[asan] Use GS for shadow prototype

compiler-rt/lib/asan/asan_interface.inc

 INTERFACE_FUNCTION(__asan_set_shadow_05)
 INTERFACE_FUNCTION(__asan_set_shadow_06)
 INTERFACE_FUNCTION(__asan_set_shadow_07)
 INTERFACE_FUNCTION(__asan_set_shadow_f1)
 INTERFACE_FUNCTION(__asan_set_shadow_f2)
 INTERFACE_FUNCTION(__asan_set_shadow_f3)
 INTERFACE_FUNCTION(__asan_set_shadow_f5)
 INTERFACE_FUNCTION(__asan_set_shadow_f8)
+INTERFACE_FUNCTION(__asan_set_shadow2_00)
+INTERFACE_FUNCTION(__asan_set_shadow2_01)
+INTERFACE_FUNCTION(__asan_set_shadow2_02)
+INTERFACE_FUNCTION(__asan_set_shadow2_03)
+INTERFACE_FUNCTION(__asan_set_shadow2_04)
+INTERFACE_FUNCTION(__asan_set_shadow2_05)
+INTERFACE_FUNCTION(__asan_set_shadow2_06)
+INTERFACE_FUNCTION(__asan_set_shadow2_07)
+INTERFACE_FUNCTION(__asan_set_shadow2_f1)
+INTERFACE_FUNCTION(__asan_set_shadow2_f2)
+INTERFACE_FUNCTION(__asan_set_shadow2_f3)
+INTERFACE_FUNCTION(__asan_set_shadow2_f5)
+INTERFACE_FUNCTION(__asan_set_shadow2_f8)
 INTERFACE_FUNCTION(__asan_stack_free_0)
 INTERFACE_FUNCTION(__asan_stack_free_1)
 INTERFACE_FUNCTION(__asan_stack_free_2)
 INTERFACE_FUNCTION(__asan_stack_free_3)
 INTERFACE_FUNCTION(__asan_stack_free_4)
 INTERFACE_FUNCTION(__asan_stack_free_5)
 INTERFACE_FUNCTION(__asan_stack_free_6)
 INTERFACE_FUNCTION(__asan_stack_free_7)

compiler-rt/lib/asan/asan_interface_internal.h

extern "C" {
   void __asan_set_shadow_f2(uptr addr, uptr size);
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_set_shadow_f3(uptr addr, uptr size);
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_set_shadow_f5(uptr addr, uptr size);
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_set_shadow_f8(uptr addr, uptr size);
 
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_00(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_01(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_02(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_03(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_04(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_05(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_06(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_07(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_f1(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_f2(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_f3(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_f5(uptr addr, uptr size);
+  SANITIZER_INTERFACE_ATTRIBUTE
+  void __asan_set_shadow2_f8(uptr addr, uptr size);
+
   // These two functions are used by instrumented code in the
   // use-after-scope mode. They mark memory for local variables as
   // unaddressable when they leave scope and addressable before the
   // function exits.
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_poison_stack_memory(uptr addr, uptr size);
   SANITIZER_INTERFACE_ATTRIBUTE
   void __asan_unpoison_stack_memory(uptr addr, uptr size);

compiler-rt/lib/asan/asan_poisoning.cpp

static void PoisonAlignedStackMemory(uptr addr, uptr size, bool do_poison) {
   } else {
     // If necessary, mark few first bytes mapping to last shadow byte
     // as addressable
     if (end_value != 0)
       *shadow_end = Max(end_value, end_offset);
   }
 }
 
+void __asan_set_shadow2_00(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0, size);
+}
+
+void __asan_set_shadow2_01(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0x01, size);
+}
+
+void __asan_set_shadow2_02(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0x02, size);
+}
+
+void __asan_set_shadow2_03(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0x03, size);
+}
+
+void __asan_set_shadow2_04(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0x04, size);
+}
+
+void __asan_set_shadow2_05(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0x05, size);
+}
+
+void __asan_set_shadow2_06(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0x06, size);
+}
+
+void __asan_set_shadow2_07(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0x07, size);
+}
+
+void __asan_set_shadow2_f1(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0xf1, size);
+}
+
+void __asan_set_shadow2_f2(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0xf2, size);
+}
+
+void __asan_set_shadow2_f3(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0xf3, size);
+}
+
+void __asan_set_shadow2_f5(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0xf5, size);
+}
+
+void __asan_set_shadow2_f8(uptr addr, uptr size) {
+  addr += ASAN_SHADOW_OFFSET;
+  REAL(memset)((void *)addr, 0xf8, size);
+}
+
 void __asan_set_shadow_00(uptr addr, uptr size) {
   REAL(memset)((void *)addr, 0, size);
 }
 
