[libc++] Fix the behavior of throwing `operator new` under -fno-exceptions

[ldionne]

Summary

In D144319, Clang tried to land a change that would cause some functions
that are not supposed to return nullptr to optimize better. As reported
in https://reviews.llvm.org/D144319#4203982, libc++ started seeing failures
in its CI shortly after this change was landed.

As explained in D146379, the reason for these failures is that libc++'s
throwing operator new can in fact return nullptr when compiled with
exceptions disabled. However, this contradicts the Standard, which
clearly says that the throwing version of operator new(size_t)
should never return nullptr. This is actually a long standing issue.
I've previously seen a case where LTO would optimize incorrectly based
on the assumption that operator new doesn't return nullptr, an
assumption that was violated in that case because libc++.dylib was
compiled with -fno-exceptions.

Unfortunately, fixing this is kind of tricky. The Standard has a few
requirements for the allocation functions, some of which are impossible
to satisfy under -fno-exceptions:

1. operator new(size_t) must never return nullptr
2. operator new(size_t, nothrow_t) must call the throwing version and return nullptr on failure to allocate
3. We can't throw exceptions when compiled with -fno-exceptions

In the case where exceptions are enabled, things work nicely. new(size_t)
throws and new(size_t, nothrow_t) uses a try-catch to return nullptr.
However, when compiling the library with -fno-exceptions, we can't throw
an exception from new(size_t), and we can't catch anything from
new(size_t, nothrow_t). The only thing we can do from new(size_t)
is actually abort the program, which does not make it possible for
new(size_t, nothrow_t) to catch something and return nullptr.

This patch makes the following changes:

1. When compiled with -fno-exceptions, the throwing version of operator new will now abort on failure instead of returning nullptr on failure. This resolves the issue that the compiler could mis-compile based on the assumption that nullptr is never returned. This constitutes an API and ABI breaking change for folks compiling the library with -fno-exceptions (which is not the general public, who merely uses libc++ headers but use a shared library that has already been compiled). This should mostly impact vendors and other folks who compile libc++.dylib themselves.

2. When the library is compiled with -fexceptions, the nothrow version of operator new has no change. When the library is compiled with -fno-exceptions, the nothrow version of operator new will now check whether the throwing version of operator new has been overridden. If it has not been overridden, then it will use an implementation equivalent to that of the throwing operator new, except it will return nullptr on failure to allocate (instead of terminating). However, if the throwing operator new has been overridden, it is now an error NOT to also override the nothrow operator new. Indeed, there is no way for us to implement a valid nothrow operator new without knowing the exact implementation of the throwing version.

TODO: Missing test cases

• Add an assertion test to ensure that we catch the case where operator new has been overridden but operator new(nothrow) has not and the library is compiled with -fno-exceptions. We should fail with an assertion.
• Add a test to ensure that operator new(nothrow) returns nullptr on failure to allocate even when the library was compiled with -fno-exceptions.
• Add tests for the __is_function_overridden machinery.

rdar://103958777

[ldionne]

Pinging vendors for discussion.

In particular, @EricWF it would be nice to know how Google feels about this, given that it's a large code base built using -fno-exceptions (presumably the dylib too?).

Also, @jwakely I'd like to know how you feel about the fact that new(size_t, nothrow_t) aborts instead of returning nullptr when the shared library is built using -fno-exceptions. Is that a concious choice you made in libstdc++, and if so, what's the rationale? Naively, I would say this surely seems a bit surprising, but it seems to be the only way to satisfy the Standard's requirements under -fno-exceptions (since the nothrow_t version must call the throwing version).

[jwakely]

In D150610#4343811, @ldionne wrote:

Also, @jwakely I'd like to know how you feel about the fact that new(size_t, nothrow_t) aborts instead of returning nullptr when the shared library is built using -fno-exceptions. Is that a concious choice you made in libstdc++, and if so, what's the rationale?

I consider it to be a bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106477 (which I first noted at https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68210#c2 in 2016, but still haven't fixed).
It's not a conscious choice, just how it works because nobody has implemented anything better yet.

Naively, I would say this surely seems a bit surprising, but it seems to be the only way to satisfy the Standard's requirements under -fno-exceptions (since the nothrow_t version must call the throwing version).

