LLVM Detailed IR tests for introduction of flag -fsanitize-address-detect-stack-use-after-return-mode.

[kda]

Summary

Rework all tests that interact with use after return to correctly handle the case where the mode has been explicitly set to Never or Always.

for issue: https://github.com/google/sanitizers/issues/1394

[vitalybuka]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

260–282

we are going to have two conflicting flags.
Could you please just change this bool flag into Enum, probably without renaming?

static cl::opt<AsanDetectStackUseAfterReturnMode> ClUseAfterReturn("asan-use-after-return"...
0,1 should match current behavior

[kda]

Rework to update existing asan-use-after-return boolean to modal flag.

[kda]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

266–268

I added this one and the one below ('1') to avoid updating tests.
Should I just update the tests and remove these?

[vitalybuka]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

260–282

0,1 is fine
we can remove them later in a separate patch.

266–268

then maybe '2' as well?

271

it should be ASAN_OPTIONS=detect_stack_use_after_return=1

3334–3376

this comment applies to inside of the "then" branch only

Please insert corresponsing spseudo code for else branch:
void *FakeStack = __asan_stack_malloc_N(LocalStackSize);
void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize);

3395–3407

we porbably need entire thing in the else branch
AsanStackMallocFunc[StackMallocIdx] may return NULL in runtime
so we need NoFakeStack branch as well

This is future oportunity to improve: make compiler-rt never return NULL so we can remove CreateICmpEQ and one branch

3409

do you want to uncomment and keep it?

3417

FakeStack is LLVM object which represent result of the function call
(FakeStack) is never NULL, however in runtime it can contain NULL, so we need to compile IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy)); like above

llvm/test/Instrumentation/AddressSanitizer/stack-poisoning.ll

22

this statements checks that there is no this line in after previous check
more reliable is to add --implicit-check-not=asan_option_detect_stack_use_after_return into FileCheck arg to make sure it's not there at all

22

It would be nice to check for CreateICmpEQ
But probably D102867 is enough

llvm/test/Instrumentation/AddressSanitizer/stack_dynamic_alloca.ll

31

same

[kda]

fixes for correct code.

[kda]

removed commented out code.

[kda]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

3409

No. I only meant it as a comment for clarity.

llvm/test/Instrumentation/AddressSanitizer/stack-poisoning.ll

22

ack.

[vitalybuka]

LGTM

llvm/include/llvm/Transforms/Instrumentation/AddressSanitizerOptions.h

 
 /// Types of ASan module destructors supported
 enum class AsanDtorKind {
   None,    ///< Do not emit any destructors for ASan
   Global,  ///< Append to llvm.global_dtors
   Invalid, ///< Not a valid destructor Kind.
   // TODO(dliew): Add more more kinds.
 };
+
+/// Mode of ASan detect stack use after return
+enum class AsanDetectStackUseAfterReturnMode {
+  Never,   ///< Never detect stack use after return.
+  Runtime, ///< Detect stack use after return if runtime flag is enabled
+           ///< (ASAN_OPTIONS=detect_stack_use_after_return=1)
+  Always,  ///< Always detect stack use after return.
+  Invalid, ///< Not a valid detect mode.
+};
+
 } // namespace llvm
+
 #endif

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/MathExtras.h"
 #include "llvm/Support/ScopedPrinter.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Instrumentation/AddressSanitizerCommon.h"
+#include "llvm/Transforms/Instrumentation/AddressSanitizerOptions.h"
 #include "llvm/Transforms/Utils/ASanStackFrameLayout.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
 #include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 #include "llvm/Transforms/Utils/PromoteMemToReg.h"
 #include <algorithm>
 #include <cassert>
 #include <cstddef>

 // This flag may need to be replaced with -f[no]asan-stack.
 static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"),
                              cl::Hidden, cl::init(true));
 static cl::opt<uint32_t> ClMaxInlinePoisoningSize(
     "asan-max-inline-poisoning-size",
     cl::desc(
         "Inline shadow poisoning for blocks up to the given size in bytes."),
     cl::Hidden, cl::init(64));
 
