[ubsan] Reduce alignment checking of C++ object pointers

[vsk]

Summary

This patch teaches ubsan to insert an alignment check for the 'this'
pointer at the start of each method/lambda. This allows clang to emit
significantly fewer alignment checks overall, because if 'this' is
aligned, so are its fields.

This is essentially the same thing r295515 does, but for the alignment
check instead of the null check. One difference is that we keep the
alignment checks on member expressions where the base is a DeclRefExpr.
There's an opportunity to diagnose unaligned accesses in this situation
(as pointed out by Eli, see PR32630).

Testing: check-clang, check-ubsan, and a stage2 ubsan build.

Along with the patch from D30285, this roughly halves the amount of
alignment checks we emit when compiling X86FastISel.cpp. Here are the
numbers from patched/unpatched clangs based on r298160.

Setup	# of alignment checks
unpatched, -O0	24326
patched, -O0	12717	(-47.7%)

There are a few possible follow-ups:

• Don't add the per method/lambda check in delegating constructors.
• Don't instrument accesses to fields with alignment = 1.

[vsk]

Ping. I appreciate that there are a lot of test changes to sift through here -- please let me know if I can make the patch easier to review in any way.

[efriedma]

I'm not sure we actually want to skip these checks for DeclRefExps. I mean, you can rely on the backend to correctly align a local variable (assuming the stack is correctly aligned), but it's very easy to misalign a global.

[vsk]

Hi Eli, thanks for your feedback :).

In D30283#702085, @efriedma wrote:

I'm not sure we actually want to skip these checks for DeclRefExps. I mean, you can rely on the backend to correctly align a local variable (assuming the stack is correctly aligned), but it's very easy to misalign a global.

I did some experimenting, and think that we can safely skip the alignment check for DeclRefExps. Here is what I found:

1. It seems hard to declare a misaligned global. I could not come up with an example where this happens. FWIW, I tried playing tricks with the linker but it refused to do the wrong thing (-Wl,-sectalign,__DATA,__common,1 ; -Wl,-order_file,insert_pad_byte_to_misalign_global.order_file).
2. It's easy to declare a global pointer or reference to misaligned data. UBSan already misses this bug: this patch doesn't affect the situation (I filed llvm.org/PR32364 to track the issue).

When you said "it's very easy to misalign a global", did you mean that it's easy for the compiler to mess up? If so, my thinking is that we should write better verifiers, either in our linkers or in LLVM proper. UBSan shouldn't be used as a compiler verifier: if it is, end-users will find its diagnostics to be less actionable. We shouldn't break user bots because of compiler bugs.

If, OTOH, you meant that it's easy for users to declare misaligned globals, I'd appreciate an example.

[efriedma]

It's possible to misalign a global definition by misaligning its section with a linker script... but we can probably ignore that possibility.

It's very easy to misalign global declaration, though; for example:

a.c:

extern int a[];
int f(int x) { return a[x]; }

b.c:

char a[] = "asdfzxcv";

[vsk]

In D30283#707007, @efriedma wrote:

It's possible to misalign a global definition by misaligning its section with a linker script... but we can probably ignore that possibility.

The current implementation does ignore this case.

It's very easy to misalign global declaration, though; for example: [...]

Thanks for pointing this out, I hadn't thought of this case! The current patch does not regress UBSan checking in this area. I'll upload a new test that demonstrates this.

[vsk]

Add a test which shows that we don't regress alignment-checking when accessing extern variables.

[efriedma]

test/CodeGenCXX/ubsan-global-alignment.cpp

10

Probably a good idea to also test extern globals which aren't arrays; arrays are sort of a special-case due to array->pointer decay.

[vsk]

Per Eli's comment: test that we don't regress alignment-checking for extern globals which aren't arrays. I verified that for this case, there is not functional change. However, there *is* a somewhat surprising IR change even at -O0, that is worth calling out.

Before this patch, here's what happens when loading a "long long" from a global struct:

define i64 @load_extern_S1()() #0 {
  br i1 true, label %2, label %1, !prof !2, !nosanitize !3 ;; The frontend appears to be doing some early optimizations here...

