[clang] Implement -fstrict-flex-arrays=3

[void]

Summary

The -fstrict-flex-arrays=3 is the most restrictive type of flex arrays.
No number, including 0, is allowed in the FAM. In the cases where a "0"
is used, the resulting size is the same as if a zero-sized object were
substituted.

This is needed for proper _FORTIFY_SOURCE coverage in the Linux kernel,
among other reasons. So while the only reason for specifying a
zero-length array at the end of a structure is for specify a FAM,
treating it as such will cause _FORTIFY_SOURCE not to work correctly;
__builtin_object_size will report -1 instead of 0 for a destination buffer
size to keep any kernel internals from using the deprecated members as
fake FAMs.

For example:

struct broken {
    int foo;
    int fake_fam[0];
    struct something oops;
};

There have been bugs where the above struct was created because "oops" was
added after "fake_fam" by someone not realizing. Under __FORTIFY_SOURCE, doing:

memcpy(p->fake_fam, src, len);

raises no warnings when __builtin_object_size(p->fake_fam, 1) returns -1 and
will stomp on "oops."

Omitting a warning when using the (invalid) zero-length array is how GCC
is treating -fstrict-flex-arrays=3. A warning in that situation is likely
an irritant, because requesting this option level is explicitly requesting
this behavior.

Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101836

[kees]

Excellent! Thank you for getting this prepared. Having this properly managed in the kernel means we don't have to do horrible ugly hacks to work around old 0-length arrays in UAPI (which have all been unioned with a proper flexible array now).

[kees]

clang/test/CodeGen/bounds-checking-fam.c

35–53

I would expect to see here:

struct Zero {
  int a[0];
};

// CHECK-LABEL: define {{.*}} @{{.*}}test_zero{{.*}}(
int test_one(struct One *p, int i) {
  // CHECK-STRICT-0-NOT: @__ubsan
  // CHECK-STRICT-1-NOT: @__ubsan
  // CHECK-STRICT-2-NOT: @__ubsan
  // CHECK-STRICT-3:     call void @__ubsan_handle_out_of_bounds_abort(
  return p->a[i] + (p->a)[i];
}

[serge-sans-paille]

I think this is missing a change in SemaChecking.cpp too. It would probably be better to first merge https://reviews.llvm.org/D134791 so that you don't have to patch (too much) multiple places :-)

[serge-sans-paille]

clang/test/CodeGen/bounds-checking-fam.c

7–9

Why adding -02 here?

clang/test/CodeGen/object-size-flex-array.c

45

This one worries me a bit, as an array of size 0 is invalid C, unless you consider the extension of it being a FAM. Shouldn't we emit a warning or something here? @kees what meaning would you give to that construct under -fstrict-flex-arrays=3 ?

clang/test/SemaCXX/array-bounds-strict-flex-arrays.cpp

14

update the comment here and below?

[kees]

clang/test/CodeGen/object-size-flex-array.c

45

type identifier[0]

when not a fake FAM is the same as:

struct { } identifier

It's addressable with no size.

FWIW, this is how GCC is treating it, and opted for no warning. The warning gains nothing and is likely an irritant: if someone is requesting =3, they want this behavior. If they didn't, they'd just use -Wzero-length-array. In particular, the Linux kernel is in the position of needing to have zero-length arrays (legacy userspace API) alongside real FAMs, even if we don't reference the zero-length members. So we cannot use '-Wzero-length-array', but we want to make sure no zero-length arrays will ever be used as fake FAMs, as a code quality/style enforcement. This is especially true of FORTIFY_SOURCE, where __bos() needs to report 0 instead of -1 for such a destination buffer size, so that we immediately trip compile-time (or at worst, run-time) warnings, to keep any kernel internals from using the deprecated members as a fake FAM.

Take this case:

struct broken {
    int foo;
    int fake_fam[0];
    struct something oops;
};

There have been bugs where the above struct was created because "oops" got added after "fake_fam" by someone not realizing. Under FORTIFY_SOURCE, doing:

memcpy(p->fake_fam, src, len);

raises no warning when __bos(p->fake_fam, 1) returns -1 and will happily stomp on "oops". If __bos() returns 0, we can compile-time (or run-time) block the memcpy. (And this holds for -fsanitize=bounds as well: if it is considered to be unknown size, it won't trip on access, but if it's 0-sized, it'll trip.)

So, we can't keep zero-length arrays out of the kernel, but we want to be able to enforce that if they DO show up, they will trip warnings quickly.

[serge-sans-paille]

clang/test/CodeGen/object-size-flex-array.c

45

Thanks for clarifying the situation, esp. the kernel background. This looks like a quite specific scenario, but it's fine with me.

[void]

clang/test/CodeGen/bounds-checking-fam.c

7–9

Mostly because that's how Linux compiles its files. It also mirrors the test below. I'm not super married to it if you'd rather I omit it.

clang/test/CodeGen/object-size-flex-array.c

45

I'll add @kees's comment to the commit message.

[void]

Update comments to reflect reality.

