[esan|cfrag] Add counters for struct array accesses

[zhaoqin]

Summary

Adds one counter to the struct counter array for counting struct
array accesses.

Adds instrumentation to insert counter update for struct array
accesses.

[zhaoqin]

update comment to explain why we append the counter array.

[zhaoqin]

Rename FieldCounters to Counters

[aizatsky]

lib/Transforms/Instrumentation/EfficiencySanitizer.cpp

174

It is not clear to me what you are getting by appending counter to the end rather than adding a fixed field to the struct. Wouldn't the code become simpler?

[zhaoqin]

lib/Transforms/Instrumentation/EfficiencySanitizer.cpp

174

As I explained in the comment below, I was trying to avoid creating additional variable name for the new counter, so reduce link time, which deduplicates/merges counters based on their names.

[zhaoqin]

lib/Transforms/Instrumentation/EfficiencySanitizer.cpp

174

To be clear, the struct instance is created for each compilation/translation unit (e.g., x264.cc).
The counter (and all the struct field counters) is for each structure (e.g., struct x264_t). We rely on special name and weak linkage to merge the counters of the same struct from different CUs at link time.
I could create separate counter with special name for each case, but I think an array of counter seems more reasonable, it is also easy to extend without breaking the binary compatibility in the future.
I will try to make the code more clear on that.

[• dberlin]

lib/Transforms/Instrumentation/EfficiencySanitizer.cpp

751

So it looks like you just ignore any negative indices?
(but you don't mark them ignored)

Note that both

 %a = getelementptr inbounds {[2 x i8], [2 x i8]}, {[2 x i8], [2 x i8]}* %p, i32 0, i32 0, i32 1
%b = getelementptr inbounds {[2 x i8], [2 x i8]}, {[2 x i8], [2 x i8]}* %p, i32 0, i32 1, i32 -1

are valid :)

[zhaoqin]

lib/Transforms/Instrumentation/EfficiencySanitizer.cpp

751

As you can see, the Idx here is to get from a struct field, if (isa<StructType>(Ty))
I do not think a negative index for struct field indexing is valid.

[zhaoqin]

refact StructInfo

[• dberlin]

I do not think a negative index for struct field indexing is valid.

You are incorrect :)

FWIW, this is a common mistake.
Please remember that LLVM level structs and GEP do not have the same rules
and pretty much no relation to C-level structs.

GEP is just an indexing operation. Unlike C, i can form pointers to
wherever i want, and even if i mark them inbounds, your only guarantee is
that they are in the object somewhere, you have no guarantee on whether i
use positive or negative gep indices to generate those pointers and either
way is just as valid.
As mentioned, there are plenty of cases frontends will generate negative
gep indices for normal source level field accesses of C-level structs.

[zhaoqin]

use getSExtValue instead of getZExtValue for GetElementPtr instr.

[zhaoqin]

In D21594#472370, @dberlin wrote:

I do not think a negative index for struct field indexing is valid.

You are incorrect :)

I see, thanks! Update CL.

FWIW, this is a common mistake.
Please remember that LLVM level structs and GEP do not have the same rules
and pretty much no relation to C-level structs.

GEP is just an indexing operation. Unlike C, i can form pointers to
wherever i want, and even if i mark them inbounds, your only guarantee is
that they are in the object somewhere, you have no guarantee on whether i
use positive or negative gep indices to generate those pointers and either
way is just as valid.
As mentioned, there are plenty of cases frontends will generate negative
gep indices for normal source level field accesses of C-level structs.

I understand that GEP is just an indexing operation, which I treat it like LEA instr in x86.
One thing I do not understand is how the negative index would work for a struct type.
For array, because we know the element size, we can use positive or negative indexing to calculate an address/offset from the base.
However for struct, if the index is not within the struct field range, i.e., negative or too large, how does the compiler know how the offset/address is calculated?
For example, if the index is -1, how does the compiler decide the first negative struct field size?
I would expect the compiler will generate an error on fail to compute the offset.
Will there be a default size if no field size information available for the out of range index?

[• dberlin]

You are right. What will happen is it will not look like a structure field
access, and will use i8 or something so it can do the calculation.
I'll paste a clang generated example in a bit

[aizatsky]

Much simpler now. Thanks.

LG modulo Daniel's comments.

