Disabling speculative loads under asan.

[aizatsky]

Summary

While instrumenting std::string with asan I discovered that speculative load might load data from poisoned region. Disabling all speculative loads for asan-annotated functions.

The test follows the std::string implementation.

Corresponding CL in llvm: http://reviews.llvm.org/D13264

[aizatsky]

• reverted make file change

[aizatsky]

• cleanup

[aizatsky]

rebase

[aizatsky]

ping. Lets get this high-level test in.

[kcc]

LGTM, please ask someone else to commit.
(assuming the test fails w/o your previous fix in llvm)

[krasin]

Submitted as http://reviews.llvm.org/D13905

test/CMakeLists.txt

if(NOT ANDROID)
   endif()
   if(UNIX)
     list(APPEND SANITIZER_COMMON_LIT_TEST_DEPS SanitizerLintCheck)
   endif()
 endif()
 
 # Run sanitizer tests only if we're sure that clang would produce
 # working binaries.
+MESSAGE( STATUS "********** ADDING TEST" )
 if(COMPILER_RT_CAN_EXECUTE_TESTS)
+MESSAGE( STATUS "********** COMPILER_RT_CAN_EXECUTE_TESTS, COMPILER_RT_HAS_ASAN=" ${COMPILER_RT_HAS_ASAN} )
   if(COMPILER_RT_HAS_ASAN)
     add_subdirectory(asan)
   endif()
   if(COMPILER_RT_HAS_DFSAN)
     add_subdirectory(dfsan)
   endif()
   if(COMPILER_RT_HAS_LSAN)
     add_subdirectory(lsan)

test/asan/TestCases/speculative_load.cc

+// Verifies that speculative loads from unions do not happen under asan.
+// RUN: %clangxx_asan -O0 %s -o %t && %run %t 2>&1
+// RUN: %clangxx_asan -O1 %s -o %t && %run %t 2>&1
+// RUN: %clangxx_asan -O2 %s -o %t && %run %t 2>&1
+// RUN: %clangxx_asan -O3 %s -o %t && %run %t 2>&1
+
+#include <sanitizer/asan_interface.h>
+
+struct S {
+  struct _long {
+      void* _pad;
+      const char* _ptr;
+  };
+
+  struct _short {
+    unsigned char _size;
+    char _ch[23];
+  };
+
+  union {
+    _short _s;
+    _long _l;
+  } _data;
+
+  S() {
+    _data._s._size = 0;
+    __asan_poison_memory_region(_data._s._ch, 23);
+  }
+
+  bool is_long() const {
+    return _data._s._size & 1;
+  }
+
+  const char* get_pointer() const {
+    return is_long() ? _data._l._ptr : _data._s._ch;
+  }
+};
+
+
+inline void side_effect(const void *arg) {
+  __asm__ __volatile__("" : : "r" (arg) : "memory");
+}
+
+int main(int argc, char **argv) {
+  S s;
+  side_effect(&s); // optimizer is too smart otherwise
+  const char *ptr = s.get_pointer();
+  side_effect(ptr); // force use ptr
+  return 0;
+}
+// CHECK: 0 bytes to the right