[ubsan] Diagnose noreturn functions which return

[vsk]

Summary

Diagnose 'unreachable' UB when a noreturn function returns.

1. Insert a check at the end of functions marked noreturn.
2. A decl may be marked noreturn in the caller TU, but not marked in the TU where it's defined. To diagnose this scenario, strip away the noreturn attribute and insert a check after the call.

Testing: check-clang, check-ubsan, check-ubsan-minimal, D40700

rdar://33660464

[vsk]

Ah, I've found a problem while writing run-time tests. I'll need to take another cut at this.

[vsk]

• Emit the check in the noreturn function, so that the UB does not result in the optimizer throwing away the diagnostic instrumentation.

[vsk]

• Leave out an unrelated change in the handling of NakedAttr.

[efriedma]

lib/CodeGen/CGCall.cpp

2756

Unfortunately, this won't catch cases where the caller has a noreturn marking, but the callee doesn't. Maybe strip the noreturn attribute from the caller, then put the sanitizer check into both the caller and callee?

2758

This is likely a problem. Not because the code is supposed to be reachable, but because putting additional code into a naked function can have weird effects. Probably not worth messing with this case.

[vsk]

lib/CodeGen/CGCall.cpp

2756

If the caller sees a noreturn marking on the call target, inserting a 'reached-unreachable' check after the call is UB, and the optimizer throws it away. Perhaps you had a different case in mind?

2758

Sorry for the noisy change. I recognized it as a mistake a second after I uploaded the new diff :(.

[efriedma]

lib/CodeGen/CGCall.cpp

2756

I'm thinking of the case where the caller can't see the callee, like this:

a.c:
void a(void) __attribute((noreturn));
void b(void) { a(); }

b.c:
void a(void) {}

[vsk]

lib/CodeGen/CGCall.cpp

2756

Got it. So clang would then do:

a.c:
void a(void) /* strip the noreturn attribute */;
void b(void) { a(); /* insert a reached-unreachable check here */}

[vsk]

• Diagnose in the scenario Eli pointed out, by stripping the 'noreturn' attribute and emitting a check after the call.
• Test updates.

[vsk]

• Make the patch cleaner by introducing an overload of EmitCall() which doesn't require a SourceLocation argument.

[vsk]

• Tighten the IR test case.

[efriedma]

LGTM

lib/CodeGen/CGAtomic.cpp

Address TempAlloca = CGF.CreateMemTemp(
       "atomic-temp");
   // Cast to pointer to value type for bitfields.
   if (LVal.isBitField())
     return CGF.Builder.CreatePointerBitCastOrAddrSpaceCast(
         TempAlloca, getAtomicAddress().getType());
   return TempAlloca;
 }
 
-static RValue emitAtomicLibcall(CodeGenFunction &CGF,
-                                StringRef fnName,
-                                QualType resultType,
-                                CallArgList &args) {
+static RValue emitAtomicLibcall(CodeGenFunction &CGF, StringRef fnName,
+                                QualType resultType, CallArgList &args) {
   const CGFunctionInfo &fnInfo =
     CGF.CGM.getTypes().arrangeBuiltinFunctionCall(resultType, args);
   llvm::FunctionType *fnTy = CGF.CGM.getTypes().GetFunctionType(fnInfo);
   llvm::Constant *fn = CGF.CGM.CreateRuntimeFunction(fnTy, fnName);
   auto callee = CGCallee::forDirect(fn);
-  return CGF.EmitCall(fnInfo, callee, ReturnValueSlot(), args);
+  return CGF.EmitCall(fnInfo, callee, ReturnValueSlot(), args,
+                      SourceLocation());
 }
 
 /// Does a store of the given IR type modify the full expected width?
 static bool isFullSizeType(CodeGenModule &CGM, llvm::Type *type,
                            uint64_t expectedSize) {
   return (CGM.getDataLayout().getTypeStoreSize(type) * 8 == expectedSize);
 }
 

lib/CodeGen/CGBlocks.cpp

RValue CodeGenFunction::EmitBlockCallExpr(const CallExpr *E,
 
   llvm::Type *BlockFTyPtr = llvm::PointerType::getUnqual(BlockFTy);
   Func = Builder.CreatePointerCast(Func, BlockFTyPtr);
 
   // Prepare the callee.
   CGCallee Callee(CGCalleeInfo(), Func);
 
   // And call the block.
-  return EmitCall(FnInfo, Callee, ReturnValue, Args);
+  return EmitCall(FnInfo, Callee, ReturnValue, Args, E->getExprLoc());
 }
 
 Address CodeGenFunction::GetAddrOfBlockDecl(const VarDecl *variable,
                                             bool isByRef) {
   assert(BlockInfo && "evaluating block ref without block information?");
   const CGBlockInfo::Capture &capture = BlockInfo->getCapture(variable);
 
   // Handle constant captures.

