[randstruct] Randomize all elements of a record

[void]

Summary

A record may have more than just FieldDecls in it. If so, then we're
likely to drop them if we only randomize the FieldDecls.

We need to be careful about anonymous structs/unions. Their fields are
made available in the RecordDecl as IndirectFieldDecls, which are listed
after the anonymous struct/union. The ordering doesn't appear to be
super important, however we place them unrandomized at the end of the
RecordDecl just in case. There's also the possiblity of
StaticAssertDecls. We also want those at the end.

All other non-FieldDecls we place at the top, just in case we get
something like:

struct foo {
  enum e { BORK };
  enum e a;
};

Link: https://github.com/KSPP/linux/issues/185

[aaron.ballman]

I think you'll need a more targeted approach than assuming the only kinds of declarations in a struct are field-like in C.

It seems that the issue you've got is with anonymous objects in a structure where the inner fields are available for lookup in the outer structure. One question I have is: what's the expectation for the user? There's two ways to look at this. 1) The anonymous object is a single field; that its members can be found in the outer object is not relevant. 2) The fields of the anonymous object should also be randomized. The same is true for any inner structure, not just anonymous ones.

I had assumed that any structure not marked for randomization would not be randomized. Based on that, I don't think inner structure objects (anonymous or otherwise) should automatically randomize their fields. WDYT?

clang/lib/Sema/SemaDecl.cpp

18063–18064

This (and everything else about fields) is now misnamed.

clang/lib/Sema/SemaInit.cpp

2126–2128

This is now misnamed.

2191

This is no longer testing the correct thing. e.g.,

struct S {
  int f;
  _Static_assert(sizeof(int) == 4, "oh no!");
};

This has two decls but only one field:

TranslationUnitDecl
`-RecordDecl <line:1:1, line:4:1> line:1:8 struct S definition
  |-FieldDecl <line:2:3, col:7> col:7 f 'int'
  `-StaticAssertDecl <line:3:3, col:44> col:3
    |-ImplicitCastExpr <col:18, col:33> '_Bool' <IntegralToBoolean>
    | `-BinaryOperator <col:18, col:33> 'int' '=='
    |   |-UnaryExprOrTypeTraitExpr <col:18, col:28> 'unsigned long' sizeof 'int'
    |   `-ImplicitCastExpr <col:33> 'unsigned long' <IntegralCast>
    |     `-IntegerLiteral <col:33> 'int' 4
    `-StringLiteral <col:36> 'char[7]' lvalue "oh no!"

Note, when you randomize that structure, we drop the _Static_assert declaration, so there is definitely a bug to be fixed here: https://godbolt.org/z/n9YE63rno

[kees]

In D123958#3459205, @aaron.ballman wrote:

I had assumed that any structure not marked for randomization would not be randomized. Based on that, I don't think inner structure objects (anonymous or otherwise) should automatically randomize their fields. WDYT?

Correct, inner structs should be evaluated without looking at the state of the outer randomization.

struct mixed {
    int a;
    float b;
} __attribute__((randomize_layout));

struct ordered {
    int foo;
    char bar[8];
};

struct composite {
    int one;
    struct mixed two;
    struct ordered three;
    struct {
        unsigned long am;
        double ordered;
    };
} __attribute__((randomize_layout));

• Each of the member's relative positions of struct composite should be randomized: one, two, three, anon struct.
• The members of two should be randomized.
• The members of three should not be randomized.
• The members of the anon struct should not be randomized.

[void]

In D123958#3459205, @aaron.ballman wrote:

I think you'll need a more targeted approach than assuming the only kinds of declarations in a struct are field-like in C.

It seems that the issue you've got is with anonymous objects in a structure where the inner fields are available for lookup in the outer structure. One question I have is: what's the expectation for the user? There's two ways to look at this. 1) The anonymous object is a single field; that its members can be found in the outer object is not relevant. 2) The fields of the anonymous object should also be randomized. The same is true for any inner structure, not just anonymous ones.

I had assumed that any structure not marked for randomization would not be randomized. Based on that, I don't think inner structure objects (anonymous or otherwise) should automatically randomize their fields. WDYT?

We don't randomize inner structures unless they have the randomize_layout flag. That's always been the case, and this patch doesn't change that.