-static cl::opt<bool> ClUseAfterReturn("asan-use-after-return",
-                                      cl::desc("Check stack-use-after-return"),
-                                      cl::Hidden, cl::init(true));
+static cl::opt<AsanDetectStackUseAfterReturnMode> ClUseAfterReturn(
+    "asan-use-after-return",
+    cl::desc("Sets the mode of detection for stack-use-after-return."),
+    cl::values(
+        clEnumValN(AsanDetectStackUseAfterReturnMode::Never, "never",
+                   "Never detect stack use after return."),
+        clEnumValN(AsanDetectStackUseAfterReturnMode::Never,
+                   "0", // only needed to keep unit tests passing
+                   "Redundant with 'never'."),
+        clEnumValN(
+            AsanDetectStackUseAfterReturnMode::Runtime, "runtime",
+            "Detect stack use after return if "
+            "binary flag 'ASAN_OPTIONS=detect_stack_use_after_return' is set."),
+        clEnumValN(AsanDetectStackUseAfterReturnMode::Runtime,
+                   "1", // only needed to keep unit tests passing
+                   "redundant with 'runtime'."),
+        clEnumValN(AsanDetectStackUseAfterReturnMode::Always, "always",
+                   "Always detect stack use after return."),
+        clEnumValN(AsanDetectStackUseAfterReturnMode::Always,
+                   "2", // only needed to keep unit tests passing
+                   "Always detect stack use after return.")),
+    cl::Hidden, cl::init(AsanDetectStackUseAfterReturnMode::Runtime));
 
 static cl::opt<bool> ClRedzoneByvalArgs("asan-redzone-byval-args",
                                         cl::desc("Create redzones for byval "
                                                  "arguments (extra copy "
                                                  "required)"), cl::Hidden,
                                         cl::init(true));
 
 static cl::opt<bool> ClUseAfterScope("asan-use-after-scope",
if (const DILocation *FnLoc = EntryDebugLocation.get()) {
             Desc.Line = std::min(Desc.Line ? Desc.Line : Line, Line);
       }
     }
   }
 
   auto DescriptionString = ComputeASanStackFrameDescription(SVD);
   LLVM_DEBUG(dbgs() << DescriptionString << " --- " << L.FrameSize << "\n");
   uint64_t LocalStackSize = L.FrameSize;
-  bool DoStackMalloc = ClUseAfterReturn && !ASan.CompileKernel &&
-                       LocalStackSize <= kMaxStackMallocSize;
+  bool DoStackMalloc =
+      ClUseAfterReturn != AsanDetectStackUseAfterReturnMode::Never &&
+      !ASan.CompileKernel && LocalStackSize <= kMaxStackMallocSize;
   bool DoDynamicAlloca = ClDynamicAllocaStack;
   // Don't do dynamic alloca or stack malloc if:
   // 1) There is inline asm: too often it makes assumptions on which registers
   //    are available.
   // 2) There is a returns_twice call (typically setjmp), which is
   //    optimization-hostile, and doesn't play well with introduced indirect
   //    register-relative calculation of local variable addresses.
   DoDynamicAlloca &= !HasInlineAsm && !HasReturnsTwiceCall;
   DoStackMalloc &= !HasInlineAsm && !HasReturnsTwiceCall;
 
   Value *StaticAlloca =
       DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false);
 
   Value *FakeStack;
   Value *LocalStackBase;
   Value *LocalStackBaseAlloca;
   uint8_t DIExprFlags = DIExpression::ApplyOffset;
 