[void]

@rsmith, @serge-sans-paille, and @kees, I need some advice. There's a test in clang/test/CodeGen/bounds-checking.c that's checking bounds stuff on unions. The behavior is...weird to me. It says that an array of 0 or 1 is a FAM, but one larger is not (see below). That seems counter to how structs are handled. If this is true, then the check in clang/lib/AST/Expr.cpp also needs to be updated...

union U { int a[0]; int b[1]; int c[2]; };                                             
  
// CHECK-LABEL: define {{.*}} @f4                                                      
int f4(union U *u, int i) {
  // a and b are treated as flexible array members.
  // CHECK-NOT: @llvm.ubsantrap                                                        
  return u->a[i] + u->b[i] + u->c[i];                                                  
  // CHECK: }
}                                                                                      
  
// CHECK-LABEL: define {{.*}} @f5
int f5(union U *u, int i) {
  // c is not a flexible array member.
  // NONLOCAL: call {{.*}} @llvm.ubsantrap                                             
  return u->c[i];
  // CHECK: }                                                                          
}

[serge-sans-paille]

In D134902#3848246, @void wrote:

@rsmith, @serge-sans-paille, and @kees, I need some advice. There's a test in clang/test/CodeGen/bounds-checking.c that's checking bounds stuff on unions. The behavior is...weird to me. It says that an array of 0 or 1 is a FAM, but one larger is not (see below). That seems counter to how structs are handled. If this is true, then the check in clang/lib/AST/Expr.cpp also needs to be updated...

I second the opinion here. C99 says nothing about flexible array member for unions, that's already a "language extension". (and so not be considered as FAM by -fstrict-flex-arrays=3)
Both GCC and Clang implement that extension for array of size 0 and 1, see https://godbolt.org/z/1xYMYq75s. That's the *legacy* behavior of Clang.

We may want to harmonize with struct behavior (for consistency etc) but I'd advocate to so in a separate patch.

[kees]

In D134902#3848246, @void wrote:

@rsmith, @serge-sans-paille, and @kees, I need some advice. There's a test in clang/test/CodeGen/bounds-checking.c that's checking bounds stuff on unions. The behavior is...weird to me. It says that an array of 0 or 1 is a FAM, but one larger is not (see below).

Note that union vs struct shouldt't matter. A union is just a struct where all members are "trailing". ;)

f5 looks like a broken test that didn't realize that N-sized trailing arrays are considered fake FAMs. This would explain some of the unexpected behavior I've seen with -fsanitize=bounds under Clang vs GCC:
https://godbolt.org/z/5v3evhMqq
Here GCC (correctly) accepts all as fake FAMs.

Note that GCC has an option -fsanitize=strict-bounds that changes the behavior to treating [N] and [1] as fixed size, but _not_ [0]. The plan is for GCC to make this an alias of -fstrict-flex-arrays=2, and then have UBSAN Bounds correctly tied to the -fstrict-flex-arrays level.

That seems counter to how structs are handled. If this is true, then the check in clang/lib/AST/Expr.cpp also needs to be updated...

I would expect diagnostics, __builtin_object_size(), __builtin_dynamic_object_size(), and -fsanitize=bounds to all agree on the definition of fake FAMs, which is all controlled by -fstrict-flex-arrays level.

[kees]

In D134902#3848595, @serge-sans-paille wrote:

I second the opinion here. C99 says nothing about flexible array member for unions, that's already a "language extension". (and so not be considered as FAM by -fstrict-flex-arrays=3)

To be super pedantic, C99 implies a FAM in a union is illegal. 6.7.2.1.16 says "As a special case, the last element of a structure with more than one named member may have an incomplete array type; this is called a flexible array member." The implication is that such a state ("more than one named member") isn't possible in a union.

But in real-world usage, this definition isn't useful and flies in the face of actual (fake) FAM usage. Having fake FAMs in unions is _very_ common in the Linux kernel, and they even appear alone in structs. There is no pragmatic reason for the C99 limitation, and it's needlessly enforced only for "real" FAMs. But this is a separate issue we can solve separately.

Both GCC and Clang implement that extension for array of size 0 and 1, see https://godbolt.org/z/1xYMYq75s. That's the *legacy* behavior of Clang.

We may want to harmonize with struct behavior (for consistency etc) but I'd advocate to so in a separate patch.

I just want to repeat for clarity: this isn't about union vs struct. This is about UBSAN vs not. Here is the same behavior, shown with a struct:
https://godbolt.org/z/4TbWYP4f9
Clang's -fsanitize=array-bounds is misbehaving.

[dblaikie]

clang/test/CodeGen/bounds-checking-fam.c

7–9

Yeah, generally Clang tests don't run LLVM optimizations - clang should be checking the output of Clang's IRGen, not the optimizations that LLVM performs.

Not sure how many Clang codegen tests disable llvm optimizations entirely, but that's basically/should be the default (-disable-llvm-optzns, I think that's the flag anyway).

If LLVM's output is so verbose it's hard to check reliably/non-brittally then maybe running some optimizations to simplify things might be acceptable.

[void]

Integrate the new flag level into the FAM predicate.

[void]

Add a release note.

[void]

This should be ready for review. PTAL.

[serge-sans-paille]

clang/include/clang/Basic/LangOptions.h

60

Looks unrelated to this patch :-)

231

Looks unrelated to this patch.

clang/lib/AST/ExprConstant.cpp

14085

fascinatingly off topic. But gives a good hint on what you're working on ;-)

[void]

clang/include/clang/Basic/LangOptions.h

60

I don't see a change here.

