[Clang][UBSan] Fix the crash caused by __builtin_assume_aligned with -no-opaque-pointers enabled

[yronglin]

Summary

Fix issue: https://github.com/llvm/llvm-project/issues/62868

[yronglin]

Try fix test.

[yronglin]

The col number in diagnostic message seems not correct https://godbolt.org/z/jnG5orhYW

[yronglin]

ping~

[yronglin]

ping~

[erichkeane]

I don't know much about this section, but I DO note that the pre-commit CI failures all seem related here.

[yronglin]

In D151121#4378402, @yronglin wrote:

The col number in diagnostic message seems not correct https://godbolt.org/z/jnG5orhYW

Thanks for your review @erichkeane , the column number in diagnostic message seems not correct https://godbolt.org/z/jnG5orhYW

clang/lib/CodeGen/CodeGenFunction.h

   /// Pass the result to unprotectFromPeepholes to declare that
   /// protection is no longer required.
   ///
   /// There's no particular reason why this shouldn't apply to
   /// l-values, it's just that no existing peepholes work on pointers.
   PeepholeProtection protectFromPeepholes(RValue rvalue);
   void unprotectFromPeepholes(PeepholeProtection protection);
 
-  void emitAlignmentAssumptionCheck(llvm::Value *Ptr, QualType Ty,
+  void emitAlignmentAssumptionCheck(llvm::Value *Ptr, QualType WrittenTy,
                                     SourceLocation Loc,
                                     SourceLocation AssumptionLoc,
                                     llvm::Value *Alignment,
                                     llvm::Value *OffsetValue,
                                     llvm::Value *TheCheck,
                                     llvm::Instruction *Assumption);
 
-  void emitAlignmentAssumption(llvm::Value *PtrValue, QualType Ty,
+  void emitAlignmentAssumption(llvm::Value *PtrValue, QualType PtrTy,
                                SourceLocation Loc, SourceLocation AssumptionLoc,
                                llvm::Value *Alignment,
                                llvm::Value *OffsetValue = nullptr);
 
-  void emitAlignmentAssumption(llvm::Value *PtrValue, const Expr *E,
+  void emitAlignmentAssumption(llvm::Value *PtrValue, const Expr *PtrExpr,
                                SourceLocation AssumptionLoc,
                                llvm::Value *Alignment,
                                llvm::Value *OffsetValue = nullptr);
 
   //===--------------------------------------------------------------------===//
   //                             Statement Emission
   //===--------------------------------------------------------------------===//
 

clang/lib/CodeGen/CodeGenFunction.cpp

 void CodeGenFunction::unprotectFromPeepholes(PeepholeProtection protection) {
   if (!protection.Inst) return;
 
   // In theory, we could try to duplicate the peepholes now, but whatever.
   protection.Inst->eraseFromParent();
 }
 
 void CodeGenFunction::emitAlignmentAssumption(llvm::Value *PtrValue,
-                                              QualType Ty, SourceLocation Loc,
+                                              QualType WrittenTy,
+                                              SourceLocation Loc,
                                               SourceLocation AssumptionLoc,
                                               llvm::Value *Alignment,
                                               llvm::Value *OffsetValue) {
   if (Alignment->getType() != IntPtrTy)
     Alignment =
         Builder.CreateIntCast(Alignment, IntPtrTy, false, "casted.align");
   if (OffsetValue && OffsetValue->getType() != IntPtrTy)
     OffsetValue =
if (SanOpts.has(SanitizerKind::Alignment)) {
     llvm::Value *MaskedPtr = Builder.CreateAnd(PtrIntValue, Mask, "maskedptr");
     TheCheck = Builder.CreateICmpEQ(MaskedPtr, Zero, "maskcond");
   }
   llvm::Instruction *Assumption = Builder.CreateAlignmentAssumption(
       CGM.getDataLayout(), PtrValue, Alignment, OffsetValue);
 
   if (!SanOpts.has(SanitizerKind::Alignment))
     return;
-  emitAlignmentAssumptionCheck(PtrValue, Ty, Loc, AssumptionLoc, Alignment,
-                               OffsetValue, TheCheck, Assumption);
+  emitAlignmentAssumptionCheck(PtrValue, WrittenTy, Loc, AssumptionLoc,
+                               Alignment, OffsetValue, TheCheck, Assumption);
 }
 