 void __asan_set_shadow_01(uptr addr, uptr size) {
   REAL(memset)((void *)addr, 0x01, size);
 }
 

compiler-rt/lib/asan/asan_rtl.cpp

switch (fake_condition) {
     case 45: __asan_set_shadow_05(0, 0); break;
     case 46: __asan_set_shadow_06(0, 0); break;
     case 47: __asan_set_shadow_07(0, 0); break;
     case 48: __asan_set_shadow_f1(0, 0); break;
     case 49: __asan_set_shadow_f2(0, 0); break;
     case 50: __asan_set_shadow_f3(0, 0); break;
     case 51: __asan_set_shadow_f5(0, 0); break;
     case 52: __asan_set_shadow_f8(0, 0); break;
+    case 140: __asan_set_shadow2_00(0, 0); break;
+    case 141: __asan_set_shadow2_01(0, 0); break;
+    case 142: __asan_set_shadow2_02(0, 0); break;
+    case 143: __asan_set_shadow2_03(0, 0); break;
+    case 144: __asan_set_shadow2_04(0, 0); break;
+    case 145: __asan_set_shadow2_05(0, 0); break;
+    case 146: __asan_set_shadow2_06(0, 0); break;
+    case 147: __asan_set_shadow2_07(0, 0); break;
+    case 148: __asan_set_shadow2_f1(0, 0); break;
+    case 149: __asan_set_shadow2_f2(0, 0); break;
+    case 150: __asan_set_shadow2_f3(0, 0); break;
+    case 151: __asan_set_shadow2_f5(0, 0); break;
+    case 152: __asan_set_shadow2_f8(0, 0); break;
   }
   // clang-format on
 }
 
 static void asan_atexit() {
   Printf("AddressSanitizer exit stats:\n");
   __asan_print_accumulated_stats();
   // Print AsanMappingProfile.

compiler-rt/lib/asan/asan_rtl_x86_64.S

 FNAME(reg, op, s, i): ;\
 
 #define ENDF .cfi_endproc ;\
 
 // Access check functions for 1,2 and 4 byte types, which require extra checks.
 #define ASAN_MEMORY_ACCESS_INITIAL_CHECK_ADD(reg, op, s) \
         mov    %##reg,%r10 ;\
         shr    $0x3,%r10 ;\
-        movsbl ASAN_SHADOW_OFFSET_CONST(%r10),%r10d ;\
+        movsbl %gs:(%r10),%r10d ;\
         test   %r10d,%r10d ;\
         jne    CLABEL(reg, op, s, add) ;\
 RLABEL(reg, op, s, add): ;\
         retq  ;\
 
 #define ASAN_MEMORY_ACCESS_EXTRA_CHECK_1(reg, op, i) \
 CLABEL(reg, op, 1, i): ;\
-        push   %rcx ;\
-        mov    %##reg,%rcx ;\
-        and    $0x7,%ecx ;\
-        cmp    %r10d,%ecx ;\
-        pop    %rcx ;\
+        mov    %##reg,%r11 ;\
+        and    $0x7,%r11d ;\
+        cmp    %r10d,%r11d ;\
         jl     RLABEL(reg, op, 1, i);\
         mov    %##reg,%rdi ;\
         jmp    __asan_report_##op##1_asm ;\
 
 #define ASAN_MEMORY_ACCESS_EXTRA_CHECK_2(reg, op, i) \
 CLABEL(reg, op, 2, i): ;\
-        push   %rcx ;\
-        mov    %##reg,%rcx ;\
-        and    $0x7,%ecx ;\
-        add    $0x1,%ecx ;\
-        cmp    %r10d,%ecx ;\
-        pop    %rcx ;\
+        mov    %##reg,%r11 ;\
+        and    $0x7,%r11d ;\
+        add    $0x1,%r11d ;\
+        cmp    %r10d,%r11d ;\
         jl     RLABEL(reg, op, 2, i);\
         mov    %##reg,%rdi ;\
         jmp    __asan_report_##op##2_asm ;\
 
 #define ASAN_MEMORY_ACCESS_EXTRA_CHECK_4(reg, op, i) \
 CLABEL(reg, op, 4, i): ;\
-        push   %rcx ;\
-        mov    %##reg,%rcx ;\
-        and    $0x7,%ecx ;\
-        add    $0x3,%ecx ;\
-        cmp    %r10d,%ecx ;\
-        pop    %rcx ;\
+        mov    %##reg,%r11 ;\
+        and    $0x7,%r11d ;\
+        add    $0x3,%r11d ;\
+        cmp    %r10d,%r11d ;\
         jl     RLABEL(reg, op, 4, i);\
         mov    %##reg,%rdi ;\
         jmp    __asan_report_##op##4_asm ;\
 