[zhaoqin]

In D21594#472524, @dberlin wrote:

You are right. What will happen is it will not look like a structure field
access, and will use i8 or something so it can do the calculation.
I'll paste a clang generated example in a bit

I just tried a manual test example as below:

%struct.RT = type { i8, [10 x [20 x i32]], i8 }
%struct.ST = type { i32, double, %struct.RT }

define i32* @foo(%struct.ST* %s) nounwind uwtable readnone optsize ssp {
entry:

%arrayidx = getelementptr inbounds %struct.ST, %struct.ST* %s, i64 0, i32 -1
ret i32* %arrayidx

}

which I tried gep on struct.ST with a negative field.
And I get the error that invalid getelementptr indices:

$ /usr/local/google/home/zhaoqin/Workspace/LLVM/builds/build_x64_rel.git/./bin/opt < /usr/local/google/home/zhaoqin/Workspace/LLVM/llvm.git/test/Instrumentation/EfficiencySanitizer/struct_field_gep.ll -esan -esan-cache-frag -S
/usr/local/google/home/zhaoqin/Workspace/LLVM/builds/build_x64_rel.git/./bin/opt: <stdin>:28:50: error: invalid getelementptr indices

%arrayidx = getelementptr inbounds %struct.ST, %struct.ST* %s, i64 0, i32 -1
                                                                               ^

[zhaoqin]

Even without esan instrumentation, the same error.

/usr/local/google/home/zhaoqin/Workspace/LLVM/builds/build_x64_rel.git/./bin/opt < /usr/local/google/home/zhaoqin/Workspace/LLVM/llvm.git/test/Instrumentation/EfficiencySanitizer/struct_field_gep.ll -S/usr/local/google/home/zhaoqin/Workspace/LLVM/builds/build_x64_rel.git/./bin/opt: <stdin>:28:50: error: invalid getelementptr indices

%arrayidx = getelementptr inbounds %struct.ST, %struct.ST* %s, i64 0, i32 -1
                                               ^

lib/Transforms/Instrumentation/EfficiencySanitizer.cpp

private:
   GlobalVariable *createCacheFragInfoGV(Module &M, const DataLayout &DL,
                                         Constant *UnitName);
   Constant *createEsanInitToolInfoArg(Module &M, const DataLayout &DL);
   void createDestructor(Module &M, Constant *ToolInfoArg);
   bool runOnFunction(Function &F, Module &M);
   bool instrumentLoadOrStore(Instruction *I, const DataLayout &DL);
   bool instrumentMemIntrinsic(MemIntrinsic *MI);
   bool instrumentGetElementPtr(Instruction *I, Module &M);
+  bool insertCounterUpdate(Instruction *I, StructType *StructTy,
+                           unsigned CounterIdx);
+  unsigned getFieldCounterIdx(StructType *StructTy) {
+    return 0;
+  }
+  unsigned getArrayCounterIdx(StructType *StructTy) {
+    return StructTy->getNumElements();
+  }
+  unsigned getStructCounterSize(StructType *StructTy) {
+    // The struct counter array includes:
+    // - one counter for each struct field,
+    // - one counter for the struct access within an array.
+    return (StructTy->getNumElements()/*field*/ + 1/*array*/);
+  }
   bool shouldIgnoreMemoryAccess(Instruction *I);
   int getMemoryAccessFuncIndex(Value *Addr, const DataLayout &DL);
   Value *appToShadow(Value *Shadow, IRBuilder<> &IRB);
   bool instrumentFastpath(Instruction *I, const DataLayout &DL, bool IsStore,
                           Value *Addr, unsigned Alignment);
   // Each tool has its own fastpath routine:
   bool instrumentFastpathCacheFrag(Instruction *I, const DataLayout &DL,
                                    Value *Addr, unsigned Alignment);
GlobalVariable *EfficiencySanitizer::createCacheFragInfoGV(
   // This structure should be kept consistent with the StructInfo struct
   // in the runtime library.
   // struct StructInfo {
   //   const char *StructName;
   //   u32 Size;
   //   u32 NumFields;
   //   u32 *FieldOffsets;
   //   u32 *FieldSize;
-  //   u64 *FieldCounters;
   //   const char **FieldTypeNames;
+  //   u64 *FieldCounters;
+  //   u64 *ArrayCounter;
   // };
   auto *StructInfoTy =
     StructType::get(Int8PtrTy, Int32Ty, Int32Ty, Int32PtrTy, Int32PtrTy,
-                    Int64PtrTy, Int8PtrPtrTy, nullptr);
+                    Int8PtrPtrTy, Int64PtrTy, Int64PtrTy, nullptr);
   auto *StructInfoPtrTy = StructInfoTy->getPointerTo();
   // This structure should be kept consistent with the CacheFragInfo struct
   // in the runtime library.
   // struct CacheFragInfo {
   //   const char *UnitName;
   //   u32 NumStructs;
   //   StructInfo *Structs;
   // };
for (auto &StructTy : Vec) {
     ++NumStructs;
 
     // StructName.
     SmallString<MaxStructCounterNameSize> CounterNameStr;
     createStructCounterName(StructTy, CounterNameStr);
     GlobalVariable *StructCounterName = createPrivateGlobalForString(
         M, CounterNameStr, /*AllowMerging*/true);
 