 void CodeGenFunction::emitAlignmentAssumption(llvm::Value *PtrValue,
-                                              const Expr *E,
+                                              const Expr *PtrExpr,
                                               SourceLocation AssumptionLoc,
                                               llvm::Value *Alignment,
                                               llvm::Value *OffsetValue) {
-  QualType Ty = E->getType();
-  SourceLocation Loc = E->getExprLoc();
-
-  emitAlignmentAssumption(PtrValue, Ty, Loc, AssumptionLoc, Alignment,
+  // Written type used to build TypeDescriptor.
+  QualType WrittenTy;
+  if (auto *CE = dyn_cast<CastExpr>(PtrExpr)) {
+    WrittenTy = CE->getSubExprAsWritten()->getType();
+  } else {
+    WrittenTy = PtrExpr->getType();
+  }
+  SourceLocation Loc = PtrExpr->getExprLoc();
+  emitAlignmentAssumption(PtrValue, WrittenTy, Loc, AssumptionLoc, Alignment,
                           OffsetValue);
 }
 
 llvm::Value *CodeGenFunction::EmitAnnotationCall(llvm::Function *AnnotationFn,
                                                  llvm::Value *AnnotatedVal,
                                                  StringRef AnnotationStr,
                                                  SourceLocation Location,
                                                  const AnnotateAttr *Attr) {

 
 // Loc - where the diagnostic will point, where in the source code this
 //  alignment has failed.
 // SecondaryLoc - if present (will be present if sufficiently different from
 //  Loc), the diagnostic will additionally point a "Note:" to this location.
 //  It should be the location where the __attribute__((assume_aligned))
 //  was written e.g.
 void CodeGenFunction::emitAlignmentAssumptionCheck(
-    llvm::Value *Ptr, QualType Ty, SourceLocation Loc,
+    llvm::Value *Ptr, QualType WrittenTy, SourceLocation Loc,
     SourceLocation SecondaryLoc, llvm::Value *Alignment,
     llvm::Value *OffsetValue, llvm::Value *TheCheck,
     llvm::Instruction *Assumption) {
   assert(Assumption && isa<llvm::CallInst>(Assumption) &&
          cast<llvm::CallInst>(Assumption)->getCalledOperand() ==
              llvm::Intrinsic::getDeclaration(
                  Builder.GetInsertBlock()->getParent()->getParent(),
                  llvm::Intrinsic::assume) &&
          "Assumption should be a call to llvm.assume().");
   assert(&(Builder.GetInsertBlock()->back()) == Assumption &&
          "Assumption should be the last instruction of the basic block, "
          "since the basic block is still being generated.");
 
   if (!SanOpts.has(SanitizerKind::Alignment))
     return;
 
   // Don't check pointers to volatile data. The behavior here is implementation-
   // defined.
-  if (Ty->getPointeeType().isVolatileQualified())
+  // The volatile qualifier on PtrTy will be ignored in Sema, we try to find
+  // volatile in WrittenTy as a workaround.
+  if ((WrittenTy->isPointerType() &&
+       WrittenTy->getPointeeType().isVolatileQualified()) ||
+      (WrittenTy->isArrayType() && WrittenTy.isVolatileQualified())) {
     return;
+  }
 
   // We need to temorairly remove the assumption so we can insert the
   // sanitizer check before it, else the check will be dropped by optimizations.
   Assumption->removeFromParent();
 
   {
     SanitizerScope SanScope(this);
 
     if (!OffsetValue)
       OffsetValue = Builder.getInt1(false); // no offset.
 
     llvm::Constant *StaticData[] = {EmitCheckSourceLocation(Loc),
                                     EmitCheckSourceLocation(SecondaryLoc),
-                                    EmitCheckTypeDescriptor(Ty)};
+                                    EmitCheckTypeDescriptor(WrittenTy)};
     llvm::Value *DynamicData[] = {EmitCheckValue(Ptr),
                                   EmitCheckValue(Alignment),
                                   EmitCheckValue(OffsetValue)};
     EmitCheck({std::make_pair(TheCheck, SanitizerKind::Alignment)},
               SanitizerHandler::AlignmentAssumption, StaticData, DynamicData);
   }
 