See the bug report above for another approach, which I've not had time to finish working on (and which won't work on all targets). It detects whether the program has replaced operator new(size_t) and if it _hasn't_, then we can make the nothrow_t version just return a null pointer directly. If the user has replaced operator new(size_t) then they'd better replace the nothrow_t one as well if they want to use -fno-exceptions.

[EricWF]

In D150610#4343811, @ldionne wrote:

Pinging vendors for discussion.

In particular, @EricWF it would be nice to know how Google feels about this, given that it's a large code base built using -fno-exceptions (presumably the dylib too?).

Let me test it and find out.

Also, @jwakely I'd like to know how you feel about the fact that new(size_t, nothrow_t) aborts instead of returning nullptr when the shared library is built using -fno-exceptions. Is that a concious choice you made in libstdc++, and if so, what's the rationale? Naively, I would say this surely seems a bit surprising, but it seems to be the only way to satisfy the Standard's requirements under -fno-exceptions (since the nothrow_t version must call the throwing version).

Yeah, I'm curious about this too.

[ldionne]

In D150610#4345267, @jwakely wrote:

I consider it to be a bug: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106477 (which I first noted at https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68210#c2 in 2016, but still haven't fixed).
It's not a conscious choice, just how it works because nobody has implemented anything better yet.

Thanks for the additional context!

Naively, I would say this surely seems a bit surprising, but it seems to be the only way to satisfy the Standard's requirements under -fno-exceptions (since the nothrow_t version must call the throwing version).

See the bug report above for another approach, which I've not had time to finish working on (and which won't work on all targets). It detects whether the program has replaced operator new(size_t) and if it _hasn't_, then we can make the nothrow_t version just return a null pointer directly. If the user has replaced operator new(size_t) then they'd better replace the nothrow_t one as well if they want to use -fno-exceptions.

That's interesting. I think we could do something similar. However, let's say we could do whatever we wanted and design from scratch, would you agree that it might make sense for operator new(size_t) to be equivalent to operator new(size_t, nothrow_t) when compiled with -fno-exceptions? I know the Standard doesn't formally acknowledge the existence of -fno-exceptions, but if we agreed that this is the desired behavior, we could perhaps relax the wording of operator new to make that implementation valid. WDYT?

I've spoken to some users in the embedded world and the consensus seems to be that having operator new(size_t) not return nullptr when it fails to allocate is problematic. Some have quite a bit of code already written where operator new(size_t) may return nullptr if it fails to allocate (which is a violation of the current spec technically).

[probinson]

The Standard has a few requirements for the allocation functions, some of which are impossible to satisfy under -fno-exceptions:

1. operator new(size_t) must never return nullptr
2. operator new(size_t, nothrow_t) must call the throwing version and return nullptr on failure to allocate
3. We can't throw exceptions when compiled with -fno-exceptions

Feels like building the library with -fno-exceptions is just plain non-conforming?

Requirement 2 seems odd, the only justification I can come up with is to allow replacing _only_ the throwing version, and having the nothrow version still Just Work in a compatible way. Naively I'd have thought the other way around would make more sense (throwing version calls nothrow version and turns nullptr into throw/abort) but that's not what got standardized.

[ldionne]

In D150610#4418324, @probinson wrote:

The Standard has a few requirements for the allocation functions, some of which are impossible to satisfy under -fno-exceptions:

1. operator new(size_t) must never return nullptr
2. operator new(size_t, nothrow_t) must call the throwing version and return nullptr on failure to allocate
3. We can't throw exceptions when compiled with -fno-exceptions

Feels like building the library with -fno-exceptions is just plain non-conforming?

Yes, I think that's accurate. We basically don't have a way to be conforming when we build the library itself with -fno-exceptions. @jwakely's suggestion makes us very close to that, in the sense that operator new(size_t) will behave as expected, and operator new(size_t, nothrow_t) will give the impression that we're calling operator new(size_t). The only remaining problem is what happens if the library is built with -fno-exceptions and the user overrides operator new(size_t) *but not* operator new(size_t, nothrow_t). In that case, our operator new(size_t, nothrow_t) will call the user's operator new(size_t) (which must terminate-on-failure in order to be conforming), and we'll still be non-conforming the same way we are today.