The issue is that we were dropping the inner structures/unions because they aren't FieldDecls, but RecordDecls, with an IndirectFieldDecl if the inner structure is anonymous. The IndirectFieldDecl bits appear after the RecordDecl they're attached to, but doesn't seem like the ordering is important. The IndirectFieldDecl thing is there so that the anonymous fields are available in the outer structure.

[aaron.ballman]

In D123958#3461020, @void wrote:

In D123958#3459205, @aaron.ballman wrote:

I think you'll need a more targeted approach than assuming the only kinds of declarations in a struct are field-like in C.

It seems that the issue you've got is with anonymous objects in a structure where the inner fields are available for lookup in the outer structure. One question I have is: what's the expectation for the user? There's two ways to look at this. 1) The anonymous object is a single field; that its members can be found in the outer object is not relevant. 2) The fields of the anonymous object should also be randomized. The same is true for any inner structure, not just anonymous ones.

I had assumed that any structure not marked for randomization would not be randomized. Based on that, I don't think inner structure objects (anonymous or otherwise) should automatically randomize their fields. WDYT?

We don't randomize inner structures unless they have the randomize_layout flag. That's always been the case, and this patch doesn't change that.

That's good, I misunderstood originally, so thanks!

The issue is that we were dropping the inner structures/unions because they aren't FieldDecls, but RecordDecls, with an IndirectFieldDecl if the inner structure is anonymous. The IndirectFieldDecl bits appear after the RecordDecl they're attached to, but doesn't seem like the ordering is important. The IndirectFieldDecl thing is there so that the anonymous fields are available in the outer structure.

Agreed that we need to fix that behavior, but I think it's pretty fragile to assume every declaration in a struct can be reordered. I mentioned static assert decls above as one obvious example, but also consider things like:

struct S {
  enum E {
    One,
  };

  enum E whatever;
} __attribute__((randomize_layout));

We currently drop the enumeration declaration entirely (oops), but if we rearrange all declaration orders, then the declaration of whatever may suddenly look to come BEFORE we know what the type of enum E will be.

[void]

In D123958#3461714, @aaron.ballman wrote:

In D123958#3461020, @void wrote:

In D123958#3459205, @aaron.ballman wrote:

I think you'll need a more targeted approach than assuming the only kinds of declarations in a struct are field-like in C.

It seems that the issue you've got is with anonymous objects in a structure where the inner fields are available for lookup in the outer structure. One question I have is: what's the expectation for the user? There's two ways to look at this. 1) The anonymous object is a single field; that its members can be found in the outer object is not relevant. 2) The fields of the anonymous object should also be randomized. The same is true for any inner structure, not just anonymous ones.

I had assumed that any structure not marked for randomization would not be randomized. Based on that, I don't think inner structure objects (anonymous or otherwise) should automatically randomize their fields. WDYT?

We don't randomize inner structures unless they have the randomize_layout flag. That's always been the case, and this patch doesn't change that.

That's good, I misunderstood originally, so thanks!

The issue is that we were dropping the inner structures/unions because they aren't FieldDecls, but RecordDecls, with an IndirectFieldDecl if the inner structure is anonymous. The IndirectFieldDecl bits appear after the RecordDecl they're attached to, but doesn't seem like the ordering is important. The IndirectFieldDecl thing is there so that the anonymous fields are available in the outer structure.

Agreed that we need to fix that behavior, but I think it's pretty fragile to assume every declaration in a struct can be reordered. I mentioned static assert decls above as one obvious example, but also consider things like:

struct S {
  enum E {
    One,
  };

  enum E whatever;
} __attribute__((randomize_layout));

*sigh* Gotta love C.

We currently drop the enumeration declaration entirely (oops), but if we rearrange all declaration orders, then the declaration of whatever may suddenly look to come BEFORE we know what the type of enum E will be.

Maybe the best way we can handle these things is to reorder only FieldDecls and RecordDecls. All of the other Decl types will be smooshed towards the top of the RecordDecl. Again, I'm making an assumption that the ordering of the IndirectFieldDecls and others aren't going to be an issue once the parsing is finished. Alternatively, we could move things like the IndirectFieldDecls and StaticAsserts to the end of the RecordDecl (but before the flexible array decl).

If my assumption about the IndirectFieldDecls is wrong, and the ordering is important, then first, "Wha?! It's such a fragile model!!" Second, I'll have to come up with a way to encapsulate the inner RecordDecl and associated IndirectFieldDecls so that they can be moved around as a single unit.

[void]

Correctly handle all types of Decls that can be found in a RecordDecl.

