Add a test for vcall on a null ptr.

[krasin]

Summary

Turns out that in the case of -fsanitize=null and a virtual call,
the type check was generated *after* reading from vtable, which
causes a non-interpretable segfault. The check has been moved up
in https://reviews.llvm.org/D26559 and this CL adds a test for this case.

[krasin]

sync

[pcc]

test/ubsan/TestCases/TypeCheck/null.cpp

1

Why add the -g?

10

Is this #include needed?

35

Did you intend to add tests for these cases?

[krasin]

sync & address the comments.

test/ubsan/TestCases/TypeCheck/null.cpp

1

It's a debug left over. Thank you for the catch.

10

Debug leftover. Removed. Thank you for spotting this.

35

Actually, the real reason for adding these is that break_optimization didn't really fool the compiler, and I had to add some more logic to avoid letting it know that the pointer is always null => it's undefined behavior. In my case, I saw my return being ignored and two switch statements executed together.

I can't currently reproduce it now, most likely, because the fix has eliminated the virtual call on a pointer that is guaranteed to be null. So, I have removed these as well as break_optimization calls.

[krasin]

Ping.

[pcc]

LGTM

test/ubsan/TestCases/TypeCheck/null.cpp

-// RUN: %clangxx -fsanitize=null %s -O3 -o %t
-// RUN: %run %t l 2>&1 | FileCheck %s --check-prefix=CHECK-LOAD
-// RUN: %expect_crash %run %t s 2>&1 | FileCheck %s --check-prefix=CHECK-STORE
-// RUN: %run %t r 2>&1 | FileCheck %s --check-prefix=CHECK-REFERENCE
-// RUN: %run %t m 2>&1 | FileCheck %s --check-prefix=CHECK-MEMBER
-// RUN: %run %t f 2>&1 | FileCheck %s --check-prefix=CHECK-MEMFUN
+// RUN: %clangxx -fsanitize=null -fno-sanitize-recover=null -g %s -O3 -o %t
+// RUN: not %run %t l 2>&1 | FileCheck %s --check-prefix=CHECK-LOAD
+// RUN: not %run %t s 2>&1 | FileCheck %s --check-prefix=CHECK-STORE
+// RUN: not %run %t r 2>&1 | FileCheck %s --check-prefix=CHECK-REFERENCE
+// RUN: not %run %t m 2>&1 | FileCheck %s --check-prefix=CHECK-MEMBER
+// RUN: not %run %t f 2>&1 | FileCheck %s --check-prefix=CHECK-MEMFUN
+// RUN: not %run %t t 2>&1 | FileCheck %s --check-prefix=CHECK-VCALL
+// RUN: not %run %t u 2>&1 | FileCheck %s --check-prefix=CHECK-VCALL2
+
+#include <stdio.h>
 
 struct S {
   int f() { return 0; }
   int k;
 };
 
+struct T {
+  virtual int v() { return 1; }
+};
+
+struct U : T {
+  virtual int v() { return 2; }
+};
+
+static inline void break_optimization(void *arg) {
+  __asm__ __volatile__("" : : "r" (arg) : "memory");
+}
+
 int main(int, char **argv) {
   int *p = 0;
   S *s = 0;
+  T *t = 0;
+  U *u = 0;
+
+  if (argv[1][0] == 'T') {
+    t = new T;
+  }
+  if (argv[1][0] == 'U') {
+    u = new U;
+  }
+
+  break_optimization(s);
+  break_optimization(t);
+  break_optimization(u);
 
   (void)*p; // ok!
+  (void)*t; // ok!
 
   switch (argv[1][0]) {
   case 'l':
     // CHECK-LOAD: null.cpp:[[@LINE+1]]:12: runtime error: load of null pointer of type 'int'
     return *p;
   case 's':
     // CHECK-STORE: null.cpp:[[@LINE+1]]:5: runtime error: store to null pointer of type 'int'
     *p = 1;
     break;
   case 'r':
     // CHECK-REFERENCE: null.cpp:[[@LINE+1]]:15: runtime error: reference binding to null pointer of type 'int'
     {int &r = *p;}
     break;
   case 'm':
     // CHECK-MEMBER: null.cpp:[[@LINE+1]]:15: runtime error: member access within null pointer of type 'S'
     return s->k;
   case 'f':
     // CHECK-MEMFUN: null.cpp:[[@LINE+1]]:15: runtime error: member call on null pointer of type 'S'
     return s->f();
+  case 't':
+  case 'T':
+    // CHECK-VCALL: null.cpp:[[@LINE+1]]:15: runtime error: member call on null pointer of type 'T'
+    return t->v();
+  case 'u':
+  case 'U':
+    // CHECK-VCALL2: null.cpp:[[@LINE+1]]:15: runtime error: member call on null pointer of type 'U'
+    return u->v();
   }
 }