I think what I would really like is for a relaxation that does not force operator new(size_t, nothrow_t) to call operator new(size_t), since implementations effectively cannot do that. That would weaken a useful guarantee provided by the standard for the benefit of platforms that use -fno-exceptions -- I'm not sure that's the right tradeoff and even less sure that's something WG21 would ever consider.

Requirement 2 seems odd, the only justification I can come up with is to allow replacing _only_ the throwing version, and having the nothrow version still Just Work in a compatible way. Naively I'd have thought the other way around would make more sense (throwing version calls nothrow version and turns nullptr into throw/abort) but that's not what got standardized.

Yes and yes, I agree and I think it would have made more sense. However, I think changing that is impossible at this point.

[ldionne]

Update with new approach that detects whether operator new has been overridden or not. This is a WIP for comments only.

[jwakely]

In D150610#4437773, @ldionne wrote:

Update with new approach that detects whether operator new has been overridden or not. This is a WIP for comments only.

Cool! Nice to see this idea put into practice. Now I should do the same for libstdc++ :-)

[ldionne]

I am going to abandon this change on Phabricator since I've moved it to https://github.com/llvm/llvm-project/pull/69498 instead.

libcxx/include/CMakeLists.txt

set(files
   __numeric/midpoint.h
   __numeric/partial_sum.h
   __numeric/pstl_reduce.h
   __numeric/pstl_transform_reduce.h
   __numeric/reduce.h
   __numeric/transform_exclusive_scan.h
   __numeric/transform_inclusive_scan.h
   __numeric/transform_reduce.h
+  __overridable_function
   __pstl/internal/algorithm_fwd.h
   __pstl/internal/algorithm_impl.h
   __pstl/internal/execution_defs.h
   __pstl/internal/execution_impl.h
   __pstl/internal/glue_algorithm_defs.h
   __pstl/internal/glue_algorithm_impl.h
   __pstl/internal/glue_memory_defs.h
   __pstl/internal/glue_memory_impl.h

libcxx/include/__overridable_function

+// -*- C++ -*-
+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef _LIBCPP___OVERRIDABLE_FUNCTION
+#define _LIBCPP___OVERRIDABLE_FUNCTION
+
+#include <__config>
+#include <cstdint>
+
+_LIBCPP_BEGIN_NAMESPACE_STD
+
+#define _LIBCPP_MAKE_OVERRIDABLE_FUNCTION_DETECTABLE                                                                   \
+  __attribute__((__section__("__TEXT,__lcxx_override,regular,pure_instructions")))
+
+template <class _Ret, class... _Args>
+_LIBCPP_HIDE_FROM_ABI bool __is_function_overridden(_Ret (*__ptr)(_Args...)) noexcept {
+  // The linker places these at the start/end of the __lcxx_override section,
+  // which is where we put the definitions for any overridable function, via
+  // _LIBCPP_MAKE_OVERRIDABLE_FUNCTION_DETECTABLE.
+  //
+  // Placing the function in a separate section allows for this logic to be applied
+  // even in the scenario where clients are statically linking against libc++/libc++abi.
+  extern const uintptr_t __lcxx_override_start __asm("section$start$__TEXT$__lcxx_override");
+  extern const uintptr_t __lcxx_override_end __asm("section$end$__TEXT$__lcxx_override");
+  uintptr_t* __uptr = reinterpret_cast<uintptr_t*>(__ptr);
+
+  return __uptr < &__lcxx_override_start || __uptr > &__lcxx_override_end;
+}
+
+_LIBCPP_END_NAMESPACE_STD
+
+#endif // _LIBCPP___OVERRIDABLE_FUNCTION

libcxx/include/new

 void  operator delete[](void* ptr, void*) noexcept;
 
 */
 
 #include <__assert> // all public C++ headers provide the assertion handler
 #include <__availability>
 #include <__config>
 #include <__exception/exception.h>
+#include <__overridable_function>
 #include <__type_traits/alignment_of.h>
 #include <__type_traits/is_function.h>
 #include <__type_traits/is_same.h>
 #include <__type_traits/remove_cv.h>
 #include <__verbose_abort>
 #include <cstddef>
 #include <cstdlib>
 #include <version>

 #if defined(_LIBCPP_CXX03_LANG)
 #define _THROW_BAD_ALLOC throw(std::bad_alloc)
 #else
 #define _THROW_BAD_ALLOC
 #endif
 
