basic code generation for use-after-dtor

[nmusgrave]

• changed arg types for generated dtor handler

[eugenis]

Please add a CodeGen test.

lib/CodeGen/CGClass.cpp

1471

I think remove "_exit" from the name - it can be confused with the program exit.

[kcc]

lib/CodeGen/CGClass.cpp

1456

why not just array with a {} initializer?

[nmusgrave]

• passing in array instead of vector, simple codegen tests started

[eugenis]

The test should be in CodeGenCXX, and probably called "sanitize-dtor-callback.cpp".

test/CodeGen/sanitize-dtor-usage.cpp

7

You probably don't need a lot of this code, like main() function, or A() constructor.

11

remove the comments.

20

Add a CHECK-LABEL: test for the function name to make sure the call is in the destructor.

You'll probably need -triple=x86_64-pc-linux in the run line so that destructor name mangling is consistent.

22

This does not do anything because of --check-prefix=DTOR (CHECK is the default prefix that is disabled if you set some other prefix). Add --check-prefix=CHECK.

Test that the function call is not added when building without -fsanitize-memory-use-after-dtor.

[rnk]

lib/CodeGen/CGClass.cpp

1456

Would you mind factoring this out to a helper function? Most readers of clang irgen probably aren't interested in this instrumentation.

[nmusgrave]

• refactored test for modularity, better flags

[eugenis]

lib/CodeGen/CGClass.cpp

1452

memory-poisoning

test/CodeGenCXX/sanitize-dtor-callback.cpp

10 ↗

(On Diff #29615)

Does it work without main?

15 ↗

(On Diff #29615)

A nit: it's common to write just CHECK-LABEL: _ZN6SimpleD2Ev

19 ↗

(On Diff #29615)

Please add a -LABEL check

[nmusgrave]

• refactor label name

[samsonov]

lib/CodeGen/CGClass.cpp

1459

Remove the size of the array here. For instance, if you reduce the number of elements, the code would still compile, but the array would have trailing nullptrs.

[nmusgrave]

• helper function for dtor codegen

[nmusgrave]

• simplified tests, formatting

[eugenis]

LGTM

[eugenis]

Committed as r242097.

lib/CodeGen/CGClass.cpp

void CodeGenFunction::EmitDestructorBody(FunctionArgList &Args) {
   }
 
   // Jump out through the epilogue cleanups.
   DtorEpilogue.ForceCleanup();
 
   // Exit the try if applicable.
   if (isTryBody)
     ExitCXXTryStmt(*cast<CXXTryStmt>(Body), true);
+
+  // Insert memory-posioning instrumentation.
+  // Generates function call for handling object poisoning, passing in
+  // references to 'this' and its size as arguments.
+  if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor) {
+    const ASTRecordLayout &Layout =
+        getContext().getASTRecordLayout(Dtor->getParent());
+
+    llvm::Value *Args[2] = {
+      Builder.CreateBitCast(LoadCXXThis(), VoidPtrTy),
+      llvm::ConstantInt::get(CGM.SizeTy, Layout.getSize().getQuantity())
+    };
+    llvm::Type *ArgTypes[2] = {
+      VoidPtrTy,
+      SizeTy
+    };
+
+    llvm::FunctionType *FnType =
+        llvm::FunctionType::get(CGM.VoidTy, ArgTypes, false);
+    llvm::Value *Fn =
+        CGM.CreateRuntimeFunction(FnType, "__sanitizer_dtor_callback");
+    EmitNounwindRuntimeCall(Fn, Args);
+  }
 }
 
 void CodeGenFunction::emitImplicitAssignmentOperatorBody(FunctionArgList &Args) {
   const CXXMethodDecl *AssignOp = cast<CXXMethodDecl>(CurGD.getDecl());
   const Stmt *RootS = AssignOp->getBody();
   assert(isa<CompoundStmt>(RootS) &&
          "Body of an implicit assignment operator should be compound stmt.");
   const CompoundStmt *RootCS = cast<CompoundStmt>(RootS);

test/CodeGen/sanitize-dtor-usage.cpp

+// Test -fsanitize-memory-use-after-dtor
+// RUN: %clang_cc1 -fsanitize=memory -fsanitize-memory-use-after-dtor -emit-llvm -o - %s | FileCheck %s --check-prefix=DTOR
+
+//#include <sanitizer/msan_interface.h>
+struct A {
+  int x_;
+  A() {
+    x_ = 5;
+  }
+  ~A() {
+    // __msan_poison(this, sizeof(*this));
+  }
+};
+int main() {
+  A a;
+  a.~A();
+  //__msan_check_mem_is_initialized(&a.x_, sizeof(a.x_));
+}
+
+// Check that MSan destructor sanitization poisons simple internal attribute
+// DTOR: call void @__sanitizer_dtor_callback
+// CHECK: ret void