231

Or here.

clang/lib/AST/ExprConstant.cpp

14085

I'm not sure what you mean.

[aaron.ballman]

In D134902#3848616, @kees wrote:

In D134902#3848595, @serge-sans-paille wrote:

I second the opinion here. C99 says nothing about flexible array member for unions, that's already a "language extension". (and so not be considered as FAM by -fstrict-flex-arrays=3)

To be super pedantic, C99 implies a FAM in a union is illegal. 6.7.2.1.16 says "As a special case, the last element of a structure with more than one named member may have an incomplete array type; this is called a flexible array member." The implication is that such a state ("more than one named member") isn't possible in a union.

The C standard says "structure" when it means struct and "union" when it means union, and "structure and/or union" when it means both/either, so this constraint is not implied -- it's explicitly stated. A FAM in a union is a constraint violation per 6.7.2.1. (Note: C compilers are not consistent about getting this constraint correct. Clang and GCC both get it right, ICC, MSVC, SDCC all get it wrong.)

But in real-world usage, this definition isn't useful and flies in the face of actual (fake) FAM usage. Having fake FAMs in unions is _very_ common in the Linux kernel, and they even appear alone in structs. There is no pragmatic reason for the C99 limitation, and it's needlessly enforced only for "real" FAMs. But this is a separate issue we can solve separately.

A *fake* FAM is undefined behavior and thus fair game for implementations to define the behavior of in whatever way we'd like, so long as developers know it's not portable and it may explode on other compilers. A real FAM requires at least a diagnostic, but we're free to make it a pedantic warning diagnostic if we want. If we feel strongly about the limitation being needless, we could propose to standardize support for it if implementations that accept a real FAM in a union basically all agree on the behavior. (Agreed that this is a separate issue from this patch though.)

One thing I would appreciate is, once we're getting close to done with the work around flexible arrays, is to explicitly document our implementation-defined behaviors around flexible arrays in https://clang.llvm.org/docs/LanguageExtensions.html. Right now, what is and isn't a flexible array to Clang is really complex and not having the rules written down anywhere is not helpful to users. These cleanup efforts are fantastic and seem like a good opportunity for us to rectify the lack of docs.

clang/docs/ReleaseNotes.rst

386 ↗

(On Diff #469807)

I think another way to phrase this is that level 3 only supports flexible array members as the feature is defined by the C standard, aka, this is standards-conforming mode. WDYT?

[void]

Update the release notes to something resembling English. Also add a better
explanation of what "3" means.

[void]

In D134902#3882255, @aaron.ballman wrote:

One thing I would appreciate is, once we're getting close to done with the work around flexible arrays, is to explicitly document our implementation-defined behaviors around flexible arrays in https://clang.llvm.org/docs/LanguageExtensions.html. Right now, what is and isn't a flexible array to Clang is really complex and not having the rules written down anywhere is not helpful to users. These cleanup efforts are fantastic and seem like a good opportunity for us to rectify the lack of docs.

Sure. Do you want that done with this change?

[aaron.ballman]

In D134902#3883209, @void wrote:

In D134902#3882255, @aaron.ballman wrote:

One thing I would appreciate is, once we're getting close to done with the work around flexible arrays, is to explicitly document our implementation-defined behaviors around flexible arrays in https://clang.llvm.org/docs/LanguageExtensions.html. Right now, what is and isn't a flexible array to Clang is really complex and not having the rules written down anywhere is not helpful to users. These cleanup efforts are fantastic and seem like a good opportunity for us to rectify the lack of docs.

Sure. Do you want that done with this change?

Up to you -- I'd be fine if you preferred to do it in a follow-up given that it's somewhat indirectly related to adding support for 3. Changes LGTM currently, but please wait a day or so before landing in case @serge-sans-paille or @kees have comments.

[void]

Quick ping to @kees and @serge-sans-paille for any comments. :)

[kees]

The self-tests all look correct to me, so I expect it is working how I'd expect. I haven't had a chance to do kernel builds with this yet, but I'm hoping to make time soon. I'd say if others are happy, let's land it, and if anything unexpected happens we can fix those issues if they appear. :)

[serge-sans-paille]

Looks good!

clang/include/clang/Basic/LangOptions.h

 /// In the Microsoft ABI, this controls the placement of virtual displacement
 /// members used to implement virtual inheritance.
 enum class MSVtorDispMode { Never, ForVBaseOverride, ForVFTable };
 
 /// Shader programs run in specific pipeline stages.
 /// The order of these values matters, and must be kept in sync with the
 /// Triple Environment enum in llvm::Triple. The ordering is enforced in
 ///  static_asserts in Triple.cpp and in clang/Basic/HLSLRuntime.h.
 enum class ShaderStage {
   Pixel = 0,
   Vertex,
   Geometry,
   Hull,
   Domain,
   Compute,
   Library,
   RayGeneration,
enum class ClangABI {
     ///   - make trivial only those defaulted copy constructors with a
     ///     parameter-type-list equivalent to the parameter-type-list of an
     ///     implicit declaration.
     Ver14,
 
