LLVM Detailed IR tests for introduction of flag -fsanitize-address-detect-stack-use-after-return-mode.

[kda]

Summary

Rework all tests that interact with use after return to correctly handle the case where the mode has been explicitly set to Never or Always.

for issue: https://github.com/google/sanitizers/issues/1394

[vitalybuka]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

260–277

we are going to have two conflicting flags.
Could you please just change this bool flag into Enum, probably without renaming?

static cl::opt<AsanDetectStackUseAfterReturnMode> ClUseAfterReturn("asan-use-after-return"...
0,1 should match current behavior

[kda]

Rework to update existing asan-use-after-return boolean to modal flag.

[kda]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

266–268

I added this one and the one below ('1') to avoid updating tests.
Should I just update the tests and remove these?

[vitalybuka]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

260–277

0,1 is fine
we can remove them later in a separate patch.

266–268

then maybe '2' as well?

271

it should be ASAN_OPTIONS=detect_stack_use_after_return=1

3322–3325

this comment applies to inside of the "then" branch only

Please insert corresponsing spseudo code for else branch:
void *FakeStack = __asan_stack_malloc_N(LocalStackSize);
void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize);

3344–3356

we porbably need entire thing in the else branch
AsanStackMallocFunc[StackMallocIdx] may return NULL in runtime
so we need NoFakeStack branch as well

This is future oportunity to improve: make compiler-rt never return NULL so we can remove CreateICmpEQ and one branch

3358

do you want to uncomment and keep it?

3366

FakeStack is LLVM object which represent result of the function call
(FakeStack) is never NULL, however in runtime it can contain NULL, so we need to compile IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy)); like above

llvm/test/Instrumentation/AddressSanitizer/stack-poisoning.ll

21

this statements checks that there is no this line in after previous check
more reliable is to add --implicit-check-not=asan_option_detect_stack_use_after_return into FileCheck arg to make sure it's not there at all

23

It would be nice to check for CreateICmpEQ
But probably D102867 is enough

llvm/test/Instrumentation/AddressSanitizer/stack_dynamic_alloca.ll

22

same

[kda]

fixes for correct code.

[kda]

removed commented out code.

[kda]

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

3358

No. I only meant it as a comment for clarity.

llvm/test/Instrumentation/AddressSanitizer/stack-poisoning.ll

23

ack.

[vitalybuka]

LGTM

llvm/include/llvm/Transforms/Instrumentation/AddressSanitizerOptions.h

 
 /// Types of ASan module destructors supported
 enum class AsanDtorKind {
   None,    ///< Do not emit any destructors for ASan
   Global,  ///< Append to llvm.global_dtors
   Invalid, ///< Not a valid destructor Kind.
   // TODO(dliew): Add more more kinds.
 };
+
+/// Mode of ASan detect stack use after return
+enum class AsanDetectStackUseAfterReturnMode {
+  Never,   ///< Never detect stack use after return.
+  Runtime, ///< Detect stack use after return if runtime flag is enabled
+           ///< (ASAN_OPTIONS=detect_stack_use_after_return=1)
+  Always,  ///< Always detect stack use after return.
+  Invalid, ///< Not a valid detect mode.
+};
+
 } // namespace llvm
+
 #endif

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/MathExtras.h"
 #include "llvm/Support/ScopedPrinter.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Instrumentation/AddressSanitizerCommon.h"
+#include "llvm/Transforms/Instrumentation/AddressSanitizerOptions.h"
 #include "llvm/Transforms/Utils/ASanStackFrameLayout.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
 #include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 #include "llvm/Transforms/Utils/PromoteMemToReg.h"
 #include <algorithm>
 #include <cassert>
 #include <cstddef>

 // This flag may need to be replaced with -f[no]asan-stack.
 static cl::opt<bool> ClStack("asan-stack", cl::desc("Handle stack memory"),
                              cl::Hidden, cl::init(true));
 static cl::opt<uint32_t> ClMaxInlinePoisoningSize(
     "asan-max-inline-poisoning-size",
     cl::desc(
         "Inline shadow poisoning for blocks up to the given size in bytes."),
     cl::Hidden, cl::init(64));
 