 #define ASAN_MEMORY_ACCESS_CALLBACK_ADD_1(reg, op) \
 BEGINF(reg, op, 1, add) ;\
         ASAN_MEMORY_ACCESS_INITIAL_CHECK_ADD(reg, op, 1) ;\
         ASAN_MEMORY_ACCESS_EXTRA_CHECK_1(reg, op, add) ;\

compiler-rt/lib/asan/asan_shadow_setup.cpp

 #include "sanitizer_common/sanitizer_platform.h"
 
 // asan_fuchsia.cpp has their own InitializeShadowMemory implementation.
 #if !SANITIZER_FUCHSIA
 
 #  include "asan_internal.h"
 #  include "asan_mapping.h"
 
+#  if SANITIZER_X64
+#    include <asm/prctl.h>
+#    include <sys/syscall.h>
+#    include <unistd.h>
+
+#  endif
 namespace __asan {
 
 static void ProtectGap(uptr addr, uptr size) {
   if (!flags()->protect_shadow_gap) {
     // The shadow gap is unprotected, so there is a chance that someone
     // is actually using this memory. Which means it needs a shadow...
     uptr GapShadowBeg = RoundDownTo(MEM_TO_SHADOW(addr), GetPageSizeCached());
     uptr GapShadowEnd =
#if SANITIZER_LINUX && \
     (defined(__x86_64__) || defined(__aarch64__) || SANITIZER_RISCV64)
   Report("This might be related to ELF_ET_DYN_BASE change in Linux 4.12.\n");
   Report(
       "See https://github.com/google/sanitizers/issues/856 for possible "
       "workarounds.\n");
 #endif
 }
 
+#  if SANITIZER_X64
+__attribute__((destructor)) void __chktag_count_report(void) {
+  void *gs = nullptr;
+  syscall(SYS_arch_prctl, ARCH_GET_GS, &gs);
+
+  if ((uptr)gs != __asan_shadow_memory_dynamic_address) {
+    Report("GS %p\n", gs);
+    Die();
+  }
+}
+#  endif
+
 void InitializeShadowMemory() {
   // Set the shadow memory address to uninitialized.
   __asan_shadow_memory_dynamic_address = kDefaultShadowSentinel;
 
   uptr shadow_start = kLowShadowBeg;
   // Detect if a dynamic shadow address must used and find a available location
   // when necessary. When dynamic address is used, the macro |kLowShadowBeg|
   // expands to |__asan_shadow_memory_dynamic_address| which is
   // |kDefaultShadowSentinel|.
   bool full_shadow_is_available = false;
   if (shadow_start == kDefaultShadowSentinel) {
     shadow_start = FindDynamicShadowStart();
     if (SANITIZER_LINUX) full_shadow_is_available = true;
   }
   // Update the shadow memory address (potentially) used by instrumentation.
   __asan_shadow_memory_dynamic_address = shadow_start;
-
+#  if SANITIZER_X64
+  syscall(SYS_arch_prctl, ARCH_SET_GS,
+          (void *)__asan_shadow_memory_dynamic_address);
+#  endif
   if (kLowShadowBeg) shadow_start -= GetMmapGranularity();
 
   if (!full_shadow_is_available)
     full_shadow_is_available =
         MemoryRangeIsAvailable(shadow_start, kHighShadowEnd);
 
 #if SANITIZER_LINUX && defined(__x86_64__) && defined(_LP64) && \
     !ASAN_FIXED_MAPPING

compiler-rt/lib/asan/weak_symbols.txt

 ___asan_set_shadow_f1
 ___asan_set_shadow_f2
 ___asan_set_shadow_f3
 ___asan_set_shadow_f4
 ___asan_set_shadow_f5
 ___asan_set_shadow_f6
 ___asan_set_shadow_f7
 ___asan_set_shadow_f8
+___asan_set_shadow2_00
+___asan_set_shadow2_01
+___asan_set_shadow2_02
+___asan_set_shadow2_03
+___asan_set_shadow2_04
+___asan_set_shadow2_05
+___asan_set_shadow2_06
+___asan_set_shadow2_07
+___asan_set_shadow2_f1
+___asan_set_shadow2_f2
+___asan_set_shadow2_f3
+___asan_set_shadow2_f4
+___asan_set_shadow2_f5
+___asan_set_shadow2_f6
+___asan_set_shadow2_f7
+___asan_set_shadow2_f8
 No newline at end of file