lib/CodeGen/CGBuiltin.cpp

for (const auto &Item : Layout.Items) {
     ArgVal = Builder.CreateZExtOrBitCast(ArgVal, ConvertType(ArgTy));
     Args.add(RValue::get(ArgVal), ArgTy);
   }
 
   const CGFunctionInfo &FI =
       CGM.getTypes().arrangeBuiltinFunctionCall(Ctx.VoidTy, Args);
   llvm::Function *F = CodeGenFunction(CGM).generateBuiltinOSLogHelperFunction(
       Layout, BufAddr.getAlignment());
-  EmitCall(FI, CGCallee::forDirect(F), ReturnValueSlot(), Args);
+  EmitCall(FI, CGCallee::forDirect(F), ReturnValueSlot(), Args, E.getExprLoc());
 
   // Push a clang.arc.use cleanup for each object in RetainableOperands. The
   // cleanup will cause the use to appear after the final log call, keeping
   // the object valid while it’s held in the log buffer.  Note that if there’s
   // a release cleanup on the object, it will already be active; since
   // cleanups are emitted in reverse order, the use will occur before the
   // object is released.
   if (!RetainableOperands.empty() && getLangOpts().ObjCAutoRefCount &&
case Builtin::BI__builtin___clear_cache: {
     Value *F = CGM.getIntrinsic(Intrinsic::clear_cache);
     return RValue::get(Builder.CreateCall(F, {Begin, End}));
   }
   case Builtin::BI__builtin_trap:
     return RValue::get(EmitTrapCall(Intrinsic::trap));
   case Builtin::BI__debugbreak:
     return RValue::get(EmitTrapCall(Intrinsic::debugtrap));
   case Builtin::BI__builtin_unreachable: {
-    if (SanOpts.has(SanitizerKind::Unreachable)) {
-      SanitizerScope SanScope(this);
-      EmitCheck(std::make_pair(static_cast<llvm::Value *>(Builder.getFalse()),
-                               SanitizerKind::Unreachable),
-                SanitizerHandler::BuiltinUnreachable,
-                EmitCheckSourceLocation(E->getExprLoc()), None);
-    } else
-      Builder.CreateUnreachable();
+    EmitUnreachable(E->getExprLoc());
 
     // We do need to preserve an insertion point.
     EmitBlock(createBasicBlock("unreachable.cont"));
 
     return RValue::get(nullptr);
   }
 
   case Builtin::BI__builtin_powi:
if (BuiltinID == Builtin::BI__atomic_is_lock_free)
                getContext().VoidPtrTy);
     else
       Args.add(RValue::get(llvm::Constant::getNullValue(VoidPtrTy)),
                getContext().VoidPtrTy);
     const CGFunctionInfo &FuncInfo =
         CGM.getTypes().arrangeBuiltinFunctionCall(E->getType(), Args);
     llvm::FunctionType *FTy = CGM.getTypes().GetFunctionType(FuncInfo);
     llvm::Constant *Func = CGM.CreateRuntimeFunction(FTy, LibCallName);
-    return EmitCall(FuncInfo, CGCallee::forDirect(Func),
-                    ReturnValueSlot(), Args);
+    return EmitCall(FuncInfo, CGCallee::forDirect(Func), ReturnValueSlot(),
+                    Args, SourceLocation());
   }
 
   case Builtin::BI__atomic_test_and_set: {
     // Look at the argument type to determine whether this is a volatile
     // operation. The parameter type is always volatile.
     QualType PtrTy = E->getArg(0)->IgnoreImpCasts()->getType();
     bool Volatile =
         PtrTy->castAs<PointerType>()->getPointeeType().isVolatileQualified();

lib/CodeGen/CGCall.cpp

static llvm::StoreInst *findDominatingStoreToReturnValue(CodeGenFunction &CGF) {
   // Okay, the store's basic block dominates the insertion point; we
   // can do our thing.
   return store;
 }
 
 void CodeGenFunction::EmitFunctionEpilog(const CGFunctionInfo &FI,
                                          bool EmitRetDbgLoc,
                                          SourceLocation EndLoc) {
   if (CurCodeDecl && CurCodeDecl->hasAttr<NakedAttr>()) {
     // Naked functions don't have epilogues.
     Builder.CreateUnreachable();
     return;
   }
 
   // Functions with no result always return void.
   if (!ReturnValue.isValid()) {
     Builder.CreateRetVoid();
     return;
   }
void CodeGenFunction::deferPlaceholderReplacement(llvm::Instruction *Old,
                                                   llvm::Value *New) {
   DeferredReplacements.push_back(std::make_pair(Old, New));
 }
 
 RValue CodeGenFunction::EmitCall(const CGFunctionInfo &CallInfo,
                                  const CGCallee &Callee,
                                  ReturnValueSlot ReturnValue,
                                  const CallArgList &CallArgs,
+                                 SourceLocation Loc,
                                  llvm::Instruction **callOrInvoke) {
   // FIXME: We no longer need the types from CallArgs; lift up and simplify.
 
   assert(Callee.isOrdinary());
 
   // Handle struct-return functions by passing a pointer to the
   // location that we would like to return into.
   QualType RetTy = CallInfo.getReturnType();
#endif
   // If the call doesn't return, finish the basic block and clear the
   // insertion point; this allows the rest of IRGen to discard
   // unreachable code.
   if (CS.doesNotReturn()) {
     if (UnusedReturnSize)
       EmitLifetimeEnd(llvm::ConstantInt::get(Int64Ty, UnusedReturnSize),
                       SRetPtr.getPointer());
 