   if (DoStackMalloc) {
     LocalStackBaseAlloca =
         IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base");
+    if (ClUseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) {
       // void *FakeStack = __asan_option_detect_stack_use_after_return
       //     ? __asan_stack_malloc_N(LocalStackSize)
       //     : nullptr;
-    // void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize);
+      // void *LocalStackBase = (FakeStack) ? FakeStack :
+      //                        alloca(LocalStackSize);
       Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal(
           kAsanOptionDetectUseAfterReturn, IRB.getInt32Ty());
       Value *UseAfterReturnIsEnabled = IRB.CreateICmpNE(
           IRB.CreateLoad(IRB.getInt32Ty(), OptionDetectUseAfterReturn),
           Constant::getNullValue(IRB.getInt32Ty()));
       Instruction *Term =
           SplitBlockAndInsertIfThen(UseAfterReturnIsEnabled, InsBefore, false);
       IRBuilder<> IRBIf(Term);
       StackMallocIdx = StackMallocSizeClass(LocalStackSize);
       assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass);
       Value *FakeStackValue =
           IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx],
                            ConstantInt::get(IntptrTy, LocalStackSize));
       IRB.SetInsertPoint(InsBefore);
       FakeStack = createPHI(IRB, UseAfterReturnIsEnabled, FakeStackValue, Term,
                             ConstantInt::get(IntptrTy, 0));
-
+    } else {
+      // assert(ClUseAfterReturn == AsanDetectStackUseAfterReturnMode:Always)
+      // void *FakeStack = __asan_stack_malloc_N(LocalStackSize);
+      // void *LocalStackBase = (FakeStack) ? FakeStack :
+      //                        alloca(LocalStackSize);
+      StackMallocIdx = StackMallocSizeClass(LocalStackSize);
+      FakeStack = IRB.CreateCall(AsanStackMallocFunc[StackMallocIdx],
+                                 ConstantInt::get(IntptrTy, LocalStackSize));
+    }
     Value *NoFakeStack =
         IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy));
-    Term = SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false);
-    IRBIf.SetInsertPoint(Term);
+    Instruction *Term =
+        SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false);
+    IRBuilder<> IRBIf(Term);
     Value *AllocaValue =
         DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca;
 
     IRB.SetInsertPoint(InsBefore);
     LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
     IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca);
     DIExprFlags |= DIExpression::DerefBefore;
   } else {
     // void *FakeStack = nullptr;
     // void *LocalStackBase = alloca(LocalStackSize);
     FakeStack = ConstantInt::get(IntptrTy, 0);
     LocalStackBase =
         DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca;
     LocalStackBaseAlloca = LocalStackBase;
   }
 
   // It shouldn't matter whether we pass an `alloca` or a `ptrtoint` as the
   // dbg.declare address opereand, but passing a `ptrtoint` seems to confuse
   // later passes and can result in dropped variable coverage in debug info.
   Value *LocalStackBaseAllocaPtr =
       isa<PtrToIntInst>(LocalStackBaseAlloca)
           ? cast<PtrToIntInst>(LocalStackBaseAlloca)->getPointerOperand()
           : LocalStackBaseAlloca;
   assert(isa<AllocaInst>(LocalStackBaseAllocaPtr) &&
          "Variable descriptions relative to ASan stack base will be dropped");
 
   // Replace Alloca instructions with base+offset.
   for (const auto &Desc : SVD) {
     AllocaInst *AI = Desc.AI;
     replaceDbgDeclare(AI, LocalStackBaseAllocaPtr, DIB, DIExprFlags,
                       Desc.Offset);
     Value *NewAllocaPtr = IRB.CreateIntToPtr(
         IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)),
         AI->getType());
     AI->replaceAllUsesWith(NewAllocaPtr);
   }
 
   // The left-most redzone has enough space for at least 4 pointers.
   // Write the Magic value to redzone[0].
   Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy);
   IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic),
                   BasePlus0);
   // Write the frame description constant to redzone[1].
   Value *BasePlus1 = IRB.CreateIntToPtr(
       IRB.CreateAdd(LocalStackBase,
                     ConstantInt::get(IntptrTy, ASan.LongSize / 8)),
       IntptrPtrTy);
   GlobalVariable *StackDescriptionGlobal =
       createPrivateGlobalForString(*F.getParent(), DescriptionString,
                                    /*AllowMerging*/ true, kAsanGenPrefix);
   Value *Description = IRB.CreatePointerCast(StackDescriptionGlobal, IntptrTy);
   IRB.CreateStore(Description, BasePlus1);
   // Write the PC to redzone[2].
   Value *BasePlus2 = IRB.CreateIntToPtr(
       IRB.CreateAdd(LocalStackBase,

