Add support for attribute "overallocated"

[ahatanak]

Summary

This patch adds support for attribute "overallocated", which will be used to indicate a union or struct is over-allocated. This is needed to have __builtin_object_size correctly compute the size of an object when malloc allocates extra space at the end of a struct or union. For example,

struct S {

int a;
char s[32];

};

void *p = malloc(sizeof(S) + 64);
unsigned s = builtin_object_size(((struct S*)p)->s, 1); // "s" should be 32+64=96, not 32.

The link to the relevant discussion on cfe-dev is here:

http://lists.llvm.org/pipermail/cfe-dev/2016-March/047782.html

[rsmith]

include/clang/Basic/AttrDocs.td

2073–2079

I don't think this says what you mean. "Overallocated" alone does not imply that you can use S::b to access more than 4 bytes. If you want that to work, I think the right model is for the attribute to imply that the final member within the struct is treated as a flexible array member, no matter what its array bound is.

This should then apply to everywhere we consider flexible array members, not just to builtin_object_size.

[ahatanak]

Fix a bug in tryEvaluateBuiltinObjectSize. If the pointer passed to builtin_object_size doesn't point to an array, it should be able to compute the exact size of the subobject the pointer points to. Therefore, it should be able to tell the last call to builtin_object_size in test/CodeGen/object-size.c should return 128.

[ahatanak]

include/clang/Basic/AttrDocs.td

2073–2079

I intended overallocated to mean there might be extra memory at the end of a struct or union regardless of whether or not the last member is an array. This seemed more useful than restricting it to structs with array members as was discussed in the cfe-dev thread. For example, Hal mentioned that we might have caught the bugs you fixed in r262891 had we used this attribute on over-allocated classes.

Does this sound reasonable to you or do you see any problem with this approach? Alternatively, we can use an attribute (variable_length_array or gcc's bnd_variable_size) that will be attached to the array, which is good enough for the use case we care about (we want __builtin_object_size to return an exact or a conservative value for struct sockaddr_un that was mentioned in the thread).

[aaron.ballman]

include/clang/Basic/Attr.td

2279

Can drop the "Expected" string literal. A record type should automatically do the right thing.

lib/Sema/SemaDeclAttr.cpp

4932

This isn't required.

5404

Can just call handleSimpleAttribute() instead.

[george.burgess.iv]

Thanks for the patch!

lib/AST/ExprConstant.cpp

1055

Did you mean : 1 here?

[ahatanak]

Address review comments and change the wording in AttrDocs.td to explain what the attribute means and how it is used. Also, fixed the code in VisitMemberExpr to set LValue::OverAllocated before the base class of the member expression is visited. This change was needed because the base class of the innermost MemberExpr has to be examined to see whether the member belongs to an overallocated class. Without this change, the last check in test/CodeGen/object-size.c fails.

[aaron.ballman]

Missing Sema tests for the attribute.

include/clang/Basic/AttrDocs.td

2082

I *think* this code example will give doxygen fits because it's not indented; have you tried generating the docs locally? You can test this by running: clang-tblgen -gen-attr-docs -I E:\llvm\llvm\tools\clang\include E:\llvm\llvm\tools\clang\include\clang\Basic\Attr.td -o E:\llvm\llvm\tools\clang\docs\AttributeReference.rst and then building the docs as normal. Note, you will have to revert AttributeReference.rst when you are done.

lib/AST/ExprConstant.cpp

1051–1058

All three of these should be using unsigned, otherwise you do not get the behavior you expect in MSVC (it allocates bit-fields of different types on their own boundaries).

[rsmith]

include/clang/Basic/AttrDocs.td

2073–2079

No, this approach is not reasonable. Just changing what __builtin_object_size returns does not change the fact that code that tries to use bytes off the end of the struct would have undefined behavior. Lying in the result of __builtin_object_size is actively harmful.

Note that in your example below, you cannot access more than four chars through ((struct S*)p)->b, despite the attribute, because the attribute does not affect the behaviour of the array member of S.

The right thing to do here would presumably be to have an attribute that makes an array be treated as a flexible array member, *even if* its bound is specified (and greater than 0). This would affect __builtin_object_size, sanitizers, alias analysis, diagnostics for flexible array members in the middle of a type, and so on.

[ahatanak]

I think you are right. There are other places that need to be fixed to properly support over-allocated structures. I'll see if I can come up with a patch that treats the over-allocated array as flexible array member.

[ahatanak]

The new patch defines a new attribute "flexible_array", which gets attached to the last array member of a struct.