 #if !defined(_LIBCPP_ABI_VCRUNTIME)
 
-_LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS void* operator new(std::size_t __sz) _THROW_BAD_ALLOC;
+_LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS _LIBCPP_MAKE_OVERRIDABLE_FUNCTION_DETECTABLE void* operator new(std::size_t __sz) _THROW_BAD_ALLOC;
 _LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS void* operator new(std::size_t __sz, const std::nothrow_t&) _NOEXCEPT _LIBCPP_NOALIAS;
 _LIBCPP_OVERRIDABLE_FUNC_VIS void  operator delete(void* __p) _NOEXCEPT;
 _LIBCPP_OVERRIDABLE_FUNC_VIS void  operator delete(void* __p, const std::nothrow_t&) _NOEXCEPT;
 #ifndef _LIBCPP_HAS_NO_LIBRARY_SIZED_DEALLOCATION
 _LIBCPP_OVERRIDABLE_FUNC_VIS _LIBCPP_AVAILABILITY_SIZED_NEW_DELETE void  operator delete(void* __p, std::size_t __sz) _NOEXCEPT;
 #endif
 
-_LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS void* operator new[](std::size_t __sz) _THROW_BAD_ALLOC;
+_LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS _LIBCPP_MAKE_OVERRIDABLE_FUNCTION_DETECTABLE void* operator new[](std::size_t __sz) _THROW_BAD_ALLOC;
 _LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS void* operator new[](std::size_t __sz, const std::nothrow_t&) _NOEXCEPT _LIBCPP_NOALIAS;
 _LIBCPP_OVERRIDABLE_FUNC_VIS void  operator delete[](void* __p) _NOEXCEPT;
 _LIBCPP_OVERRIDABLE_FUNC_VIS void  operator delete[](void* __p, const std::nothrow_t&) _NOEXCEPT;
 #ifndef _LIBCPP_HAS_NO_LIBRARY_SIZED_DEALLOCATION
 _LIBCPP_OVERRIDABLE_FUNC_VIS _LIBCPP_AVAILABILITY_SIZED_NEW_DELETE void  operator delete[](void* __p, std::size_t __sz) _NOEXCEPT;
 #endif
 
 #ifndef _LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION
-_LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS void* operator new(std::size_t __sz, std::align_val_t) _THROW_BAD_ALLOC;
+_LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS _LIBCPP_MAKE_OVERRIDABLE_FUNCTION_DETECTABLE void* operator new(std::size_t __sz, std::align_val_t) _THROW_BAD_ALLOC;
 _LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS void* operator new(std::size_t __sz, std::align_val_t, const std::nothrow_t&) _NOEXCEPT _LIBCPP_NOALIAS;
 _LIBCPP_OVERRIDABLE_FUNC_VIS void  operator delete(void* __p, std::align_val_t) _NOEXCEPT;
 _LIBCPP_OVERRIDABLE_FUNC_VIS void  operator delete(void* __p, std::align_val_t, const std::nothrow_t&) _NOEXCEPT;
 #ifndef _LIBCPP_HAS_NO_LIBRARY_SIZED_DEALLOCATION
 _LIBCPP_OVERRIDABLE_FUNC_VIS _LIBCPP_AVAILABILITY_SIZED_NEW_DELETE void  operator delete(void* __p, std::size_t __sz, std::align_val_t) _NOEXCEPT;
 #endif
 
-_LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS void* operator new[](std::size_t __sz, std::align_val_t) _THROW_BAD_ALLOC;
+_LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS _LIBCPP_MAKE_OVERRIDABLE_FUNCTION_DETECTABLE void* operator new[](std::size_t __sz, std::align_val_t) _THROW_BAD_ALLOC;
 _LIBCPP_NODISCARD_AFTER_CXX17 _LIBCPP_OVERRIDABLE_FUNC_VIS void* operator new[](std::size_t __sz, std::align_val_t, const std::nothrow_t&) _NOEXCEPT _LIBCPP_NOALIAS;
 _LIBCPP_OVERRIDABLE_FUNC_VIS void  operator delete[](void* __p, std::align_val_t) _NOEXCEPT;
 _LIBCPP_OVERRIDABLE_FUNC_VIS void  operator delete[](void* __p, std::align_val_t, const std::nothrow_t&) _NOEXCEPT;
 #ifndef _LIBCPP_HAS_NO_LIBRARY_SIZED_DEALLOCATION
 _LIBCPP_OVERRIDABLE_FUNC_VIS _LIBCPP_AVAILABILITY_SIZED_NEW_DELETE void  operator delete[](void* __p, std::size_t __sz, std::align_val_t) _NOEXCEPT;
 #endif
 #endif
 

