t.supp" UBSAN_OPTIONS=suppressions=%t.supp %run %t cS 2>&1
+// RUN: ASAN_OPTIONS="$ASAN_OPTIONS suppressions=%t.supp" UBSAN_OPTIONS=suppressions=%t.supp %run %t mV 2>&1
+// RUN: ASAN_OPTIONS="$ASAN_OPTIONS suppressions=%t.supp" UBSAN_OPTIONS=suppressions=%t.supp %run %t fV 2>&1
+// RUN: ASAN_OPTIONS="$ASAN_OPTIONS suppressions=%t.supp" UBSAN_OPTIONS=suppressions=%t.supp %run %t cV 2>&1
+// RUN: ASAN_OPTIONS="$ASAN_OPTIONS suppressions=%t.supp" UBSAN_OPTIONS=suppressions=%t.supp %run %t oU 2>&1
+
 // FIXME: This test produces linker errors on Darwin.
 // XFAIL: darwin
 
 struct S {
   S() : a(0) {}
   ~S() {}
   int a;
   int f() { return 0; }
   virtual int v() { return 0; }
 };
 
 struct T : S {
   T() : b(0) {}
   int b;
   int g() { return 0; }
   virtual int v() { return 1; }
 };
 
 struct U : S, T { virtual int v() { return 2; } };
 
+struct V : S {};
+
 // Make p global so that lsan does not complain.
 T *p = 0;
 
 int access_p(T *p, char type);
 
 int main(int, char **argv) {
   T t;
   (void)t.a;

 
 int access_p(T *p, char type) {
   switch (type) {
   case 'r':
     // Binding a reference to storage of appropriate size and alignment is OK.
     {T &r = *p;}
     break;
 
+  case 'x':
+    for (int i=0; i<2; i++) {
+      if (i==0)
+        p = reinterpret_cast<T*>(new S);
+      else
+        p = reinterpret_cast<T*>(new V);
+      // CHECK-LOC-SUPPRESS: vptr.cpp:[[@LINE+5]]:7: runtime error: member call on address [[PTR:0x[0-9a-f]*]] which does not point to an object of type 'T'
+      // CHECK-LOC-SUPPRESS-NEXT: [[PTR]]: note: object is of type 'V'
+      // CHECK-LOC-SUPPRESS-NEXT: {{^ .. .. .. ..  .. .. .. .. .. .. .. ..  }}
+      // CHECK-LOC-SUPPRESS-NEXT: {{^              \^~~~~~~~~~~(~~~~~~~~~~~~)? *$}}
+      // CHECK-LOC-SUPPRESS-NEXT: {{^              vptr for 'V'}}
+      p->g();
+      // CHECK-LOC-SUPPRESS-NOT: [[PTR]]: note: object is of type 'S'
+    }
+    return 0;
+
   case 'm':
     // CHECK-MEMBER: vptr.cpp:[[@LINE+6]]:15: runtime error: member access within address [[PTR:0x[0-9a-f]*]] which does not point to an object of type 'T'
     // CHECK-MEMBER-NEXT: [[PTR]]: note: object is of type [[DYN_TYPE:'S'|'U']]
     // CHECK-MEMBER-NEXT: {{^ .. .. .. ..  .. .. .. .. .. .. .. ..  }}
     // CHECK-MEMBER-NEXT: {{^              \^~~~~~~~~~~(~~~~~~~~~~~~)? *$}}
     // CHECK-MEMBER-NEXT: {{^              vptr for}} [[DYN_TYPE]]
     // CHECK-MEMBER-NEXT: #0 {{.*}} in access_p{{.*}}vptr.cpp:[[@LINE+1]]
     return p->b;
case 'c':
     // CHECK-DOWNCAST-NEXT: [[PTR]]: note: object is of type [[DYN_TYPE:'S'|'U']]
     // CHECK-DOWNCAST-NEXT: {{^ .. .. .. ..  .. .. .. .. .. .. .. ..  }}
     // CHECK-DOWNCAST-NEXT: {{^              \^~~~~~~~~~~(~~~~~~~~~~~~)? *$}}
     // CHECK-DOWNCAST-NEXT: {{^              vptr for}} [[DYN_TYPE]]
     // CHECK-DOWNCAST-NEXT: #0 {{.*}} in access_p{{.*}}vptr.cpp:[[@LINE+1]]
     static_cast<T*>(reinterpret_cast<S*>(p));
     return 0;
   }
 }