[void]

Gentle ping.

[aaron.ballman]

Can you also add a test specifically for an enumeration declaration, as that was something we found bugs with?

clang/lib/AST/Randstruct.cpp

200

CA->isIncompleteArrayType() looks to be at the wrong spot. An incomplete array type is one of type IncompleteArrayType, which a ConstantArrayType is not. Are we missing test coverage, or does the hasFlexibleArrayMember() make it so that we just need to remove this check entirely?

clang/unittests/AST/RandstructTest.cpp

420

Can you add a test where the last field is char name[1]; and another one for char name[]; so that we have full coverage there?

[void]

Add a few more tests and remove a dead check.

clang/lib/AST/Randstruct.cpp

200

It looks like if it's an IncompleteArrayType, then it will be captured by hasFlexibleArrayMember. I think we can do without the check here. (It doesn't hurt, because it should always return false.)

clang/unittests/AST/RandstructTest.cpp

420

The name[] is above this test. The name[1] is due to a copy-paste error (oops). Fixed.

[void]

Fix test.

[aaron.ballman]

LGTM!

clang/unittests/AST/RandstructTest.cpp

420

Ah, good call on name[], I missed that one.

clang/include/clang/AST/Decl.h

public:
   void setParamDestroyedInCallee(bool V) {
     RecordDeclBits.ParamDestroyedInCallee = V;
   }
 
   bool isRandomized() const { return RecordDeclBits.IsRandomized; }
 
   void setIsRandomized(bool V) { RecordDeclBits.IsRandomized = V; }
 
-  void reorderFields(const SmallVectorImpl<Decl *> &Fields);
+  void reorderDecls(const SmallVectorImpl<Decl *> &Decls);
 
   /// Determines whether this declaration represents the
   /// injected class name.
   ///
   /// The injected class name in C++ is the name of the class that
   /// appears inside the class itself. For example:
   ///
   /// \code

clang/include/clang/AST/Randstruct.h

 // randomization.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_CLANG_AST_RANDSTRUCT_H
 #define LLVM_CLANG_AST_RANDSTRUCT_H
 
 namespace llvm {
-template <typename T> class ArrayRef;
 template <typename T> class SmallVectorImpl;
-class StringRef;
 } // end namespace llvm
 
 namespace clang {
 
 class ASTContext;
 class Decl;
 class RecordDecl;
 
 namespace randstruct {
 
-bool randomizeStructureLayout(const ASTContext &Context, llvm::StringRef Name,
-                              llvm::ArrayRef<Decl *> Fields,
+bool randomizeStructureLayout(const ASTContext &Context, RecordDecl *RD,
                               llvm::SmallVectorImpl<Decl *> &FinalOrdering);
 
 } // namespace randstruct
 } // namespace clang
 
 #endif // LLVM_CLANG_AST_RANDSTRUCT_H

clang/lib/AST/Decl.cpp

 
 /// isMsStruct - Get whether or not this record uses ms_struct layout.
 /// This which can be turned on with an attribute, pragma, or the
 /// -mms-bitfields command-line option.
 bool RecordDecl::isMsStruct(const ASTContext &C) const {
   return hasAttr<MSStructAttr>() || C.getLangOpts().MSBitfields == 1;
 }
 
-void RecordDecl::reorderFields(const SmallVectorImpl<Decl *> &Fields) {
-  std::tie(FirstDecl, LastDecl) = DeclContext::BuildDeclChain(Fields, false);
+void RecordDecl::reorderDecls(const SmallVectorImpl<Decl *> &Decls) {
+  std::tie(FirstDecl, LastDecl) = DeclContext::BuildDeclChain(Decls, false);
   LastDecl->NextInContextAndBits.setPointer(nullptr);
   setIsRandomized(true);
 }
 
 void RecordDecl::LoadFieldsFromExternalStorage() const {
   ExternalASTSource *Source = getASTContext().getExternalSource();
   assert(hasExternalLexicalStorage() && Source && "No external storage?");
 

clang/lib/AST/Randstruct.cpp

 // randomization.
 //
 //===----------------------------------------------------------------------===//
 
 #include "clang/AST/Randstruct.h"
 #include "clang/AST/ASTContext.h"
 #include "clang/AST/ASTDiagnostic.h"
 #include "clang/AST/Attr.h"
+#include "clang/AST/Decl.h"
+#include "clang/AST/DeclCXX.h" // For StaticAssertDecl
 #include "clang/Basic/Diagnostic.h"
 #include "llvm/ADT/SmallVector.h"
 
