[CodeGenCXX] Emit strip.invariant.group with -fstrict-vtable-pointers

[Prazek]

Summary

Emmiting new intrinsic that strips invariant.groups to make
devirtulization sound, as described in RFC: Devirtualization v2.

[rsmith]

clang/include/clang/AST/DeclCXX.h

779 ↗

(On Diff #148312)

isCompleteDefinition checks whether this declaration of the class is a definition, not whether it has a definition anywhere; the latter is what you need here. You can use hasDefinition to check that.

Please also check hasAnyDependentBases() (or add a comment to this function to indicate that it may return false for a templated class whose instantiations might be dynamic classes) -- if a class has dependent bases, we might not find out that it's a dynamic class until it's instantiated.

clang/lib/CodeGen/CGExprScalar.cpp

1626–1627 ↗

(On Diff #148312)

Are there any cases where we need a barrier when the destination type is a dynamic type here?

[Prazek]

clang/lib/CodeGen/CGExprScalar.cpp

1626–1627 ↗

(On Diff #148312)

No, I don't think so. I will also add test for that.

[Prazek]

Added launder when going from possiblyNotDynamic to possiblyDynamic
emitting strip for pointer -> int only if poitner is possiblyDynamic

[Prazek]

one more test

[Prazek]

@rjmccall @rsmith friendly ping

[rjmccall]

clang/include/clang/AST/DeclCXX.h

784 ↗

(On Diff #148746)

Both of these new methods deserve doc comments explaining that they're conservative checks because the class might be incomplete or dependent.

I think NonDynamic would read better than NotDynamic.

clang/lib/CodeGen/CGExprScalar.cpp

1623 ↗

(On Diff #148746)

Unnecessary getTypePtr().

1624 ↗

(On Diff #148746)

The opposite of Dst is Src. Alternatively, the opposite of Source is Destination (or Result). Please pick.

1633 ↗

(On Diff #148746)

If you made a couple of tiny helper functions here that you could invoke on either SourceClassDecl or DstClassDecl, you could avoid some redundant logic and also make the calls self-documenting enough to legibly inline into the if-conditions.

...in fact, since you start from a QualType in every case, maybe you should just define the helper as a method there.

1647 ↗

(On Diff #148746)

Incidentally, how do you protect against code like this?

A *ptr;
reinterpret_cast<B *&>(ptr) = new B();
ptr->foo();

Presumably there needs to be a launder/strip here, but I guess it would have to be introduced by the middle-end when forwarding the store? The way I've written this is an aliasing violation, but (1) I assume your pass isn't disabled whenever strict-aliasing is disabled and (2) you can do this with a memcpy and still pretty reliably expect that LLVM will be able to eventually forward the store.

1791 ↗

(On Diff #148746)

Another place you could definitely just use that helper function on QualType.

1802 ↗

(On Diff #148746)

Same.

3305 ↗

(On Diff #148746)

Yeah, helper function on QualType, please. :)

[Prazek]

clang/lib/CodeGen/CGExprScalar.cpp

1623 ↗

(On Diff #148746)

getType returns QualType and it does not have getPointeeCXXRecordDecl. Am I missing something?

1647 ↗

(On Diff #148746)

Can you add more info on what is A and B so I can make sure I understand it correctly?
Is the prefix of the layout the same for both, but they are not in the hierarchy?

I haven't thought about the strict aliasing. I think the only sane way would be to require strict aliasing for the strict vtable pointers.

[Prazek]

Refactor

clang/lib/CodeGen/CGExprScalar.cpp

1633 ↗

(On Diff #148746)

oh yea, it is definitely better!

[Prazek]

clang/lib/CodeGen/CGExprScalar.cpp

1624 ↗

(On Diff #148746)

Not sure if it still holds (if the DestTy should be DstTy, but I haven't declared it myself)

[rjmccall]

clang/lib/CodeGen/CGExprScalar.cpp

1623 ↗

(On Diff #148746)

operator-> on QualType drills to the Type*.

1647 ↗

(On Diff #148746)

It's whatever case you're worried about such that you have to launder member accesses and bitcasts.

And like I mentioned, relying on strict aliasing isn't enough because you can do it legally with memcpy. Maybe it's okay to consider it UB? I'm not sure about that.