   // We are now in the (new, empty) "cont" basic block.

clang/lib/Sema/SemaChecking.cpp

 }
 
 /// Handle __builtin_assume_aligned. This is declared
 /// as (const void*, size_t, ...) and can take one optional constant int arg.
 bool Sema::SemaBuiltinAssumeAligned(CallExpr *TheCall) {
   if (checkArgCountRange(*this, TheCall, 2, 3))
     return true;
 
-  unsigned NumArgs = TheCall->getNumArgs();
-  Expr *FirstArg = TheCall->getArg(0);
-
-  {
-    ExprResult FirstArgResult =
-        DefaultFunctionArrayLvalueConversion(FirstArg);
-    if (checkBuiltinArgument(*this, TheCall, 0))
-      return true;
-    /// In-place updation of FirstArg by checkBuiltinArgument is ignored.
-    TheCall->setArg(0, FirstArgResult.get());
-  }
 
   // The alignment must be a constant integer.
   Expr *SecondArg = TheCall->getArg(1);
 
   // We can't check the value of a dependent argument.
   if (!SecondArg->isValueDependent()) {
     llvm::APSInt Result;
     if (SemaBuiltinConstantArg(TheCall, 1, Result))
       return true;
 
     if (!Result.isPowerOf2())
       return Diag(TheCall->getBeginLoc(), diag::err_alignment_not_power_of_two)
              << SecondArg->getSourceRange();
 
     if (Result > Sema::MaximumAlignment)
       Diag(TheCall->getBeginLoc(), diag::warn_assume_aligned_too_great)
           << SecondArg->getSourceRange() << Sema::MaximumAlignment;
   }
 
-  if (NumArgs > 2) {
+  if (TheCall->getNumArgs() > 2) {
     Expr *ThirdArg = TheCall->getArg(2);
     if (convertArgumentToType(*this, ThirdArg, Context.getSizeType()))
       return true;
     TheCall->setArg(2, ThirdArg);
   }
 
   return false;
 }

clang/test/CodeGen/catch-alignment-assumption-array.c

 // RUN: %clang_cc1 -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s
 // RUN: %clang_cc1 -fsanitize=alignment -fno-sanitize-recover=alignment -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s -implicit-check-not="call void @__ubsan_handle_alignment_assumption" --check-prefixes=CHECK,CHECK-SANITIZE,CHECK-SANITIZE-ANYRECOVER,CHECK-SANITIZE-NORECOVER,CHECK-SANITIZE-UNREACHABLE
 // RUN: %clang_cc1 -fsanitize=alignment -fsanitize-recover=alignment -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s -implicit-check-not="call void @__ubsan_handle_alignment_assumption" --check-prefixes=CHECK,CHECK-SANITIZE,CHECK-SANITIZE-ANYRECOVER,CHECK-SANITIZE-RECOVER
 // RUN: %clang_cc1 -fsanitize=alignment -fsanitize-trap=alignment -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s -implicit-check-not="call void @__ubsan_handle_alignment_assumption" --check-prefixes=CHECK,CHECK-SANITIZE,CHECK-SANITIZE-TRAP,CHECK-SANITIZE-UNREACHABLE
 
-// CHECK-SANITIZE-ANYRECOVER: @[[CHAR:.*]] = {{.*}} c"'char *'\00" }
+// CHECK-SANITIZE-ANYRECOVER: @[[CHAR:.*]] = {{.*}} c"'char[1]'\00" }
 // CHECK-SANITIZE-ANYRECOVER: @[[ALIGNMENT_ASSUMPTION:.*]] = {{.*}}, i32 30, i32 35 }, {{.*}} @[[CHAR]] }
 
 void *caller(void) {
   char str[] = "";
   // CHECK:                           define{{.*}}
   // CHECK-NEXT:                      entry:
   // CHECK-NEXT:                        %[[STR:.*]] = alloca [1 x i8], align 1
   // CHECK-NEXT:                        call void @llvm.memset.p0.i64(ptr align 1 %[[STR]], i8 0, i64 1, i1 false)

clang/test/CodeGen/catch-alignment-assumption-builtin_assume_aligned-polymorphism-no-opaque-ptr.cpp