-    // FieldCounters.
+    // Counters.
     // We create the counter array with StructCounterName and weak linkage
     // so that the structs with the same name and layout from different
     // compilation units will be merged into one.
-    auto *CounterArrayTy = ArrayType::get(Int64Ty, StructTy->getNumElements());
+    auto *CounterArrayTy = ArrayType::get(Int64Ty,
+                                          getStructCounterSize(StructTy));
     GlobalVariable *Counters =
       new GlobalVariable(M, CounterArrayTy, false,
                          GlobalVariable::WeakAnyLinkage,
                          ConstantAggregateZero::get(CounterArrayTy),
                          CounterNameStr);
 
     // Remember the counter variable for each struct type.
     StructTyMap.insert(std::pair<Type *, GlobalVariable *>(StructTy, Counters));
for (unsigned i = 0; i < StructTy->getNumElements(); ++i) {
       OffsetVec.push_back(ConstantInt::get(Int32Ty, SL->getElementOffset(i)));
       SizeVec.push_back(ConstantInt::get(Int32Ty,
                                          DL.getTypeAllocSize(Ty)));
     }
     TypeNames->setInitializer(ConstantArray::get(TypeNameArrayTy, TypeNameVec));
     Offsets->setInitializer(ConstantArray::get(OffsetArrayTy, OffsetVec));
     Size->setInitializer(ConstantArray::get(SizeArrayTy, SizeVec));
 
+    Constant *FieldCounterIdx[2];
+    FieldCounterIdx[0] = ConstantInt::get(Int32Ty, 0);
+    FieldCounterIdx[1] = ConstantInt::get(Int32Ty,
+                                          getFieldCounterIdx(StructTy));
+    Constant *ArrayCounterIdx[2];
+    ArrayCounterIdx[0] = ConstantInt::get(Int32Ty, 0);
+    ArrayCounterIdx[1] = ConstantInt::get(Int32Ty,
+                                          getArrayCounterIdx(StructTy));
     Initializers.push_back(
         ConstantStruct::get(
             StructInfoTy,
             ConstantExpr::getPointerCast(StructCounterName, Int8PtrTy),
             ConstantInt::get(Int32Ty, SL->getSizeInBytes()),
             ConstantInt::get(Int32Ty, StructTy->getNumElements()),
             ConstantExpr::getPointerCast(Offsets, Int32PtrTy),
             ConstantExpr::getPointerCast(Size, Int32PtrTy),
-            ConstantExpr::getPointerCast(Counters, Int64PtrTy),
             ConstantExpr::getPointerCast(TypeNames, Int8PtrPtrTy),
+            ConstantExpr::getGetElementPtr(CounterArrayTy, Counters,
+                                           FieldCounterIdx),
+            ConstantExpr::getGetElementPtr(CounterArrayTy, Counters,
+                                           ArrayCounterIdx),
             nullptr));
   }
   // Structs.
   Constant *StructInfo;
   if (NumStructs == 0) {
     StructInfo = ConstantPointerNull::get(StructInfoPtrTy);
   } else {
     auto *StructInfoArrayTy = ArrayType::get(StructInfoTy, NumStructs);