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

 static const int kMaxAsanStackMallocSizeClass = 10;
 const char kAsanStackMallocNameTemplate[] = "__asan_stack_malloc_";
 const char kAsanStackMallocAlwaysNameTemplate[] =
     "__asan_stack_malloc_always_";
 const char kAsanStackFreeNameTemplate[] = "__asan_stack_free_";
 const char kAsanGenPrefix[] = "___asan_gen_";
 const char kODRGenPrefix[] = "__odr_asan_gen_";
 const char kSanCovGenPrefix[] = "__sancov_gen_";
-const char kAsanSetShadowPrefix[] = "__asan_set_shadow_";
+const char kAsanSetShadowPrefix[] = "__asan_set_shadow2_";
 const char kAsanPoisonStackMemoryName[] = "__asan_poison_stack_memory";
 const char kAsanUnpoisonStackMemoryName[] = "__asan_unpoison_stack_memory";
 
 // ASan version script has __asan_* wildcard. Triple underscore prevents a
 // linker (gold) warning about attempting to export a local symbol.
 const char kAsanGlobalsRegisteredFlagName[] = "___asan_globals_registered";
 
 const char kAsanOptionDetectUseAfterReturn[] =
void instrumentMaskedLoadOrStore(AddressSanitizer *Pass, const DataLayout &DL,
                                    uint32_t Exp);
   Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
                            Value *ShadowValue, uint32_t TypeStoreSize);
   Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
                                  bool IsWrite, size_t AccessSizeIndex,
                                  Value *SizeArgument, uint32_t Exp);
   void instrumentMemIntrinsic(MemIntrinsic *MI);
   Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
+  Value *memToShadowGS(Value *Shadow, IRBuilder<> &IRB);
   bool suppressInstrumentationSiteForDebug(int &Instrumented);
   bool instrumentFunction(Function &F, const TargetLibraryInfo *TLI);
   bool maybeInsertAsanInitAtFunctionEntry(Function &F);
   bool maybeInsertDynamicShadowAtFunctionEntry(Function &F);
   void markEscapedLocalAllocas(Function &F);
 
 private:
   friend struct FunctionStackPoisoner;
Value *AddressSanitizer::memToShadow(Value *Shadow, IRBuilder<> &IRB) {
   else
     ShadowBase = ConstantInt::get(IntptrTy, Mapping.Offset);
   if (Mapping.OrShadowOffset)
     return IRB.CreateOr(Shadow, ShadowBase);
   else
     return IRB.CreateAdd(Shadow, ShadowBase);
 }
 
+Value *AddressSanitizer::memToShadowGS(Value *Shadow, IRBuilder<> &IRB) {
+  Shadow = IRB.CreateLShr(Shadow, Mapping.Scale);
+  return Shadow;
+}
+
 // Instrument memset/memmove/memcpy
 void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI) {
   InstrumentationIRBuilder IRB(MI);
   if (isa<MemTransferInst>(MI)) {
     IRB.CreateCall(
         isa<MemMoveInst>(MI) ? AsanMemmove : AsanMemcpy,
         {IRB.CreatePointerCast(MI->getOperand(0), IRB.getInt8PtrTy()),
          IRB.CreatePointerCast(MI->getOperand(1), IRB.getInt8PtrTy()),
InsertBefore = instrumentAMDGPUAddress(OrigIns, InsertBefore, Addr,
                                            TypeStoreSize, IsWrite, SizeArgument);
     if (!InsertBefore)
       return;
   }
 
   InstrumentationIRBuilder IRB(InsertBefore);
   size_t AccessSizeIndex = TypeStoreSizeToSizeIndex(TypeStoreSize);
   const ASanAccessInfo AccessInfo(IsWrite, CompileKernel, AccessSizeIndex);
   
+  const size_t Granularity = 1ULL << Mapping.Scale;
+
   if (UseCalls && ClOptimizeCallbacks) {
+
+    if ((TypeStoreSize < 8 * Granularity)) {
+      Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
+      Type *ShadowTy =
+          IntegerType::get(*C, std::max(8U, TypeStoreSize >> Mapping.Scale));
+      Type *ShadowPtrTy = PointerType::get(ShadowTy, 256);
+      Value *ShadowPtr = memToShadowGS(AddrLong, IRB);
+      const uint64_t ShadowAlign = std::max<uint64_t>(
+          Alignment.valueOrOne().value() >> Mapping.Scale, 1);
+      Value *ShadowValue = IRB.CreateAlignedLoad(
+          ShadowTy, IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy),
+          Align(ShadowAlign));
+      Value *Cmp = IRB.CreateIsNotNull(ShadowValue);
+
+      Instruction *CrashTerm = SplitBlockAndInsertIfThen(
+          Cmp, InsertBefore, false,
+          MDBuilder(*C).createBranchWeights(1, 100000));
+      IRB.SetInsertPoint(CrashTerm);
+    }
+
     const ASanAccessInfo AccessInfo(IsWrite, CompileKernel, AccessSizeIndex);
     Module *M = IRB.GetInsertBlock()->getParent()->getParent();
     IRB.CreateCall(
         Intrinsic::getDeclaration(M, Intrinsic::asan_check_memaccess),
         {IRB.CreatePointerCast(Addr, Int8PtrTy),
          ConstantInt::get(Int32Ty, AccessInfo.Packed)});
     return;
   }
 