; <label>:1:                                      ; preds = %0
  call void @__ubsan_handle_type_mismatch(i8* bitcast ({ { [99 long long i8]*, i32, i32 }, { i16, i16, [12 long long i8] }*, i64, i8 }* @1 to i8*), i64 ptrtoint (%struct.S1* @g_S1 to i64)) #2, !nosanitize !3
  br label %2, !nosanitize !3

; <label>:2:                                      ; preds = %1, %0
  %3 = load i64, i64* getelementptr inbounds (%struct.S1, %struct.S1* @g_S1, i32 0, i32 0), align 8
  ret i64 %3
}

Because this patch skips alignment checking when the base of a MemberExpr is a DeclRefExpr, the IR changes, even though the behavior doesn't:

define i64 @load_extern_S1()() #0 {
  %0 = load i64, i64* getelementptr inbounds (%struct.S1, %struct.S1* @g_S1, i32 0, i32 0), align 8
  ret i64 %0
}

IMO this is an acceptable change which won't lead to missed diagnostics. But I'm calling it out in case anyone thinks otherwise.

[efriedma]

Oh, right... constant folding uses the declared alignment of the global to constant-fold the comparison. (I still think it would be interesting to solve, but maybe orthogonal to some extent.)

[vsk]

Eli pointed out that it's possible to make alignment checks for extern globals work better (llvm.org/PR32630). One solution depends on emitting alignment checks on bases of member expressions which are DeclRefExprs. I updated this patch so that we'll continue to do that. PTAL.

[efriedma]

LGTM.

test/CodeGenCXX/ubsan-suppress-checks.cpp

25

LAMBDA-NOT: call void @__ubsan_handle_type_mismatch ?

[vsk]

Thanks for the review!

test/CodeGenCXX/ubsan-suppress-checks.cpp

25

I'll tighten up this test. This method contains two calls to __ubsan_handle_type_mismatch. The first is due to a null+alignment check for "this" at the start of "do_nothing_with_lambda". The second occurs because we have the same checks for the anonymous object backing "f". Before this patch, the first check on "this" did not perform an alignment check. The second check has always been present.

lib/CodeGen/CGExpr.cpp

 LValue CodeGenFunction::EmitUnsupportedLValue(const Expr *E,
                                               const char *Name) {
   ErrorUnsupported(E, Name);
   llvm::Type *Ty = llvm::PointerType::getUnqual(ConvertType(E->getType()));
   return MakeAddrLValue(Address(llvm::UndefValue::get(Ty), CharUnits::One()),
                         E->getType());
 }
 
-bool CodeGenFunction::IsDeclRefOrWrappedCXXThis(const Expr *Obj) {
-  if (isa<DeclRefExpr>(Obj))
-    return true;
-
+bool CodeGenFunction::IsWrappedCXXThis(const Expr *Obj) {
   const Expr *Base = Obj;
   while (!isa<CXXThisExpr>(Base)) {
     // The result of a dynamic_cast can be null.
     if (isa<CXXDynamicCastExpr>(Base))
       return false;
 
     if (const auto *CE = dyn_cast<CastExpr>(Base)) {
       Base = CE->getSubExpr();

 LValue CodeGenFunction::EmitCheckedLValue(const Expr *E, TypeCheckKind TCK) {
   LValue LV;
   if (SanOpts.has(SanitizerKind::ArrayBounds) && isa<ArraySubscriptExpr>(E))
     LV = EmitArraySubscriptExpr(cast<ArraySubscriptExpr>(E), /*Accessed*/true);
   else
     LV = EmitLValue(E);
   if (!isa<DeclRefExpr>(E) && !LV.isBitField() && LV.isSimple()) {
     SanitizerSet SkippedChecks;
-    if (const auto *ME = dyn_cast<MemberExpr>(E))
-      if (IsDeclRefOrWrappedCXXThis(ME->getBase()))
+    if (const auto *ME = dyn_cast<MemberExpr>(E)) {
+      bool IsBaseCXXThis = IsWrappedCXXThis(ME->getBase());
+      if (IsBaseCXXThis)
+        SkippedChecks.set(SanitizerKind::Alignment, true);
+      if (IsBaseCXXThis || isa<DeclRefExpr>(ME->getBase()))
         SkippedChecks.set(SanitizerKind::Null, true);
+    }
     EmitTypeCheck(TCK, E->getExprLoc(), LV.getPointer(),
                   E->getType(), LV.getAlignment(), SkippedChecks);
   }
   return LV;
 }
 