 #include <algorithm>
 #include <random>
 #include <set>
 #include <sstream>
 #include <string>
void randomizeStructureLayoutImpl(const ASTContext &Context,
   FieldsOut = FinalOrder;
 }
 
 } // anonymous namespace
 
 namespace clang {
 namespace randstruct {
 
-bool randomizeStructureLayout(const ASTContext &Context, StringRef Name,
-                              ArrayRef<Decl *> Fields,
+bool randomizeStructureLayout(const ASTContext &Context, RecordDecl *RD,
                               SmallVectorImpl<Decl *> &FinalOrdering) {
   SmallVector<FieldDecl *, 64> RandomizedFields;
+  SmallVector<Decl *, 8> PostRandomizedFields;
 
   unsigned TotalNumFields = 0;
-  for (Decl *D : Fields) {
+  for (Decl *D : RD->decls()) {
     ++TotalNumFields;
     if (auto *FD = dyn_cast<FieldDecl>(D))
       RandomizedFields.push_back(FD);
+    else if (isa<StaticAssertDecl>(D) || isa<IndirectFieldDecl>(D))
+      PostRandomizedFields.push_back(D);
     else
       FinalOrdering.push_back(D);
   }
 
   if (RandomizedFields.empty())
     return false;
 
-  // Struct might end with a variable-length array or an array of size 0 or 1,
+  // Struct might end with a flexible array or an array of size 0 or 1,
   // in which case we don't want to randomize it.
-  FieldDecl *VLA = nullptr;
-  const auto *CA =
-      dyn_cast<ConstantArrayType>(RandomizedFields.back()->getType());
-  if ((CA && (CA->getSize().sle(2) || CA->isIncompleteArrayType())) ||
-      llvm::any_of(Fields, [](Decl *D) {
-        if (const FieldDecl *FD = dyn_cast<FieldDecl>(D)) {
-          const Type *FDTy = FD->getType().getTypePtr();
-          if (const RecordType *FDTTy = FDTy->getAs<RecordType>())
-            return FDTTy->getDecl()->hasFlexibleArrayMember();
-        }
-        return false;
-      }))
-    VLA = RandomizedFields.pop_back_val();
+  FieldDecl *FlexibleArray =
+      RD->hasFlexibleArrayMember() ? RandomizedFields.pop_back_val() : nullptr;
+  if (!FlexibleArray) {
+    if (const auto *CA =
+            dyn_cast<ConstantArrayType>(RandomizedFields.back()->getType()))
+      if (CA->getSize().sle(2))
+        FlexibleArray = RandomizedFields.pop_back_val();
 
-  std::string Seed = (Context.getLangOpts().RandstructSeed + Name).str();
+  std::string Seed =
+      Context.getLangOpts().RandstructSeed + RD->getNameAsString();
   std::seed_seq SeedSeq(Seed.begin(), Seed.end());
   std::mt19937 RNG(SeedSeq);
 
   randomizeStructureLayoutImpl(Context, RandomizedFields, RNG);
-  if (VLA)
-    RandomizedFields.push_back(VLA);
 
+  // Plorp the randomized decls into the final ordering.
   FinalOrdering.insert(FinalOrdering.end(), RandomizedFields.begin(),
                        RandomizedFields.end());
 
+  // Add fields that belong towards the end of the RecordDecl.
+  FinalOrdering.insert(FinalOrdering.end(), PostRandomizedFields.begin(),
+                       PostRandomizedFields.end());
+
+  // Add back the flexible array.
+  if (FlexibleArray)
+    FinalOrdering.push_back(FlexibleArray);
+
   assert(TotalNumFields == FinalOrdering.size() &&
          "Decl count has been altered after Randstruct randomization!");
   (void)TotalNumFields;
   return true;
 }
 
 } // end namespace randstruct
 } // end namespace clang

clang/lib/Sema/SemaDecl.cpp

if (Record) {
     }
 
     if (!Completed)
       Record->completeDefinition();
 
     // Handle attributes before checking the layout.
     ProcessDeclAttributeList(S, Record, Attrs);
 