-    Builder.CreateUnreachable();
+    EmitUnreachable(Loc);
     Builder.ClearInsertionPoint();
 
     // FIXME: For now, emit a dummy basic block because expr emitters in
     // generally are not ready to handle emitting expressions at unreachable
     // points.
     EnsureInsertPoint();
 
     // Return a reasonable RValue.

lib/CodeGen/CGClass.cpp

CGCXXABI::AddedStructorArgs ExtraArgs =
                                                  Delegating, Args);
 
   // Emit the call.
   llvm::Constant *CalleePtr =
     CGM.getAddrOfCXXStructor(D, getFromCtorType(Type));
   const CGFunctionInfo &Info = CGM.getTypes().arrangeCXXConstructorCall(
       Args, D, Type, ExtraArgs.Prefix, ExtraArgs.Suffix, PassPrototypeArgs);
   CGCallee Callee = CGCallee::forDirect(CalleePtr, D);
-  EmitCall(Info, Callee, ReturnValueSlot(), Args);
+  EmitCall(Info, Callee, ReturnValueSlot(), Args, SourceLocation());
 
   // Generate vtable assumptions if we're constructing a complete object
   // with a vtable.  We don't do this for base subobjects for two reasons:
   // first, it's incorrect for classes with virtual bases, and second, we're
   // about to overwrite the vptrs anyway.
   // We also have to make sure if we can refer to vtable:
   // - Otherwise we can refer to vtable if it's safe to speculatively emit.
   // FIXME: If vtable is used by ctor/dtor, or if vtable is external and we are
if (!resultType->isVoidType() &&
     returnSlot = ReturnValueSlot(ReturnValue, resultType.isVolatileQualified());
 
   // We don't need to separately arrange the call arguments because
   // the call can't be variadic anyway --- it's impossible to forward
   // variadic arguments.
 
   // Now emit our call.
   auto callee = CGCallee::forDirect(calleePtr, callOperator);
-  RValue RV = EmitCall(calleeFnInfo, callee, returnSlot, callArgs);
+  RValue RV =
+      EmitCall(calleeFnInfo, callee, returnSlot, callArgs, SourceLocation());
 
   // If necessary, copy the returned value into the slot.
   if (!resultType->isVoidType() && returnSlot.isNull())
     EmitReturnOfRValue(RV, resultType);
   else
     EmitBranchThroughCleanup(ReturnBlock);
 }
 

lib/CodeGen/CGDecl.cpp

void Emit(CodeGenFunction &CGF, Flags flags) override {
       QualType ArgTy = FnInfo.arg_begin()->type;
       llvm::Value *Arg =
         CGF.Builder.CreateBitCast(Addr, CGF.ConvertType(ArgTy));
 
       CallArgList Args;
       Args.add(RValue::get(Arg),
                CGF.getContext().getPointerType(Var.getType()));
       auto Callee = CGCallee::forDirect(CleanupFn);
-      CGF.EmitCall(FnInfo, Callee, ReturnValueSlot(), Args);
+      CGF.EmitCall(FnInfo, Callee, ReturnValueSlot(), Args, SourceLocation());
     }
   };
 } // end anonymous namespace
 
 /// EmitAutoVarWithLifetime - Does the setup required for an automatic
 /// variable with lifetime.
 static void EmitAutoVarWithLifetime(CodeGenFunction &CGF, const VarDecl &var,
                                     Address addr,

lib/CodeGen/CGException.cpp

void Emit(CodeGenFunction &CGF, Flags F) override {
     Args.add(RValue::get(IsForEH), ArgTys[0]);
     Args.add(RValue::get(FP), ArgTys[1]);
 
     // Arrange a two-arg function info and type.
     const CGFunctionInfo &FnInfo =
         CGM.getTypes().arrangeBuiltinFunctionCall(Context.VoidTy, Args);
 
     auto Callee = CGCallee::forDirect(OutlinedFinally);
-    CGF.EmitCall(FnInfo, Callee, ReturnValueSlot(), Args);
+    CGF.EmitCall(FnInfo, Callee, ReturnValueSlot(), Args, SourceLocation());
   }
 };
 } // end anonymous namespace
 
 namespace {
 /// Find all local variable captures in the statement.
 struct CaptureFinder : ConstStmtVisitor<CaptureFinder> {
   CodeGenFunction &ParentCGF;

lib/CodeGen/CGExpr.cpp

if (!CGM.getCodeGenOpts().OptimizationLevel || !TrapBB) {
     Builder.CreateUnreachable();
   } else {
     Builder.CreateCondBr(Checked, Cont, TrapBB);
   }
 