 /// EmitLValue - Emit code to compute a designator that specifies the location
 /// of the expression.
LValue CodeGenFunction::EmitMemberExpr(const MemberExpr *E) {
 
   // If this is s.x, emit s as an lvalue.  If it is s->x, emit s as a scalar.
   LValue BaseLV;
   if (E->isArrow()) {
     AlignmentSource AlignSource;
     Address Addr = EmitPointerWithAlignment(BaseExpr, &AlignSource);
     QualType PtrTy = BaseExpr->getType()->getPointeeType();
     SanitizerSet SkippedChecks;
-    if (IsDeclRefOrWrappedCXXThis(BaseExpr))
+    bool IsBaseCXXThis = IsWrappedCXXThis(BaseExpr);
+    if (IsBaseCXXThis)
+      SkippedChecks.set(SanitizerKind::Alignment, true);
+    if (IsBaseCXXThis || isa<DeclRefExpr>(BaseExpr))
       SkippedChecks.set(SanitizerKind::Null, true);
     EmitTypeCheck(TCK_MemberAccess, E->getExprLoc(), Addr.getPointer(), PtrTy,
                   /*Alignment=*/CharUnits::Zero(), SkippedChecks);
     BaseLV = MakeAddrLValue(Addr, PtrTy, AlignSource);
   } else
     BaseLV = EmitCheckedLValue(BaseExpr, TCK_MemberAccess);
 
   NamedDecl *ND = E->getMemberDecl();

lib/CodeGen/CGExprCXX.cpp

RValue CodeGenFunction::EmitCXXMemberOrOperatorMemberCallExpr(
   //   If a non-static member function of a class X is called for an object that
   //   is not of type X, or of a type derived from X, the behavior is undefined.
   SourceLocation CallLoc;
   ASTContext &C = getContext();
   if (CE)
     CallLoc = CE->getExprLoc();
 
   SanitizerSet SkippedChecks;
-  if (const auto *CMCE = dyn_cast<CXXMemberCallExpr>(CE))
-    if (IsDeclRefOrWrappedCXXThis(CMCE->getImplicitObjectArgument()))
+  if (const auto *CMCE = dyn_cast<CXXMemberCallExpr>(CE)) {
+    auto *IOA = CMCE->getImplicitObjectArgument();
+    bool IsImplicitObjectCXXThis = IsWrappedCXXThis(IOA);
+    if (IsImplicitObjectCXXThis)
+      SkippedChecks.set(SanitizerKind::Alignment, true);
+    if (IsImplicitObjectCXXThis || isa<DeclRefExpr>(IOA))
       SkippedChecks.set(SanitizerKind::Null, true);
+  }
   EmitTypeCheck(
       isa<CXXConstructorDecl>(CalleeDecl) ? CodeGenFunction::TCK_ConstructorCall
                                           : CodeGenFunction::TCK_MemberCall,
       CallLoc, This.getPointer(), C.getRecordType(CalleeDecl->getParent()),
       /*Alignment=*/CharUnits::Zero(), SkippedChecks);
 
   // FIXME: Uses of 'MD' past this point need to be audited. We may need to use
   // 'CalleeDecl' instead.

lib/CodeGen/CodeGenFunction.h

#endif
 
   /// getAccessedFieldNo - Given an encoded value and a result number, return
   /// the input field number being accessed.
   static unsigned getAccessedFieldNo(unsigned Idx, const llvm::Constant *Elts);
 
   llvm::BlockAddress *GetAddrOfLabel(const LabelDecl *L);
   llvm::BasicBlock *GetIndirectGotoBlock();
 
-  /// Check if \p E is a reference, or a C++ "this" pointer wrapped in value-
-  /// preserving casts.
-  static bool IsDeclRefOrWrappedCXXThis(const Expr *E);
+  /// Check if \p E is a C++ "this" pointer wrapped in value-preserving casts.
+  static bool IsWrappedCXXThis(const Expr *E);
 
   /// EmitNullInitialization - Generate code to set a value of the given type to
   /// null, If the type contains data member pointers, they will be initialized
   /// to -1 in accordance with the Itanium C++ ABI.
   void EmitNullInitialization(Address DestPtr, QualType Ty);
 
   /// Emits a call to an LLVM variable-argument intrinsic, either
   /// \c llvm.va_start or \c llvm.va_end.