[Prazek]

clang/lib/CodeGen/CGExprScalar.cpp

1647 ↗

(On Diff #148746)

AFAIK reinterpreting one class as another is UB if they are not in hierarchy (especially calling virtual function on reinterpreted class), not sure if strict aliasing should allow it anyway (if it would be a hand written custom vptr then it should be ok with strict aliasing turned off, but with vptr I don't think it is legal).
@rsmith Can you comment on that?

[rsmith]

clang/lib/CodeGen/CGExprScalar.cpp

1647 ↗

(On Diff #148746)

OK, here's how I think about what we're doing here:

We view the IR-level pointer value for a pointer to a dynamic class type as being a fat pointer, containing the actual pointer value and also a tag indicating the dynamic type of the object (only notionally, though -- the actual bit representation of the pointer doesn't include the extra information, but we don't ever emit IR that inspects the bit representation of the fat pointer to avoid exposing that fact). In that model, if you try to type pun between a pointer to a dynamic class type and a pointer to a non-dynamic-class type, that can't be expected to work because the (notional) value is different, much as type punning between a derived and base class pointer wouldn't work for a pointer to something other than a base class at offset zero.

I think @rjmccall's example is OK, because both A and B would need to be dynamic class types in a hierarchy to work, and that means we'd be using the same notional pointer representation. A slight variation of that example:

struct A {};
struct B : A { virtual void f(); };
struct C : B { void f(); } c;
A *p = &c;
B *q;
memcpy(&q, &p, sizeof(B*)); // or q = std::bit_cast<B*>(p);
q->f();

... would be UB, because the representation of an A* and a B* are different (a B* contains a tag and an A* does not).

[Prazek]

clang/lib/CodeGen/CGExprScalar.cpp

1647 ↗

(On Diff #148746)

Does this answer satisfy you John? Can I push it to trunk?

[rjmccall]

clang/lib/CodeGen/CGExprScalar.cpp

1647 ↗

(On Diff #148746)

Yeah, Richard's answer makes sense to me.

include/clang/AST/DeclCXX.h

static CXXRecordDecl *CreateLambda(const ASTContext &C, DeclContext *DC,
                                      bool DependentLambda, bool IsGeneric,
                                      LambdaCaptureDefault CaptureDefault);
   static CXXRecordDecl *CreateDeserialized(const ASTContext &C, unsigned ID);
 
   bool isDynamicClass() const {
     return data().Polymorphic || data().NumVBases != 0;
   }
 
+  /// @returns true if class is dynamic or might be dynamic because the
+  /// definition is incomplete of dependent.
+  bool mayBeDynamicClass() const {
+    return !hasDefinition() || isDynamicClass() || hasAnyDependentBases();
+  }
+
+  /// @returns true if class is non dynamic or might be non dynamic because the
+  /// definition is incomplete of dependent.
+  bool mayBeNonDynamicClass() const {
+    return !hasDefinition() || !isDynamicClass() || hasAnyDependentBases();
+  }
+
   void setIsParsingBaseSpecifiers() { data().IsParsingBaseSpecifiers = true; }
 
   bool isParsingBaseSpecifiers() const {
     return data().IsParsingBaseSpecifiers;
   }
 
   unsigned getODRHash() const;
 

include/clang/AST/Type.h

public:
   bool isCXX11PODType(const ASTContext &Context) const;
 
   /// Return true if this is a trivial type per (C++0x [basic.types]p9)
   bool isTrivialType(const ASTContext &Context) const;
 
   /// Return true if this is a trivially copyable type (C++0x [basic.types]p9)
   bool isTriviallyCopyableType(const ASTContext &Context) const;
 
+
+  /// Returns true if it is a class and it might be dynamic.
+  bool mayBeDynamicClass() const;
+
+  /// Returns true if it is not a class or if the class might not be dynamic.
+  bool mayBeNotDynamicClass() const;
+
   // Don't promise in the API that anything besides 'const' can be
   // easily added.
 