llvm/test/Instrumentation/AddressSanitizer/fake-stack.ll

 ; NOTE: Assertions have been autogenerated by utils/update_test_checks.py
 ; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=0 -S | FileCheck %s --check-prefixes=CHECK,NEVER
 ; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=1 -S | FileCheck %s --check-prefixes=CHECK,RUNTIME
-; FIXME: Replace 1->2 in D102462.
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=1 -S | FileCheck %s --check-prefixes=CHECK,ALWAYS
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=2 -S | FileCheck %s --check-prefixes=CHECK,ALWAYS
 target datalayout = "e-i64:64-f80:128-s:64-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 declare void @Foo(i8*)
 
 define void @Empty() uwtable sanitize_address {
 ; CHECK-LABEL: @Empty(
 ; CHECK-NEXT:  entry:

 ; RUNTIME-NEXT:    store i64 0, i64* [[TMP32]], align 1
 ; RUNTIME-NEXT:    br label [[TMP33]]
 ; RUNTIME:       33:
 ; RUNTIME-NEXT:    ret void
 ;
 ; ALWAYS-LABEL: @Simple(
 ; ALWAYS-NEXT:  entry:
 ; ALWAYS-NEXT:    [[ASAN_LOCAL_STACK_BASE:%.*]] = alloca i64, align 8
-; ALWAYS-NEXT:    [[TMP0:%.*]] = load i32, i32* @__asan_option_detect_stack_use_after_return, align 4
-; ALWAYS-NEXT:    [[TMP1:%.*]] = icmp ne i32 [[TMP0]], 0
+; ALWAYS-NEXT:    [[TMP0:%.*]] = call i64 @__asan_stack_malloc_0(i64 64)
+; ALWAYS-NEXT:    [[TMP1:%.*]] = icmp eq i64 [[TMP0]], 0
 ; ALWAYS-NEXT:    br i1 [[TMP1]], label [[TMP2:%.*]], label [[TMP4:%.*]]
 ; ALWAYS:       2:
-; ALWAYS-NEXT:    [[TMP3:%.*]] = call i64 @__asan_stack_malloc_0(i64 64)
+; ALWAYS-NEXT:    [[MYALLOCA:%.*]] = alloca i8, i64 64, align 32
+; ALWAYS-NEXT:    [[TMP3:%.*]] = ptrtoint i8* [[MYALLOCA]] to i64
 ; ALWAYS-NEXT:    br label [[TMP4]]
 ; ALWAYS:       4:
-; ALWAYS-NEXT:    [[TMP5:%.*]] = phi i64 [ 0, [[ENTRY:%.*]] ], [ [[TMP3]], [[TMP2]] ]
-; ALWAYS-NEXT:    [[TMP6:%.*]] = icmp eq i64 [[TMP5]], 0
-; ALWAYS-NEXT:    br i1 [[TMP6]], label [[TMP7:%.*]], label [[TMP9:%.*]]
-; ALWAYS:       7:
-; ALWAYS-NEXT:    [[MYALLOCA:%.*]] = alloca i8, i64 64, align 32
-; ALWAYS-NEXT:    [[TMP8:%.*]] = ptrtoint i8* [[MYALLOCA]] to i64
-; ALWAYS-NEXT:    br label [[TMP9]]
-; ALWAYS:       9:
-; ALWAYS-NEXT:    [[TMP10:%.*]] = phi i64 [ [[TMP5]], [[TMP4]] ], [ [[TMP8]], [[TMP7]] ]