-static cl::opt<bool> ClUseAfterReturn("asan-use-after-return",
-                                      cl::desc("Check stack-use-after-return"),
-                                      cl::Hidden, cl::init(true));
+static cl::opt<AsanDetectStackUseAfterReturnMode> ClUseAfterReturn(
+    "asan-use-after-return",
+    cl::desc("Sets the mode of detection for stack-use-after-return."),
+    cl::values(clEnumValN(AsanDetectStackUseAfterReturnMode::Never, "never",
+                          "Never detect stack use after return."),
+               clEnumValN(AsanDetectStackUseAfterReturnMode::Never,
+                          "0", // only needed to keep unit tests passing
+                          "Redundant with 'never'."),
+               clEnumValN(AsanDetectStackUseAfterReturnMode::Runtime, "runtime",
+                          "Detect stack use after return if "
+                          "binary flag 'asan-use-after-return' is true."),
+               clEnumValN(AsanDetectStackUseAfterReturnMode::Runtime,
+                          "1", // only needed to keep unit tests passing
+                          "redundant with 'runtime'."),
+               clEnumValN(AsanDetectStackUseAfterReturnMode::Always, "always",
+                          "Always detect stack use after return.")),
+    cl::Hidden, cl::init(AsanDetectStackUseAfterReturnMode::Runtime));
 
 static cl::opt<bool> ClRedzoneByvalArgs("asan-redzone-byval-args",
                                         cl::desc("Create redzones for byval "
                                                  "arguments (extra copy "
                                                  "required)"), cl::Hidden,
                                         cl::init(true));
 
 static cl::opt<bool> ClUseAfterScope("asan-use-after-scope",
if (const DILocation *FnLoc = EntryDebugLocation.get()) {
             Desc.Line = std::min(Desc.Line ? Desc.Line : Line, Line);
       }
     }
   }
 
   auto DescriptionString = ComputeASanStackFrameDescription(SVD);
   LLVM_DEBUG(dbgs() << DescriptionString << " --- " << L.FrameSize << "\n");
   uint64_t LocalStackSize = L.FrameSize;
-  bool DoStackMalloc = ClUseAfterReturn && !ASan.CompileKernel &&
-                       LocalStackSize <= kMaxStackMallocSize;
+  bool DoStackMalloc =
+      ClUseAfterReturn != AsanDetectStackUseAfterReturnMode::Never &&
+      !ASan.CompileKernel && LocalStackSize <= kMaxStackMallocSize;
   bool DoDynamicAlloca = ClDynamicAllocaStack;
   // Don't do dynamic alloca or stack malloc if:
   // 1) There is inline asm: too often it makes assumptions on which registers
   //    are available.
   // 2) There is a returns_twice call (typically setjmp), which is
   //    optimization-hostile, and doesn't play well with introduced indirect
   //    register-relative calculation of local variable addresses.
   DoDynamicAlloca &= !HasInlineAsm && !HasReturnsTwiceCall;
   DoStackMalloc &= !HasInlineAsm && !HasReturnsTwiceCall;
 
   Value *StaticAlloca =
       DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false);
 
   Value *FakeStack;
   Value *LocalStackBase;
   Value *LocalStackBaseAlloca;
   uint8_t DIExprFlags = DIExpression::ApplyOffset;
 
   if (DoStackMalloc) {
     LocalStackBaseAlloca =
         IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base");
     // void *FakeStack = __asan_option_detect_stack_use_after_return
     //     ? __asan_stack_malloc_N(LocalStackSize)
     //     : nullptr;
     // void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize);
+    if (ClUseAfterReturn == AsanDetectStackUseAfterReturnMode::Runtime) {
       Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal(
           kAsanOptionDetectUseAfterReturn, IRB.getInt32Ty());
       Value *UseAfterReturnIsEnabled = IRB.CreateICmpNE(
           IRB.CreateLoad(IRB.getInt32Ty(), OptionDetectUseAfterReturn),
           Constant::getNullValue(IRB.getInt32Ty()));
       Instruction *Term =
           SplitBlockAndInsertIfThen(UseAfterReturnIsEnabled, InsBefore, false);
       IRBuilder<> IRBIf(Term);
       StackMallocIdx = StackMallocSizeClass(LocalStackSize);
       assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass);
       Value *FakeStackValue =
           IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx],
                            ConstantInt::get(IntptrTy, LocalStackSize));
       IRB.SetInsertPoint(InsBefore);
       FakeStack = createPHI(IRB, UseAfterReturnIsEnabled, FakeStackValue, Term,
                             ConstantInt::get(IntptrTy, 0));
 