   /// Add the `const` type qualifier to this QualType.
   void addConst() {
     addFastQualifiers(Qualifiers::Const);
   }
   QualType withConst() const {

lib/AST/Type.cpp

else if (ty->isArrayType())
     return ty->castAsArrayTypeUnsafe()->
         getElementType().getBaseTypeIdentifier();
 
   if (ND)
     return ND->getIdentifier();
   return nullptr;
 }
 
+bool QualType::mayBeDynamicClass() const {
+  const auto *ClassDecl = getTypePtr()->getPointeeCXXRecordDecl();
+  return ClassDecl && ClassDecl->mayBeDynamicClass();
+}
+
+bool QualType::mayBeNotDynamicClass() const {
+  const auto *ClassDecl = getTypePtr()->getPointeeCXXRecordDecl();
+  return !ClassDecl || ClassDecl->mayBeNonDynamicClass();
+}
+
 bool QualType::isConstant(QualType T, const ASTContext &Ctx) {
   if (T.isConstQualified())
     return true;
 
   if (const ArrayType *AT = Ctx.getAsArrayType(T))
     return AT->getElementType().isConstant(Ctx);
 
   return T.getAddressSpace() == LangAS::opencl_constant;

lib/CodeGen/CGExpr.cpp

if (base.getTBAAInfo().isMayAlias() ||
 
     // Update the final access type and size.
     FieldTBAAInfo.AccessType = CGM.getTBAATypeInfo(FieldType);
     FieldTBAAInfo.Size =
         getContext().getTypeSizeInChars(FieldType).getQuantity();
   }
 
   Address addr = base.getAddress();
+  if (auto *ClassDef = dyn_cast<CXXRecordDecl>(rec)) {
+    if (CGM.getCodeGenOpts().StrictVTablePointers &&
+        ClassDef->isDynamicClass()) {
+      // Getting to any field of dynamic object requires stripping dynamic
+      // information provided by invariant.group.  This is because accessing
+      // fields may leak the real address of dynamic object, which could result
+      // in miscompilation when leaked pointer would be compared.
+      auto *stripped = Builder.CreateStripInvariantGroup(addr.getPointer());
+      addr = Address(stripped, addr.getAlignment());
+    }
+  }
+
   unsigned RecordCVR = base.getVRQualifiers();
   if (rec->isUnion()) {
     // For unions, there is no pointer adjustment.
     assert(!FieldType->isReferenceType() && "union has reference member");
     if (CGM.getCodeGenOpts().StrictVTablePointers &&
         hasAnyVptr(FieldType, getContext()))
       // Because unions can easily skip invariant.barriers, we need to add
       // a barrier every time CXXRecord field with vptr is referenced.

lib/CodeGen/CGExprScalar.cpp

case CK_BitCast: {
     if (CGF.SanOpts.has(SanitizerKind::CFIUnrelatedCast)) {
       if (auto PT = DestTy->getAs<PointerType>())
         CGF.EmitVTablePtrCheckForCast(PT->getPointeeType(), Src,
                                       /*MayBeNull=*/true,
                                       CodeGenFunction::CFITCK_UnrelatedCast,
                                       CE->getLocStart());
     }
 
+    if (CGF.CGM.getCodeGenOpts().StrictVTablePointers) {
+      const QualType SrcType = E->getType();
+
+      if (SrcType.mayBeNotDynamicClass() && DestTy.mayBeDynamicClass()) {
+        // Casting to pointer that could carry dynamic information (provided by
+        // invariant.group) requires launder.
+        Src = Builder.CreateLaunderInvariantGroup(Src);
+      } else if (SrcType.mayBeDynamicClass() && DestTy.mayBeNotDynamicClass()) {
+        // Casting to pointer that does not carry dynamic information (provided
+        // by invariant.group) requires stripping it.  Note that we don't do it
+        // if the source could not be dynamic type and destination could be
+        // dynamic because dynamic information is already laundered.  It is
+        // because launder(strip(src)) == launder(src), so there is no need to
+        // add extra strip before launder.
+        Src = Builder.CreateStripInvariantGroup(Src);
+      }
+    }
+
     return Builder.CreateBitCast(Src, DstTy);
   }
   case CK_AddressSpaceConversion: {
     Expr::EvalResult Result;
     if (E->EvaluateAsRValue(Result, CGF.getContext()) &&
         Result.Val.isNullPointer()) {
       // If E has side effect, it is emitted even if its final result is a
       // null pointer. In that case, a DCE pass should be able to
case CK_IntegralToPointer: {
     // First, convert to the correct width so that we control the kind of
     // extension.
     auto DestLLVMTy = ConvertType(DestTy);
     llvm::Type *MiddleTy = CGF.CGM.getDataLayout().getIntPtrType(DestLLVMTy);
     bool InputSigned = E->getType()->isSignedIntegerOrEnumerationType();
     llvm::Value* IntResult =
       Builder.CreateIntCast(Src, MiddleTy, InputSigned, "conv");
 