lib/CodeGen/CodeGenFunction.cpp

if (MD->getParent()->isLambda() &&
       }
     } else {
       // Not in a lambda; just use 'this' from the method.
       // FIXME: Should we generate a new load for each use of 'this'?  The
       // fast register allocator would be happier...
       CXXThisValue = CXXABIThisValue;
     }
 
-    // Null-check the 'this' pointer once per function, if it's available.
+    // Check the 'this' pointer once per function, if it's available.
     if (CXXThisValue) {
       SanitizerSet SkippedChecks;
-      SkippedChecks.set(SanitizerKind::Alignment, true);
       SkippedChecks.set(SanitizerKind::ObjectSize, true);
-      EmitTypeCheck(TCK_Load, Loc, CXXThisValue, MD->getThisType(getContext()),
-                    /*Alignment=*/CharUnits::Zero(), SkippedChecks);
+      QualType ThisTy = MD->getThisType(getContext());
+      EmitTypeCheck(TCK_Load, Loc, CXXThisValue, ThisTy,
+                    getContext().getTypeAlignInChars(ThisTy->getPointeeType()),
+                    SkippedChecks);
     }
   }
 
   // If any of the arguments have a variably modified type, make sure to
   // emit the type size.
   for (FunctionArgList::const_iterator i = Args.begin(), e = Args.end();
        i != e; ++i) {
     const VarDecl *VD = *i;

test/CodeGenCXX/ubsan-global-alignment.cpp

+// RUN: %clang_cc1 -std=c++11 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=alignment | FileCheck %s
+
+struct S {
+  int I;
+};
+
+extern S g_S;
+extern S array_S[];
+
+// CHECK-LABEL: define i32 @_Z18load_extern_global
+int load_extern_global() {
+  // FIXME: The IR builder constant-folds the alignment check away to 'true'
+  // here, so we never call the diagnostic. This is PR32630.
+  // CHECK-NOT: ptrtoint i32* {{.*}} to i32, !nosanitize
+  // CHECK: [[I:%.*]] = load i32, i32* getelementptr inbounds (%struct.S, %struct.S* @g_S, i32 0, i32 0), align 4
+  // CHECK-NEXT: ret i32 [[I]]
+  return g_S.I;
+}
+
+// CHECK-LABEL: define i32 @_Z22load_from_extern_array
+int load_from_extern_array(int I) {
+  // CHECK: [[I:%.*]] = getelementptr inbounds %struct.S, %struct.S* {{.*}}, i32 0, i32 0
+  // CHECK-NEXT: [[PTRTOINT:%.*]] = ptrtoint i32* [[I]] to i64, !nosanitize
+  // CHECK-NEXT: [[AND:%.*]] = and i64 [[PTRTOINT]], 3, !nosanitize
+  // CHECK-NEXT: [[ICMP:%.*]] = icmp eq i64 [[AND]], 0, !nosanitize
+  // CHECK-NEXT: br i1 [[ICMP]]
+  // CHECK: call void @__ubsan_handle_type_mismatch
+  return array_S[I].I;
+}

