[ASAN] Fix detection of stack-use-after scope for char arrays.

[vitalybuka]

Summary

Clang inserts GetElementPtrInst so findAllocaForValue was not
able to find allocas.

PR27453

[eugenis]

This needs an IR-level test that shows that proper instrumentation appears on lifetime-after-gep allocas.

[vitalybuka]

ll test

[vitalybuka]

In D22657#492216, @eugenis wrote:

This needs an IR-level test that shows that proper instrumentation appears on lifetime-after-gep allocas.

Done.

[eugenis]

lib/Transforms/Instrumentation/AddressSanitizer.cpp

2294

We definitely should not crash if we see something we don't understand.
A dbg() message at most.

[vitalybuka]

removed assert

[eugenis]

LGTM

lib/Transforms/Instrumentation/AddressSanitizer.cpp

2292

The message should probably say something about alloca or lifetime.

[vitalybuka]

updated message

lib/Transforms/Instrumentation/AddressSanitizer.cpp

for (Value *IncValue : PN->incoming_values()) {
       // Allow self-referencing phi-nodes.
       if (IncValue == PN) continue;
       AllocaInst *IncValueAI = findAllocaForValue(IncValue);
       // AI for incoming values should exist and should all be equal.
       if (IncValueAI == nullptr || (Res != nullptr && IncValueAI != Res))
         return nullptr;
       Res = IncValueAI;
     }
+  } else if (GetElementPtrInst *EP = dyn_cast<GetElementPtrInst>(V)) {
+    Res = findAllocaForValue(EP->getPointerOperand());
+  } else {
+    // If we get here we need to handle other types of instructions which can
+    // be inserted between alloca and intrinsic.
+    assert(false);
   }
   if (Res) AllocaForValue[V] = Res;
   return Res;
 }
 
 void FunctionStackPoisoner::handleDynamicAllocaCall(AllocaInst *AI) {
   IRBuilder<> IRB(AI);
 

test/Instrumentation/AddressSanitizer/lifetime.ll

 bb1:
   %i.phi = phi i8* [ %i.ptr, %entry ], [ %i.ptr2, %bb0 ]
   call void @llvm.lifetime.end(i64 8, i8* %i.phi)
   ; CHECK: __asan_poison_stack_memory
   ; CHECK: ret void
   ret void
 }
 
+; Check that arguments of lifetime may come from getelementptr nodes.
+define void @getelementptr_args() sanitize_address{
+  ; CHECK-LABEL: define void @getelementptr_args
+entry:
+  %x = alloca [1024 x i8], align 16
+  %d = alloca i8*, align 8
+
+  %0 = getelementptr inbounds [1024 x i8], [1024 x i8]* %x, i64 0, i64 0
+  call void @llvm.lifetime.start(i64 1024, i8* %0)
+  ; CHECK: __asan_unpoison_stack_memory
+
+  store i8* %0, i8** %d, align 8
+
+  call void @llvm.lifetime.end(i64 1024, i8* %0)
+  ; CHECK: __asan_poison_stack_memory
+
+  ret void
+  ; CHECK: __asan_unpoison_stack_memory
+}
+
 define void @zero_sized(i64 %a) #0 {
 ; CHECK-LABEL: define void @zero_sized(i64 %a)
 
 entry:
   %a.addr = alloca i64, align 8
   %b = alloca [0 x i8], align 1
   store i64 %a, i64* %a.addr, align 8
   %0 = bitcast [0 x i8]* %b to i8*
   call void @llvm.lifetime.start(i64 0, i8* %0) #2
   ; CHECK-NOT: call void @__asan_unpoison_stack_memory
   %1 = bitcast [0 x i8]* %b to i8*
   call void @llvm.lifetime.end(i64 0, i8* %1) #2
   ; CHECK-NOT: call void @__asan_poison_stack_memory
 
   ret void
 }