     /// Attempt to be ABI-compatible with code generated by Clang 15.0.x.
     /// This causes clang to:
     ///   - Reverse the implementation for DR692, DR1395 and DR1432.
     ///   - pack non-POD members of packed structs.
     Ver15,
 
     /// Conform to the underlying platform's C and C++ ABIs as closely
     /// as we can.
     Latest
   };
 
   enum class CoreFoundationABI {
public:
   enum class StrictFlexArraysLevelKind {
     /// Any trailing array member is a FAM.
     Default = 0,
     /// Any trailing array member of undefined, 0, or 1 size is a FAM.
     OneZeroOrIncomplete = 1,
     /// Any trailing array member of undefined or 0 size is a FAM.
     ZeroOrIncomplete = 2,
     /// Any trailing array member of undefined size is a FAM.
-    Incomplete = 3,
+    IncompleteOnly = 3,
   };
 
 public:
   /// The used language standard.
   LangStandard::Kind LangStd;
 
   /// Set of enabled sanitizers.
   SanitizerSet Sanitize;

clang/include/clang/Driver/Options.td

defm allow_editor_placeholders : BoolFOption<"allow-editor-placeholders",
   LangOpts<"AllowEditorPlaceholders">, DefaultFalse,
   PosFlag<SetTrue, [CC1Option], "Treat editor placeholders as valid source code">,
   NegFlag<SetFalse>>;
 def fallow_unsupported : Flag<["-"], "fallow-unsupported">, Group<f_Group>;
 def fapple_kext : Flag<["-"], "fapple-kext">, Group<f_Group>, Flags<[CC1Option]>,
   HelpText<"Use Apple's kernel extensions ABI">,
   MarshallingInfoFlag<LangOpts<"AppleKext">>;
 def fstrict_flex_arrays_EQ : Joined<["-"], "fstrict-flex-arrays=">, Group<f_Group>,
-  MetaVarName<"<n>">, Values<"0,1,2">,
+  MetaVarName<"<n>">, Values<"0,1,2,3">,
   LangOpts<"StrictFlexArraysLevel">,
   Flags<[CC1Option]>,
   NormalizedValuesScope<"LangOptions::StrictFlexArraysLevelKind">,
-  NormalizedValues<["Default", "OneZeroOrIncomplete", "ZeroOrIncomplete"]>,
+  NormalizedValues<["Default", "OneZeroOrIncomplete", "ZeroOrIncomplete", "IncompleteOnly"]>,
   HelpText<"Enable optimizations based on the strict definition of flexible arrays">,
   MarshallingInfoEnum<LangOpts<"StrictFlexArraysLevel">, "Default">;
 defm apple_pragma_pack : BoolFOption<"apple-pragma-pack",
   LangOpts<"ApplePragmaPack">, DefaultFalse,
   PosFlag<SetTrue, [CC1Option], "Enable Apple gcc-compatible #pragma pack handling">,
   NegFlag<SetFalse>>;
 defm xl_pragma_pack : BoolFOption<"xl-pragma-pack",
   LangOpts<"XLPragmaPack">, DefaultFalse,

clang/lib/AST/Expr.cpp

bool Expr::isFlexibleArrayMemberLike(
     bool IgnoreTemplateOrMacroSubstitution) const {
 
   // For compatibility with existing code, we treat arrays of length 0 or
   // 1 as flexible array members.
   const auto *CAT = Context.getAsConstantArrayType(getType());
   if (CAT) {
     llvm::APInt Size = CAT->getSize();
 
+    using FAMKind = LangOptions::StrictFlexArraysLevelKind;
+
+    if (StrictFlexArraysLevel == FAMKind::IncompleteOnly)
+      return false;
+
     // GCC extension, only allowed to represent a FAM.
     if (Size == 0)
       return true;
 
-    using FAMKind = LangOptions::StrictFlexArraysLevelKind;
     if (StrictFlexArraysLevel == FAMKind::ZeroOrIncomplete && Size.uge(1))
       return false;
 
     if (StrictFlexArraysLevel == FAMKind::OneZeroOrIncomplete && Size.uge(2))
       return false;
   } else if (!Context.getAsIncompleteArrayType(getType()))
     return false;
 