 bool EfficiencySanitizer::instrumentGetElementPtr(Instruction *I, Module &M) {
   GetElementPtrInst *GepInst = dyn_cast<GetElementPtrInst>(I);
   bool Res = false;
   if (GepInst == nullptr || GepInst->getNumIndices() == 1) {
     ++NumIgnoredGEPs;
     return false;
   }
   Type *SourceTy = GepInst->getSourceElementType();
+  StructType *StructTy;
+  ConstantInt *Idx;
+  // Check if GEP calculates address from a struct array.
+  if (isa<StructType>(SourceTy)) {
+    StructTy = cast<StructType>(SourceTy);
+    Idx = dyn_cast<ConstantInt>(GepInst->getOperand(1));
+    if ((Idx == nullptr || Idx->getSExtValue() != 0) &&
+        !shouldIgnoreStructType(StructTy) && StructTyMap.count(StructTy) != 0)
+      Res |= insertCounterUpdate(I, StructTy, getArrayCounterIdx(StructTy));
+  }
   // Iterate all (except the first and the last) idx within each GEP instruction
   // for possible nested struct field address calculation.
   for (unsigned i = 1; i < GepInst->getNumIndices(); ++i) {
     SmallVector<Value *, 8> IdxVec(GepInst->idx_begin(),
                                    GepInst->idx_begin() + i);
-    StructType *StructTy = dyn_cast<StructType>(
-        GetElementPtrInst::getIndexedType(SourceTy, IdxVec));
-    if (StructTy == nullptr || shouldIgnoreStructType(StructTy) ||
-        StructTyMap.count(StructTy) == 0)
+    Type *Ty = GetElementPtrInst::getIndexedType(SourceTy, IdxVec);
+    unsigned CounterIdx = 0;
+    if (isa<ArrayType>(Ty)) {
+      ArrayType *ArrayTy = cast<ArrayType>(Ty);
+      StructTy = dyn_cast<StructType>(ArrayTy->getElementType());
+      if (shouldIgnoreStructType(StructTy) || StructTyMap.count(StructTy) == 0)
+        continue;
+      // The last counter for struct array access.
+      CounterIdx = getArrayCounterIdx(StructTy);
+    } else if (isa<StructType>(Ty)) {
+      StructTy = cast<StructType>(Ty);
+      if (shouldIgnoreStructType(StructTy) || StructTyMap.count(StructTy) == 0)
         continue;
       // Get the StructTy's subfield index.
-    ConstantInt *Idx = dyn_cast<ConstantInt>(GepInst->getOperand(i+1));
-    if (Idx == nullptr || Idx->getZExtValue() > StructTy->getNumElements())
+      Idx = dyn_cast<ConstantInt>(GepInst->getOperand(i+1));
+      if (Idx == nullptr || Idx->getSExtValu() < 0)
+        continue;
+      CounterIdx = getFieldCounterIdx(StructTy) + Idx->getSExtValue();
+      if (CounterIdx >= StructTy->getNumElements())
         continue;
-    GlobalVariable *CounterArray = StructTyMap[StructTy];
-    if (CounterArray == nullptr)
-      return false;
-    IRBuilder<> IRB(I);
-    Constant *Indices[2];
-    // Xref http://llvm.org/docs/LangRef.html#i-getelementptr and
-    // http://llvm.org/docs/GetElementPtr.html.
-    // The first index of the GEP instruction steps through the first operand,
-    // i.e., the array itself.
-    Indices[0] = ConstantInt::get(IRB.getInt32Ty(), 0);
-    // The second index is the index within the array.
-    Indices[1] = ConstantInt::get(IRB.getInt32Ty(), Idx->getZExtValue());
-    Constant *Counter =
-        ConstantExpr::getGetElementPtr(
-            ArrayType::get(IRB.getInt64Ty(), StructTy->getNumElements()),
-            CounterArray, Indices);
-    Value *Load = IRB.CreateLoad(Counter);
-    IRB.CreateStore(IRB.CreateAdd(Load, ConstantInt::get(IRB.getInt64Ty(), 1)),
-                    Counter);
-    Res = true;
-  }
-  if (Res)
-    ++NumInstrumentedGEPs;
-  else
-    ++NumIgnoredGEPs;
-  return Res;
+    }
+    Res |= insertCounterUpdate(I, StructTy, CounterIdx);
+  }
+  if (Res)
+    ++NumInstrumentedGEPs;
+  else
+    ++NumIgnoredGEPs;
+  return Res;
+}
+
+bool EfficiencySanitizer::insertCounterUpdate(Instruction *I,
+                                              StructType *StructTy,
+                                              unsigned CounterIdx) {
+  Indices[1] = ConstantInt::get(IRB.getInt32Ty(), CounterIdx);
+        ArrayType::get(IRB.getInt64Ty(), getStructCounterSize(StructTy)),
+  return true;
 }
 
 int EfficiencySanitizer::getMemoryAccessFuncIndex(Value *Addr,
                                                   const DataLayout &DL) {
   Type *OrigPtrTy = Addr->getType();
   Type *OrigTy = cast<PointerType>(OrigPtrTy)->getElementType();
   assert(OrigTy->isSized());
   // The size is always a multiple of 8.

test/Instrumentation/EfficiencySanitizer/struct_field_count_basic.ll

 ; Test basic EfficiencySanitizer struct field count instrumentation.
 ;
 ; RUN: opt < %s -esan -esan-cache-frag -S | FileCheck %s
 
 %struct.A = type { i32, i32 }
 %union.U = type { double }
 %struct.C = type { %struct.anon, %union.anon, [10 x i8] }
 %struct.anon = type { i32, i32 }
 %union.anon = type { double }
 