-    // Maybe randomize the field order.
+    // Maybe randomize the record's decls.
     if (!getLangOpts().CPlusPlus && Record->hasAttr<RandomizeLayoutAttr>() &&
         !Record->isUnion() && !getLangOpts().RandstructSeed.empty() &&
         !Record->isRandomized()) {
-      SmallVector<Decl *, 32> OrigFieldOrdering(Record->fields());
-      SmallVector<Decl *, 32> NewFieldOrdering;
-      if (randstruct::randomizeStructureLayout(
-              Context, Record->getNameAsString(), OrigFieldOrdering,
-              NewFieldOrdering))
-        Record->reorderFields(NewFieldOrdering);
+      SmallVector<Decl *, 32> NewDeclOrdering;
+      if (randstruct::randomizeStructureLayout(Context, Record,
+                                               NewDeclOrdering))
+        Record->reorderDecls(NewDeclOrdering);
     }
 
     // We may have deferred checking for a deleted destructor. Check now.
     if (CXXRecord) {
       auto *Dtor = CXXRecord->getDestructor();
       if (Dtor && Dtor->isImplicit() &&
           ShouldDeleteSpecialMember(Dtor, CXXDestructor)) {
         CXXRecord->setImplicitDestructorIsDeleted();

clang/lib/Sema/SemaInit.cpp

void InitListChecker::CheckStructUnionTypes(
   }
 
   // If structDecl is a forward declaration, this loop won't do
   // anything except look at designated initializers; That's okay,
   // because an error should get printed out elsewhere. It might be
   // worthwhile to skip over the rest of the initializer, though.
   RecordDecl *RD = DeclType->castAs<RecordType>()->getDecl();
   RecordDecl::field_iterator FieldEnd = RD->field_end();
-  size_t NumRecordFields = std::distance(RD->field_begin(), RD->field_end());
+  size_t NumRecordDecls = llvm::count_if(RD->decls(), [&](const Decl *D) {
+    return isa<FieldDecl>(D) || isa<RecordDecl>(D);
+  });
   bool CheckForMissingFields =
     !IList->isIdiomaticZeroInitializer(SemaRef.getLangOpts());
   bool HasDesignatedInit = false;
 
   while (Index < IList->getNumInits()) {
     Expr *Init = IList->getInit(Index);
     SourceLocation InitLoc = Init->getBeginLoc();
 
while (Index < IList->getNumInits()) {
     // These are okay for randomized structures. [C99 6.7.8p19]
     //
     // Also, if there is only one element in the structure, we allow something
     // like this, because it's really not randomized in the tranditional sense.
     //
     //   struct foo h = {bar};
     auto IsZeroInitializer = [&](const Expr *I) {
       if (IList->getNumInits() == 1) {
-        if (NumRecordFields == 1)
+        if (NumRecordDecls == 1)
           return true;
         if (const auto *IL = dyn_cast<IntegerLiteral>(I))
           return IL->getValue().isZero();
       }
       return false;
     };
 
     // Don't allow non-designated initializers on randomized structures.

clang/test/Sema/init-randomized-struct.c

 
 struct empty_test t10 = {}; // Okay
 
 struct degen_test {
   func_ptr a;
 } __attribute__((randomize_layout));
 
 struct degen_test t11 = { foo }; // Okay
+
+struct static_assert_test {
+  int f;
+  _Static_assert(sizeof(int) == 4, "oh no!");
+} __attribute__((randomize_layout));
+
+struct static_assert_test t12 = { 42 }; // Okay
+
+struct enum_decl_test {
+  enum e { BORK = 42, FORK = 9 } f;
+} __attribute__((randomize_layout));
+
+struct enum_decl_test t13 = { BORK }; // Okay

clang/unittests/AST/RandstructTest.cpp

makeAST(const std::string &SourceCode, bool ExpectError = false,
   }
 
   return AST;
 }
 
 namespace clang {
 namespace ast_matchers {
 
+long declCount(const RecordDecl *RD) {
+  return llvm::count_if(RD->decls(), [&](const Decl *D) {
+    return isa<FieldDecl>(D) || isa<RecordDecl>(D);
+  });
+}
+
 #define RANDSTRUCT_TEST_SUITE_TEST RecordLayoutRandomizationTestSuiteTest
 
 TEST(RANDSTRUCT_TEST_SUITE_TEST, CanDetermineIfSubsequenceExists) {
   const field_names Seq = {"a", "b", "c", "d"};
 
   EXPECT_TRUE(isSubsequence(Seq, {"b", "c"}));
   EXPECT_TRUE(isSubsequence(Seq, {"a", "b", "c", "d"}));
   EXPECT_TRUE(isSubsequence(Seq, {"b", "c", "d"}));
struct test {
         long long tomato;
         float mayonnaise;
     };
   )c");
 
   EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
 
   const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
 
   EXPECT_FALSE(RD->hasAttr<RandomizeLayoutAttr>());
   EXPECT_FALSE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
 }
 
 TEST(RANDSTRUCT_TEST, MarkedNoRandomize) {
   std::unique_ptr<ASTUnit> AST = makeAST(R"c(
     struct test {
         int bacon;
         long lettuce;
         long long tomato;
         float mayonnaise;
     } __attribute__((no_randomize_layout));
   )c");
 
   EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
 
   const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
 
   EXPECT_TRUE(RD->hasAttr<NoRandomizeLayoutAttr>());
   EXPECT_FALSE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
 }
 
 TEST(RANDSTRUCT_TEST, MarkedRandomize) {
   std::unique_ptr<ASTUnit> AST = makeAST(R"c(
     struct test {
         int bacon;
         long lettuce;
         long long tomato;
         float mayonnaise;
     } __attribute__((randomize_layout));
   )c");
 
   EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
 
   const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
 
   EXPECT_TRUE(RD->hasAttr<RandomizeLayoutAttr>());
   EXPECT_TRUE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
 }
 
 TEST(RANDSTRUCT_TEST, MismatchedAttrsDeclVsDef) {
   std::unique_ptr<ASTUnit> AST = makeAST(R"c(
     struct test __attribute__((randomize_layout));
     struct test {
         int bacon;
         long lettuce;
struct test {
         int z : 1;
         int c;
     } __attribute__((randomize_layout));
   )c");
 
   EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
 
   const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
+
   const field_names Actual = getFieldNamesFromRecord(RD);
   const field_names Subseq = {"x", "y", "z"};
 
   EXPECT_TRUE(RD->isRandomized());
   EXPECT_TRUE(isSubsequence(Actual, Subseq));
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
 }
 
-TEST(RANDSTRUCT_TEST, CheckVariableLengthArrayMemberRemainsAtEndOfStructure) {
+TEST(RANDSTRUCT_TEST, CheckFlexibleArrayMemberRemainsAtEndOfStructure1) {
   std::unique_ptr<ASTUnit> AST = makeAST(R"c(
     struct test {
         int a;
-        double b;
-        short c;
+        int b;
+        int c;
+        int d;
+        int e;
+        int f;
+        int g;
+        int h;
         char name[];
     } __attribute__((randomize_layout));
   )c");
 
   EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
 
   const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
 
+  EXPECT_TRUE(RD->hasFlexibleArrayMember());
   EXPECT_TRUE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
+  EXPECT_EQ(getFieldNamesFromRecord(RD).back(), "name");
+}
+
+TEST(RANDSTRUCT_TEST, CheckFlexibleArrayMemberRemainsAtEndOfStructure2) {
+  std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int a;
+        int b;
+        int c;
+        int d;
+        int e;
+        int f;
+        int g;
+        int h;
+        char name[0];
+    } __attribute__((randomize_layout));
+  )c");
+
+  EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
+
+  EXPECT_FALSE(RD->hasFlexibleArrayMember());
+  EXPECT_TRUE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
+  EXPECT_EQ(getFieldNamesFromRecord(RD).back(), "name");
+}
+
+TEST(RANDSTRUCT_TEST, CheckFlexibleArrayMemberRemainsAtEndOfStructure3) {
+  std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int a;
+        int b;
+        int c;
+        int d;
+        int e;
+        int f;
+        int g;
+        int h;
+        char name[1];
+    } __attribute__((randomize_layout));
+  )c");
+
+  EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
+
+  EXPECT_FALSE(RD->hasFlexibleArrayMember());
+  EXPECT_TRUE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
+  EXPECT_EQ(getFieldNamesFromRecord(RD).back(), "name");
 }
 
 TEST(RANDSTRUCT_TEST, RandstructDoesNotOverrideThePackedAttr) {
   std::unique_ptr<ASTUnit> AST =
       makeAST(R"c(
     struct test_struct {
         char a;
         float b[3];
TEST(RANDSTRUCT_TEST, RandstructDoesNotOverrideThePackedAttr) {
   // FIXME (?): calling getASTRecordLayout is probably a necessary evil so that
   // Clang's RecordBuilders can actually flesh out the information like
   // alignment, etc.
   {
     const RecordDecl *RD =
         getRecordDeclFromAST(AST->getASTContext(), "test_struct");
     const ASTRecordLayout *Layout =
         &AST->getASTContext().getASTRecordLayout(RD);
+    long OriginalDeclCount = declCount(RD);
 