   EmitBlock(Cont);
 }
 
+void CodeGenFunction::EmitUnreachable(SourceLocation Loc) {
+  if (SanOpts.has(SanitizerKind::Unreachable) && Loc.isValid()) {
+    SanitizerScope SanScope(this);
+    EmitCheck(std::make_pair(static_cast<llvm::Value *>(Builder.getFalse()),
+                             SanitizerKind::Unreachable),
+              SanitizerHandler::BuiltinUnreachable,
+              EmitCheckSourceLocation(Loc), None);
+  }
+
+  // Ensure that the current block has a terminator.
+  Builder.CreateUnreachable();
+}
+
 llvm::CallInst *CodeGenFunction::EmitTrapCall(llvm::Intrinsic::ID IntrID) {
   llvm::CallInst *TrapCall = Builder.CreateCall(CGM.getIntrinsic(IntrID));
 
   if (!CGM.getCodeGenOpts().TrapFuncName.empty()) {
     auto A = llvm::Attribute::get(getLLVMContext(), "trap-func-name",
                                   CGM.getCodeGenOpts().TrapFuncName);
     TrapCall->addAttribute(llvm::AttributeList::FunctionIndex, A);
   }
if (isa<FunctionNoProtoType>(FnType) || Chain) {
     llvm::Type *CalleeTy = getTypes().GetFunctionType(FnInfo);
     CalleeTy = CalleeTy->getPointerTo();
 
     llvm::Value *CalleePtr = Callee.getFunctionPointer();
     CalleePtr = Builder.CreateBitCast(CalleePtr, CalleeTy, "callee.knr.cast");
     Callee.setFunctionPointer(CalleePtr);
   }
 
-  return EmitCall(FnInfo, Callee, ReturnValue, Args);
+  return EmitCall(FnInfo, Callee, ReturnValue, Args, E->getExprLoc());
 }
 
 LValue CodeGenFunction::
 EmitPointerToDataMemberBinaryExpr(const BinaryOperator *E) {
   Address BaseAddr = Address::invalid();
   if (E->getOpcode() == BO_PtrMemI) {
     BaseAddr = EmitPointerWithAlignment(E->getLHS());
   } else {

lib/CodeGen/CGExprCXX.cpp

RValue CodeGenFunction::EmitCXXMemberOrOperatorCall(
     llvm::Value *This, llvm::Value *ImplicitParam, QualType ImplicitParamTy,
     const CallExpr *CE, CallArgList *RtlArgs) {
   const FunctionProtoType *FPT = MD->getType()->castAs<FunctionProtoType>();
   CallArgList Args;
   MemberCallInfo CallInfo = commonEmitCXXMemberOrOperatorCall(
       *this, MD, This, ImplicitParam, ImplicitParamTy, CE, Args, RtlArgs);
   auto &FnInfo = CGM.getTypes().arrangeCXXMethodCall(
       Args, FPT, CallInfo.ReqArgs, CallInfo.PrefixSize);
-  return EmitCall(FnInfo, Callee, ReturnValue, Args);
+  return EmitCall(FnInfo, Callee, ReturnValue, Args,
+                  CE ? CE->getExprLoc() : SourceLocation());
 }
 
 RValue CodeGenFunction::EmitCXXDestructorCall(
     const CXXDestructorDecl *DD, const CGCallee &Callee, llvm::Value *This,
     llvm::Value *ImplicitParam, QualType ImplicitParamTy, const CallExpr *CE,
     StructorType Type) {
   CallArgList Args;
   commonEmitCXXMemberOrOperatorCall(*this, DD, This, ImplicitParam,
                                     ImplicitParamTy, CE, Args, nullptr);
   return EmitCall(CGM.getTypes().arrangeCXXStructorDeclaration(DD, Type),
-                  Callee, ReturnValueSlot(), Args);
+                  Callee, ReturnValueSlot(), Args, SourceLocation());
 }
 
 RValue CodeGenFunction::EmitCXXPseudoDestructorExpr(
                                             const CXXPseudoDestructorExpr *E) {
   QualType DestroyedType = E->getDestroyedType();
   if (DestroyedType.hasStrongOrWeakObjCLifetime()) {
     // Automatic Reference Counting:
     //   If the pseudo-expression names a retainable object with weak or
CodeGenFunction::EmitCXXMemberPointerCallExpr(const CXXMemberCallExpr *E,
 
   RequiredArgs required =
       RequiredArgs::forPrototypePlus(FPT, 1, /*FD=*/nullptr);
 
   // And the rest of the call args
   EmitCallArgs(Args, FPT, E->arguments());
   return EmitCall(CGM.getTypes().arrangeCXXMethodCall(Args, FPT, required,
                                                       /*PrefixSize=*/0),
-                  Callee, ReturnValue, Args);
+                  Callee, ReturnValue, Args, E->getExprLoc());
 }
 
 RValue
 CodeGenFunction::EmitCXXOperatorMemberCallExpr(const CXXOperatorCallExpr *E,
                                                const CXXMethodDecl *MD,
                                                ReturnValueSlot ReturnValue) {
   assert(MD->isInstance() &&
          "Trying to emit a member call expr on a static method!");

 /// created by new-expressions and delete-expressions.
 static RValue EmitNewDeleteCall(CodeGenFunction &CGF,
                                 const FunctionDecl *CalleeDecl,
                                 const FunctionProtoType *CalleeType,
                                 const CallArgList &Args) {
   llvm::Instruction *CallOrInvoke;
   llvm::Constant *CalleePtr = CGF.CGM.GetAddrOfFunction(CalleeDecl);
   CGCallee Callee = CGCallee::forDirect(CalleePtr, CalleeDecl);
-  RValue RV =
-      CGF.EmitCall(CGF.CGM.getTypes().arrangeFreeFunctionCall(
+  RValue RV = CGF.EmitCall(CGF.CGM.getTypes().arrangeFreeFunctionCall(
                                Args, CalleeType, /*chainCall=*/false),
-                   Callee, ReturnValueSlot(), Args, &CallOrInvoke);
+                           Callee, ReturnValueSlot(), Args, SourceLocation(),
+                           &CallOrInvoke);
 