clang/lib/AST/ExprConstant.cpp

static bool isUserWritingOffTheEnd(const ASTContext &Ctx, const LValue &LVal) {
   // - We used to be a bit more aggressive here; we'd only be conservative if
   //   the array at the end was flexible, or if it had 0 or 1 elements. This
   //   broke some common standard library extensions (PR30346), but was
   //   otherwise seemingly fine. It may be useful to reintroduce this behavior
   //   with some sort of list. OTOH, it seems that GCC is always
   //   conservative with the last element in structs (if it's an array), so our
   //   current behavior is more compatible than an explicit list approach would
   //   be.
+  auto isFlexibleArrayMember = [&] {
     using FAMKind = LangOptions::StrictFlexArraysLevelKind;
-  FAMKind StrictFlexArraysLevel = Ctx.getLangOpts().getStrictFlexArraysLevel();
+    FAMKind StrictFlexArraysLevel =
+        Ctx.getLangOpts().getStrictFlexArraysLevel();
+
+    if (Designator.isMostDerivedAnUnsizedArray())
+      return true;
+
+    if (StrictFlexArraysLevel == FAMKind::Default)
+      return true;
+
+    if (Designator.getMostDerivedArraySize() == 0 &&
+        StrictFlexArraysLevel != FAMKind::IncompleteOnly)
+      return true;
+
+    if (Designator.getMostDerivedArraySize() == 1 &&
+        StrictFlexArraysLevel == FAMKind::OneZeroOrIncomplete)
+      return true;
+
+    return false;
+  };
+
   return LVal.InvalidBase &&
          Designator.Entries.size() == Designator.MostDerivedPathLength &&
-         Designator.MostDerivedIsArrayElement &&
-         (Designator.isMostDerivedAnUnsizedArray() ||
-          Designator.getMostDerivedArraySize() == 0 ||
-          (Designator.getMostDerivedArraySize() == 1 &&
-           StrictFlexArraysLevel != FAMKind::Incomplete &&
-           StrictFlexArraysLevel != FAMKind::ZeroOrIncomplete) ||
-          StrictFlexArraysLevel == FAMKind::Default) &&
+         Designator.MostDerivedIsArrayElement && isFlexibleArrayMember() &&
          isDesignatorAtObjectEnd(Ctx, LVal);
 }
 
 /// Converts the given APInt to CharUnits, assuming the APInt is unsigned.
 /// Fails if the conversion would cause loss of precision.
 static bool convertUnsignedAPIntToCharUnits(const llvm::APInt &Int,
                                             CharUnits &Result) {
   auto CharUnitsMax = std::numeric_limits<CharUnits::QuantityType>::max();
if (!EvaluateFloat(E->getArg(0), Result, Info) ||
         !EvaluateFloat(E->getArg(1), RHS, Info))
       return false;
     // When comparing zeroes, return -0.0 if one of the zeroes is negative.
     if (Result.isZero() && RHS.isZero() && RHS.isNegative())
       Result = RHS;
     else if (Result.isNaN() || RHS < Result)
       Result = RHS;
     return true;
   }
   }
 }
 
 bool FloatExprEvaluator::VisitUnaryReal(const UnaryOperator *E) {
   if (E->getSubExpr()->getType()->isAnyComplexType()) {
     ComplexValue CV;
     if (!EvaluateComplex(E->getSubExpr(), CV, Info))
       return false;

clang/lib/StaticAnalyzer/Core/MemRegion.cpp

const auto isFlexibleArrayMemberCandidate = [this,
         const llvm::APInt &Size = CAT->getSize();
         if (Size.isZero())
           return true;
 
         using FAMKind = LangOptions::StrictFlexArraysLevelKind;
         const FAMKind StrictFlexArraysLevel =
           Ctx.getLangOpts().getStrictFlexArraysLevel();
         if (StrictFlexArraysLevel == FAMKind::ZeroOrIncomplete ||
-            StrictFlexArraysLevel == FAMKind::Incomplete)
+            StrictFlexArraysLevel == FAMKind::IncompleteOnly)
           return false;
 
         const AnalyzerOptions &Opts = SVB.getAnalyzerOptions();
         // FIXME: this option is probably redundant with -fstrict-flex-arrays=1.
         if (Opts.ShouldConsiderSingleElementArraysAsFlexibleArrayMembers &&
             Size.isOne())
           return true;
       }

clang/test/CodeGen/bounds-checking-fam.c

 // REQUIRES: x86-registered-target
 // RUN: %clang_cc1 -emit-llvm -triple x86_64 -fstrict-flex-arrays=0 -fsanitize=array-bounds        %s -o - | FileCheck %s --check-prefixes=CHECK,CHECK-STRICT-0
 // RUN: %clang_cc1 -emit-llvm -triple x86_64 -fstrict-flex-arrays=0 -fsanitize=array-bounds -x c++ %s -o - | FileCheck %s --check-prefixes=CHECK,CHECK-STRICT-0,CXX,CXX-STRICT-0
 // RUN: %clang_cc1 -emit-llvm -triple x86_64 -fstrict-flex-arrays=1 -fsanitize=array-bounds        %s -o - | FileCheck %s --check-prefixes=CHECK,CHECK-STRICT-1
 // RUN: %clang_cc1 -emit-llvm -triple x86_64 -fstrict-flex-arrays=1 -fsanitize=array-bounds -x c++ %s -o - | FileCheck %s --check-prefixes=CHECK,CHECK-STRICT-1,CXX
 // RUN: %clang_cc1 -emit-llvm -triple x86_64 -fstrict-flex-arrays=2 -fsanitize=array-bounds        %s -o - | FileCheck %s --check-prefixes=CHECK,CHECK-STRICT-2
 // RUN: %clang_cc1 -emit-llvm -triple x86_64 -fstrict-flex-arrays=2 -fsanitize=array-bounds -x c++ %s -o - | FileCheck %s --check-prefixes=CHECK,CHECK-STRICT-2,CXX
+// RUN: %clang_cc1 -emit-llvm -triple x86_64 -fstrict-flex-arrays=3 -fsanitize=array-bounds        %s -o - | FileCheck %s --check-prefixes=CHECK,CHECK-STRICT-3
+// RUN: %clang_cc1 -emit-llvm -triple x86_64 -fstrict-flex-arrays=3 -fsanitize=array-bounds -x c++ %s -o - | FileCheck %s --check-prefixes=CHECK,CHECK-STRICT-3,CXX
 // Before flexible array member was added to C99, many projects use a
 // one-element array as the last member of a structure as an alternative.
 // E.g. https://github.com/python/cpython/issues/84301
 // Suppress such errors with -fstrict-flex-arrays=0.
 