test/CodeGenCXX/ubsan-suppress-checks.cpp

+// RUN: %clang_cc1 -std=c++11 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=alignment | FileCheck %s --check-prefixes=CHECK,ALIGN
+// RUN: %clang_cc1 -std=c++11 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=null | FileCheck %s --check-prefixes=CHECK,NULL
+// RUN: %clang_cc1 -std=c++11 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=alignment,null -DCHECK_LAMBDA | FileCheck %s --check-prefixes=LAMBDA
+
+struct A {
+  int foo;
+
+  // CHECK-LABEL: define linkonce_odr void @_ZN1A10do_nothingEv
+  void do_nothing() {
+    // ALIGN: %[[THISINT1:[0-9]+]] = ptrtoint %struct.A* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[THISINT1]], 3, !nosanitize
+    // NULL: icmp ne %struct.A* %[[THIS1:[a-z0-9]+]], null, !nosanitize
+    // NULL: ptrtoint %struct.A* %[[THIS1]] to i64, !nosanitize
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    // CHECK: ret void
+  }
+
+#ifdef CHECK_LAMBDA
+  // LAMBDA-LABEL: define linkonce_odr void @_ZN1A22do_nothing_with_lambdaEv
+  void do_nothing_with_lambda() {
+    // LAMBDA: icmp ne %struct.A* %[[THIS2:[a-z0-9]+]], null, !nosanitize
+    // LAMBDA: %[[THISINT2:[0-9]+]] = ptrtoint %struct.A* %[[THIS2]] to i64, !nosanitize
+    // LAMBDA: and i64 %[[THISINT2]], 3, !nosanitize
+    // LAMBDA: call void @__ubsan_handle_type_mismatch
+
+    auto f = [&] {
+      foo = 0;
+    };
+    f();
+
+    // LAMBDA: ret void
+  }
+
+// Check the IR for the lambda:
+//
+// LAMBDA-LABEL: define linkonce_odr void @_ZZN1A22do_nothing_with_lambdaEvENKUlvE_clEv
+// LAMBDA: call void @__ubsan_handle_type_mismatch
+// LAMBDA-NOT: call void @__ubsan_handle_type_mismatch
+// LAMBDA: ret void
+#endif
+
+  // CHECK-LABEL: define linkonce_odr i32 @_ZN1A11load_memberEv
+  int load_member() {
+    // ALIGN: %[[THISINT3:[0-9]+]] = ptrtoint %struct.A* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[THISINT3]], 3, !nosanitize
+    // NULL: icmp ne %struct.A* %[[THIS3:[a-z0-9]+]], null, !nosanitize
+    // NULL: ptrtoint %struct.A* %[[THIS3]] to i64, !nosanitize
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    return foo;
+    // CHECK: ret i32
+  }
+
+  // CHECK-LABEL: define linkonce_odr i32 @_ZN1A11call_methodEv
+  int call_method() {
+    // ALIGN: %[[THISINT4:[0-9]+]] = ptrtoint %struct.A* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[THISINT4]], 3, !nosanitize
+    // NULL: icmp ne %struct.A* %[[THIS4:[a-z0-9]+]], null, !nosanitize
+    // NULL: ptrtoint %struct.A* %[[THIS4]] to i64, !nosanitize
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    return load_member();
+    // CHECK: ret i32
+  }
+
+  // CHECK-LABEL: define linkonce_odr void @_ZN1A15assign_member_1Ev
+  void assign_member_1() {
+    // ALIGN: %[[THISINT5:[0-9]+]] = ptrtoint %struct.A* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[THISINT5]], 3, !nosanitize
+    // NULL: icmp ne %struct.A* %[[THIS5:[a-z0-9]+]], null, !nosanitize
+    // NULL: ptrtoint %struct.A* %[[THIS5]] to i64, !nosanitize
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    foo = 0;
+    // CHECK: ret void
+  }
+
+  // CHECK-LABEL: define linkonce_odr void @_ZN1A15assign_member_2Ev
+  void assign_member_2() {
+    // ALIGN: %[[THISINT6:[0-9]+]] = ptrtoint %struct.A* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[THISINT6]], 3, !nosanitize
+    // NULL: icmp ne %struct.A* %[[THIS6:[a-z0-9]+]], null, !nosanitize
+    // NULL: ptrtoint %struct.A* %[[THIS6]] to i64, !nosanitize
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    (__extension__ (this))->foo = 0;
+    // CHECK: ret void
+  }
+
+  // CHECK-LABEL: define linkonce_odr void @_ZNK1A15assign_member_3Ev
+  void assign_member_3() const {
+    // ALIGN: %[[THISINT7:[0-9]+]] = ptrtoint %struct.A* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[THISINT7]], 3, !nosanitize
+    // NULL: icmp ne %struct.A* %[[THIS7:[a-z0-9]+]], null, !nosanitize