I made changes to clang to treat arrays marked "flexible_array" as C99's flexible array members where it made sense to do so. There are several places where C99's flexible arrays and "flexible_array" are treated differently. For example, the attribute doesn't change the way arguments are passed or values are returned from a function. It doesn't change objective-c's type encoding either.

[aaron.ballman]

include/clang/AST/Decl.h

3249 ↗

(On Diff #62560)

Does this require a bit, or can this simply be looked up as needed?

include/clang/Basic/Attr.td

18

Instead of "field", how about "non-static data member"? That should make it more clear as to what it pertains to.

2281

Should be able to drop the string literal here; it should work by default. If it doesn't, then ClangAttrEmitter.cpp should be updated to properly handle it.

include/clang/Basic/DiagnosticSemaKinds.td

2165 ↗

(On Diff #62560)

This should be updated to use a %select instead of passing string literals (for eventual localization purposes).

2520 ↗

(On Diff #62560)

non-static data members instead of fields.

lib/AST/ExprConstant.cpp

170

Is the bit required here as well, or can this be queried as-needed?

1125

Perhaps this should be a default argument, since it's false almost everywhere?

5162–5163

Should be const qualified.

lib/Sema/SemaDeclAttr.cpp

1808–1809

Should be const

[ahatanak]

Address review comments.

[ahatanak]

include/clang/AST/Decl.h

3249 ↗

(On Diff #63299)

Probably it can be looked up although it would require incrementing the field_iterator until it reaches the last non-static data member of the record.

lib/AST/ExprConstant.cpp

170

I don't think there is a way to do that reliably. The FieldDecl for the array isn't always available in struct LValue, as far as I can tell, so it looks like we'll need a bit here.

[aaron.ballman]

include/clang/AST/Decl.h

3249 ↗

(On Diff #63299)

Ah shoot, I forgot that these are forward iterators, not bidirectional ones. I think the bit is probably the better way to go; we have bits to spare here.

include/clang/Basic/DiagnosticSemaKinds.td

2170 ↗

(On Diff #63299)

I think "members of structs or classes" and "the last member of a struct" could be combined into "the last member of a non-union class", instead of using separate diagnostic text. What do you think?

2171 ↗

(On Diff #63299)

Since you can only have one such member, I think we want to drop the plural from both of these. I think the first may read better as "a non-flexible array member" (since there are "arrays" and "flexible arrays", but not "fixed-sized arrays" in our diagnostics), and the second may read better as "an array member that has at least one element".

lib/AST/ExprConstant.cpp

170

Okay, that seems reasonable to me -- I don't think anyone is relying on that bit being stolen from MostDerivedPathLength.

[ahatanak]

Change diagnostic messages.

include/clang/Basic/DiagnosticSemaKinds.td

2170 ↗

(On Diff #63299)

I agree, I think these two diagnostics should be combined.

[ahatanak]

ping

[aaron.ballman]

LGTM with one small testing nit, but you should wait for @rsmith to chime in since he had comments previously.

test/SemaCXX/flexible-array-attr.cpp

52 ↗

(On Diff #63596)

Would be good to change this to b[1] so that it looks like an otherwise well-formed construct. Should not change the diagnostic.

[ahatanak]

ping

[rsmith]

include/clang/AST/Decl.h

3250 ↗

(On Diff #63596)

How is this different from HasFlexibleArrayMember? Do we really need both?

include/clang/Basic/AttrDocs.td

2076–2077

Instead of "This attribute is useful when you want", I would suggest "This attribute causes", since that is far from the only effect. It should also disable the sanitizer checks for array bounds violations, for example.

include/clang/Basic/DiagnosticSemaKinds.td

2520 ↗

(On Diff #62560)

Again, this will be confusing in C. Our diagnostics generally use the word "field" to refer to fields in C or non-static data members in C++.

2173 ↗

(On Diff #63596)

I don't think it's very clear what "nested" means here. I assume you mean that a struct with a flexible_array member can't be used as the type of a field. If so, why not? C allows that for other kinds of flexible array members.

2170 ↗

(On Diff #63299)

We shouldn't talk about classes when targeting C.

lib/AST/ExprConstant.cpp

287

Pointer arithmetic that leaves the initial portion of a member with the flexible_array attribute will lose its designator here. Is that what you want?