libcxx/src/new.cpp

 //===----------------------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include <__memory/aligned_alloc.h>
+#include <__overridable_function>
 #include <cstdlib>
 #include <new>
 
 #if !defined(__GLIBCXX__) && !defined(_LIBCPP_ABI_VCRUNTIME)
 
 // The code below is copied as-is into libc++abi's libcxxabi/src/stdlib_new_delete.cpp
 // file. The version in this file is the canonical one.
 
static void* operator_new_impl(std::size_t size) noexcept {
     }
     return p;
 }
 
 _LIBCPP_WEAK
 void *
 operator new(std::size_t size) _THROW_BAD_ALLOC
 {
-    void* p = allocate_impl(size);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    void* p = operator_new_impl(size);
     if (p == nullptr)
-        throw std::bad_alloc();
-#endif
+        std::__throw_bad_alloc();
     return p;
 }
 
 _LIBCPP_WEAK
 void*
 operator new(size_t size, const std::nothrow_t&) noexcept
 {
+#ifdef _LIBCPP_HAS_NO_EXCEPTIONS
+    _LIBCPP_ASSERT(!std::__is_function_overridden(&operator new(size_t)),
+        "libc++ was configured with exceptions disabled and `operator new(size_t)` has been overridden, "
+        "but `operator new(size_t, nothrow_t)` has not been overridden. This is problematic because "
+        "`operator new(size_t, nothrow_t)` must call `operator new(size_t)`, which will terminate in case "
+        "it fails to allocate, making it impossible for `operator new(size_t, nothrow_t)` to fulfill its "
+        "contract (since it should return nullptr upon failure).");
+
+    return operator_new_impl(size);
+#else
     void* p = nullptr;
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
-    try
-    {
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
+    try {
         p = ::operator new(size);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    } catch (...) {
     }
-    catch (...)
-    {
-    }
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
     return p;
+#endif
 }
 
 _LIBCPP_WEAK
 void*
 operator new[](size_t size) _THROW_BAD_ALLOC
 {
     return ::operator new(size);
 }
 
 _LIBCPP_WEAK
 void*
 operator new[](size_t size, const std::nothrow_t&) noexcept
 {
+#ifdef _LIBCPP_HAS_NO_EXCEPTIONS
+    _LIBCPP_ASSERT(!std::__is_function_overridden(&operator new[](size_t)),
+        "libc++ was configured with exceptions disabled and `operator new[](size_t)` has been overridden, "
+        "but `operator new[](size_t, nothrow_t)` has not been overridden. This is problematic because "
+        "`operator new[](size_t, nothrow_t)` must call `operator new[](size_t)`, which will terminate in case "
+        "it fails to allocate, making it impossible for `operator new[](size_t, nothrow_t)` to fulfill its "
+        "contract (since it should return nullptr upon failure).");
+
+    return operator_new_impl(size);
+#else
     void* p = nullptr;
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
-    try
-    {
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
+    try {
         p = ::operator new[](size);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    } catch (...) {
     }
-    catch (...)
-    {
-    }
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
     return p;
+#endif
 }
 
 _LIBCPP_WEAK
 void
 operator delete(void* ptr) noexcept
 {
     std::free(ptr);
 }
static void* operator_new_aligned_impl(std::size_t size, std::align_val_t alignment) noexcept {
     return p;
 }
 
 _LIBCPP_WEAK
 void *
 operator new(std::size_t size, std::align_val_t alignment) _THROW_BAD_ALLOC
 {
     void* p = operator_new_aligned_impl(size, alignment);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
     if (p == nullptr)
-        throw std::bad_alloc();
-#endif
+        std::__throw_bad_alloc();
     return p;
 }
 