+    // NULL: ptrtoint %struct.A* %[[THIS7]] to i64, !nosanitize
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    const_cast<A *>(this)->foo = 0;
+    // CHECK: ret void
+  }
+
+  // CHECK-LABEL: define linkonce_odr i32 @_ZN1A22call_through_referenceERS_
+  static int call_through_reference(A &a) {
+    // ALIGN: %[[OBJINT:[0-9]+]] = ptrtoint %struct.A* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[OBJINT]], 3, !nosanitize
+    // ALIGN: call void @__ubsan_handle_type_mismatch
+    // NULL-NOT: call void @__ubsan_handle_type_mismatch
+    return a.load_member();
+    // CHECK: ret i32
+  }
+
+  // CHECK-LABEL: define linkonce_odr i32 @_ZN1A20call_through_pointerEPS_
+  static int call_through_pointer(A *a) {
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    return a->load_member();
+    // CHECK: ret i32
+  }
+};
+
+struct B {
+  operator A*() const { return nullptr; }
+
+  // CHECK-LABEL: define linkonce_odr i32 @_ZN1B11load_memberEv
+  static int load_member() {
+    // Check &b before converting it to an A*.
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    //
+    // Check the result of the conversion before using it.
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    //
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    B b;
+    return static_cast<A *>(b)->load_member();
+    // CHECK: ret i32
+  }
+};
+
+struct Base {
+  int foo;
+
+  virtual int load_member_1() = 0;
+};
+
+struct Derived : public Base {
+  int bar;
+
+  // CHECK-LABEL: define linkonce_odr i32 @_ZN7Derived13load_member_2Ev
+  int load_member_2() {
+    // ALIGN: %[[THISINT8:[0-9]+]] = ptrtoint %struct.Derived* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[THISINT8]], 7, !nosanitize
+    // ALIGN: call void @__ubsan_handle_type_mismatch
+    // NULL: icmp ne %struct.Derived* %[[THIS8:[a-z0-9]+]], null, !nosanitize
+    // NULL: ptrtoint %struct.Derived* %[[THIS8]] to i64, !nosanitize
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    //
+    // Check the result of the cast before using it.
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    //
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    return dynamic_cast<Base *>(this)->load_member_1();
+    // CHECK: ret i32
+  }
+
+  // CHECK-LABEL: define linkonce_odr i32 @_ZN7Derived13load_member_3Ev
+  int load_member_3() {
+    // ALIGN: %[[THISINT9:[0-9]+]] = ptrtoint %struct.Derived* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[THISINT9]], 7, !nosanitize
+    // ALIGN: call void @__ubsan_handle_type_mismatch
+    // ALIGN: call void @__ubsan_handle_type_mismatch
+    // NULL: icmp ne %struct.Derived* %[[THIS9:[a-z0-9]+]], null, !nosanitize
+    // NULL: ptrtoint %struct.Derived* %[[THIS9]] to i64, !nosanitize
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    return reinterpret_cast<Derived *>(static_cast<Base *>(this))->foo;
+    // CHECK: ret i32
+  }
+
+  // CHECK-LABEL: define linkonce_odr i32 @_ZN7Derived13load_member_1Ev
+  int load_member_1() override {
+    // ALIGN: %[[THISINT10:[0-9]+]] = ptrtoint %struct.Derived* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %[[THISINT10]], 7, !nosanitize
+    // ALIGN: call void @__ubsan_handle_type_mismatch
+    // NULL: icmp ne %struct.Derived* %[[THIS10:[a-z0-9]+]], null, !nosanitize
+    // NULL: ptrtoint %struct.Derived* %[[THIS10]] to i64, !nosanitize
+    // CHECK: call void @__ubsan_handle_type_mismatch
+    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
+    return foo + bar;
+    // CHECK: ret i32
+  }
+};
+
+void force_irgen() {
+  A *a;
+  a->do_nothing();
+#ifdef CHECK_LAMBDA
+  a->do_nothing_with_lambda();
+#endif
+  a->load_member();
+  a->call_method();
+  a->assign_member_1();
+  a->assign_member_2();
+  a->assign_member_3();
+  A::call_through_reference(*a);
+  A::call_through_pointer(a);
+
+  B::load_member();
+
+  Base *b = new Derived;
+  b->load_member_1();
+
+  Derived *d;
+  d->load_member_2();
+  d->load_member_3();
+}