 struct Incomplete {
   int ignored;
   int a[];

 struct Two {
   int ignored;
   int a[2];
 };
 struct Three {
   int ignored;
   int a[3];
 };
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_incomplete{{.*}}(
 int test_incomplete(struct Incomplete *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1-NOT: @__ubsan
   // CHECK-STRICT-2-NOT: @__ubsan
+  // CHECK-STRICT-3-NOT: @__ubsan
   return p->a[i] + (p->a)[i];
 }
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_zero{{.*}}(
 int test_zero(struct Zero *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1-NOT: @__ubsan
   // CHECK-STRICT-2-NOT: @__ubsan
+  // CHECK-STRICT-3:     call void @__ubsan_handle_out_of_bounds_abort(
   return p->a[i] + (p->a)[i];
 }
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_one{{.*}}(
 int test_one(struct One *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1-NOT: @__ubsan
   // CHECK-STRICT-2:     call void @__ubsan_handle_out_of_bounds_abort(
+  // CHECK-STRICT-3:     call void @__ubsan_handle_out_of_bounds_abort(
   return p->a[i] + (p->a)[i];
 }
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_two{{.*}}(
 int test_two(struct Two *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1:     call void @__ubsan_handle_out_of_bounds_abort(
   // CHECK-STRICT-2:     call void @__ubsan_handle_out_of_bounds_abort(
   return p->a[i] + (p->a)[i];
 }
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_three{{.*}}(
 int test_three(struct Three *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1:     call void @__ubsan_handle_out_of_bounds_abort(
   // CHECK-STRICT-2:     call void @__ubsan_handle_out_of_bounds_abort(
+  // CHECK-STRICT-3:     call void @__ubsan_handle_out_of_bounds_abort(
   return p->a[i] + (p->a)[i];
 }
 
 union uZero {
   int a[0];
 };
 union uOne {
   int a[1];
 };
 union uTwo {
   int a[2];
 };
 union uThree {
   int a[3];
 };
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_uzero{{.*}}(
 int test_uzero(union uZero *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1-NOT: @__ubsan
   // CHECK-STRICT-2-NOT: @__ubsan
+  // CHECK-STRICT-3:     call void @__ubsan_handle_out_of_bounds_abort(
   return p->a[i] + (p->a)[i];
 }
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_uone{{.*}}(
 int test_uone(union uOne *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1-NOT: @__ubsan
   // CHECK-STRICT-2:     call void @__ubsan_handle_out_of_bounds_abort(
+  // CHECK-STRICT-3:     call void @__ubsan_handle_out_of_bounds_abort(
   return p->a[i] + (p->a)[i];
 }
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_utwo{{.*}}(
 int test_utwo(union uTwo *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1:     call void @__ubsan_handle_out_of_bounds_abort(
   // CHECK-STRICT-2:     call void @__ubsan_handle_out_of_bounds_abort(
+  // CHECK-STRICT-3:     call void @__ubsan_handle_out_of_bounds_abort(
   return p->a[i] + (p->a)[i];
 }
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_uthree{{.*}}(
 int test_uthree(union uThree *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1:     call void @__ubsan_handle_out_of_bounds_abort(
   // CHECK-STRICT-2:     call void @__ubsan_handle_out_of_bounds_abort(
+  // CHECK-STRICT-3:     call void @__ubsan_handle_out_of_bounds_abort(
   return p->a[i] + (p->a)[i];
 }
 
 #define FLEXIBLE 1
 struct Macro {
   int a[FLEXIBLE];
 };
 
 // CHECK-LABEL: define {{.*}} @{{.*}}test_macro{{.*}}(
 int test_macro(struct Macro *p, int i) {
   // CHECK-STRICT-0-NOT: @__ubsan
   // CHECK-STRICT-1-NOT: @__ubsan
   // CHECK-STRICT-2:     call void @__ubsan_handle_out_of_bounds_abort(
+  // CHECK-STRICT-3:     call void @__ubsan_handle_out_of_bounds_abort(
   return p->a[i] + (p->a)[i];
 }
 
 #if defined __cplusplus
 
 struct Base {
   int b;
 };