   /// C++1y [expr.new]p10:
   ///   [In a new-expression,] an implementation is allowed to omit a call
   ///   to a replaceable global allocation function.
   ///
   /// We model such elidable calls with the 'builtin' attribute.
   llvm::Function *Fn = dyn_cast<llvm::Function>(CalleePtr);
   if (CalleeDecl->isReplaceableGlobalAllocationFunction() &&

lib/CodeGen/CGExprComplex.cpp

ComplexPairTy ComplexExprEmitter::EmitComplexBinOpLibCall(StringRef LibCallName,
   const CGFunctionInfo &FuncInfo = CGF.CGM.getTypes().arrangeFreeFunctionCall(
       Args, cast<FunctionType>(FQTy.getTypePtr()), false);
 
   llvm::FunctionType *FTy = CGF.CGM.getTypes().GetFunctionType(FuncInfo);
   llvm::Constant *Func = CGF.CGM.CreateBuiltinFunction(FTy, LibCallName);
   CGCallee Callee = CGCallee::forDirect(Func, FQTy->getAs<FunctionProtoType>());
 
   llvm::Instruction *Call;
-  RValue Res = CGF.EmitCall(FuncInfo, Callee, ReturnValueSlot(), Args, &Call);
+  RValue Res = CGF.EmitCall(FuncInfo, Callee, ReturnValueSlot(), Args,
+                            SourceLocation(), &Call);
   cast<llvm::CallInst>(Call)->setCallingConv(CGF.CGM.getBuiltinCC());
   return Res.getComplexVal();
 }
 
 /// \brief Lookup the libcall name for a given floating point type complex
 /// multiply.
 static StringRef getComplexMultiplyLibCallName(llvm::Type *Ty) {
   switch (Ty->getTypeID()) {

lib/CodeGen/CGObjC.cpp

static void emitStructGetterCall(CodeGenFunction &CGF, ObjCIvarDecl *ivar,
   CharUnits size = CGF.getContext().getTypeSizeInChars(ivar->getType());
   args.add(RValue::get(CGF.CGM.getSize(size)), Context.getSizeType());
   args.add(RValue::get(CGF.Builder.getInt1(isAtomic)), Context.BoolTy);
   args.add(RValue::get(CGF.Builder.getInt1(hasStrong)), Context.BoolTy);
 
   llvm::Constant *fn = CGF.CGM.getObjCRuntime().GetGetStructFunction();
   CGCallee callee = CGCallee::forDirect(fn);
   CGF.EmitCall(CGF.getTypes().arrangeBuiltinFunctionCall(Context.VoidTy, args),
-               callee, ReturnValueSlot(), args);
+               callee, ReturnValueSlot(), args, SourceLocation());
 }
 
 /// Determine whether the given architecture supports unaligned atomic
 /// accesses.  They don't have to be fast, just faster than a function
 /// call and a mutex.
 static bool hasUnalignedAtomics(llvm::Triple::ArchType arch) {
   // FIXME: Allow unaligned atomic load/store on x86.  (It is not
   // currently supported by the backend.)
static void emitCPPObjectAtomicGetterCall(CodeGenFunction &CGF,
   // Third argument is the helper function.
   args.add(RValue::get(AtomicHelperFn), CGF.getContext().VoidPtrTy);
   
   llvm::Constant *copyCppAtomicObjectFn = 
     CGF.CGM.getObjCRuntime().GetCppAtomicObjectGetFunction();
   CGCallee callee = CGCallee::forDirect(copyCppAtomicObjectFn);
   CGF.EmitCall(
       CGF.getTypes().arrangeBuiltinFunctionCall(CGF.getContext().VoidTy, args),
-               callee, ReturnValueSlot(), args);
+      callee, ReturnValueSlot(), args, SourceLocation());
 }
 
 void
 CodeGenFunction::generateObjCGetterBody(const ObjCImplementationDecl *classImpl,
                                         const ObjCPropertyImplDecl *propImpl,
                                         const ObjCMethodDecl *GetterMethodDecl,
                                         llvm::Constant *AtomicHelperFn) {
   // If there's a non-trivial 'get' expression, we just have to emit that.
case PropertyImplStrategy::GetSetProperty: {
     args.add(RValue::get(cmd), getContext().getObjCSelType());
     args.add(RValue::get(ivarOffset), getContext().getPointerDiffType());
     args.add(RValue::get(Builder.getInt1(strategy.isAtomic())),
              getContext().BoolTy);
 
     // FIXME: We shouldn't need to get the function info here, the
     // runtime already should have computed it to build the function.
     llvm::Instruction *CallInstruction;
-    RValue RV = EmitCall(
-        getTypes().arrangeBuiltinFunctionCall(propType, args),
-        callee, ReturnValueSlot(), args, &CallInstruction);
+    RValue RV =
+        EmitCall(getTypes().arrangeBuiltinFunctionCall(propType, args), callee,
+                 ReturnValueSlot(), args, SourceLocation(), &CallInstruction);
     if (llvm::CallInst *call = dyn_cast<llvm::CallInst>(CallInstruction))
       call->setTailCall();
 