     EXPECT_TRUE(RD->isRandomized());
     EXPECT_EQ(19, Layout->getSize().getQuantity());
+    EXPECT_EQ(OriginalDeclCount, declCount(RD));
   }
 
   {
     const RecordDecl *RD =
         getRecordDeclFromAST(AST->getASTContext(), "another_struct");
     const ASTRecordLayout *Layout =
         &AST->getASTContext().getASTRecordLayout(RD);
+    long OriginalDeclCount = declCount(RD);
 
     EXPECT_TRUE(RD->isRandomized());
     EXPECT_EQ(10, Layout->getSize().getQuantity());
+    EXPECT_EQ(OriginalDeclCount, declCount(RD));
   }
 
   {
     const RecordDecl *RD =
         getRecordDeclFromAST(AST->getASTContext(), "last_struct");
     const ASTRecordLayout *Layout =
         &AST->getASTContext().getASTRecordLayout(RD);
+    long OriginalDeclCount = declCount(RD);
 
     EXPECT_TRUE(RD->isRandomized());
     EXPECT_EQ(9, Layout->getSize().getQuantity());
+    EXPECT_EQ(OriginalDeclCount, declCount(RD));
   }
 }
 
 TEST(RANDSTRUCT_TEST, ZeroWidthBitfieldsSeparateAllocationUnits) {
   std::unique_ptr<ASTUnit> AST = makeAST(R"c(
     struct test {
         int a : 1;
         int   : 0;
         int b : 1;
     } __attribute__((randomize_layout));
   )c");
 
   EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
 
   const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
 
   EXPECT_TRUE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
 }
 
 TEST(RANDSTRUCT_TEST, RandstructDoesNotRandomizeUnionFieldOrder) {
   std::unique_ptr<ASTUnit> AST = makeAST(R"c(
     union test {
         int a;
         int b;
         int c;
         int d;
         int e;
         int f;
     } __attribute__((randomize_layout));
   )c");
 
   EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
 
-  const RecordDecl *RD =
-      getRecordDeclFromAST(AST->getASTContext(), "test");
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
 
   EXPECT_FALSE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
 }
 
 TEST(RANDSTRUCT_TEST, AnonymousStructsAndUnionsRetainFieldOrder) {
   std::unique_ptr<ASTUnit> AST = makeAST(R"c(
     struct test {
         int a;
         struct sub_struct {
             int b;
struct test {
         };
         int r;
     } __attribute__((randomize_layout));
   )c");
 
   EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
 
   const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
 
   EXPECT_TRUE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
 
   bool AnonStructTested = false;
   bool AnonUnionTested = false;
 
   for (const Decl *D : RD->decls())
     if (const FieldDecl *FD = dyn_cast<FieldDecl>(D)) {
       if (const auto *Record = FD->getType()->getAs<RecordType>()) {
         RD = Record->getDecl();
if (const FieldDecl *FD = dyn_cast<FieldDecl>(D)) {
         }
       }
     }
 
   EXPECT_TRUE(AnonStructTested);
   EXPECT_TRUE(AnonUnionTested);
 }
 
+TEST(RANDSTRUCT_TEST, AnonymousStructsAndUnionsReferenced) {
+  std::unique_ptr<ASTUnit> AST = makeAST(R"c(
+    struct test {
+        int bacon;
+        long lettuce;
+        struct { double avocado; char blech; };
+        long long tomato;
+        union { char toast[8]; unsigned toast_thing; };
+        float mayonnaise;
+    } __attribute__((randomize_layout));
+
+    int foo(struct test *t) {
+      return t->blech;
+    }
+
+    char *bar(struct test *t) {
+      return t->toast;
+    }
+  )c");
+
+  EXPECT_FALSE(AST->getDiagnostics().hasErrorOccurred());
+
+  const RecordDecl *RD = getRecordDeclFromAST(AST->getASTContext(), "test");
+  long OriginalDeclCount = declCount(RD);
+
+  EXPECT_TRUE(RD->isRandomized());
+  EXPECT_EQ(OriginalDeclCount, declCount(RD));
+}
+
 } // namespace ast_matchers
 } // namespace clang