 _LIBCPP_WEAK
 void*
 operator new(size_t size, std::align_val_t alignment, const std::nothrow_t&) noexcept
 {
+#ifdef _LIBCPP_HAS_NO_EXCEPTIONS
+    _LIBCPP_ASSERT(!std::__is_function_overridden(&operator new(std::size_t, std::align_val_t)),
+        "libc++ was configured with exceptions disabled and `operator new(size_t, align_val_t)` has been overridden, "
+        "but `operator new(size_t, align_val_t, nothrow_t)` has not been overridden. This is problematic because "
+        "`operator new(size_t, align_val_t, nothrow_t)` must call `operator new(size_t, align_val_t)`, which will "
+        "terminate in case it fails to allocate, making it impossible for `operator new(size_t, align_val_t, nothrow_t)` "
+        "to fulfill its contract (since it should return nullptr upon failure).");
+
+    return operator_new_aligned_impl(size, alignment);
+#else
     void* p = nullptr;
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
-    try
-    {
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
+    try {
         p = ::operator new(size, alignment);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    } catch (...) {
     }
-    catch (...)
-    {
-    }
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
     return p;
+#endif
 }
 
 _LIBCPP_WEAK
 void*
 operator new[](size_t size, std::align_val_t alignment) _THROW_BAD_ALLOC
 {
     return ::operator new(size, alignment);
 }
 
 _LIBCPP_WEAK
 void*
 operator new[](size_t size, std::align_val_t alignment, const std::nothrow_t&) noexcept
 {
+#ifdef _LIBCPP_HAS_NO_EXCEPTIONS
+    _LIBCPP_ASSERT(!std::__is_function_overridden(&operator new[](std::size_t, std::align_val_t)),
+        "libc++ was configured with exceptions disabled and `operator new[](size_t, align_val_t)` has been overridden, "
+        "but `operator new[](size_t, align_val_t, nothrow_t)` has not been overridden. This is problematic because "
+        "`operator new[](size_t, align_val_t, nothrow_t)` must call `operator new[](size_t, align_val_t)`, which will "
+        "terminate in case it fails to allocate, making it impossible for `operator new[](size_t, align_val_t, nothrow_t)` "
+        "to fulfill its contract (since it should return nullptr upon failure).");
+
+    return operator_new_aligned_impl(size, alignment);
+#else
     void* p = nullptr;
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
-    try
-    {
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
+    try {
         p = ::operator new[](size, alignment);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    } catch (...) {
     }
-    catch (...)
-    {
-    }
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
     return p;
+#endif
 }
 
 _LIBCPP_WEAK
 void
 operator delete(void* ptr, std::align_val_t) noexcept
 {
     std::__libcpp_aligned_free(ptr);
 }

libcxx/test/libcxx/language.support/support.dynamic/new_dont_return_nullptr.pass.cpp

+//===----------------------------------------------------------------------===//
+//
+// Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
+// See https://llvm.org/LICENSE.txt for license information.
+// SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
+//
+//===----------------------------------------------------------------------===//
+
+// void* operator new(std::size_t);
+// void* operator new(std::size_t, std::align_val_t);
+// void* operator new[](std::size_t);
+// void* operator new[](std::size_t, std::align_val_t);
+
+// This test ensures that we abort the program instead of returning nullptr
+// when we fail to satisfy the allocation request. The throwing versions of
+// `operator new` must never return nullptr on failure to allocate (per the
+// Standard) and the compiler actually relies on that for optimizations.
+// Returning nullptr from the throwing `operator new` can basically result
+// in miscompiles.
+
+// REQUIRES: has-unix-headers
+// REQUIRES: no-exceptions
+// UNSUPPORTED: c++03, c++11, c++14
+
+#include <cstddef>
+#include <limits>
+#include <new>
+
+#include "check_assertion.h"
+
+int main(int, char**) {
+    EXPECT_DEATH((void)operator new(std::numeric_limits<std::size_t>::max()));
+    EXPECT_DEATH((void)operator new(std::numeric_limits<std::size_t>::max(), static_cast<std::align_val_t>(32)));
+    EXPECT_DEATH((void)operator new[](std::numeric_limits<std::size_t>::max()));
+    EXPECT_DEATH((void)operator new[](std::numeric_limits<std::size_t>::max(), static_cast<std::align_val_t>(32)));
+    return 0;
+}

libcxxabi/src/stdlib_new_delete.cpp

 //===----------------------------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 
 #include "__cxxabi_config.h"
 #include <__memory/aligned_alloc.h>
+#include <__overridable_function>
 #include <cstdlib>
 #include <new>
 