   Value *AddrLong = IRB.CreatePointerCast(Addr, IntptrTy);
   if (UseCalls) {
     if (Exp == 0)
       IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][0][AccessSizeIndex],
                      AddrLong);
     else
       IRB.CreateCall(AsanMemoryAccessCallback[IsWrite][1][AccessSizeIndex],
                      {AddrLong, ConstantInt::get(IRB.getInt32Ty(), Exp)});
     return;
   }
 
   Type *ShadowTy =
       IntegerType::get(*C, std::max(8U, TypeStoreSize >> Mapping.Scale));
-  Type *ShadowPtrTy = PointerType::get(ShadowTy, 0);
-  Value *ShadowPtr = memToShadow(AddrLong, IRB);
+  Type *ShadowPtrTy = PointerType::get(ShadowTy, 256);
+  Value *ShadowPtr = memToShadowGS(AddrLong, IRB);
   const uint64_t ShadowAlign =
       std::max<uint64_t>(Alignment.valueOrOne().value() >> Mapping.Scale, 1);
   Value *ShadowValue = IRB.CreateAlignedLoad(
       ShadowTy, IRB.CreateIntToPtr(ShadowPtr, ShadowPtrTy), Align(ShadowAlign));
 
   Value *Cmp = IRB.CreateIsNotNull(ShadowValue);
-  size_t Granularity = 1ULL << Mapping.Scale;
   Instruction *CrashTerm = nullptr;
 
   if (ClAlwaysSlowPath || (TypeStoreSize < 8 * Granularity)) {
     // We use branch weights for the slow path check, to indicate that the slow
     // path is rarely taken. This seems to be the case for SPEC benchmarks.
     Instruction *CheckTerm = SplitBlockAndInsertIfThen(
         Cmp, InsertBefore, false, MDBuilder(*C).createBranchWeights(1, 100000));
     assert(cast<BranchInst>(CheckTerm)->isUnconditional());
for (size_t j = 0; j < StoreSizeInBytes; j++) {
         Val |= (uint64_t)ShadowBytes[i + j] << (8 * j);
       else
         Val = (Val << 8) | ShadowBytes[i + j];
     }
 
     Value *Ptr = IRB.CreateAdd(ShadowBase, ConstantInt::get(IntptrTy, i));
     Value *Poison = IRB.getIntN(StoreSizeInBytes * 8, Val);
     IRB.CreateAlignedStore(
-        Poison, IRB.CreateIntToPtr(Ptr, Poison->getType()->getPointerTo()),
+        Poison, IRB.CreateIntToPtr(Ptr, Poison->getType()->getPointerTo(256)),
         Align(1));
 
     i += StoreSizeInBytes;
   }
 }
 
 void FunctionStackPoisoner::copyToShadow(ArrayRef<uint8_t> ShadowMask,
                                          ArrayRef<uint8_t> ShadowBytes,
Value *BasePlus2 = IRB.CreateIntToPtr(
       IRB.CreateAdd(LocalStackBase,
                     ConstantInt::get(IntptrTy, 2 * ASan.LongSize / 8)),
       IntptrPtrTy);
   IRB.CreateStore(IRB.CreatePointerCast(&F, IntptrTy), BasePlus2);
 
   const auto &ShadowAfterScope = GetShadowBytesAfterScope(SVD, L);
 
   // Poison the stack red zones at the entry.
-  Value *ShadowBase = ASan.memToShadow(LocalStackBase, IRB);
+  Value *ShadowBase = ASan.memToShadowGS(LocalStackBase, IRB);
   // As mask we must use most poisoned case: red zones and after scope.
   // As bytes we can use either the same or just red zones only.
   copyToShadow(ShadowAfterScope, ShadowAfterScope, IRB, ShadowBase);
 
   if (!StaticAllocaPoisonCallVec.empty()) {
     const auto &ShadowInScope = GetShadowBytes(SVD, L);
 
     // Poison static allocas near lifetime intrinsics.