test/CodeGenCXX/ubsan-suppress-null-checks.cpp

-// RUN: %clang_cc1 -std=c++11 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=null | FileCheck %s
-// RUN: %clang_cc1 -std=c++11 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=null -DCHECK_LAMBDA | FileCheck %s --check-prefix=LAMBDA
-
-struct A {
-  int foo;
-
-  // CHECK-LABEL: define linkonce_odr void @_ZN1A10do_nothingEv
-  void do_nothing() {
-    // CHECK: icmp ne %struct.A* %[[THIS1:[a-z0-9]+]], null, !nosanitize
-    // CHECK: ptrtoint %struct.A* %[[THIS1]] to i64, !nosanitize
-    // CHECK-NEXT: call void @__ubsan_handle_type_mismatch
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    // CHECK: ret void
-  }
-
-#ifdef CHECK_LAMBDA
-  // LAMBDA-LABEL: define linkonce_odr void @_ZN1A22do_nothing_with_lambdaEv
-  void do_nothing_with_lambda() {
-    // LAMBDA: icmp ne %struct.A* %[[THIS2:[a-z0-9]+]], null, !nosanitize
-    // LAMBDA: ptrtoint %struct.A* %[[THIS2]] to i64, !nosanitize
-    // LAMBDA-NEXT: call void @__ubsan_handle_type_mismatch
-
-    auto f = [&] {
-      foo = 0;
-    };
-    f();
-
-    // LAMBDA: ret void
-  }
-
-// Check the IR for the lambda:
-//
-// LAMBDA-LABEL: define linkonce_odr void @_ZZN1A22do_nothing_with_lambdaEvENKUlvE_clEv
-// LAMBDA: call void @__ubsan_handle_type_mismatch
-// LAMBDA-NOT: call void @__ubsan_handle_type_mismatch
-// LAMBDA: ret void
-#endif
-
-  // CHECK-LABEL: define linkonce_odr i32 @_ZN1A11load_memberEv
-  int load_member() {
-    // CHECK: icmp ne %struct.A* %[[THIS3:[a-z0-9]+]], null, !nosanitize
-    // CHECK: ptrtoint %struct.A* %[[THIS3]] to i64, !nosanitize
-    // CHECK-NEXT: call void @__ubsan_handle_type_mismatch
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    return foo;
-    // CHECK: ret i32
-  }
-
-  // CHECK-LABEL: define linkonce_odr i32 @_ZN1A11call_methodEv
-  int call_method() {
-    // CHECK: icmp ne %struct.A* %[[THIS4:[a-z0-9]+]], null, !nosanitize
-    // CHECK: ptrtoint %struct.A* %[[THIS4]] to i64, !nosanitize
-    // CHECK-NEXT: call void @__ubsan_handle_type_mismatch
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    return load_member();
-    // CHECK: ret i32
-  }
-
-  // CHECK-LABEL: define linkonce_odr void @_ZN1A15assign_member_1Ev
-  void assign_member_1() {
-    // CHECK: icmp ne %struct.A* %[[THIS5:[a-z0-9]+]], null, !nosanitize
-    // CHECK: ptrtoint %struct.A* %[[THIS5]] to i64, !nosanitize
-    // CHECK-NEXT: call void @__ubsan_handle_type_mismatch
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    foo = 0;
-    // CHECK: ret void
-  }
-
-  // CHECK-LABEL: define linkonce_odr void @_ZN1A15assign_member_2Ev
-  void assign_member_2() {
-    // CHECK: icmp ne %struct.A* %[[THIS6:[a-z0-9]+]], null, !nosanitize
-    // CHECK: ptrtoint %struct.A* %[[THIS6]] to i64, !nosanitize
-    // CHECK-NEXT: call void @__ubsan_handle_type_mismatch
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    (__extension__ (this))->foo = 0;
-    // CHECK: ret void
-  }
-
-  // CHECK-LABEL: define linkonce_odr void @_ZNK1A15assign_member_3Ev
-  void assign_member_3() const {
-    // CHECK: icmp ne %struct.A* %[[THIS7:[a-z0-9]+]], null, !nosanitize
-    // CHECK: ptrtoint %struct.A* %[[THIS7]] to i64, !nosanitize
-    // CHECK-NEXT: call void @__ubsan_handle_type_mismatch
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    const_cast<A *>(this)->foo = 0;
-    // CHECK: ret void
-  }
-
-  // CHECK-LABEL: define linkonce_odr i32 @_ZN1A22call_through_referenceERS_
-  static int call_through_reference(A &a) {
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    return a.load_member();
-    // CHECK: ret i32
-  }
-
-  // CHECK-LABEL: define linkonce_odr i32 @_ZN1A20call_through_pointerEPS_