-    return Builder.CreateIntToPtr(IntResult, DestLLVMTy);
+    auto *IntToPtr = Builder.CreateIntToPtr(IntResult, DestLLVMTy);
+
+    if (CGF.CGM.getCodeGenOpts().StrictVTablePointers) {
+      // Going from integer to pointer that could be dynamic requires reloading
+      // dynamic information from invariant.group.
+      if (DestTy.mayBeDynamicClass())
+        IntToPtr = Builder.CreateLaunderInvariantGroup(IntToPtr);
+    }
+    return IntToPtr;
   }
-  case CK_PointerToIntegral:
+  case CK_PointerToIntegral: {
     assert(!DestTy->isBooleanType() && "bool should use PointerToBool");
-    return Builder.CreatePtrToInt(Visit(E), ConvertType(DestTy));
+    auto *PtrExpr = Visit(E);
+
+    if (CGF.CGM.getCodeGenOpts().StrictVTablePointers) {
+      const QualType SrcType = E->getType();
 
+      // Casting to integer requires stripping dynamic information as it does
+      // not carries it.
+      if (SrcType.mayBeDynamicClass())
+        PtrExpr = Builder.CreateStripInvariantGroup(PtrExpr);
+    }
+
+    return Builder.CreatePtrToInt(PtrExpr, ConvertType(DestTy));
+  }
   case CK_ToVoid: {
     CGF.EmitIgnoredExpr(E);
     return nullptr;
   }
   case CK_VectorSplat: {
     llvm::Type *DstTy = ConvertType(DestTy);
     Value *Elt = Visit(const_cast<Expr*>(E));
     // Splat the element across to all elements
if (const MemberPointerType *MPT = LHSTy->getAs<MemberPointerType>()) {
     }
 
     if (LHS->getType()->isFPOrFPVectorTy()) {
       Result = Builder.CreateFCmp(FCmpOpc, LHS, RHS, "cmp");
     } else if (LHSTy->hasSignedIntegerRepresentation()) {
       Result = Builder.CreateICmp(SICmpOpc, LHS, RHS, "cmp");
     } else {
       // Unsigned integers and pointers.
+
+      if (CGF.CGM.getCodeGenOpts().StrictVTablePointers &&
+          !isa<llvm::ConstantPointerNull>(LHS) &&
+          !isa<llvm::ConstantPointerNull>(RHS)) {
+
+        // Dynamic information is required to be stripped for comparisons,
+        // because it could leak the dynamic information.  Based on comparisons
+        // of pointers to dynamic objects, the optimizer can replace one pointer
+        // with another, which might be incorrect in presence of invariant
+        // groups. Comparison with null is safe because null does not carry any
+        // dynamic information.
+        if (LHSTy.mayBeDynamicClass())
+          LHS = Builder.CreateStripInvariantGroup(LHS);
+        if (RHSTy.mayBeDynamicClass())
+          RHS = Builder.CreateStripInvariantGroup(RHS);
+      }
+
       Result = Builder.CreateICmp(UICmpOpc, LHS, RHS, "cmp");
     }
 