+// RUN: %clang_cc1 -no-opaque-pointers -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s
+// RUN: %clang_cc1 -no-opaque-pointers -fsanitize=alignment -fno-sanitize-recover=alignment -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s -implicit-check-not="call void @__ubsan_handle_alignment_assumption" --check-prefixes=CHECK,CHECK-SANITIZE,CHECK-SANITIZE-ANYRECOVER,CHECK-SANITIZE-NORECOVER,CHECK-SANITIZE-UNREACHABLE
+// RUN: %clang_cc1 -no-opaque-pointers -fsanitize=alignment -fsanitize-recover=alignment -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s -implicit-check-not="call void @__ubsan_handle_alignment_assumption" --check-prefixes=CHECK,CHECK-SANITIZE,CHECK-SANITIZE-ANYRECOVER,CHECK-SANITIZE-RECOVER
+// RUN: %clang_cc1 -no-opaque-pointers -fsanitize=alignment -fsanitize-trap=alignment -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s -implicit-check-not="call void @__ubsan_handle_alignment_assumption" --check-prefixes=CHECK,CHECK-SANITIZE,CHECK-SANITIZE-TRAP,CHECK-SANITIZE-UNREACHABLE
+
+// CHECK-SANITIZE-ANYRECOVER: @[[CHAR:.*]] = {{.*}} c"'B *'\00" }
+// CHECK-SANITIZE-ANYRECOVER: @[[LINE_100_ALIGNMENT_ASSUMPTION:.*]] = {{.*}}, i32 100, i32 35 }, {{.*}} @[[CHAR]] }
+
+struct A { int n; };
+struct B { int n; };
+struct C : A, B {};
+
+void *f(C *c) {
+  // CHECK:                             define {{.*}} i8* @{{.*}}(%struct.C* noundef %[[C:.*]]) {{.*}} {
+  // CHECK-NEXT:                        [[ENTRY:.*]]:
+  // CHECK-NEXT:                          %[[C_ADDR:.*]] = alloca %struct.C*
+  // CHECK-NEXT:                          store  %struct.C* %[[C]], %struct.C** %[[C_ADDR]]
+  // CHECK-NEXT:                          %[[C_RELOAD:.*]] = load %struct.C*, %struct.C** %[[C_ADDR]]
+  // CHECK-NEXT:                          %[[IS_NULL:.*]] = icmp eq %struct.C* %[[C_RELOAD]], null
+  // CHECK-NEXT:                          br i1 %[[IS_NULL]], label %[[CAST_END:[^,]+]], label %[[CAST_NOT_NULL:[^,]+]]
+  // CHECK:                             [[CAST_NOT_NULL]]:
+  // CHECK-NOSANITIZE-NEXT:               %[[ADD_PTR:.*]] = getelementptr inbounds i8, ptr %[[C_RELOAD]], i64 4
+  // CHECK-NOSANITIZE-NEXT:               br label %[[CAST_END]]
+  // CHECK-SANITIZE-NEXT:                 %[[PTRTOINT:.*]] = ptrtoint %struct.C* %[[C_RELOAD]] to i64
+  // CHECK-SANITIZE-NEXT:                 %[[MASKEDPTR:.*]] = and i64 %[[PTRTOINT]], 3
+  // CHECK-SANITIZE-NEXT:                 %[[MASKCOND:.*]] = icmp eq i64 %[[MASKEDPTR]], 0
+  // CHECK-SANITIZE-NEXT:                 br i1 %[[MASKCOND]], label %[[CONT:[^,]+]], label %[[HANDLER_TYPE_MISMATCH:[^,]+]]
+  // CHECK-SANITIZE:                    [[HANDLER_TYPE_MISMATCH]]:
+  // CHECK-SANITIZE-NORECOVER-NEXT:       call void @__ubsan_handle_type_mismatch_v1_abort(
