ASAN: Provide reliable debug info for local variables at -O0.

[aprantl]

Summary

The function stack poisioner conditionally stores local variables
either in an alloca or in malloc'ated memory, which has the
unfortunate side-effect, that the actual address of the variable is
only materialized when the variable is accessed, which means that
those variables are mostly invisible to the debugger even when
compiling without optimizations.

This patch stores the address of the local stack base into an alloca,
which can be referred to by the debug info and is available throughout
the function. This adds one extra pointer-sized alloca to each stack
frame where the transformation is applied to (but mem2reg can optimize
it away again when optimizations are enabled, yielding roughly the
same debug info quality as before in optimized code).

rdar://problem/30433661

[eugenis]

lib/Transforms/Instrumentation/AddressSanitizer.cpp

2913 ↗

(On Diff #126211)

Could this be expressed in less lines of code by creating an AllocaInst directly, without saving and restoring IRBuilder state?

[aprantl]

lib/Transforms/Instrumentation/AddressSanitizer.cpp

2913 ↗

(On Diff #126211)

Done.

llvm/trunk/lib/Transforms/Instrumentation/AddressSanitizer.cpp

void FunctionStackPoisoner::processStaticAllocas() {
   DoDynamicAlloca &= !HasNonEmptyInlineAsm && !HasReturnsTwiceCall;
   DoStackMalloc &= !HasNonEmptyInlineAsm && !HasReturnsTwiceCall;
 
   Value *StaticAlloca =
       DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false);
 
   Value *FakeStack;
   Value *LocalStackBase;
+  Value *LocalStackBaseAlloca;
+  bool Deref;
 
   if (DoStackMalloc) {
+    LocalStackBaseAlloca =
+        IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base");
     // void *FakeStack = __asan_option_detect_stack_use_after_return
     //     ? __asan_stack_malloc_N(LocalStackSize)
     //     : nullptr;
     // void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize);
     Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal(
         kAsanOptionDetectUseAfterReturn, IRB.getInt32Ty());
     Value *UseAfterReturnIsEnabled =
         IRB.CreateICmpNE(IRB.CreateLoad(OptionDetectUseAfterReturn),
if (DoStackMalloc) {
 
     Value *NoFakeStack =
         IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy));
     Term = SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false);
     IRBIf.SetInsertPoint(Term);
     IRBIf.SetCurrentDebugLocation(EntryDebugLocation);
     Value *AllocaValue =
         DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca;
+
     IRB.SetInsertPoint(InsBefore);
     IRB.SetCurrentDebugLocation(EntryDebugLocation);
     LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
+    IRB.SetCurrentDebugLocation(EntryDebugLocation);
+    IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca);
+    Deref = true;
   } else {
     // void *FakeStack = nullptr;
     // void *LocalStackBase = alloca(LocalStackSize);
     FakeStack = ConstantInt::get(IntptrTy, 0);
     LocalStackBase =
         DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca;
+    LocalStackBaseAlloca = LocalStackBase;
+    Deref = false;
   }
 
   // Replace Alloca instructions with base+offset.
   for (const auto &Desc : SVD) {
     AllocaInst *AI = Desc.AI;
+    replaceDbgDeclareForAlloca(AI, LocalStackBaseAlloca, DIB, Deref,
+                               Desc.Offset, DIExpression::NoDeref);
     Value *NewAllocaPtr = IRB.CreateIntToPtr(
         IRB.CreateAdd(LocalStackBase, ConstantInt::get(IntptrTy, Desc.Offset)),
         AI->getType());
-    replaceDbgDeclareForAlloca(AI, NewAllocaPtr, DIB, DIExpression::NoDeref,
-                               0, DIExpression::NoDeref);
     AI->replaceAllUsesWith(NewAllocaPtr);
   }
 
   // The left-most redzone has enough space for at least 4 pointers.
   // Write the Magic value to redzone[0].
   Value *BasePlus0 = IRB.CreateIntToPtr(LocalStackBase, IntptrPtrTy);
   IRB.CreateStore(ConstantInt::get(IntptrTy, kCurrentStackFrameMagic),
                   BasePlus0);

llvm/trunk/test/DebugInfo/Generic/block-asan.ll

 ; RUN: opt -S -asan %s | FileCheck %s
 
 ; The IR of this testcase is generated from the following C code:
 ; void bar (int);
 ;
 ; void foo() {
 ;   __block int x;
 ;   bar(x);
 ; }
 ; by compiling it with 'clang -emit-llvm -g -S' and then by manually
 ; adding the sanitize_address attribute to the @foo() function (so
 ; that ASAN accepts to instrument the function in the above opt run).
 