5161

Should we also set HasFlexibleArrayAttr on *real* flexible array members (which will be fields with IncompleteArrayType) rather than invalidating the designator?

lib/CodeGen/CGExpr.cpp

695–696 ↗

(On Diff #63596)

This is wrong. We shouldn't disable all bounds checking for all array members in a class just because it ends in a flexible array member: only that member should have its checks disabled. You can reverse the sense of this as a fast-path for the common case of a class without a flexible array member, though.

[ahatanak]

include/clang/AST/Decl.h

3250 ↗

(On Diff #63596)

As I commented below, we don't need both if we are going to treat an array with flexible_array attribute like other existing flexible arrays.

include/clang/Basic/DiagnosticSemaKinds.td

2173 ↗

(On Diff #63596)

Yes, that's what I meant. I disallowed using struct with a flexible_array member to be used as a field in another struct just because the use case I had in mind didn't need that (see the link below). We don't need to restrict its usage if we are going to handle it like other existing flexible array members.

http://lists.llvm.org/pipermail/cfe-dev/2016-February/047561.html

lib/AST/ExprConstant.cpp

5161

I'm assuming you are also suggesting we call Result.addArray on "real" flexible arrays too?

[ahatanak]

include/clang/AST/Decl.h

3250 ↗

(On Diff #63596)

I forgot to mention this, but one reason I didn't treat arrays with flexible_array attribute as C99 flexible arrays is that there are a couple of places in IRGen (TargetInfo.cpp) that call hasFlexibleArrayMember() to decide how to pass arguments to functions. For example, when I compile the following code with "-arch arm64", the first function receives a pointer while the second one receives a value:

typedef struct {
  int a;
  int b[5];
} S0;

typedef struct {
  int a;
  int b[];
} S1;

S0 g0;
S1 g1;

void foo0(S0 s0) {
  g0 = s0;
}

void foo1(S1 s1) {
  g1 = s1;
}

I agree with you that treating flexible_arrays as C99 flexible arrays will probably keep the code simple and clean, but I have to see if anyone is using structs with flexible arrays in way that will cause ABI breakage.

[ahatanak]

Address review comments.

• Arrays marked "flexible_array" are now treated as flexible arrays.
• __builtin_object_size returns a more accurate numbers for normal C99 flexible arrays (see test/CodeGen/object-size.c).

Note that a couple of tests fail with this patch applied since this patch depends on https://reviews.llvm.org/D24999.

include/clang/Basic/Attr.td

 // The documentation is organized by category. Attributes can have category-
 // specific documentation that is collated within the larger document.
 class DocumentationCategory<string name> {
   string Name = name;
   code Content = [{}];
 }
 def DocCatFunction : DocumentationCategory<"Function Attributes">;
 def DocCatVariable : DocumentationCategory<"Variable Attributes">;
 def DocCatType : DocumentationCategory<"Type Attributes">;
 def DocCatStmt : DocumentationCategory<"Statement Attributes">;
 // Attributes listed under the Undocumented category do not generate any public
 // documentation. Ideally, this category should be used for internal-only
 // attributes which contain no spellings.
 def DocCatUndocumented : DocumentationCategory<"Undocumented">;
 
 class DocDeprecated<string replacement = ""> {
   // If the Replacement field is empty, no replacement will be listed with the
std::string getDiagnosticName(const PrintingPolicy &Policy) const {
     assert(SpellingIndex == Pragma_clang_loop && "Unexpected spelling");
     return getOptionName(option) + getValueString(Policy);
   }
   }];
 
   let Documentation = [LoopHintDocs, UnrollHintDocs];
 }
 
+def OverAllocated : InheritableAttr {
+  let Spellings = [GNU<"overallocated">, CXX11<"clang", "overallocated">];
+  let Subjects = SubjectList<[Record], ErrorDiag, "ExpectedStructOrUnion">;
+  let Documentation = [OverAllocatedDocs];
+}
+
 def CapturedRecord : InheritableAttr {
   // This attribute has no spellings as it is only ever created implicitly.
   let Spellings = [];
   let SemaHandler = 0;
   let Documentation = [Undocumented];
 }
 
 def OMPThreadPrivateDecl : InheritableAttr {

include/clang/Basic/AttrDocs.td

public:
       int foo1() override;
 
       // not_tail_called on a virtual function is an error.
       [[clang::not_tail_called]] int foo2() override;
     };
   }];
 }
 