     // If this is a vector comparison, sign extend the result to the appropriate
     // vector integer type and return it (don't convert to bool).
     if (LHSTy->isVectorType())
       return Builder.CreateSExt(Result, ConvertType(E->getType()), "sext");
 

test/CodeGenCXX/strict-vtable-pointers.cpp

 // RUN: %clang_cc1 %s -I%S -triple=x86_64-apple-darwin10 -fstrict-vtable-pointers -std=c++11 -disable-llvm-passes -O2 -emit-llvm -o %t.ll
 // RUN: FileCheck --check-prefix=CHECK-CTORS %s < %t.ll
 // RUN: FileCheck --check-prefix=CHECK-NEW %s < %t.ll
 // RUN: FileCheck --check-prefix=CHECK-DTORS %s < %t.ll
 // RUN: FileCheck --check-prefix=CHECK-LINK-REQ %s < %t.ll
 
 typedef __typeof__(sizeof(0)) size_t;
-void *operator new(size_t, void*) throw();
+void *operator new(size_t, void *) throw();
+using uintptr_t = unsigned long long;
 
 struct NotTrivialDtor {
   ~NotTrivialDtor();
 };
 
 struct DynamicBase1 {
   NotTrivialDtor obj;
   virtual void foo();
 };
 
 struct DynamicDerived : DynamicBase1 {
-  void foo();
+  void foo() override;
 };
 
 struct DynamicBase2 {
   virtual void bar();
   ~DynamicBase2() {
     bar();
   }
 };
 
 struct DynamicDerivedMultiple : DynamicBase1, DynamicBase2 {
-  virtual void foo();
-  virtual void bar();
+  void foo() override;
+  void bar() override;
 };
 
 struct StaticBase {
   NotTrivialDtor obj;
   void bar();
 };
 
 struct DynamicFromStatic : StaticBase {
   virtual void bar();
 };
 
 struct DynamicFromVirtualStatic1 : virtual StaticBase {
 };
 
 struct DynamicFromVirtualStatic2 : virtual StaticBase {
 };
 
-struct DynamicFrom2Virtuals :
-            DynamicFromVirtualStatic1,
+struct DynamicFrom2Virtuals : DynamicFromVirtualStatic1,
                               DynamicFromVirtualStatic2 {
 };
 
 // CHECK-NEW-LABEL: define void @_Z12LocalObjectsv()
 // CHECK-NEW-NOT: @llvm.launder.invariant.group.p0i8(
 // CHECK-NEW-LABEL: {{^}}}
 void LocalObjects() {
   DynamicBase1 DB;
   DB.foo();

 // CHECK-CTORS-NOT: @llvm.launder.invariant.group.p0i8(
 // CHECK-CTORS-LABEL: {{^}}}
 
 struct DynamicFrom2Virtuals;
 // CHECK-CTORS-LABEL: define linkonce_odr void @_ZN20DynamicFrom2VirtualsC1Ev
 // CHECK-CTORS: call i8* @llvm.launder.invariant.group.p0i8(
 // CHECK-CTORS-LABEL: {{^}}}
 
-
 // CHECK-NEW-LABEL: define void @_Z9Pointers1v()
 // CHECK-NEW-NOT: @llvm.launder.invariant.group.p0i8(
 // CHECK-NEW-LABEL: call void @_ZN12DynamicBase1C1Ev(
 
 // CHECK-NEW: %[[THIS3:.*]] = call i8* @llvm.launder.invariant.group.p0i8(i8* %[[THIS2:.*]])
 // CHECK-NEW: %[[THIS4:.*]] = bitcast i8* %[[THIS3]] to %[[DynamicDerived:.*]]*
 // CHECK-NEW: call void @_ZN14DynamicDerivedC1Ev(%[[DynamicDerived:.*]]* %[[THIS4]])
 // CHECK-NEW-LABEL: {{^}}}

 }
 
 /*** Testing Constructors ***/
 struct DynamicBase1;
 // CHECK-CTORS-LABEL: define linkonce_odr void @_ZN12DynamicBase1C2Ev(
 // CHECK-CTORS-NOT: call i8* @llvm.launder.invariant.group.p0i8(
 // CHECK-CTORS-LABEL: {{^}}}
 
-
 struct DynamicDerived;
 