     // We need to fix the type here. Ivars with copy & retain are
     // always objects so we don't need to worry about complex or
     // aggregates.
     RV = RValue::get(Builder.CreateBitCast(
         RV.getScalarVal(),
static void emitStructSetterCall(CodeGenFunction &CGF, ObjCMethodDecl *OMD,
   // The fifth argument is the 'hasStrong' flag.
   // FIXME: should this really always be false?
   args.add(RValue::get(CGF.Builder.getFalse()), CGF.getContext().BoolTy);
 
   llvm::Constant *fn = CGF.CGM.getObjCRuntime().GetSetStructFunction();
   CGCallee callee = CGCallee::forDirect(fn);
   CGF.EmitCall(
       CGF.getTypes().arrangeBuiltinFunctionCall(CGF.getContext().VoidTy, args),
-               callee, ReturnValueSlot(), args);
+               callee, ReturnValueSlot(), args, SourceLocation());
 }
 
 /// emitCPPObjectAtomicSetterCall - Call the runtime function to store 
 /// the value from the first formal parameter into the given ivar, using 
 /// the Cpp API for atomic Cpp objects with non-trivial copy assignment.
 static void emitCPPObjectAtomicSetterCall(CodeGenFunction &CGF, 
                                           ObjCMethodDecl *OMD,
                                           ObjCIvarDecl *ivar,
static void emitCPPObjectAtomicSetterCall(CodeGenFunction &CGF,
   // Third argument is the helper function.
   args.add(RValue::get(AtomicHelperFn), CGF.getContext().VoidPtrTy);
   
   llvm::Constant *fn = 
     CGF.CGM.getObjCRuntime().GetCppAtomicObjectSetFunction();
   CGCallee callee = CGCallee::forDirect(fn);
   CGF.EmitCall(
       CGF.getTypes().arrangeBuiltinFunctionCall(CGF.getContext().VoidTy, args),
-               callee, ReturnValueSlot(), args);
+      callee, ReturnValueSlot(), args, SourceLocation());
 }
 
 
 static bool hasTrivialSetExpr(const ObjCPropertyImplDecl *PID) {
   Expr *setter = PID->getSetterCXXAssignment();
   if (!setter) return true;
 
   // Sema only makes only of these when the ivar has a C++ class type,
case PropertyImplStrategy::SetPropertyAndExpressionGet: {
     CallArgList args;
     args.add(RValue::get(self), getContext().getObjCIdType());
     args.add(RValue::get(cmd), getContext().getObjCSelType());
     if (setOptimizedPropertyFn) {
       args.add(RValue::get(arg), getContext().getObjCIdType());
       args.add(RValue::get(ivarOffset), getContext().getPointerDiffType());
       CGCallee callee = CGCallee::forDirect(setOptimizedPropertyFn);
       EmitCall(getTypes().arrangeBuiltinFunctionCall(getContext().VoidTy, args),
-               callee, ReturnValueSlot(), args);
+               callee, ReturnValueSlot(), args, SourceLocation());
     } else {
       args.add(RValue::get(ivarOffset), getContext().getPointerDiffType());
       args.add(RValue::get(arg), getContext().getObjCIdType());
       args.add(RValue::get(Builder.getInt1(strategy.isAtomic())),
                getContext().BoolTy);
       args.add(RValue::get(Builder.getInt1(strategy.isCopy())),
                getContext().BoolTy);
       // FIXME: We shouldn't need to get the function info here, the runtime
       // already should have computed it to build the function.
       CGCallee callee = CGCallee::forDirect(setPropertyFn);
       EmitCall(getTypes().arrangeBuiltinFunctionCall(getContext().VoidTy, args),
-               callee, ReturnValueSlot(), args);
+               callee, ReturnValueSlot(), args, SourceLocation());
     }
     
     return;
   }
 
   case PropertyImplStrategy::CopyStruct:
     emitStructSetterCall(*this, setterMethod, ivar);
     return;
void CodeGenFunction::EmitObjCForCollectionStmt(const ObjCForCollectionStmt &S){
   llvm::Value *V =
     Builder.CreateBitCast(Collection,
                           ConvertType(getContext().getObjCIdType()));
   CallArgList Args2;
   Args2.add(RValue::get(V), getContext().getObjCIdType());
   // FIXME: We shouldn't need to get the function info here, the runtime already
   // should have computed it to build the function.
   EmitCall(
-          CGM.getTypes().arrangeBuiltinFunctionCall(getContext().VoidTy, Args2),
-           EnumerationMutationFn, ReturnValueSlot(), Args2);
+      EnumerationMutationFn, ReturnValueSlot(), Args2, SourceLocation());
 
   // Otherwise, or if the mutation function returns, just continue.
   EmitBlock(WasNotMutatedBB);
 
