basic code generation for use-after-dtor

[nmusgrave]

• changed arg types for generated dtor handler

[eugenis]

Please add a CodeGen test.

lib/CodeGen/CGClass.cpp

1494

I think remove "_exit" from the name - it can be confused with the program exit.

[kcc]

lib/CodeGen/CGClass.cpp

1479

why not just array with a {} initializer?

[nmusgrave]

• passing in array instead of vector, simple codegen tests started

[eugenis]

The test should be in CodeGenCXX, and probably called "sanitize-dtor-callback.cpp".

test/CodeGen/sanitize-dtor-usage.cpp

7 ↗

(On Diff #29595)

You probably don't need a lot of this code, like main() function, or A() constructor.

11 ↗

(On Diff #29595)

remove the comments.

20 ↗

(On Diff #29595)

Add a CHECK-LABEL: test for the function name to make sure the call is in the destructor.

You'll probably need -triple=x86_64-pc-linux in the run line so that destructor name mangling is consistent.

22 ↗

(On Diff #29595)

This does not do anything because of --check-prefix=DTOR (CHECK is the default prefix that is disabled if you set some other prefix). Add --check-prefix=CHECK.

Test that the function call is not added when building without -fsanitize-memory-use-after-dtor.

[rnk]

lib/CodeGen/CGClass.cpp

1479

Would you mind factoring this out to a helper function? Most readers of clang irgen probably aren't interested in this instrumentation.

[nmusgrave]

• refactored test for modularity, better flags

[eugenis]

lib/CodeGen/CGClass.cpp

1475

memory-poisoning

test/CodeGenCXX/sanitize-dtor-callback.cpp

11

Does it work without main?

16

A nit: it's common to write just CHECK-LABEL: _ZN6SimpleD2Ev

20

Please add a -LABEL check

[nmusgrave]

• refactor label name

[samsonov]

lib/CodeGen/CGClass.cpp

1482

Remove the size of the array here. For instance, if you reduce the number of elements, the code would still compile, but the array would have trailing nullptrs.

[nmusgrave]

• helper function for dtor codegen

[nmusgrave]

• simplified tests, formatting

[eugenis]

LGTM

[eugenis]

Committed as r242097.

lib/CodeGen/CGClass.cpp

static bool CanSkipVTablePointerInitialization(ASTContext &Context,
   const CXXRecordDecl *ClassDecl = Dtor->getParent();
   for (const auto *Field : ClassDecl->fields())
     if (!FieldHasTrivialDestructorBody(Context, Field))
       return false;
 
   return true;
 }
 
+// Generates function call for handling object poisoning, passing in
+// references to 'this' and its size as arguments.
+static void EmitDtorSanitizerCallback(CodeGenFunction &CGF,
+                                      const CXXDestructorDecl *Dtor) {
+  const ASTRecordLayout &Layout =
+      CGF.getContext().getASTRecordLayout(Dtor->getParent());
+
+  llvm::Value *Args[] = {
+    CGF.Builder.CreateBitCast(CGF.LoadCXXThis(), CGF.VoidPtrTy),
+    llvm::ConstantInt::get(CGF.SizeTy, Layout.getSize().getQuantity())
+  };
+  llvm::Type *ArgTypes[] = {
+    CGF.VoidPtrTy,
+    CGF.SizeTy
+  };
+
+  llvm::FunctionType *FnType =
+      llvm::FunctionType::get(CGF.VoidTy, ArgTypes, false);
+  llvm::Value *Fn =
+      CGF.CGM.CreateRuntimeFunction(FnType, "__sanitizer_dtor_callback");
+  CGF.EmitNounwindRuntimeCall(Fn, Args);
+}
+
 /// EmitDestructorBody - Emits the body of the current destructor.
 void CodeGenFunction::EmitDestructorBody(FunctionArgList &Args) {
   const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CurGD.getDecl());
   CXXDtorType DtorType = CurGD.getDtorType();
 
   Stmt *Body = Dtor->getBody();
   if (Body)
     incrementProfileCounter(Body);
void CodeGenFunction::EmitDestructorBody(FunctionArgList &Args) {
   }
 
   // Jump out through the epilogue cleanups.
   DtorEpilogue.ForceCleanup();
 
   // Exit the try if applicable.
   if (isTryBody)
     ExitCXXTryStmt(*cast<CXXTryStmt>(Body), true);
+
+  // Insert memory-poisoning instrumentation.
+  if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor)
+    EmitDtorSanitizerCallback(*this, Dtor);
 }
 
 void CodeGenFunction::emitImplicitAssignmentOperatorBody(FunctionArgList &Args) {
   const CXXMethodDecl *AssignOp = cast<CXXMethodDecl>(CurGD.getDecl());
   const Stmt *RootS = AssignOp->getBody();
   assert(isa<CompoundStmt>(RootS) &&
          "Body of an implicit assignment operator should be compound stmt.");
   const CompoundStmt *RootCS = cast<CompoundStmt>(RootS);
 
   LexicalScope Scope(*this, RootCS->getSourceRange());
 
   AssignmentMemcpyizer AM(*this, AssignOp, Args);
   for (auto *I : RootCS->body())
     AM.emitAssignment(I);
   AM.finish();
 }
 
 namespace {
   /// Call the operator delete associated with the current destructor.
   struct CallDtorDelete : EHScopeStack::Cleanup {
     CallDtorDelete() {}
 
     void Emit(CodeGenFunction &CGF, Flags flags) override {
       const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CGF.CurCodeDecl);
       const CXXRecordDecl *ClassDecl = Dtor->getParent();

test/CodeGenCXX/sanitize-dtor-callback.cpp

+// Test -fsanitize-memory-use-after-dtor
+// RUN: %clang_cc1 -fsanitize=memory -fsanitize-memory-use-after-dtor -triple=x86_64-pc-linux -emit-llvm -o - %s | FileCheck %s
+// RUN: %clang_cc1 -fsanitize=memory -triple=x86_64-pc-linux -emit-llvm -o - %s | FileCheck %s -check-prefix=NO_DTOR_CHECK
+
+struct Simple {
+  int x;
+  ~Simple() {}
+};
+
+int main() {
+  Simple s;
+  s.~Simple();
+}
+// Simple internal member is poisoned by compiler-generated dtor
+// CHECK-LABEL: @_ZN6SimpleD2Ev
+// CHECK: call void @__sanitizer_dtor_callback
+// CHECK: ret void
+
+// Compiling without the flag does not generate member-poisoning dtor
+// NO_DTOR_CHECK-LABEL: @_ZN6SimpleD2Ev
+// NO_DTOR_CHECK-NOT: call void @sanitizer_dtor_callback
+// NO_DTOR_CHECK: ret void