 // CHECK-CTORS-LABEL: define linkonce_odr void @_ZN14DynamicDerivedC2Ev(
 // CHECK-CTORS: %[[THIS0:.*]] = load %[[DynamicDerived:.*]]*, %[[DynamicDerived]]** {{.*}}
 // CHECK-CTORS: %[[THIS1:.*]] = bitcast %[[DynamicDerived:.*]]* %[[THIS0]] to i8*
 // CHECK-CTORS: %[[THIS2:.*]] = call i8* @llvm.launder.invariant.group.p0i8(i8* %[[THIS1:.*]])
 // CHECK-CTORS: %[[THIS3:.*]] = bitcast i8* %[[THIS2]] to %[[DynamicDerived]]*
 // CHECK-CTORS: %[[THIS4:.*]] = bitcast %[[DynamicDerived]]* %[[THIS3]] to %[[DynamicBase:.*]]*

 // CHECK-CTORS: %[[THIS4:.*]] = bitcast %[[CLASS]]* %[[THIS3]] to %[[BASE_CLASS:.*]]*
 // CHECK-CTORS: call void @_ZN12DynamicBase1C2Ev(%[[BASE_CLASS]]* %[[THIS4]])
 
 // CHECK-CTORS: call i8* @llvm.launder.invariant.group.p0i8(
 
 // CHECK-CTORS: call void @_ZN12DynamicBase2C2Ev(
 // CHECK-CTORS-NOT: @llvm.launder.invariant.group.p0i8
 
-
 // CHECK-CTORS: %[[THIS10:.*]] = bitcast %struct.DynamicDerivedMultiple* %[[THIS0]] to i32 (...)***
 // CHECK-CTORS: store {{.*}} @_ZTV22DynamicDerivedMultiple, i32 0, inrange i32 0, i32 2) {{.*}} %[[THIS10]]
 // CHECK-CTORS: %[[THIS11:.*]] = bitcast %struct.DynamicDerivedMultiple* %[[THIS0]] to i8*
 // CHECK-CTORS: %[[THIS_ADD:.*]] = getelementptr inbounds i8, i8* %[[THIS11]], i64 16
 // CHECK-CTORS: %[[THIS12:.*]]  = bitcast i8* %[[THIS_ADD]] to i32 (...)***
 
-
 // CHECK-CTORS: store {{.*}} @_ZTV22DynamicDerivedMultiple, i32 0, inrange i32 1, i32 2) {{.*}} %[[THIS12]]
 // CHECK-CTORS-LABEL: {{^}}}
 
 struct DynamicFromStatic;
 // CHECK-CTORS-LABEL: define linkonce_odr void @_ZN17DynamicFromStaticC2Ev(
 // CHECK-CTORS-NOT: @llvm.launder.invariant.group.p0i8(
 // CHECK-CTORS-LABEL: {{^}}}
 
 struct A {
   virtual void foo();
+  int m;
 };
 struct B : A {
-  virtual void foo();
+  void foo() override;
 };
 
 union U {
   A a;
   B b;
 };
 
 void changeToB(U *u);
 void changeToA(U *u);
 
 void g2(A *a) {
   a->foo();
 }
 // We have to guard access to union fields with invariant.group, because
 // it is very easy to skip the barrier with unions. In this example the inlined
 // g2 will produce loads with the same !invariant.group metadata, and
 // u->a and u->b would use the same pointer.
 // CHECK-NEW-LABEL: define void @_Z14UnionsBarriersP1U
 void UnionsBarriers(U *u) {
   // CHECK-NEW: call void @_Z9changeToBP1U(
   changeToB(u);
   // CHECK-NEW: call i8* @llvm.launder.invariant.group.p0i8(i8*
   // CHECK-NEW: call void @_Z2g2P1A(%struct.A*
   g2(&u->b);
-  // CHECK-NEW: call void @_Z9changeToAP1U(%union.U* 
+  // CHECK-NEW: call void @_Z9changeToAP1U(%union.U*
   changeToA(u);
   // CHECK-NEW: call i8* @llvm.launder.invariant.group.p0i8(i8*
   // call void @_Z2g2P1A(%struct.A* %a)
   g2(&u->a);
   // CHECK-NEW-NOT: call i8* @llvm.launder.invariant.group.p0i8(i8*
 }
 
 struct HoldingVirtuals {
void UnionsBarrier3(U3 &u) {
   // CHECK-NEW: call void @_Z4takeR13VirtualInBase(
   take(u.v2);
 