 ; Check that the location of the ASAN instrumented __block variable is
 ; correct.
-; CHECK: !DIExpression(DW_OP_plus_uconst, 8, DW_OP_deref, DW_OP_plus_uconst, 24)
+; CHECK: !DIExpression(DW_OP_deref, DW_OP_plus_uconst, 32, DW_OP_plus_uconst, 8, DW_OP_deref, DW_OP_plus_uconst, 24)
 
 target datalayout = "e-m:o-i64:64-f80:128-n8:16:32:64-S128"
 
 %struct.__block_byref_x = type { i8*, %struct.__block_byref_x*, i32, i32, i32 }
 
 ; Function Attrs: nounwind ssp uwtable
 define void @foo() #0 !dbg !4 {
 entry:

llvm/trunk/test/Instrumentation/AddressSanitizer/basic.ll

entry:
   %z = alloca [10 x i8], align 1
   call void @alloca_test_use([10 x i8]* %x)
   call void @alloca_test_use([10 x i8]* %y)
   call void @alloca_test_use([10 x i8]* %z)
   ret void
 }
 
 ; CHECK-LABEL: define void @alloca_test()
+; CHECK: %asan_local_stack_base = alloca
 ; CHECK: = alloca
 ; CHECK-NOT: = alloca
 ; CHECK: ret void
 
 define void @LongDoubleTest(x86_fp80* nocapture %a) nounwind uwtable sanitize_address {
 entry:
     store x86_fp80 0xK3FFF8000000000000000, x86_fp80* %a, align 16
     ret void

llvm/trunk/test/Instrumentation/AddressSanitizer/debug_info.ll

entry:
   %1 = load i32, i32* %r, align 4, !dbg !15
   ret i32 %1, !dbg !15
 }
 
 ;   CHECK: define i32 @_Z3zzzi
 ;   CHECK: entry:
 ; Verify that llvm.dbg.declare calls are in the entry basic block.
 ;   CHECK-NOT: %entry
-;   CHECK: call void @llvm.dbg.declare(metadata {{.*}}, metadata ![[ARG_ID:[0-9]+]], metadata !DIExpression())
+;   CHECK: call void @llvm.dbg.declare(metadata {{.*}}, metadata ![[ARG_ID:[0-9]+]], metadata !DIExpression(DW_OP_plus_uconst, 32))
 ;   CHECK-NOT: %entry
-;   CHECK: call void @llvm.dbg.declare(metadata {{.*}}, metadata ![[VAR_ID:[0-9]+]], metadata !DIExpression())
+;   CHECK: call void @llvm.dbg.declare(metadata {{.*}}, metadata ![[VAR_ID:[0-9]+]], metadata !DIExpression(DW_OP_plus_uconst, 48))
 
 declare void @llvm.dbg.declare(metadata, metadata, metadata) nounwind readnone
 
 !llvm.dbg.cu = !{!0}
 !llvm.module.flags = !{!17}
 
 !0 = distinct !DICompileUnit(language: DW_LANG_C_plus_plus, producer: "clang version 3.3 (trunk 169314)", isOptimized: true, emissionKind: FullDebug, file: !16, enums: !1, retainedTypes: !1, globals: !1)
 !1 = !{}