-; ALWAYS-NEXT:    store i64 [[TMP10]], i64* [[ASAN_LOCAL_STACK_BASE]], align 8
-; ALWAYS-NEXT:    [[TMP11:%.*]] = add i64 [[TMP10]], 32
-; ALWAYS-NEXT:    [[TMP12:%.*]] = inttoptr i64 [[TMP11]] to i8*
-; ALWAYS-NEXT:    [[TMP13:%.*]] = inttoptr i64 [[TMP10]] to i64*
-; ALWAYS-NEXT:    store i64 1102416563, i64* [[TMP13]], align 8
-; ALWAYS-NEXT:    [[TMP14:%.*]] = add i64 [[TMP10]], 8
-; ALWAYS-NEXT:    [[TMP15:%.*]] = inttoptr i64 [[TMP14]] to i64*
-; ALWAYS-NEXT:    store i64 ptrtoint ([11 x i8]* @___asan_gen_ to i64), i64* [[TMP15]], align 8
-; ALWAYS-NEXT:    [[TMP16:%.*]] = add i64 [[TMP10]], 16
-; ALWAYS-NEXT:    [[TMP17:%.*]] = inttoptr i64 [[TMP16]] to i64*
-; ALWAYS-NEXT:    store i64 ptrtoint (void ()* @Simple to i64), i64* [[TMP17]], align 8
-; ALWAYS-NEXT:    [[TMP18:%.*]] = lshr i64 [[TMP10]], 3
-; ALWAYS-NEXT:    [[TMP19:%.*]] = add i64 [[TMP18]], 2147450880
-; ALWAYS-NEXT:    [[TMP20:%.*]] = add i64 [[TMP19]], 0
-; ALWAYS-NEXT:    [[TMP21:%.*]] = inttoptr i64 [[TMP20]] to i64*
-; ALWAYS-NEXT:    store i64 -868083113472691727, i64* [[TMP21]], align 1
-; ALWAYS-NEXT:    call void @Foo(i8* [[TMP12]])
-; ALWAYS-NEXT:    store i64 1172321806, i64* [[TMP13]], align 8
-; ALWAYS-NEXT:    [[TMP22:%.*]] = icmp ne i64 [[TMP5]], 0
-; ALWAYS-NEXT:    br i1 [[TMP22]], label [[TMP23:%.*]], label [[TMP30:%.*]]
-; ALWAYS:       23:
-; ALWAYS-NEXT:    [[TMP24:%.*]] = add i64 [[TMP19]], 0
-; ALWAYS-NEXT:    [[TMP25:%.*]] = inttoptr i64 [[TMP24]] to i64*
-; ALWAYS-NEXT:    store i64 -723401728380766731, i64* [[TMP25]], align 1
-; ALWAYS-NEXT:    [[TMP26:%.*]] = add i64 [[TMP5]], 56
+; ALWAYS-NEXT:    [[TMP5:%.*]] = phi i64 [ [[TMP0]], [[ENTRY:%.*]] ], [ [[TMP3]], [[TMP2]] ]
+; ALWAYS-NEXT:    store i64 [[TMP5]], i64* [[ASAN_LOCAL_STACK_BASE]], align 8
+; ALWAYS-NEXT:    [[TMP6:%.*]] = add i64 [[TMP5]], 32
+; ALWAYS-NEXT:    [[TMP7:%.*]] = inttoptr i64 [[TMP6]] to i8*
+; ALWAYS-NEXT:    [[TMP8:%.*]] = inttoptr i64 [[TMP5]] to i64*
+; ALWAYS-NEXT:    store i64 1102416563, i64* [[TMP8]], align 8
+; ALWAYS-NEXT:    [[TMP9:%.*]] = add i64 [[TMP5]], 8
+; ALWAYS-NEXT:    [[TMP10:%.*]] = inttoptr i64 [[TMP9]] to i64*
+; ALWAYS-NEXT:    store i64 ptrtoint ([11 x i8]* @___asan_gen_ to i64), i64* [[TMP10]], align 8