   // Initialize the element variable.
   RunCleanupsScope elementVariableScope(*this);
   bool elementIsVariable;
   LValue elementLValue;

lib/CodeGen/CGObjCGNU.cpp

llvm::Metadata *impMD[] = {
       llvm::MDString::get(VMContext, Class->getSuperClass()->getNameAsString()),
       llvm::ConstantAsMetadata::get(llvm::ConstantInt::get(
           llvm::Type::getInt1Ty(VMContext), IsClassMessage))};
   llvm::MDNode *node = llvm::MDNode::get(VMContext, impMD);
 
   CGCallee callee(CGCalleeInfo(), imp);
 
   llvm::Instruction *call;
-  RValue msgRet = CGF.EmitCall(MSI.CallInfo, callee, Return, ActualArgs, &call);
+  RValue msgRet = CGF.EmitCall(MSI.CallInfo, callee, Return, ActualArgs,
+                               SourceLocation(), &call);
   call->setMetadata(msgSendMDKind, node);
   return msgRet;
 }
 
 /// Generate code for a message send expression.
 RValue
 CGObjCGNU::GenerateMessageSend(CodeGenFunction &CGF,
                                ReturnValueSlot Return,
CGObjCGNU::GenerateMessageSend(CodeGenFunction &CGF,
 
   // Reset the receiver in case the lookup modified it
   ActualArgs[0] = CallArg(RValue::get(Receiver), ASTIdTy, false);
 
   imp = EnforceType(Builder, imp, MSI.MessengerType);
 
   llvm::Instruction *call;
   CGCallee callee(CGCalleeInfo(), imp);
-  RValue msgRet = CGF.EmitCall(MSI.CallInfo, callee, Return, ActualArgs, &call);
+  RValue msgRet = CGF.EmitCall(MSI.CallInfo, callee, Return, ActualArgs,
+                               SourceLocation(), &call);
   call->setMetadata(msgSendMDKind, node);
 
-
   if (!isPointerSizedReturn) {
     messageBB = CGF.Builder.GetInsertBlock();
     CGF.Builder.CreateBr(continueBB);
     CGF.EmitBlock(continueBB);
     if (msgRet.isScalar()) {
       llvm::Value *v = msgRet.getScalarVal();
       llvm::PHINode *phi = Builder.CreatePHI(v->getType(), 2);
       phi->addIncoming(v, messageBB);

lib/CodeGen/CGObjCMac.cpp

CGObjCCommonMac::EmitMessageSend(CodeGen::CodeGenFunction &CGF,
   if (RequiresNullCheck) {
     nullReturn.init(CGF, Arg0);
   }
   
   llvm::Instruction *CallSite;
   Fn = llvm::ConstantExpr::getBitCast(Fn, MSI.MessengerType);
   CGCallee Callee = CGCallee::forDirect(Fn);
   RValue rvalue = CGF.EmitCall(MSI.CallInfo, Callee, Return, ActualArgs,
-                               &CallSite);
+                               SourceLocation(), &CallSite);
 
   // Mark the call as noreturn if the method is marked noreturn and the
   // receiver cannot be null.
   if (Method && Method->hasAttr<NoReturnAttr>() && !ReceiverCanBeNull) {
     llvm::CallSite(CallSite).setDoesNotReturn();
   }
 
   return nullReturn.complete(CGF, Return, rvalue, ResultType, CallArgs,
CGObjCNonFragileABIMac::EmitVTableMessageSend(CodeGenFunction &CGF,
   // Load the function to call from the message ref table.
   Address calleeAddr =
       CGF.Builder.CreateStructGEP(mref, 0, CharUnits::Zero());
   llvm::Value *calleePtr = CGF.Builder.CreateLoad(calleeAddr, "msgSend_fn");
 
   calleePtr = CGF.Builder.CreateBitCast(calleePtr, MSI.MessengerType);
   CGCallee callee(CGCalleeInfo(), calleePtr);
 
-  RValue result = CGF.EmitCall(MSI.CallInfo, callee, returnSlot, args);
+  RValue result =
+      CGF.EmitCall(MSI.CallInfo, callee, returnSlot, args, SourceLocation());
   return nullReturn.complete(CGF, returnSlot, result, resultType, formalArgs,
                              requiresnullCheck ? method : nullptr);
 }
 
 /// Generate code for a message send expression in the nonfragile abi.
 CodeGen::RValue
 CGObjCNonFragileABIMac::GenerateMessageSend(CodeGen::CodeGenFunction &CGF,
                                             ReturnValueSlot Return,

lib/CodeGen/CGVTables.cpp

#endif
   if (!ResultType->isVoidType() &&
       CurFnInfo->getReturnInfo().getKind() == ABIArgInfo::Indirect &&
       !hasScalarEvaluationKind(CurFnInfo->getReturnType()))
     Slot = ReturnValueSlot(ReturnValue, ResultType.isVolatileQualified());
 
   // Now emit our call.
   llvm::Instruction *CallOrInvoke;
   CGCallee Callee = CGCallee::forDirect(CalleePtr, MD);
-  RValue RV = EmitCall(*CurFnInfo, Callee, Slot, CallArgs, &CallOrInvoke);
+  RValue RV = EmitCall(*CurFnInfo, Callee, Slot, CallArgs, SourceLocation(),
+                       &CallOrInvoke);
 