llvm/trunk/test/Instrumentation/AddressSanitizer/local_stack_base.ll

+; RUN: opt -S -asan -asan-skip-promotable-allocas=0 %s -o - | FileCheck %s
+; Generated from:
+; int bar(int y) {
+;   return y + 2;
+; }
+
+source_filename = "/tmp/t.c"
+target datalayout = "e-m:o-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-apple-macosx10.13.0"
+
+; Function Attrs: noinline nounwind optnone sanitize_address ssp uwtable
+define i32 @foo(i32 %i) #0 !dbg !8 {
+entry:
+  %i.addr = alloca i32, align 4
+  store i32 %i, i32* %i.addr, align 4
+  call void @llvm.dbg.declare(metadata i32* %i.addr, metadata !12, metadata !DIExpression()), !dbg !13
+
+  ; CHECK: %asan_local_stack_base = alloca i64
+  ; CHECK: %[[ALLOCA:.*]] = ptrtoint i8* %MyAlloca to i64
+  ; CHECK: %[[PHI:.*]] = phi i64 {{.*}} %[[ALLOCA]],
+  ; CHECK: store i64 %[[PHI]], i64* %asan_local_stack_base, !dbg
+  ; CHECK: call void @llvm.dbg.declare(metadata i64* %asan_local_stack_base, metadata !13, metadata !DIExpression(DW_OP_deref, DW_OP_plus_uconst, 32)), !dbg !14
+  %0 = load i32, i32* %i.addr, align 4, !dbg !14
+  %add = add nsw i32 %0, 2, !dbg !15
+  ret i32 %add, !dbg !16
+}
+
+; Function Attrs: nounwind readnone speculatable
+declare void @llvm.dbg.declare(metadata, metadata, metadata) #1
+
+attributes #0 = { noinline nounwind optnone sanitize_address ssp uwtable }
+attributes #1 = { nounwind readnone speculatable }
+
+!llvm.dbg.cu = !{!0}
+!llvm.module.flags = !{!3, !4, !5, !6}
+!llvm.ident = !{!7}
+
+!0 = distinct !DICompileUnit(language: DW_LANG_C99, file: !1, producer: "clang version 6.0.0 (trunk 320115) (llvm/trunk 320116)", isOptimized: false, runtimeVersion: 0, emissionKind: FullDebug, enums: !2)
+!1 = !DIFile(filename: "/tmp/t.c", directory: "/Data/llvm")
+!2 = !{}
+!3 = !{i32 2, !"Dwarf Version", i32 4}
+!4 = !{i32 2, !"Debug Info Version", i32 3}
+!5 = !{i32 1, !"wchar_size", i32 4}
+!6 = !{i32 7, !"PIC Level", i32 2}
+!7 = !{!"clang version 6.0.0 (trunk 320115) (llvm/trunk 320116)"}
+!8 = distinct !DISubprogram(name: "foo", scope: !1, file: !1, line: 1, type: !9, isLocal: false, isDefinition: true, scopeLine: 1, flags: DIFlagPrototyped, isOptimized: false, unit: !0, variables: !2)
+!9 = !DISubroutineType(types: !10)
+!10 = !{!11, !11}
+!11 = !DIBasicType(name: "int", size: 32, encoding: DW_ATE_signed)
+!12 = !DILocalVariable(name: "i", arg: 1, scope: !8, file: !1, line: 1, type: !11)
+!13 = !DILocation(line: 1, column: 13, scope: !8)
+!14 = !DILocation(line: 2, column: 10, scope: !8)
+!15 = !DILocation(line: 2, column: 12, scope: !8)
+!16 = !DILocation(line: 2, column: 3, scope: !8)

llvm/trunk/test/Instrumentation/AddressSanitizer/stack_layout.ll

 ; CHECK: private unnamed_addr constant{{.*}}3 256 128 3 CCC 448 128 3 BBB 608 128 3 AAA\0
 ; CHECK: private unnamed_addr constant{{.*}}2 32 4 3 AAA 48 4 5 BBB:7\0
 
 define void @Func1() sanitize_address {
 entry:
 ; CHECK-LABEL: Func1
 
 ; CHECK-STATIC: alloca [192 x i8]
+; CHECK-STATIC: %asan_local_stack_base = alloca i64
 ; CHECK-DYNAMIC: alloca i8, i64 192
 
 ; CHECK-NOT: alloca
 ; CHECK: ret void
   %XXX = alloca [10 x i8], align 1
   %YYY = alloca [20 x i8], align 1
   %ZZZ = alloca [30 x i8], align 1
   %arr1.ptr = bitcast [10 x i8]* %XXX to i8*
   store volatile i8 0, i8* %arr1.ptr
   %arr2.ptr = bitcast [20 x i8]* %YYY to i8*
   store volatile i8 0, i8* %arr2.ptr
   %arr3.ptr = bitcast [30 x i8]* %ZZZ to i8*
   store volatile i8 0, i8* %arr3.ptr
   ret void
 }
 
 define void @Func2() sanitize_address {
 entry:
 ; CHECK-LABEL: Func2
 
 ; CHECK-STATIC: alloca [864 x i8]
+; CHECK-STATIC: %asan_local_stack_base = alloca i64
 ; CHECK-DYNAMIC: alloca i8, i64 864
 
 ; CHECK-NOT: alloca
 ; CHECK: ret void
   %AAA = alloca [5 x i8], align 1
   %BBB = alloca [55 x i8], align 1
   %CCC = alloca [555 x i8], align 1
   %arr1.ptr = bitcast [5 x i8]* %AAA to i8*
   store volatile i8 0, i8* %arr1.ptr
   %arr2.ptr = bitcast [55 x i8]* %BBB to i8*
   store volatile i8 0, i8* %arr2.ptr
   %arr3.ptr = bitcast [555 x i8]* %CCC to i8*
   store volatile i8 0, i8* %arr3.ptr
   ret void
 }
 
 ; Check that we reorder vars according to alignment and handle large alignments.
 define void @Func3() sanitize_address {
 entry:
 ; CHECK-LABEL: Func3
 
 ; CHECK-STATIC: alloca [768 x i8]
+; CHECK-STATIC: %asan_local_stack_base = alloca i64
 ; CHECK-DYNAMIC: alloca i8, i64 768
 
 ; CHECK-NOT: alloca
 ; CHECK: ret void
   %AAA = alloca [128 x i8], align 16
   %BBB = alloca [128 x i8], align 64
   %CCC = alloca [128 x i8], align 256
   %arr1.ptr = bitcast [128 x i8]* %AAA to i8*