+; ALWAYS-NEXT:    [[TMP11:%.*]] = add i64 [[TMP5]], 16
+; ALWAYS-NEXT:    [[TMP12:%.*]] = inttoptr i64 [[TMP11]] to i64*
+; ALWAYS-NEXT:    store i64 ptrtoint (void ()* @Simple to i64), i64* [[TMP12]], align 8
+; ALWAYS-NEXT:    [[TMP13:%.*]] = lshr i64 [[TMP5]], 3
+; ALWAYS-NEXT:    [[TMP14:%.*]] = add i64 [[TMP13]], 2147450880
+; ALWAYS-NEXT:    [[TMP15:%.*]] = add i64 [[TMP14]], 0
+; ALWAYS-NEXT:    [[TMP16:%.*]] = inttoptr i64 [[TMP15]] to i64*
+; ALWAYS-NEXT:    store i64 -868083113472691727, i64* [[TMP16]], align 1
+; ALWAYS-NEXT:    call void @Foo(i8* [[TMP7]])
+; ALWAYS-NEXT:    store i64 1172321806, i64* [[TMP8]], align 8
+; ALWAYS-NEXT:    [[TMP17:%.*]] = icmp ne i64 [[TMP0]], 0
+; ALWAYS-NEXT:    br i1 [[TMP17]], label [[TMP18:%.*]], label [[TMP25:%.*]]
+; ALWAYS:       18:
+; ALWAYS-NEXT:    [[TMP19:%.*]] = add i64 [[TMP14]], 0
+; ALWAYS-NEXT:    [[TMP20:%.*]] = inttoptr i64 [[TMP19]] to i64*
+; ALWAYS-NEXT:    store i64 -723401728380766731, i64* [[TMP20]], align 1
+; ALWAYS-NEXT:    [[TMP21:%.*]] = add i64 [[TMP0]], 56
+; ALWAYS-NEXT:    [[TMP22:%.*]] = inttoptr i64 [[TMP21]] to i64*
+; ALWAYS-NEXT:    [[TMP23:%.*]] = load i64, i64* [[TMP22]], align 8
+; ALWAYS-NEXT:    [[TMP24:%.*]] = inttoptr i64 [[TMP23]] to i8*
+; ALWAYS-NEXT:    store i8 0, i8* [[TMP24]], align 1
+; ALWAYS-NEXT:    br label [[TMP28:%.*]]
+; ALWAYS:       25:
+; ALWAYS-NEXT:    [[TMP26:%.*]] = add i64 [[TMP14]], 0
 ; ALWAYS-NEXT:    [[TMP27:%.*]] = inttoptr i64 [[TMP26]] to i64*
-; ALWAYS-NEXT:    [[TMP28:%.*]] = load i64, i64* [[TMP27]], align 8
-; ALWAYS-NEXT:    [[TMP29:%.*]] = inttoptr i64 [[TMP28]] to i8*
-; ALWAYS-NEXT:    store i8 0, i8* [[TMP29]], align 1
-; ALWAYS-NEXT:    br label [[TMP33:%.*]]
-; ALWAYS:       30:
-; ALWAYS-NEXT:    [[TMP31:%.*]] = add i64 [[TMP19]], 0
-; ALWAYS-NEXT:    [[TMP32:%.*]] = inttoptr i64 [[TMP31]] to i64*
-; ALWAYS-NEXT:    store i64 0, i64* [[TMP32]], align 1
-; ALWAYS-NEXT:    br label [[TMP33]]
-; ALWAYS:       33:
+; ALWAYS-NEXT:    store i64 0, i64* [[TMP27]], align 1
+; ALWAYS-NEXT:    br label [[TMP28]]
+; ALWAYS:       28:
 ; ALWAYS-NEXT:    ret void
 ;
 entry:
   %x = alloca i8, align 16
   call void @Foo(i8* %x)
   ret void
 }
 