+def OverAllocatedDocs : Documentation {
+  let Category = DocCatType;
+  let Content = [{
+Use ``overallocated`` to indicate a struct or union is over-allocated. For example,
+
+.. code-block:: c++
+
+struct S {
+  char a[4], char b[4];
+} __attribute__((overallocated));
+
+unsigned foo() {
+  void *p = malloc(sizeof(struct S) + 32);
+  return __builtin_object_size(((struct S*)p)->b, 1); // Returns 36 instead of 4.
+}
+
+  }];
+}
+
 def InternalLinkageDocs : Documentation {
   let Category = DocCatFunction;
   let Content = [{
 The ``internal_linkage`` attribute changes the linkage type of the declaration to internal.
 This is similar to C-style ``static``, but can be used on classes and class methods. When applied to a class definition,
 this attribute affects all methods and static data members of that class.
 This can be used to contain the ABI of a C++ library by excluding unwanted class methods from the export tables.
   }];

lib/AST/ExprConstant.cpp

struct SubobjectDesignator {
 
     /// Is this a pointer one past the end of an object?
     bool IsOnePastTheEnd : 1;
 
     /// Indicator of whether the most-derived object is an array element.
     bool MostDerivedIsArrayElement : 1;
 
     /// The length of the path to the most-derived object of which this is a
     /// subobject.
     unsigned MostDerivedPathLength : 29;
 
     /// The size of the array of which the most-derived object is an element.
     /// This will always be 0 if the most-derived object is not an array
     /// element. 0 is not an indicator of whether or not the most-derived object
     /// is an array, however, because 0-length arrays are allowed.
     uint64_t MostDerivedArraySize;
 
struct SubobjectDesignator {
     }
     void diagnosePointerArithmetic(EvalInfo &Info, const Expr *E, uint64_t N);
     /// Add N to the address of this subobject.
     void adjustIndex(EvalInfo &Info, const Expr *E, uint64_t N) {
       if (Invalid) return;
       if (MostDerivedPathLength == Entries.size() &&
           MostDerivedIsArrayElement) {
         Entries.back().ArrayIndex += N;
         if (Entries.back().ArrayIndex > MostDerivedArraySize) {
           diagnosePointerArithmetic(Info, E, Entries.back().ArrayIndex);
           setInvalid();
         }
         return;
       }
       // [expr.add]p4: For the purposes of these operators, a pointer to a
       // nonarray object behaves the same as a pointer to the first element of
       // an array of length one with the type of the object as its element type.
void setFrom(const APValue &v) {
         IntImag = v.getComplexIntImag();
       }
     }
   };
 
   struct LValue {
     APValue::LValueBase Base;
     CharUnits Offset;
     bool InvalidBase : 1;
-    unsigned CallIndex : 31;
+
+    // Indicates the enclosing struct is marked overallocated. This is used in
+    // computation of __builtin_object_size.
+    bool OverAllocated = 1;
+
+    unsigned CallIndex : 30;
     SubobjectDesignator Designator;
 
     const APValue::LValueBase getLValueBase() const { return Base; }
     CharUnits &getLValueOffset() { return Offset; }
     const CharUnits &getLValueOffset() const { return Offset; }
     unsigned getLValueCallIndex() const { return CallIndex; }
     SubobjectDesignator &getLValueDesignator() { return Designator; }
     const SubobjectDesignator &getLValueDesignator() const { return Designator;}
 
+    LValue() : OverAllocated(false) {}
+
     void moveInto(APValue &V) const {
       if (Designator.Invalid)
         V = APValue(Base, Offset, APValue::NoLValuePath(), CallIndex);
       else
         V = APValue(Base, Offset, Designator.Entries,
                     Designator.IsOnePastTheEnd, CallIndex);
     }
     void setFrom(ASTContext &Ctx, const APValue &V) {
struct LValue {
     }
 