 ; CHECK:        @0 = private unnamed_addr constant [8 x i8] c"<stdin>\00", align 1
 ; CHECK-NEXT:   @1 = private unnamed_addr constant [17 x i8] c"struct.A#2#11#11\00", align 1
-; CHECK-NEXT:   @"struct.A#2#11#11" = weak global [2 x i64] zeroinitializer
+; CHECK-NEXT:   @"struct.A#2#11#11" = weak global [3 x i64] zeroinitializer
 ; CHECK-NEXT:   @2 = internal constant [2 x i8*] [i8* getelementptr inbounds ([4 x i8], [4 x i8]* @5, i32 0, i32 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @6, i32 0, i32 0)]
 ; CHECK-NEXT:   @3 = internal constant [2 x i32] [i32 0, i32 4]
 ; CHECK-NEXT:   @4 = internal constant [2 x i32] [i32 4, i32 4]
 ; CHECK-NEXT:   @5 = private unnamed_addr constant [4 x i8] c"i32\00", align 1
 ; CHECK-NEXT:   @6 = private unnamed_addr constant [4 x i8] c"i32\00", align 1
 ; CHECK-NEXT:   @7 = private unnamed_addr constant [12 x i8] c"union.U#1#3\00", align 1
-; CHECK-NEXT:   @"union.U#1#3" = weak global [1 x i64] zeroinitializer
+; CHECK-NEXT:   @"union.U#1#3" = weak global [2 x i64] zeroinitializer
 ; CHECK-NEXT:   @8 = internal constant [1 x i8*] [i8* getelementptr inbounds ([7 x i8], [7 x i8]* @11, i32 0, i32 0)]
 ; CHECK-NEXT:   @9 = internal constant [1 x i32] zeroinitializer
 ; CHECK-NEXT:   @10 = internal constant [1 x i32] [i32 8]
 ; CHECK-NEXT:   @11 = private unnamed_addr constant [7 x i8] c"double\00", align 1
 ; CHECK-NEXT:   @12 = private unnamed_addr constant [20 x i8] c"struct.C#3#14#13#13\00", align 1
-; CHECK-NEXT:   @"struct.C#3#14#13#13" = weak global [3 x i64] zeroinitializer
+; CHECK-NEXT:   @"struct.C#3#14#13#13" = weak global [4 x i64] zeroinitializer
 ; CHECK-NEXT:   @13 = internal constant [3 x i8*] [i8* getelementptr inbounds ([33 x i8], [33 x i8]* @16, i32 0, i32 0), i8* getelementptr inbounds ([30 x i8], [30 x i8]* @17, i32 0, i32 0), i8* getelementptr inbounds ([10 x i8], [10 x i8]* @18, i32 0, i32 0)]
 ; CHECK-NEXT:   @14 = internal constant [3 x i32] [i32 0, i32 8, i32 16]
 ; CHECK-NEXT:   @15 = internal constant [3 x i32] [i32 8, i32 8, i32 10]
 ; CHECK-NEXT:   @16 = private unnamed_addr constant [33 x i8] c"%struct.anon = type { i32, i32 }\00", align 1
 ; CHECK-NEXT:   @17 = private unnamed_addr constant [30 x i8] c"%union.anon = type { double }\00", align 1
 ; CHECK-NEXT:   @18 = private unnamed_addr constant [10 x i8] c"[10 x i8]\00", align 1
 ; CHECK-NEXT:   @19 = private unnamed_addr constant [20 x i8] c"struct.anon#2#11#11\00", align 1
-; CHECK-NEXT:   @"struct.anon#2#11#11" = weak global [2 x i64] zeroinitializer
+; CHECK-NEXT:   @"struct.anon#2#11#11" = weak global [3 x i64] zeroinitializer
 ; CHECK-NEXT:   @20 = internal constant [2 x i8*] [i8* getelementptr inbounds ([4 x i8], [4 x i8]* @23, i32 0, i32 0), i8* getelementptr inbounds ([4 x i8], [4 x i8]* @24, i32 0, i32 0)]
 ; CHECK-NEXT:   @21 = internal constant [2 x i32] [i32 0, i32 4]
 ; CHECK-NEXT:   @22 = internal constant [2 x i32] [i32 4, i32 4]
 ; CHECK-NEXT:   @23 = private unnamed_addr constant [4 x i8] c"i32\00", align 1
 ; CHECK-NEXT:   @24 = private unnamed_addr constant [4 x i8] c"i32\00", align 1
 ; CHECK-NEXT:   @25 = private unnamed_addr constant [15 x i8] c"union.anon#1#3\00", align 1
-; CHECK-NEXT:   @"union.anon#1#3" = weak global [1 x i64] zeroinitializer
+; CHECK-NEXT:   @"union.anon#1#3" = weak global [2 x i64] zeroinitializer
 ; CHECK-NEXT:   @26 = internal constant [1 x i8*] [i8* getelementptr inbounds ([7 x i8], [7 x i8]* @29, i32 0, i32 0)]
 ; CHECK-NEXT:   @27 = internal constant [1 x i32] zeroinitializer
 ; CHECK-NEXT:   @28 = internal constant [1 x i32] [i32 8]
 ; CHECK-NEXT:   @29 = private unnamed_addr constant [7 x i8] c"double\00", align 1
-; CHECK-NEXT:   @30 = internal global [5 x { i8*, i32, i32, i32*, i32*, i64*, i8** }] [{ i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([17 x i8], [17 x i8]* @1, i32 0, i32 0), i32 8, i32 2, i32* getelementptr inbounds ([2 x i32], [2 x i32]* @3, i32 0, i32 0), i32* getelementptr inbounds ([2 x i32], [2 x i32]* @4, i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 0), i8** getelementptr inbounds ([2 x i8*], [2 x i8*]* @2, i32 0, i32 0) }, { i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([12 x i8], [12 x i8]* @7, i32 0, i32 0), i32 8, i32 1, i32* getelementptr inbounds ([1 x i32], [1 x i32]* @9, i32 0, i32 0), i32* getelementptr inbounds ([1 x i32], [1 x i32]* @10, i32 0, i32 0), i64* getelementptr