llvm/test/Instrumentation/AddressSanitizer/lifetime-uar-uas.ll

 ; Test handling of llvm.lifetime intrinsics in UAR/UAS modes.
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=0 -asan-use-after-scope=0 -S | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=0 -asan-use-after-scope=0 -S | FileCheck %s
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=1 -asan-use-after-scope=0 -S | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=1 -asan-use-after-scope=0 -S | FileCheck %s
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=0 -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=0 -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=1 -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=1 -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
 
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
 
 declare void @llvm.lifetime.start.p0i8(i64, i8* nocapture) nounwind
 declare void @llvm.lifetime.end.p0i8(i64, i8* nocapture) nounwind
 
 define i32 @basic_test() sanitize_address {
   ; CHECK-LABEL: define i32 @basic_test()

llvm/test/Instrumentation/AddressSanitizer/localescape.ll

-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return -asan-stack-dynamic-alloca -S | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return -asan-stack-dynamic-alloca -S | FileCheck %s
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=0 -asan-stack-dynamic-alloca=0 -S | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=0 -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -asan-stack-dynamic-alloca=0 -S | FileCheck %s
 
 target datalayout = "e-m:x-p:32:32-i64:64-f80:32-n8:16:32-a:0:32-S32"
 target triple = "i686-pc-windows-msvc18.0.0"
 
 declare i32 @llvm.eh.typeid.for(i8*) #2
 declare i8* @llvm.frameaddress(i32)
 declare i8* @llvm.eh.recoverfp(i8*, i8*)
 declare i8* @llvm.localrecover(i8*, i8*, i32)

llvm/test/Instrumentation/AddressSanitizer/stack-poisoning.ll

-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return -S | FileCheck --check-prefix=CHECK-UAR %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return -S | FileCheck --check-prefix=CHECK-UAR %s
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=0 -S | FileCheck --check-prefix=CHECK-PLAIN %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=0 -S | FileCheck --check-prefix=CHECK-PLAIN %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -S | FileCheck --check-prefix=CHECK-PLAIN %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -S | FileCheck --check-prefix=CHECK-PLAIN %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -S | FileCheck --check-prefixes=CHECK-UAR,CHECK-UAR-RUNTIME %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -S | FileCheck --check-prefixes=CHECK-UAR,CHECK-UAR-RUNTIME %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -S \
+; RUN:        | FileCheck --check-prefixes=CHECK-UAR --implicit-check-not=__asan_option_detect_stack_use_after_return %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -S | FileCheck --check-prefix=CHECK-UAR %s
 target datalayout = "e-i64:64-f80:128-s:64-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 declare void @Foo(i8*)
 
 define void @Bar() uwtable sanitize_address {
 entry:
 ; CHECK-PLAIN-LABEL: Bar
 ; CHECK-PLAIN-NOT: label
 ; CHECK-PLAIN: ret void
 
 ; CHECK-UAR-LABEL: Bar
-; CHECK-UAR: load i32, i32* @__asan_option_detect_stack_use_after_return
-; CHECK-UAR: label
+; CHECK-UAR-RUNTIME: load i32, i32* @__asan_option_detect_stack_use_after_return
+; CHECK-UAR-RUNTIME: label
 ; CHECK-UAR: call i64 @__asan_stack_malloc_4
-; CHECK-UAR: label
+; CHECK-UAR-RUNTIME: label
 ; Poison red zones.
 ; CHECK-UAR: store i64 -1007680412564983311
 ; CHECK-UAR: store i64 72057598113936114
 ; CHECK-UAR: store i32 -218959118
 ; CHECK-UAR: store i64 -868082074056920316
 ; CHECK-UAR: store i16 -3085
 ; CHECK-UAR: call void @Foo
 ; CHECK-UAR: call void @Foo