   // Consider return adjustment if we have ThunkInfo.
   if (Thunk && !Thunk->Return.isEmpty())
     RV = PerformReturnAdjustment(*this, ResultType, RV, *Thunk);
   else if (llvm::CallInst* Call = dyn_cast<llvm::CallInst>(CallOrInvoke))
     Call->setTailCallKind(llvm::CallInst::TCK_Tail);
 
   // Emit return.

lib/CodeGen/CodeGenFunction.h

public:
   //                         Scalar Expression Emission
   //===--------------------------------------------------------------------===//
 
   /// EmitCall - Generate a call of the given function, expecting the given
   /// result type, and using the given argument list which specifies both the
   /// LLVM arguments and the types they were derived from.
   RValue EmitCall(const CGFunctionInfo &CallInfo, const CGCallee &Callee,
                   ReturnValueSlot ReturnValue, const CallArgList &Args,
+                  SourceLocation Loc,
                   llvm::Instruction **callOrInvoke = nullptr);
 
   RValue EmitCall(QualType FnType, const CGCallee &Callee, const CallExpr *E,
                   ReturnValueSlot ReturnValue,
                   llvm::Value *Chain = nullptr);
   RValue EmitCallExpr(const CallExpr *E,
                       ReturnValueSlot ReturnValue = ReturnValueSlot());
   RValue EmitSimpleCallExpr(const CallExpr *E, ReturnValueSlot ReturnValue);
public:
   void EmitCfiSlowPathCheck(SanitizerMask Kind, llvm::Value *Cond,
                             llvm::ConstantInt *TypeId, llvm::Value *Ptr,
                             ArrayRef<llvm::Constant *> StaticArgs);
 
   /// \brief Create a basic block that will call the trap intrinsic, and emit a
   /// conditional branch to it, for the -ftrapv checks.
   void EmitTrapCheck(llvm::Value *Checked);
 
+  /// If the unreachable sanitizer is disabled or \p Loc is invalid, simply
+  /// emit an UnreachableInst. Otherwise, emit a runtime trap.
+  void EmitUnreachable(SourceLocation Loc);
+
   /// \brief Emit a call to trap or debugtrap and attach function attribute
   /// "trap-func-name" if specified.
   llvm::CallInst *EmitTrapCall(llvm::Intrinsic::ID IntrID);
 
   /// \brief Emit a stub for the cross-DSO CFI check function.
   void EmitCfiCheckStub();
 
   /// \brief Emit a cross-DSO CFI failure handling function.

lib/CodeGen/MicrosoftCXXABI.cpp

AddedStructorArgs ExtraArgs =
                                  /*ForVirtualBase=*/false,
                                  /*Delegating=*/false, Args);
   // Call the destructor with our arguments.
   llvm::Constant *CalleePtr =
     CGM.getAddrOfCXXStructor(CD, StructorType::Complete);
   CGCallee Callee = CGCallee::forDirect(CalleePtr, CD);
   const CGFunctionInfo &CalleeInfo = CGM.getTypes().arrangeCXXConstructorCall(
       Args, CD, Ctor_Complete, ExtraArgs.Prefix, ExtraArgs.Suffix);
-  CGF.EmitCall(CalleeInfo, Callee, ReturnValueSlot(), Args);
+  CGF.EmitCall(CalleeInfo, Callee, ReturnValueSlot(), Args, SourceLocation());
 
   Cleanups.ForceCleanup();
 
   // Emit the ret instruction, remove any temporary instructions created for the
   // aid of CodeGen.
   CGF.FinishFunction(SourceLocation());
 
   return ThunkFn;

test/CodeGenCXX/ubsan-unreachable.cpp

+// RUN: %clang_cc1 -triple x86_64-apple-darwin10 -emit-llvm -o - %s -fsanitize=unreachable | FileCheck %s
+
+extern void __attribute__((noreturn)) abort();
+
+// CHECK-LABEL: define void @_Z14calls_noreturnv
+void calls_noreturn() {
+  abort();
+
+  // CHECK: __ubsan_handle_builtin_unreachable
+  // CHECK: unreachable
+}
+
+struct A {
+  // Test regular members.
+  void __attribute__((noreturn)) does_not_return1() {
+    abort();
+  }
+
+  // CHECK-LABEL: define linkonce_odr void @_ZN1A5call1Ev
+  void call1() {
+    does_not_return1();
+
+    // CHECK: __ubsan_handle_builtin_unreachable
+    // CHECK: unreachable
+  }
+
+  // Test static members.
+  static void __attribute__((noreturn)) does_not_return2() {
+    abort();
+  }
+
+  // CHECK-LABEL: define linkonce_odr void @_ZN1A5call2Ev
+  void call2() {
+    does_not_return2();
+
+    // CHECK: __ubsan_handle_builtin_unreachable
+    // CHECK: unreachable
+  }
+
+  // Test calls through pointers to non-static member functions.
+  typedef void __attribute__((noreturn)) (A::*MemFn)();
+
+  // CHECK-LABEL: define linkonce_odr void @_ZN1A5call3Ev
+  void call3() {
+    MemFn MF = &A::does_not_return1;
+    (this->*MF)();
+
+    // CHECK: __ubsan_handle_builtin_unreachable
+    // CHECK: unreachable
+  }
+};
+
+void force_irgen() {
+  A a;
+  a.call1();
+  a.call2();
+  a.call3();
+}