clang/test/CodeGen/object-size-flex-array.c

-// RUN: %clang -fstrict-flex-arrays=2 -target x86_64-apple-darwin -S -emit-llvm %s -o - 2>&1 | FileCheck --check-prefixes=CHECK,CHECK-STRICT-2 %s
-// RUN: %clang -fstrict-flex-arrays=1 -target x86_64-apple-darwin -S -emit-llvm %s -o - 2>&1 | FileCheck --check-prefixes=CHECK,CHECK-STRICT-1 %s
-// RUN: %clang -fstrict-flex-arrays=0 -target x86_64-apple-darwin -S -emit-llvm %s -o - 2>&1 | FileCheck --check-prefixes=CHECK,CHECK-STRICT-0 %s
+// RUN: %clang                        -target x86_64 -O2 -S -emit-llvm %s -o - 2>&1 | FileCheck --check-prefixes=CHECK,CHECK-NO-STRICT %s
+// RUN: %clang -fstrict-flex-arrays=0 -target x86_64 -O2 -S -emit-llvm %s -o - 2>&1 | FileCheck --check-prefixes=CHECK,CHECK-STRICT-0 %s
+// RUN: %clang -fstrict-flex-arrays=1 -target x86_64 -O2 -S -emit-llvm %s -o - 2>&1 | FileCheck --check-prefixes=CHECK,CHECK-STRICT-1 %s
+// RUN: %clang -fstrict-flex-arrays=2 -target x86_64 -O2 -S -emit-llvm %s -o - 2>&1 | FileCheck --check-prefixes=CHECK,CHECK-STRICT-2 %s
+// RUN: %clang -fstrict-flex-arrays=3 -target x86_64 -O2 -S -emit-llvm %s -o - 2>&1 | FileCheck --check-prefixes=CHECK,CHECK-STRICT-3 %s
 
 #define OBJECT_SIZE_BUILTIN __builtin_object_size
 
 typedef struct {
   float f;
   double c[];
 } foo_t;
 

 
 typedef struct {
   float f;
   double c[2];
 } foo2_t;
 
 // CHECK-LABEL: @bar(
 unsigned bar(foo_t *f) {
-  // CHECK-STRICT-0: ret i32 %
-  // CHECK-STRICT-1: ret i32 %
-  // CHECK-STRICT-2: ret i32 %
+  // CHECK-NO-STRICT: ret i32 -1
+  // CHECK-STRICT-0: ret i32 -1
+  // CHECK-STRICT-1: ret i32 -1
+  // CHECK-STRICT-2: ret i32 -1
+  // CHECK-STRICT-3: ret i32 -1
   return OBJECT_SIZE_BUILTIN(f->c, 1);
 }
 
 // CHECK-LABEL: @bar0(
 unsigned bar0(foo0_t *f) {
-  // CHECK-STRICT-0: ret i32 %
-  // CHECK-STRICT-1: ret i32 %
-  // CHECK-STRICT-2: ret i32 %
+  // CHECK-NO-STRICT: ret i32 -1
+  // CHECK-STRICT-0: ret i32 -1
+  // CHECK-STRICT-1: ret i32 -1
+  // CHECK-STRICT-2: ret i32 -1
+  // CHECK-STRICT-3: ret i32 0
   return OBJECT_SIZE_BUILTIN(f->c, 1);
 }
 
 // CHECK-LABEL: @bar1(
 unsigned bar1(foo1_t *f) {
-  // CHECK-STRICT-0: ret i32 %
-  // CHECK-STRICT-1: ret i32 %
+  // CHECK-NO-STRICT: ret i32 -1
+  // CHECK-STRICT-0: ret i32 -1
+  // CHECK-STRICT-1: ret i32 -1
   // CHECK-STRICT-2: ret i32 8
+  // CHECK-STRICT-3: ret i32 8
   return OBJECT_SIZE_BUILTIN(f->c, 1);
 }
 
 // CHECK-LABEL: @bar2(
 unsigned bar2(foo2_t *f) {
-  // CHECK-STRICT-0: ret i32 %
+  // CHECK-NO-STRICT: ret i32 -1
+  // CHECK-STRICT-0: ret i32 -1
   // CHECK-STRICT-1: ret i32 16
   // CHECK-STRICT-2: ret i32 16
+  // CHECK-STRICT-3: ret i32 16
   return OBJECT_SIZE_BUILTIN(f->c, 1);
 }
 
+#define DYNAMIC_OBJECT_SIZE_BUILTIN __builtin_dynamic_object_size
+
+// CHECK-LABEL: @dyn_bar(
+unsigned dyn_bar(foo_t *f) {
+  // CHECK-NO-STRICT: ret i32 -1
+  // CHECK-STRICT-0: ret i32 -1
+  // CHECK-STRICT-1: ret i32 -1
+  // CHECK-STRICT-2: ret i32 -1
+  // CHECK-STRICT-3: ret i32 -1
+  return DYNAMIC_OBJECT_SIZE_BUILTIN(f->c, 1);
+}
+
+// CHECK-LABEL: @dyn_bar0(
+unsigned dyn_bar0(foo0_t *f) {
+  // CHECK-NO-STRICT: ret i32 -1
+  // CHECK-STRICT-0: ret i32 -1
+  // CHECK-STRICT-1: ret i32 -1
+  // CHECK-STRICT-2: ret i32 -1
+  // CHECK-STRICT-3: ret i32 0
+  return DYNAMIC_OBJECT_SIZE_BUILTIN(f->c, 1);
+}
+
+// CHECK-LABEL: @dyn_bar1(
+unsigned dyn_bar1(foo1_t *f) {
+  // CHECK-NO-STRICT: ret i32 -1
+  // CHECK-STRICT-0: ret i32 -1
+  // CHECK-STRICT-1: ret i32 -1
+  // CHECK-STRICT-2: ret i32 8
+  // CHECK-STRICT-3: ret i32 8
+  return DYNAMIC_OBJECT_SIZE_BUILTIN(f->c, 1);
+}
+
+// CHECK-LABEL: @dyn_bar2(
+unsigned dyn_bar2(foo2_t *f) {
+  // CHECK-NO-STRICT: ret i32 -1
+  // CHECK-STRICT-0: ret i32 -1
+  // CHECK-STRICT-1: ret i32 16
+  // CHECK-STRICT-2: ret i32 16
+  // CHECK-STRICT-3: ret i32 16
+  return DYNAMIC_OBJECT_SIZE_BUILTIN(f->c, 1);
+}
+
 // Also checks for non-trailing flex-array like members
 