llvm/test/Instrumentation/AddressSanitizer/stack_dynamic_alloca.ll

 ; RUN: opt < %s -asan -asan-module -asan-stack-dynamic-alloca \
-; RUN:       -asan-use-after-return -S -enable-new-pm=0 | FileCheck %s
+; RUN:       -asan-use-after-return=runtime -S -enable-new-pm=0 | FileCheck %s \
+; RUN:       --check-prefixes=CHECK,CHECK-RUNTIME
 ; RUN: opt < %s -passes='asan-pipeline' -asan-stack-dynamic-alloca \
-; RUN:       -asan-use-after-return -S | FileCheck %s
+; RUN:       -asan-use-after-return=runtime -S | FileCheck %s \
+; RUN:       --check-prefixes=CHECK,CHECK-RUNTIME
 ; RUN: opt < %s -asan -asan-module -asan-stack-dynamic-alloca -asan-mapping-scale=5 \
-; RUN:       -asan-use-after-return -S -enable-new-pm=0 | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-stack-dynamic-alloca -asan-mapping-scale=5 \
-; RUN:       -asan-use-after-return -S | FileCheck %s
+; RUN:       -asan-use-after-return=runtime -S -enable-new-pm=0 | FileCheck %s \
+; RUN:       --check-prefixes=CHECK,CHECK-RUNTIME
+; RUN: opt < %s -asan -asan-module -asan-stack-dynamic-alloca \
+; RUN:       -asan-use-after-return=always -S -enable-new-pm=0 | FileCheck %s \
+; RUN:       --check-prefixes=CHECK,CHECK-ALWAYS \
+; RUN:       --implicit-check-not=__asan_option_detect_stack_use_after_return
+; RUN: opt < %s -passes='asan-pipeline' -asan-stack-dynamic-alloca \
+; RUN:       -asan-use-after-return=always -S | FileCheck %s \
+; RUN:       --check-prefixes=CHECK,CHECK-ALWAYS \
+; RUN:       --implicit-check-not=__asan_option_detect_stack_use_after_return
+; RUN: opt < %s -asan -asan-module -asan-stack-dynamic-alloca -asan-mapping-scale=5 \
+; RUN:       -asan-use-after-return=always -S -enable-new-pm=0 | FileCheck %s \
+; RUN:       --check-prefixes=CHECK,CHECK-ALWAYS \
+; RUN:       --implicit-check-not=__asan_option_detect_stack_use_after_return
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 define void @Func1() sanitize_address {
 entry:
 ; CHECK-LABEL: Func1
 
 ; CHECK: entry:
-; CHECK: load i32, i32* @__asan_option_detect_stack_use_after_return
+; CHECK-RUNTIME: load i32, i32* @__asan_option_detect_stack_use_after_return
+; COM: CHECK-NORUNTIME-NOT: load i32, i32* @__asan_option_detect_stack_use_after_return
 
-; CHECK: [[UAR_ENABLED_BB:^[0-9]+]]:
+; CHECK-RUNTIME: [[UAR_ENABLED_BB:^[0-9]+]]:
 ; CHECK: [[FAKE_STACK_RT:%[0-9]+]] = call i64 @__asan_stack_malloc_
 
-; CHECK: [[FAKE_STACK_BB:^[0-9]+]]:
-; CHECK: [[FAKE_STACK:%[0-9]+]] = phi i64 [ 0, %entry ], [ [[FAKE_STACK_RT]], %[[UAR_ENABLED_BB]] ]
-; CHECK: icmp eq i64 [[FAKE_STACK]], 0
+; CHECK-RUNTIME: [[FAKE_STACK_BB:^[0-9]+]]:
+; CHECK-RUNTIME: [[FAKE_STACK:%[0-9]+]] = phi i64 [ 0, %entry ], [ [[FAKE_STACK_RT]], %[[UAR_ENABLED_BB]] ]
+; CHECK-RUNTIME: icmp eq i64 [[FAKE_STACK]], 0
+; CHECK-ALWAYS: icmp eq i64 [[FAKE_STACK_RT]], 0
 
 ; CHECK: [[NO_FAKE_STACK_BB:^[0-9]+]]:
 ; CHECK: %MyAlloca = alloca i8, i64
 ; CHECK: [[ALLOCA:%[0-9]+]] = ptrtoint i8* %MyAlloca
 
-; CHECK: phi i64 [ [[FAKE_STACK]], %[[FAKE_STACK_BB]] ], [ [[ALLOCA]], %[[NO_FAKE_STACK_BB]] ]
+; CHECK-RUNTIME: phi i64 [ [[FAKE_STACK]], %[[FAKE_STACK_BB]] ], [ [[ALLOCA]], %[[NO_FAKE_STACK_BB]] ]
+; CHECK-ALWAYS: phi i64 [ [[FAKE_STACK_RT]], %entry ], [ [[ALLOCA]], %[[NO_FAKE_STACK_BB]] ]
 
 ; CHECK: ret void
 
   %XXX = alloca [20 x i8], align 1
   %arr.ptr = bitcast [20 x i8]* %XXX to i8*
   store volatile i8 0, i8* %arr.ptr
   ret void
 }