inbounds ([1 x i64], [1 x i64]* @"union.U#1#3", i32 0, i32 0), i8** getelementptr inbounds ([1 x i8*], [1 x i8*]* @8, i32 0, i32 0) }, { i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([20 x i8], [20 x i8]* @12, i32 0, i32 0), i32 32, i32 3, i32* getelementptr inbounds ([3 x i32], [3 x i32]* @14, i32 0, i32 0), i32* getelementptr inbounds ([3 x i32], [3 x i32]* @15, i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0), i8** getelementptr inbounds ([3 x i8*], [3 x i8*]* @13, i32 0, i32 0) }, { i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([20 x i8], [20 x i8]* @19, i32 0, i32 0), i32 8, i32 2, i32* getelementptr inbounds ([2 x i32], [2 x i32]* @21, i32 0, i32 0), i32* getelementptr inbounds ([2 x i32], [2 x i32]* @22, i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 0), i8** getelementptr inbounds ([2 x i8*], [2 x i8*]* @20, i32 0, i32 0) }, { i8*, i32, i32, i32*, i32*, i64*, i8** } { i8* getelementptr inbounds ([15 x i8], [15 x i8]* @25, i32 0, i32 0), i32 8, i32 1, i32* getelementptr inbounds ([1 x i32], [1 x i32]* @27, i32 0, i32 0), i32* getelementptr inbounds ([1 x i32], [1 x i32]* @28, i32 0, i32 0), i64* getelementptr inbounds ([1 x i64], [1 x i64]* @"union.anon#1#3", i32 0, i32 0), i8** getelementptr inbounds ([1 x i8*], [1 x i8*]* @26, i32 0, i32 0) }]
-; CHECK-NEXT:   @31 = internal constant { i8*, i32, { i8*, i32, i32, i32*, i32*, i64*, i8** }* } { i8* getelementptr inbounds ([8 x i8], [8 x i8]* @0, i32 0, i32 0), i32 5, { i8*, i32, i32, i32*, i32*, i64*, i8** }* getelementptr inbounds ([5 x { i8*, i32, i32, i32*, i32*, i64*, i8** }], [5 x { i8*, i32, i32, i32*, i32*, i64*, i8** }]* @30, i32 0, i32 0) }
+; CHECK-NEXT:   @30 = internal global [5 x { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }] [{ i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([17 x i8], [17 x i8]* @1, i32 0, i32 0), i32 8, i32 2, i32* getelementptr inbounds ([2 x i32], [2 x i32]* @3, i32 0, i32 0), i32* getelementptr inbounds ([2 x i32], [2 x i32]* @4, i32 0, i32 0), i8** getelementptr inbounds ([2 x i8*], [2 x i8*]* @2, i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 2) }, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([12 x i8], [12 x i8]* @7, i32 0, i32 0), i32 8, i32 1, i32* getelementptr inbounds ([1 x i32], [1 x i32]* @9, i32 0, i32 0), i32* getelementptr inbounds ([1 x i32], [1 x i32]* @10, i32 0, i32 0), i8** getelementptr inbounds ([1 x i8*], [1 x i8*]* @8, i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"union.U#1#3", i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"union.U#1#3", i32 0, i32 1) }, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([20 x i8], [20 x i8]* @12, i32 0, i32 0), i32 32, i32 3, i32* getelementptr inbounds ([3 x i32], [3 x i32]* @14, i32 0, i32 0), i32* getelementptr inbounds ([3 x i32], [3 x i32]* @15, i32 0, i32 0), i8** getelementptr inbounds ([3 x i8*], [3 x i8*]* @13, i32 0, i32 0), i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0), i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3) }, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([20 x i8], [20 x i8]* @19, i32 0, i32 0), i32 8, i32 2, i32* getelementptr inbounds ([2 x i32], [2 x i32]* @21, i32 0, i32 0), i32* getelementptr inbounds ([2 x i32], [2 x i32]* @22, i32 0, i32 0), i8** getelementptr inbounds ([2 x i8*], [2 x i8*]* @20, i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 0), i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 2) }, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* } { i8* getelementptr inbounds ([15 x i8], [15 x i8]* @25, i32 0, i32 0), i32 8, i32 1, i32* getelementptr inbounds ([1 x i32], [1 x i32]* @27, i32 0, i32 0), i32* getelementptr inbounds ([1 x i32], [1 x i32]* @28, i32 0, i32 0), i8** getelementptr inbounds ([1 x i8*], [1 x i8*]* @26, i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"union.anon#1#3", i32 0, i32 0), i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"union.anon#1#3", i32 0, i32 1) }]
+; CHECK-NEXT:   @31 = internal constant { i8*, i32, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }* } { i8* getelementptr inbounds ([8 x i8], [8 x i8]* @0, i32 0, i32 0), i32 5, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }* getelementptr inbounds ([5 x { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }], [5 x { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }]* @30, i32 0, i32 0) }
 