 typedef struct {
   double c[0];
   float f;
 } foofoo0_t;
 
 typedef struct {
   double c[1];
   float f;
 } foofoo1_t;
 
 typedef struct {
   double c[2];
   float f;
 } foofoo2_t;
 
 // CHECK-LABEL: @babar0(
 unsigned babar0(foofoo0_t *f) {
+  // CHECK-NO-STRICT: ret i32 0
   // CHECK-STRICT-0: ret i32 0
   // CHECK-STRICT-1: ret i32 0
   // CHECK-STRICT-2: ret i32 0
+  // CHECK-STRICT-3: ret i32 0
   return OBJECT_SIZE_BUILTIN(f->c, 1);
 }
 
 // CHECK-LABEL: @babar1(
 unsigned babar1(foofoo1_t *f) {
+  // CHECK-NO-STRICT: ret i32 8
   // CHECK-STRICT-0: ret i32 8
   // CHECK-STRICT-1: ret i32 8
   // CHECK-STRICT-2: ret i32 8
+  // CHECK-STRICT-3: ret i32 8
   return OBJECT_SIZE_BUILTIN(f->c, 1);
 }
 
 // CHECK-LABEL: @babar2(
 unsigned babar2(foofoo2_t *f) {
+  // CHECK-NO-STRICT: ret i32 16
   // CHECK-STRICT-0: ret i32 16
   // CHECK-STRICT-1: ret i32 16
   // CHECK-STRICT-2: ret i32 16
+  // CHECK-STRICT-3: ret i32 16
   return OBJECT_SIZE_BUILTIN(f->c, 1);
 }

clang/test/Sema/array-bounds-ptr-arith.c

 // RUN: %clang_cc1 -verify=expected        -Warray-bounds-pointer-arithmetic %s
 // RUN: %clang_cc1 -verify=expected        -Warray-bounds-pointer-arithmetic %s -fstrict-flex-arrays=0
 // RUN: %clang_cc1 -verify=expected,strict -Warray-bounds-pointer-arithmetic %s -fstrict-flex-arrays=2
+// RUN: %clang_cc1 -verify=expected,strict -Warray-bounds-pointer-arithmetic %s -fstrict-flex-arrays=3
 
 // Test case from PR10615
 struct ext2_super_block{
   unsigned char s_uuid[8]; // expected-note {{declared here}}
   int ignored; // Prevents "s_uuid" from being treated as a flexible array
                // member.
 };
 

clang/test/SemaCXX/array-bounds-strict-flex-arrays.cpp

-// RUN: %clang_cc1 -verify=relaxed -fstrict-flex-arrays=1 %s
-// RUN: %clang_cc1 -verify=relaxed,strict -fstrict-flex-arrays=2 %s
+// RUN: %clang_cc1 -verify=relaxed                    -fstrict-flex-arrays=1 %s
+// RUN: %clang_cc1 -verify=relaxed,strict             -fstrict-flex-arrays=2 %s
+// RUN: %clang_cc1 -verify=relaxed,strict,very-strict -fstrict-flex-arrays=3 %s
 
 // We cannot know for sure the size of a flexible array.
 struct t {
   int f;
   int a[];
 };
 void test(t *s2) {
   s2->a[2] = 0; // no-warning
 }
 
-// Under -fstrict-flex-arrays={1,2} `a` is not a flexible array
+// Under -fstrict-flex-arrays={1,2,3} `a` is not a flexible array
 struct t0 {
   int f;
   int a[10]; // relaxed-note {{array 'a' declared here}}
 };
 void test0(t0 *s2) {
   s2->a[12] = 0; // relaxed-warning {{array index 12 is past the end of the array (that has type 'int[10]')}}
 }
 
 
 // Under -fstrict-flex-arrays=2 `a` is not a flexible array, but it is under -fstrict-flex-arrays=1
 struct t1 {
   int f;
   int a[1]; // strict-note {{array 'a' declared here}}
 };
 void test1(t1 *s2) {
   s2->a[2] = 0; // strict-warning {{array index 2 is past the end of the array (that has type 'int[1]')}}
 }
 
-// Under -fstrict-flex-arrays={1,2} `a` is a flexible array.
+// Under -fstrict-flex-arrays={1,2} `a` is a flexible array, but not under -fstrict-flex-arrays=3.
 struct t2 {
   int f;
-  int a[0];
+  int a[0]; // very-strict-note {{array 'a' declared here}}
 };
 void test1(t2 *s2) {
-  s2->a[2] = 0; // no-warning
+  s2->a[2] = 0; // very-strict-warning {{array index 2 is past the end of the array (that has type 'int[0]')}}
 }