     void addDecl(EvalInfo &Info, const Expr *E,
                  const Decl *D, bool Virtual = false) {
       if (checkSubobject(Info, E, isa<FieldDecl>(D) ? CSK_Field : CSK_Base))
         Designator.addDeclUnchecked(D, Virtual);
     }
     void addArray(EvalInfo &Info, const Expr *E, const ConstantArrayType *CAT) {
       if (checkSubobject(Info, E, CSK_ArrayToPointer))
         Designator.addArrayUnchecked(CAT);
     }
     void addComplex(EvalInfo &Info, const Expr *E, QualType EltTy, bool Imag) {
       if (checkSubobject(Info, E, Imag ? CSK_Imag : CSK_Real))
         Designator.addComplexUnchecked(EltTy, Imag);
     }
     void adjustIndex(EvalInfo &Info, const Expr *E, uint64_t N) {
       if (N && checkNullPointer(Info, E, CSK_ArrayIndex))
bool VisitMemberExpr(const MemberExpr *E) {
     } else if (E->getBase()->isRValue()) {
       assert(E->getBase()->getType()->isRecordType());
       EvalOK = EvaluateTemporary(E->getBase(), Result, this->Info);
       BaseTy = E->getBase()->getType();
     } else {
       EvalOK = this->Visit(E->getBase());
       BaseTy = E->getBase()->getType();
     }
+
+    // Check to see if the parent record is marked overallocated.
+    const TagDecl *TD = BaseTy->getAsTagDecl();
+
+    if (isa<CXXRecordDecl>(TD))
+      TD = E->getBase()->getBestDynamicClassType();
+
+    Result.OverAllocated = TD->hasAttr<OverAllocatedAttr>();
+
     if (!EvalOK) {
       if (!this->Info.allowInvalidBaseExpr())
         return false;
       Result.setInvalid(E);
       return true;
     }
 
     const ValueDecl *MD = E->getMemberDecl();
if (SubExpr->isGLValue()) {
                            Info, Result, SubExpr))
         return false;
     }
     // The result is a pointer to the first element of the array.
     if (const ConstantArrayType *CAT
           = Info.Ctx.getAsConstantArrayType(SubExpr->getType()))
       Result.addArray(Info, E, CAT);
     else
       Result.Designator.setInvalid();
     return true;
 
   case CK_FunctionToPointerDecay:
     return EvaluateLValue(SubExpr, Result, Info);
   }
 
   return ExprEvaluatorBaseTy::VisitCastExpr(E);
 }
 
 static CharUnits GetAlignOfType(EvalInfo &Info, QualType T) {
static bool tryEvaluateBuiltinObjectSize(const Expr *E, unsigned Type,
 
   // The following is a moderately common idiom in C:
   //
   // struct Foo { int a; char c[1]; };
   // struct Foo *F = (struct Foo *)malloc(sizeof(struct Foo) + strlen(Bar));
   // strcpy(&F->c[0], Bar);
   //
   // So, if we see that we're examining a 1-length (or 0-length) array at the
-  // end of a struct with an unknown base, we give up instead of breaking code
-  // that behaves this way. Note that we only do this when Type=1, because
-  // Type=3 is a lower bound, so answering conservatively is fine.
+  // end of a struct with an unknown base or the last field of a struct marked
+  // overallocated, we give up instead of breaking code that behaves this way.
+  // Note that we only do this when Type=1, because Type=3 is a lower bound, so
+  // answering conservatively is fine.
   if (End.InvalidBase && SubobjectOnly && Type == 1 &&
       End.Designator.Entries.size() == End.Designator.MostDerivedPathLength &&
-      End.Designator.MostDerivedIsArrayElement &&
-      End.Designator.MostDerivedArraySize < 2 &&
+      ((End.Designator.MostDerivedIsArrayElement &&
+        End.Designator.MostDerivedArraySize < 2) ||
+       End.OverAllocated) &&
       isDesignatorAtObjectEnd(Info.Ctx, End))
     return false;
 
   if (BaseOffset > EndOffset)
     return Success(0, E);
 
   return Success((EndOffset - BaseOffset).getQuantity(), E);
 }

lib/Sema/SemaDeclAttr.cpp

if (checkAttrMutualExclusion<AlwaysInlineAttr>(S, D, Attr.getRange(),
     return;
 
   D->addAttr(::new (S.Context) NotTailCalledAttr(
       Attr.getRange(), S.Context, Attr.getAttributeSpellingListIndex()));
 }
 
 static void handleDisableTailCallsAttr(Sema &S, Decl *D,
                                        const AttributeList &Attr) {
   if (checkAttrMutualExclusion<NakedAttr>(S, D, Attr.getRange(),
                                           Attr.getName()))
     return;
 
   D->addAttr(::new (S.Context) DisableTailCallsAttr(
       Attr.getRange(), S.Context, Attr.getAttributeSpellingListIndex()));
 }
 
 static void handleUsedAttr(Sema &S, Decl *D, const AttributeList &Attr) {
   if (const VarDecl *VD = dyn_cast<VarDecl>(D)) {
case llvm::Triple::x86_64:
     handleAnyX86InterruptAttr(S, D, Attr);
     break;
   default:
     handleARMInterruptAttr(S, D, Attr);
     break;
   }
 }
 