   // CHECK-NEW: call i8* @llvm.launder.invariant.group.p0i8(i8*
   // CHECK-NEW: call void @_Z4takeR18VirtualInheritance(
   take(u.v3);
 }
 
+// CHECK-NEW-LABEL: define void @_Z7comparev()
+void compare() {
+  A *a = new A;
+  a->foo();
+  // CHECK-NEW: call i8* @llvm.launder.invariant.group.p0i8(i8*
+  A *b = new (a) B;
+
+  // CHECK-NEW: %[[a:.*]] = call i8* @llvm.strip.invariant.group.p0i8(i8*
+  // CHECK-NEW: %[[a2:.*]] = bitcast i8* %[[a]] to %struct.A*
+  // CHECK-NEW: %[[b:.*]] = call i8* @llvm.strip.invariant.group.p0i8(i8*
+  // CHECK-NEW: %[[b2:.*]] = bitcast i8* %[[b]] to %struct.A*
+  // CHECK-NEW: %cmp = icmp eq %struct.A* %[[a2]], %[[b2]]
+  if (a == b)
+    b->foo();
+}
+
+// CHECK-NEW-LABEL: compare2
+bool compare2(A *a, A *a2) {
+  // CHECK-NEW: %[[a:.*]] = call i8* @llvm.strip.invariant.group.p0i8(i8*
+  // CHECK-NEW: %[[a2:.*]] = bitcast i8* %[[a]] to %struct.A*
+  // CHECK-NEW: %[[b:.*]] = call i8* @llvm.strip.invariant.group.p0i8(i8*
+  // CHECK-NEW: %[[b2:.*]] = bitcast i8* %[[b]] to %struct.A*
+  // CHECK-NEW: %cmp = icmp ult %struct.A* %[[a2]], %[[b2]]
+  return a < a2;
+}
+// CHECK-NEW-LABEL: compareIntPointers
+bool compareIntPointers(int *a, int *b) {
+  // CHECK-NEW-NOT: call i8* @llvm.strip.invariant.group
+  return a == b;
+}
+
+struct HoldingOtherVirtuals {
+  B b;
+};
+
+// There is no need to add barriers for comparision of pointer to classes
+// that are not dynamic.
+// CHECK-NEW-LABEL: compare5
+bool compare5(HoldingOtherVirtuals *a, HoldingOtherVirtuals *b) {
+  // CHECK-NEW-NOT: call i8* @llvm.strip.invariant.group
+  return a == b;
+}
+// CHECK-NEW-LABEL: compareNull
+bool compareNull(A *a) {
+  // CHECK-NEW-NOT: call i8* @llvm.strip.invariant.group
+
+  if (a != nullptr)
+    return false;
+  if (!a)
+    return false;
+  return a == nullptr;
+}
+
+struct X;
+// We have to also introduce the barriers if comparing pointers to incomplete
+// objects
+// CHECK-NEW-LABEL: define zeroext i1 @_Z8compare4P1XS0_
+bool compare4(X *x, X *x2) {
+  // CHECK-NEW: %[[x:.*]] = call i8* @llvm.strip.invariant.group.p0i8(i8*
+  // CHECK-NEW: %[[xp:.*]] = bitcast i8* %[[x]] to %struct.X*
+  // CHECK-NEW: %[[x2:.*]] = call i8* @llvm.strip.invariant.group.p0i8(i8*
+  // CHECK-NEW: %[[x2p:.*]] = bitcast i8* %[[x2]] to %struct.X*
+  // CHECK-NEW: %cmp = icmp eq %struct.X* %[[xp]], %[[x2p]]
+  return x == x2;
+}
+
+// CHECK-NEW-LABEL: define void @_Z7member1P20HoldingOtherVirtuals(
+void member1(HoldingOtherVirtuals *p) {
+
+  // CHECK-NEW-NOT: call i8* @llvm.strip.invariant.group.p0i8(
+  (void)p->b;
+}
+
+// CHECK-NEW-LABEL: member2
+void member2(A *a) {
+  // CHECK-NEW: call i8* @llvm.strip.invariant.group.p0i8
+  (void)a->m;
+}
+