 define i32 @main() {
 entry:
   %a = alloca %struct.A, align 4
   %u = alloca %union.U, align 8
   %c = alloca [2 x %struct.C], align 16
   %k = alloca %struct.A*, align 8
   %x = getelementptr inbounds %struct.A, %struct.A* %a, i32 0, i32 0

 
 ; CHECK: @llvm.global_ctors = {{.*}}@esan.module_ctor
 ; CHECK: @llvm.global_dtors = {{.*}}@esan.module_dtor
 
 ; CHECK:        %a = alloca %struct.A, align 4
 ; CHECK-NEXT:   %u = alloca %union.U, align 8
 ; CHECK-NEXT:   %c = alloca [2 x %struct.C], align 16
 ; CHECK-NEXT:   %k = alloca %struct.A*, align 8
-; CHECK-NEXT:   %0 = load i64, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   %0 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 0)
 ; CHECK-NEXT:   %1 = add i64 %0, 1
-; CHECK-NEXT:   store i64 %1, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   store i64 %1, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 0)
 ; CHECK-NEXT:   %x = getelementptr inbounds %struct.A, %struct.A* %a, i32 0, i32 0
-; CHECK-NEXT:   %2 = load i64, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 1)
+; CHECK-NEXT:   %2 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 1)
 ; CHECK-NEXT:   %3 = add i64 %2, 1
-; CHECK-NEXT:   store i64 %3, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.A#2#11#11", i32 0, i32 1)
+; CHECK-NEXT:   store i64 %3, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.A#2#11#11", i32 0, i32 1)
 ; CHECK-NEXT:   %y = getelementptr inbounds %struct.A, %struct.A* %a, i32 0, i32 1
 ; CHECK-NEXT:   %f = bitcast %union.U* %u to float*
 ; CHECK-NEXT:   %d = bitcast %union.U* %u to double*
-; CHECK-NEXT:   %arrayidx = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 0
-; CHECK-NEXT:   %4 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
+; CHECK-NEXT:   %4 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %5 = add i64 %4, 1
-; CHECK-NEXT:   store i64 %5, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
-; CHECK-NEXT:   %cs = getelementptr inbounds %struct.C, %struct.C* %arrayidx, i32 0, i32 0
-; CHECK-NEXT:   %6 = load i64, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   store i64 %5, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %arrayidx = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 0
+; CHECK-NEXT:   %6 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
 ; CHECK-NEXT:   %7 = add i64 %6, 1
-; CHECK-NEXT:   store i64 %7, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   store i64 %7, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
+; CHECK-NEXT:   %cs = getelementptr inbounds %struct.C, %struct.C* %arrayidx, i32 0, i32 0
+; CHECK-NEXT:   %8 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 0)
+; CHECK-NEXT:   %9 = add i64 %8, 1
+; CHECK-NEXT:   store i64 %9, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 0)
 ; CHECK-NEXT:   %x1 = getelementptr inbounds %struct.anon, %struct.anon* %cs, i32 0, i32 0
+; CHECK-NEXT:   %10 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %11 = add i64 %10, 1
+; CHECK-NEXT:   store i64 %11, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %arrayidx2 = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 1
-; CHECK-NEXT:   %8 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
-; CHECK-NEXT:   %9 = add i64 %8, 1
-; CHECK-NEXT:   store i64 %9, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
+; CHECK-NEXT:   %12 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
+; CHECK-NEXT:   %13 = add i64 %12, 1
+; CHECK-NEXT:   store i64 %13, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 0)
 ; CHECK-NEXT:   %cs3 = getelementptr inbounds %struct.C, %struct.C* %arrayidx2, i32 0, i32 0
-; CHECK-NEXT:   %10 = load i64, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 1)
-; CHECK-NEXT:   %11 = add i64 %10, 1
-; CHECK-NEXT:   store i64 %11, i64* getelementptr inbounds ([2 x i64], [2 x i64]* @"struct.anon#2#11#11", i32 0, i32 1)
+; CHECK-NEXT:   %14 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 1)
+; CHECK-NEXT:   %15 = add i64 %14, 1
+; CHECK-NEXT:   store i64 %15, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.anon#2#11#11", i32 0, i32 1)
 ; CHECK-NEXT:   %y4 = getelementptr inbounds %struct.anon, %struct.anon* %cs3, i32 0, i32 1
+; CHECK-NEXT:   %16 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %17 = add i64 %16, 1
+; CHECK-NEXT:   store i64 %17, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %arrayidx5 = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 0
-; CHECK-NEXT:   %12 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
-; CHECK-NEXT:   %13 = add i64 %12, 1
-; CHECK-NEXT:   store i64 %13, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
+; CHECK-NEXT:   %18 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
+; CHECK-NEXT:   %19 = add i64 %18, 1
+; CHECK-NEXT:   store i64 %19, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
 ; CHECK-NEXT:   %cu = getelementptr inbounds %struct.C, %struct.C* %arrayidx5, i32 0, i32 1
 ; CHECK-NEXT:   %f6 = bitcast %union.anon* %cu to float*
+; CHECK-NEXT:   %20 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %21 = add i64 %20, 1
+; CHECK-NEXT:   store i64 %21, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %arrayidx7 = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 1
-; CHECK-NEXT:   %14 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
-; CHECK-NEXT:   %15 = add i64 %14, 1
-; CHECK-NEXT:   store i64 %15, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
+; CHECK-NEXT:   %22 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
+; CHECK-NEXT:   %23 = add i64 %22, 1
+; CHECK-NEXT:   store i64 %23, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 1)
 ; CHECK-NEXT:   %cu8 = getelementptr inbounds %struct.C, %struct.C* %arrayidx7, i32 0, i32 1
 ; CHECK-NEXT:   %d9 = bitcast %union.anon* %cu8 to double*
+; CHECK-NEXT:   %24 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
+; CHECK-NEXT:   %25 = add i64 %24, 1
+; CHECK-NEXT:   store i64 %25, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 3)
 ; CHECK-NEXT:   %arrayidx10 = getelementptr inbounds [2 x %struct.C], [2 x %struct.C]* %c, i64 0, i64 0
-; CHECK-NEXT:   %16 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 2)
-; CHECK-NEXT:   %17 = add i64 %16, 1
-; CHECK-NEXT:   store i64 %17, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.C#3#14#13#13", i32 0, i32 2)
+; CHECK-NEXT:   %26 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 2)
+; CHECK-NEXT:   %27 = add i64 %26, 1
+; CHECK-NEXT:   store i64 %27, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.C#3#14#13#13", i32 0, i32 2)
 ; CHECK-NEXT:   %c11 = getelementptr inbounds %struct.C, %struct.C* %arrayidx10, i32 0, i32 2
 ; CHECK-NEXT:   %arrayidx12 = getelementptr inbounds [10 x i8], [10 x i8]* %c11, i64 0, i64 2
 ; CHECK-NEXT:   %k1 = load %struct.A*, %struct.A** %k, align 8
 ; CHECK-NEXT:   %arrayidx13 = getelementptr inbounds %struct.A, %struct.A* %k1, i64 0
 ; CHECK-NEXT:   ret i32 0
 