 // Perform a few sanity checks on libc++ and libc++abi macros to ensure that
 // the code below can be an exact copy of the code in libcxx/src/new.cpp.
 #if !defined(_THROW_BAD_ALLOC)
 #  error The _THROW_BAD_ALLOC macro should be already defined by libc++
 #endif
 
 #ifndef _LIBCPP_WEAK
 #  error The _LIBCPP_WEAK macro should be already defined by libc++
 #endif
 
 #if defined(_LIBCXXABI_NO_EXCEPTIONS) != defined(_LIBCPP_HAS_NO_EXCEPTIONS)
 #  error libc++ and libc++abi seem to disagree on whether exceptions are enabled
 #endif
 
 // ------------------ BEGIN COPY ------------------
 // Implement all new and delete operators as weak definitions
 // in this shared library, so that they can be overridden by programs
 // that define non-weak copies of the functions.
 
-static void* operator_new_impl(std::size_t size) {
+static void* operator_new_impl(std::size_t size) noexcept {
     if (size == 0)
         size = 1;
     void* p;
     while ((p = std::malloc(size)) == nullptr) {
         // If malloc fails and there is a new_handler,
         // call it to try free up memory.
         std::new_handler nh = std::get_new_handler();
         if (nh)
             nh();
         else
             break;
     }
     return p;
 }
 
 _LIBCPP_WEAK
 void *
 operator new(std::size_t size) _THROW_BAD_ALLOC
 {
-    void* p = allocate_impl(size);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    void* p = operator_new_impl(size);
     if (p == nullptr)
-        throw std::bad_alloc();
-#endif
+        std::__throw_bad_alloc();
     return p;
 }
 
 _LIBCPP_WEAK
 void*
 operator new(size_t size, const std::nothrow_t&) noexcept
 {
+#ifdef _LIBCPP_HAS_NO_EXCEPTIONS
+    _LIBCPP_ASSERT(!std::__is_function_overridden(&operator new(size_t)),
+        "libc++ was configured with exceptions disabled and `operator new(size_t)` has been overridden, "
+        "but `operator new(size_t, nothrow_t)` has not been overridden. This is problematic because "
+        "`operator new(size_t, nothrow_t)` must call `operator new(size_t)`, which will terminate in case "
+        "it fails to allocate, making it impossible for `operator new(size_t, nothrow_t)` to fulfill its "
+        "contract (since it should return nullptr upon failure).");
+
+    return operator_new_impl(size);
+#else
     void* p = nullptr;
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
-    try
-    {
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
+    try {
         p = ::operator new(size);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    } catch (...) {
     }
-    catch (...)
-    {
-    }
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
     return p;
+#endif
 }
 
 _LIBCPP_WEAK
 void*
 operator new[](size_t size) _THROW_BAD_ALLOC
 {
     return ::operator new(size);
 }
 
 _LIBCPP_WEAK
 void*
 operator new[](size_t size, const std::nothrow_t&) noexcept
 {
+#ifdef _LIBCPP_HAS_NO_EXCEPTIONS
+    _LIBCPP_ASSERT(!std::__is_function_overridden(&operator new[](size_t)),
+        "libc++ was configured with exceptions disabled and `operator new[](size_t)` has been overridden, "
+        "but `operator new[](size_t, nothrow_t)` has not been overridden. This is problematic because "
+        "`operator new[](size_t, nothrow_t)` must call `operator new[](size_t)`, which will terminate in case "
+        "it fails to allocate, making it impossible for `operator new[](size_t, nothrow_t)` to fulfill its "
+        "contract (since it should return nullptr upon failure).");
+
+    return operator_new_impl(size);
+#else
     void* p = nullptr;
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
-    try
-    {
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
+    try {
         p = ::operator new[](size);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    } catch (...) {
     }
-    catch (...)
-    {
-    }
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
     return p;
+#endif
 }
 
 _LIBCPP_WEAK
 void
 operator delete(void* ptr) noexcept
 {
     std::free(ptr);
 }

 void
 operator delete[] (void* ptr, size_t) noexcept
 {
     ::operator delete[](ptr);
 }
 