       Value *NoFakeStack =
           IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy));
       Term = SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false);
       IRBIf.SetInsertPoint(Term);
-    Value *AllocaValue =
-        DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca;
+      Value *AllocaValue = DoDynamicAlloca
+                               ? createAllocaForLayout(IRBIf, L, true)
+                               : StaticAlloca;
 
       IRB.SetInsertPoint(InsBefore);
-    LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
+      LocalStackBase =
+          createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
       IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca);
       DIExprFlags |= DIExpression::DerefBefore;
     } else {
+      // assert(ClUseAfterReturn == AsanDetectStackUseAfterReturnMode:Always)
+      StackMallocIdx = StackMallocSizeClass(LocalStackSize);
+      FakeStack = IRB.CreateCall(AsanStackMallocFunc[StackMallocIdx],
+                                 ConstantInt::get(IntptrTy, LocalStackSize));
+      IRB.SetInsertPoint(InsBefore);
+
+      Value *AllocValue =
+          DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca;
+      LocalStackBase = (FakeStack) ? FakeStack : AllocValue;
+    }
+  } else {
     // void *FakeStack = nullptr;
     // void *LocalStackBase = alloca(LocalStackSize);
     FakeStack = ConstantInt::get(IntptrTy, 0);
     LocalStackBase =
         DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca;
     LocalStackBaseAlloca = LocalStackBase;
   }
 

llvm/test/Instrumentation/AddressSanitizer/lifetime-uar-uas.ll

 ; Test handling of llvm.lifetime intrinsics in UAR/UAS modes.
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=0 -asan-use-after-scope=0 -S | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=0 -asan-use-after-scope=0 -S | FileCheck %s
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=1 -asan-use-after-scope=0 -S | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=1 -asan-use-after-scope=0 -S | FileCheck %s
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=0 -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=0 -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=1 -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=1 -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -asan-use-after-scope=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -asan-use-after-scope=1 -S | FileCheck %s --check-prefix=CHECK-UAS
 
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
 
 declare void @llvm.lifetime.start.p0i8(i64, i8* nocapture) nounwind
 declare void @llvm.lifetime.end.p0i8(i64, i8* nocapture) nounwind
 
 define i32 @basic_test() sanitize_address {
   ; CHECK-LABEL: define i32 @basic_test()

llvm/test/Instrumentation/AddressSanitizer/localescape.ll

-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return -asan-stack-dynamic-alloca -S | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return -asan-stack-dynamic-alloca -S | FileCheck %s
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=0 -asan-stack-dynamic-alloca=0 -S | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=0 -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -asan-stack-dynamic-alloca -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -asan-stack-dynamic-alloca=0 -S | FileCheck %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -asan-stack-dynamic-alloca=0 -S | FileCheck %s
 
 target datalayout = "e-m:x-p:32:32-i64:64-f80:32-n8:16:32-a:0:32-S32"
 target triple = "i686-pc-windows-msvc18.0.0"
 
 declare i32 @llvm.eh.typeid.for(i8*) #2
 declare i8* @llvm.frameaddress(i32)
 declare i8* @llvm.eh.recoverfp(i8*, i8*)
 declare i8* @llvm.localrecover(i8*, i8*, i32)

llvm/test/Instrumentation/AddressSanitizer/stack-poisoning.ll

-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return -S | FileCheck --check-prefix=CHECK-UAR %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return -S | FileCheck --check-prefix=CHECK-UAR %s
-; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=0 -S | FileCheck --check-prefix=CHECK-PLAIN %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=0 -S | FileCheck --check-prefix=CHECK-PLAIN %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=never -S | FileCheck --check-prefix=CHECK-PLAIN %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=never -S | FileCheck --check-prefix=CHECK-PLAIN %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=runtime -S | FileCheck --check-prefixes=CHECK-UAR,CHECK-UAR-RUNTIME %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=runtime -S | FileCheck --check-prefixes=CHECK-UAR,CHECK-UAR-RUNTIME %s
+; RUN: opt < %s -asan -asan-module -enable-new-pm=0 -asan-use-after-return=always -S | FileCheck --check-prefixes=CHECK-UAR,CHECK-UAR-NORUNTIME %s
+; RUN: opt < %s -passes='asan-pipeline' -asan-use-after-return=always -S | FileCheck --check-prefix=CHECK-UAR %s
 target datalayout = "e-i64:64-f80:128-s:64-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 declare void @Foo(i8*)
 
 define void @Bar() uwtable sanitize_address {
 entry:
 ; CHECK-PLAIN-LABEL: Bar
 ; CHECK-PLAIN-NOT: label
 ; CHECK-PLAIN: ret void
 