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ; Top-level:
 
 ; CHECK: define internal void @esan.module_ctor()
-; CHECK: call void @__esan_init(i32 1, i8* bitcast ({ i8*, i32, { i8*, i32, i32, i32*, i32*, i64*, i8** }* }* @31 to i8*))
+; CHECK: call void @__esan_init(i32 1, i8* bitcast ({ i8*, i32, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }* }* @31 to i8*))
 ; CHECK: define internal void @esan.module_dtor()
-; CHECK: call void @__esan_exit(i8* bitcast ({ i8*, i32, { i8*, i32, i32, i32*, i32*, i64*, i8** }* }* @31 to i8*))
+; CHECK: call void @__esan_exit(i8* bitcast ({ i8*, i32, { i8*, i32, i32, i32*, i32*, i8**, i64*, i64* }* }* @31 to i8*))

test/Instrumentation/EfficiencySanitizer/struct_field_gep.ll

 %struct.ST = type { i32, double, %struct.RT }
 
 define i32* @foo(%struct.ST* %s) nounwind uwtable readnone optsize ssp {
 entry:
   %arrayidx = getelementptr inbounds %struct.ST, %struct.ST* %s, i64 1, i32 2, i32 1, i64 5, i64 13
   ret i32* %arrayidx
 }
 
-; CHECK:        %0 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 2)
+; CHECK:        %0 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 3)
 ; CHECK-NEXT:   %1 = add i64 %0, 1
-; CHECK-NEXT:   store i64 %1, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 2)
-; CHECK-NEXT:   %2 = load i64, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.RT#3#11#14#11", i32 0, i32 1)
+; CHECK-NEXT:   store i64 %1, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 3)
+; CHECK-NEXT:   %2 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 2)
 ; CHECK-NEXT:   %3 = add i64 %2, 1
-; CHECK-NEXT:   store i64 %3, i64* getelementptr inbounds ([3 x i64], [3 x i64]* @"struct.RT#3#11#14#11", i32 0, i32 1)
+; CHECK-NEXT:   store i64 %3, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.ST#3#13#3#11", i32 0, i32 2)
+; CHECK-NEXT:   %4 = load i64, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.RT#3#11#14#11", i32 0, i32 1)
+; CHECK-NEXT:   %5 = add i64 %4, 1
+; CHECK-NEXT:   store i64 %5, i64* getelementptr inbounds ([4 x i64], [4 x i64]* @"struct.RT#3#11#14#11", i32 0, i32 1)
 ; CHECK-NEXT:   %arrayidx = getelementptr inbounds %struct.ST, %struct.ST* %s, i64 1, i32 2, i32 1, i64 5, i64 13
 ; CHECK-NEXT:   ret i32* %arrayidx