+  // CHECK-SANITIZE-RECOVER-NEXT:         call void @__ubsan_handle_type_mismatch_v1(
+  // CHECK-SANITIZE-TRAP-NEXT:            call void @llvm.ubsantrap(
+  // CHECK-SANITIZE-UNREACHABLE-NEXT:     unreachable
+  // CHECK-SANITIZE:                    [[CONT]]:
+  // CHECK-SANITIZE-NEXT:                 %[[CONT_BITCAST:.*]] = bitcast %struct.C* %0 to i8*
+  // CHECK-SANITIZE-NEXT:                 %[[ADD_PTR:.*]] = getelementptr inbounds i8, i8* %[[CONT_BITCAST]], i64 4
+  // CHECK-SANITIZE-NEXT:                 %[[CONT_BITCAST1:.*]] = bitcast i8* %[[ADD_PTR]] to %struct.B*
+  // CHECK-SANITIZE-NEXT:                 br label %[[CAST_END]]
+  // CHECK:                             [[CAST_END]]:
+  // CHECK-NOSANITIZE-NEXT:               %[[CAST_RESULT:.*]] = phi %struct.B* [ %[[CONT_BITCAST1]], %[[CAST_NOT_NULL]] ], [ null, %[[ENTRY]] ]
+  // CHECK-NOSANITIZE-NEXT:               call void @llvm.assume(i1 true) [ "align"(ptr %[[CAST_RESULT]], i64 8) ]
+  // CHECK-NOSANITIZE-NEXT:               ret ptr %[[CAST_RESULT]]
+  // CHECK-NOSANITIZE-NEXT:              }
+  // CHECK-SANITIZE-NEXT:                 %[[CAST_RESULT:.*]] = phi %struct.B* [ %[[CONT_BITCAST1]], %[[CONT]] ], [ null, %[[ENTRY]] ]
+  // CHECK-SANITIZE-NEXT:                 %[[CAST_RESULT1:.*]] = bitcast %struct.B* %[[CAST_RESULT]] to i8*
+  // CHECK-SANITIZE-NEXT:                 %[[PTRINT:.*]] = ptrtoint i8* %[[CAST_RESULT1]] to i64
+  // CHECK-SANITIZE-NEXT:                 %[[MASKEDPTR:.*]] = and i64 %[[PTRINT]], 7
+  // CHECK-SANITIZE-NEXT:                 %[[MASKCOND:.*]] = icmp eq i64 %[[MASKEDPTR]], 0
+  // CHECK-SANITIZE-NEXT:                 %[[PTRINT_DUP:.*]] = ptrtoint i8* %[[CAST_RESULT1]] to i64
+  // CHECK-SANITIZE-NEXT:                 br i1 %[[MASKCOND]], label %[[CONT1:.*]], label %[[HANDLER_ALIGNMENT_ASSUMPTION:[^,]+]],{{.*}}
+  // CHECK-SANITIZE:                    [[HANDLER_ALIGNMENT_ASSUMPTION]]:
+  // CHECK-SANITIZE-NORECOVER-NEXT:       call void @__ubsan_handle_alignment_assumption_abort(i8* {{.*}}@[[LINE_100_ALIGNMENT_ASSUMPTION]]{{.*}}, i64 %[[PTRINT_DUP]], i64 8, i64 0){{.*}}
+  // CHECK-SANITIZE-RECOVER-NEXT:         call void @__ubsan_handle_alignment_assumption(i8* {{.*}}@[[LINE_100_ALIGNMENT_ASSUMPTION]]{{.*}}, i64 %[[PTRINT_DUP]], i64 8, i64 0){{.*}}
+  // CHECK-SANITIZE-TRAP-NEXT:            call void @llvm.ubsantrap(i8 23){{.*}}
+  // CHECK-SANITIZE-UNREACHABLE-NEXT:     unreachable
+  // CHECK-SANITIZE:                    [[CONT1]]:
+  // CHECK-SANITIZE-NEXT:                 call void @llvm.assume(i1 true) [ "align"(i8* %[[CAST_RESULT1]], i64 8) ]
+  // CHECK-SANITIZE-NEXT:                 ret i8* %[[CAST_RESULT1]]
+  // CHECK-SANITIZE-NEXT:                }
+#line 100
+  return __builtin_assume_aligned((B*)c, 8);
+}