+static void handleOverAllocatedAttr(Sema &S, Decl *D, const AttributeList &Attr) {
+  D->addAttr(::new (S.Context)
+             OverAllocatedAttr(Attr.getLoc(), S.Context,
+                               Attr.getAttributeSpellingListIndex()));
+}
+
 static void handleAMDGPUNumVGPRAttr(Sema &S, Decl *D,
                                     const AttributeList &Attr) {
   uint32_t NumRegs;
   Expr *NumRegsExpr = static_cast<Expr *>(Attr.getArgAsExpr(0));
   if (!checkUInt32Argument(S, Attr, NumRegsExpr, NumRegs))
     return;
 
   D->addAttr(::new (S.Context)
S.Diag(Attr.getLoc(), diag::err_stmt_attribute_invalid_on_decl)
         << Attr.getName() << D->getLocation();
     break;
   case AttributeList::AT_Interrupt:
     handleInterruptAttr(S, D, Attr);
     break;
   case AttributeList::AT_X86ForceAlignArgPointer:
     handleX86ForceAlignArgPointerAttr(S, D, Attr);
     break;
+  case AttributeList::AT_OverAllocated:
+    handleOverAllocatedAttr(S, D, Attr);
+    break;
   case AttributeList::AT_DLLExport:
   case AttributeList::AT_DLLImport:
     handleDLLAttr(S, D, Attr);
     break;
   case AttributeList::AT_Mips16:
     handleSimpleAttributeWithExclusions<Mips16Attr, MipsInterruptAttr>(S, D,
                                                                        Attr);
     break;

test/CodeGen/object-size.c

void test31() {
   gi = __builtin_object_size(&ds1[9].snd[0], 1);
 
   // CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %{{.*}}, i1 false)
   gi = __builtin_object_size(&ds0[9].snd[0], 1);
 
   // CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %{{.*}}, i1 false)
   gi = __builtin_object_size(&dsv[9].snd[0], 1);
 }
+
+union U0 {
+  int a[16], b[16];
+} __attribute__((overallocated));
+
+struct S0 {
+  int a[16], b[16];
+};
+
+struct S1 {
+  int a[16], b[16];
+} __attribute__((overallocated));
+
+struct S2 {
+  int a[16], b[16];
+  struct S1 s1;
+  struct S0 s0;
+} __attribute__((overallocated));
+
+// CHECK-LABEL: @test32
+void test32() {
+  union U0 *u0;
+  struct S1 *s1;
+  struct S2 *s2;
+
+  // CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %{{.*}}, i1 false)
+  gi = __builtin_object_size(u0->a, 1);
+
+  // CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %{{.*}}, i1 false)
+  gi = __builtin_object_size(u0->b, 1);
+
+  // CHECK: store i32 64, i32* @gi
+  gi = __builtin_object_size(s1->a, 1);
+
+  // CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %{{.*}}, i1 false)
+  gi = __builtin_object_size(s1->b, 1);
+
+  // CHECK: store i32 64, i32* @gi
+  gi = __builtin_object_size(s2->b, 1);
+
+  // CHECK: store i32 64, i32* @gi
+  gi = __builtin_object_size(s2->s1.b, 1);
+
+  // CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %{{.*}}, i1 false)
+  gi = __builtin_object_size(&s2->s0, 1);
+}

test/CodeGen/object-size.cpp

void test2() {
   gi = __builtin_object_size(&c->bs[0].buf[0], 0);
   // CHECK: store i32 16
   gi = __builtin_object_size(&c->bs[0].buf[0], 1);
   // CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %{{.*}}, i1 true)
   gi = __builtin_object_size(&c->bs[0].buf[0], 2);
   // CHECK: store i32 16
   gi = __builtin_object_size(&c->bs[0].buf[0], 3);
 }
+
+struct S0 {
+  int a[16], b[16];
+} __attribute__((overallocated));
+
+struct S1 : S0 {
+};
+
+struct S2 : S1 {
+} __attribute__((overallocated));
+
+// CHECK-LABEL: define void @_Z5test3v()
+void test3() {
+  struct S0 *s0;
+  struct S1 *s1;
+  struct S2 *s2;
+
+  // CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %{{.*}}, i1 false)
+  gi = __builtin_object_size(s0->b, 1);
+
+  // CHECK: store i32 64, i32* @gi
+  gi = __builtin_object_size(s1->b, 1);
+
+  // CHECK: call i64 @llvm.objectsize.i64.p0i8(i8* %{{.*}}, i1 false)
+  gi = __builtin_object_size(s2->b, 1);
+}