-  static int call_through_pointer(A *a) {
-    // CHECK: call void @__ubsan_handle_type_mismatch
-    return a->load_member();
-    // CHECK: ret i32
-  }
-};
-
-struct B {
-  operator A*() const { return nullptr; }
-
-  // CHECK-LABEL: define linkonce_odr i32 @_ZN1B11load_memberEv
-  static int load_member() {
-    // Null-check &b before converting it to an A*.
-    // CHECK: call void @__ubsan_handle_type_mismatch
-    //
-    // Null-check the result of the conversion before using it.
-    // CHECK: call void @__ubsan_handle_type_mismatch
-    //
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    B b;
-    return static_cast<A *>(b)->load_member();
-    // CHECK: ret i32
-  }
-};
-
-struct Base {
-  int foo;
-
-  virtual int load_member_1() = 0;
-};
-
-struct Derived : public Base {
-  int bar;
-
-  // CHECK-LABEL: define linkonce_odr i32 @_ZN7Derived13load_member_2Ev
-  int load_member_2() {
-    // CHECK: icmp ne %struct.Derived* %[[THIS8:[a-z0-9]+]], null, !nosanitize
-    // CHECK: ptrtoint %struct.Derived* %[[THIS8]] to i64, !nosanitize
-    // CHECK-NEXT: call void @__ubsan_handle_type_mismatch
-    //
-    // Null-check the result of the cast before using it.
-    // CHECK: call void @__ubsan_handle_type_mismatch
-    //
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    return dynamic_cast<Base *>(this)->load_member_1();
-    // CHECK: ret i32
-  }
-
-  // CHECK-LABEL: define linkonce_odr i32 @_ZN7Derived13load_member_3Ev
-  int load_member_3() {
-    // CHECK: icmp ne %struct.Derived* %[[THIS9:[a-z0-9]+]], null, !nosanitize
-    // CHECK: ptrtoint %struct.Derived* %[[THIS9]] to i64, !nosanitize
-    // CHECK-NEXT: call void @__ubsan_handle_type_mismatch
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    return reinterpret_cast<Derived *>(static_cast<Base *>(this))->foo;
-    // CHECK: ret i32
-  }
-
-  // CHECK-LABEL: define linkonce_odr i32 @_ZN7Derived13load_member_1Ev
-  int load_member_1() override {
-    // CHECK: icmp ne %struct.Derived* %[[THIS10:[a-z0-9]+]], null, !nosanitize
-    // CHECK: ptrtoint %struct.Derived* %[[THIS10]] to i64, !nosanitize
-    // CHECK-NEXT: call void @__ubsan_handle_type_mismatch
-    // CHECK-NOT: call void @__ubsan_handle_type_mismatch
-    return foo + bar;
-    // CHECK: ret i32
-  }
-};
-
-void force_irgen() {
-  A *a;
-  a->do_nothing();
-#ifdef CHECK_LAMBDA
-  a->do_nothing_with_lambda();
-#endif
-  a->load_member();
-  a->call_method();
-  a->assign_member_1();
-  a->assign_member_2();
-  a->assign_member_3();
-  A::call_through_reference(*a);
-  A::call_through_pointer(a);
-
-  B::load_member();
-
-  Base *b = new Derived;
-  b->load_member_1();
-
-  Derived *d;
-  d->load_member_2();
-  d->load_member_3();
-}

test/CodeGenCXX/ubsan-type-checks.cpp

 // RUN: %clang_cc1 -std=c++11 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=alignment | FileCheck %s -check-prefixes=ALIGN,COMMON
 // RUN: %clang_cc1 -std=c++11 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=null | FileCheck %s -check-prefixes=NULL,COMMON
 // RUN: %clang_cc1 -std=c++11 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=object-size | FileCheck %s -check-prefixes=OBJSIZE,COMMON
 
 struct A {
   // COMMON-LABEL: define linkonce_odr void @_ZN1A10do_nothingEv
   void do_nothing() {
-    // ALIGN-NOT: ptrtoint %struct.A* %{{.*}} to i64, !nosanitize
-    // ALIGN-NOT: and i64 %{{.*}}, 7, !nosanitize
+    // ALIGN: ptrtoint %struct.A* %{{.*}} to i64, !nosanitize
+    // ALIGN: and i64 %{{.*}}, 0, !nosanitize
  
     // NULL: icmp ne %struct.A* %{{.*}}, null, !nosanitize
  
     // OBJSIZE-NOT: call i64 @llvm.objectsize
   }
 };
 
 void force_irgen() {
   A a;
   a.do_nothing();
 }