 #if !defined(_LIBCPP_HAS_NO_LIBRARY_ALIGNED_ALLOCATION)
 
-static void* operator_new_aligned_impl(std::size_t size, std::align_val_t alignment) {
+static void* operator_new_aligned_impl(std::size_t size, std::align_val_t alignment) noexcept {
     if (size == 0)
         size = 1;
     if (static_cast<size_t>(alignment) < sizeof(void*))
       alignment = std::align_val_t(sizeof(void*));
 
     // Try allocating memory. If allocation fails and there is a new_handler,
     // call it to try free up memory, and try again until it succeeds, or until
     // the new_handler decides to terminate.
     void* p;
     while ((p = std::__libcpp_aligned_alloc(static_cast<std::size_t>(alignment), size)) == nullptr) {
         std::new_handler nh = std::get_new_handler();
         if (nh)
             nh();
         else
             break;
     }
     return p;
 }
 
 _LIBCPP_WEAK
 void *
 operator new(std::size_t size, std::align_val_t alignment) _THROW_BAD_ALLOC
 {
     void* p = operator_new_aligned_impl(size, alignment);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
     if (p == nullptr)
-        throw std::bad_alloc();
-#endif
+        std::__throw_bad_alloc();
     return p;
 }
 
 _LIBCPP_WEAK
 void*
 operator new(size_t size, std::align_val_t alignment, const std::nothrow_t&) noexcept
 {
+#ifdef _LIBCPP_HAS_NO_EXCEPTIONS
+    _LIBCPP_ASSERT(!std::__is_function_overridden(&operator new(std::size_t, std::align_val_t)),
+        "libc++ was configured with exceptions disabled and `operator new(size_t, align_val_t)` has been overridden, "
+        "but `operator new(size_t, align_val_t, nothrow_t)` has not been overridden. This is problematic because "
+        "`operator new(size_t, align_val_t, nothrow_t)` must call `operator new(size_t, align_val_t)`, which will "
+        "terminate in case it fails to allocate, making it impossible for `operator new(size_t, align_val_t, nothrow_t)` "
+        "to fulfill its contract (since it should return nullptr upon failure).");
+
+    return operator_new_aligned_impl(size, alignment);
+#else
     void* p = nullptr;
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
-    try
-    {
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
+    try {
         p = ::operator new(size, alignment);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    } catch (...) {
     }
-    catch (...)
-    {
-    }
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
     return p;
+#endif
 }
 
 _LIBCPP_WEAK
 void*
 operator new[](size_t size, std::align_val_t alignment) _THROW_BAD_ALLOC
 {
     return ::operator new(size, alignment);
 }
 
 _LIBCPP_WEAK
 void*
 operator new[](size_t size, std::align_val_t alignment, const std::nothrow_t&) noexcept
 {
+#ifdef _LIBCPP_HAS_NO_EXCEPTIONS
+    _LIBCPP_ASSERT(!std::__is_function_overridden(&operator new[](std::size_t, std::align_val_t)),
+        "libc++ was configured with exceptions disabled and `operator new[](size_t, align_val_t)` has been overridden, "
+        "but `operator new[](size_t, align_val_t, nothrow_t)` has not been overridden. This is problematic because "
+        "`operator new[](size_t, align_val_t, nothrow_t)` must call `operator new[](size_t, align_val_t)`, which will "
+        "terminate in case it fails to allocate, making it impossible for `operator new[](size_t, align_val_t, nothrow_t)` "
+        "to fulfill its contract (since it should return nullptr upon failure).");
+
+    return operator_new_aligned_impl(size, alignment);
+#else
     void* p = nullptr;
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
-    try
-    {
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
+    try {
         p = ::operator new[](size, alignment);
-#ifndef _LIBCPP_HAS_NO_EXCEPTIONS
+    } catch (...) {
     }
-    catch (...)
-    {
-    }
-#endif // _LIBCPP_HAS_NO_EXCEPTIONS
     return p;
+#endif
 }
 
 _LIBCPP_WEAK
 void
 operator delete(void* ptr, std::align_val_t) noexcept
 {
     std::__libcpp_aligned_free(ptr);
 }