 ; CHECK-UAR-LABEL: Bar
-; CHECK-UAR: load i32, i32* @__asan_option_detect_stack_use_after_return
-; CHECK-UAR: label
+; CHECK-UAR-RUNTIME: load i32, i32* @__asan_option_detect_stack_use_after_return
+; CHECK-UAR-RUNTIME: label
+; CHECK-UAR-NORUNTIME-NOT: load i32, i32* @__asan_option_detect_stack_use_after_return
+; CHECK-UAR-NORUNTIME-NOT: label
 ; CHECK-UAR: call i64 @__asan_stack_malloc_4
-; CHECK-UAR: label
+; CHECK-UAR-RUNTIME: label
 ; Poison red zones.
 ; CHECK-UAR: store i64 -1007680412564983311
 ; CHECK-UAR: store i64 72057598113936114
 ; CHECK-UAR: store i32 -218959118
 ; CHECK-UAR: store i64 -868082074056920316
 ; CHECK-UAR: store i16 -3085
 ; CHECK-UAR: call void @Foo
 ; CHECK-UAR: call void @Foo

llvm/test/Instrumentation/AddressSanitizer/stack_dynamic_alloca.ll

 ; RUN: opt < %s -asan -asan-module -asan-stack-dynamic-alloca \
-; RUN:       -asan-use-after-return -S -enable-new-pm=0 | FileCheck %s
+; RUN:       -asan-use-after-return=runtime -S -enable-new-pm=0 | FileCheck %s --check-prefixes=CHECK-RUNTIME
 ; RUN: opt < %s -passes='asan-pipeline' -asan-stack-dynamic-alloca \
-; RUN:       -asan-use-after-return -S | FileCheck %s
+; RUN:       -asan-use-after-return=runtime -S | FileCheck %s --check-prefixes=CHECK-RUNTIME
 ; RUN: opt < %s -asan -asan-module -asan-stack-dynamic-alloca -asan-mapping-scale=5 \
-; RUN:       -asan-use-after-return -S -enable-new-pm=0 | FileCheck %s
-; RUN: opt < %s -passes='asan-pipeline' -asan-stack-dynamic-alloca -asan-mapping-scale=5 \
-; RUN:       -asan-use-after-return -S | FileCheck %s
+; RUN:       -asan-use-after-return=runtime -S -enable-new-pm=0 | FileCheck %s --check-prefixes=CHECK-RUNTIME
+; RUN: opt < %s -asan -asan-module -asan-stack-dynamic-alloca \
+; RUN:       -asan-use-after-return=always -S -enable-new-pm=0 | FileCheck %s --check-prefixes=CHECK-NORUNTIME
+; RUN: opt < %s -passes='asan-pipeline' -asan-stack-dynamic-alloca \
+; RUN:       -asan-use-after-return=always -S | FileCheck %s --check-prefixes=CHECK-NORUNTIME
+; RUN: opt < %s -asan -asan-module -asan-stack-dynamic-alloca -asan-mapping-scale=5 \
+; RUN:       -asan-use-after-return=always -S -enable-new-pm=0 | FileCheck %s --check-prefixes=CHECK-NORUNTIME
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
 target triple = "x86_64-unknown-linux-gnu"
 
 define void @Func1() sanitize_address {
 entry:
 ; CHECK-LABEL: Func1
 
 ; CHECK: entry:
-; CHECK: load i32, i32* @__asan_option_detect_stack_use_after_return
+; CHECK-RUNTIME: load i32, i32* @__asan_option_detect_stack_use_after_return
+; CHECK-NORUNTIME-NOT: load i32, i32* @__asan_option_detect_stack_use_after_return
 
 ; CHECK: [[UAR_ENABLED_BB:^[0-9]+]]:
 ; CHECK: [[FAKE_STACK_RT:%[0-9]+]] = call i64 @__asan_stack_malloc_
 
 ; CHECK: [[FAKE_STACK_BB:^[0-9]+]]:
 ; CHECK: [[FAKE_STACK:%[0-9]+]] = phi i64 [ 0, %entry ], [ [[FAKE_STACK_RT]], %[[UAR_ENABLED_BB]] ]
 ; CHECK: icmp eq i64 [[FAKE_STACK]], 0