+// Check if from comparison of addresses of member we can't infer the equality
+// of ap and bp.
+// CHECK-NEW-LABEL: @_Z18testCompareMembersv(
+void testCompareMembers() {
+  // CHECK-NEW:    [[AP:%.*]] = alloca %struct.A*
+  // CHECK-NEW:    [[APM:%.*]] = alloca i32*
+  // CHECK-NEW:    [[BP:%.*]] = alloca %struct.B*
+  // CHECK-NEW:    [[BPM:%.*]] = alloca i32*
+
+  A *ap = new A;
+  // CHECK-NEW:   call void %{{.*}}(%struct.A* %{{.*}})
+  ap->foo();
+  // CHECK-NEW:    [[TMP7:%.*]] = load %struct.A*, %struct.A** [[AP]]
+  // CHECK-NEW:    [[TMP8:%.*]] = bitcast %struct.A* [[TMP7]] to i8*
+  // CHECK-NEW:    [[TMP9:%.*]] = call i8* @llvm.strip.invariant.group.p0i8(i8* [[TMP8]])
+  // CHECK-NEW:    [[TMP10:%.*]] = bitcast i8* [[TMP9]] to %struct.A*
+  // CHECK-NEW:    [[M:%.*]] = getelementptr inbounds [[STRUCT_A:%.*]], %struct.A* [[TMP10]], i32 0, i32 1
+  // CHECK-NEW:    store i32* [[M]], i32** [[APM]]
+  int *const apm = &ap->m;
+
+  B *bp = new (ap) B;
+
+  // CHECK-NEW:    [[TMP20:%.*]] = load %struct.B*, %struct.B** [[BP]]
+  // CHECK-NEW:    [[TMP21:%.*]] = bitcast %struct.B* [[TMP20]] to %struct.A*
+  // CHECK-NEW:    [[TMP22:%.*]] = bitcast %struct.A* [[TMP21]] to i8*
+  // CHECK-NEW:    [[TMP23:%.*]] = call i8* @llvm.strip.invariant.group.p0i8(i8* [[TMP22]])
+  // CHECK-NEW:    [[TMP24:%.*]] = bitcast i8* [[TMP23]] to %struct.A*
+  // CHECK-NEW:    [[M4:%.*]] = getelementptr inbounds [[STRUCT_A]], %struct.A* [[TMP24]], i32 0, i32 1
+  // CHECK-NEW:    store i32* [[M4]], i32** [[BPM]]
+  int *const bpm = &bp->m;
+
+  // CHECK-NEW:    [[TMP25:%.*]] = load i32*, i32** [[APM]]
+  // CHECK-NEW:    [[TMP26:%.*]] = load i32*, i32** [[BPM]]
+  // CHECK-NEW-NOT: strip.invariant.group
+  // CHECK-NEW-NOT: launder.invariant.group
+  // CHECK-NEW:    [[CMP:%.*]] = icmp eq i32* [[TMP25]], [[TMP26]]
+  if (apm == bpm) {
+    bp->foo();
+  }
+}
+
+// CHECK-NEW-LABEL: define void @_Z9testCast1P1A(%struct.A*
+void testCast1(A *a) {
+  // Here we get rid of dynamic info
+  // CHECK-NEW: call i8* @llvm.strip.invariant.group
+  auto *v = (void *)a;
+
+  // CHECK-NEW: call i8* @llvm.strip.invariant.group
+  auto i2 = (uintptr_t)a;
+  (void)i2;
+
+  // CHECK-NEW-NOT: @llvm.strip.invariant.group
+  // CHECK-NEW-NOT: @llvm.launder.invariant.group
+
+  // The information is already stripped
+  auto i = (uintptr_t)v;
+}
+
+struct Incomplete;
+// CHECK-NEW-LABEL: define void @_Z9testCast2P10Incomplete(%struct.Incomplete*
+void testCast2(Incomplete *I) {
+  // Here we get rid of potential dynamic info
+  // CHECK-NEW: call i8* @llvm.strip.invariant.group
+  auto *v = (void *)I;
+
+  // CHECK-NEW: call i8* @llvm.strip.invariant.group
+  auto i2 = (uintptr_t)I;
+  (void)i2;
+
+  // CHECK-NEW-NOT: @llvm.strip.invariant.group
+  // CHECK-NEW-NOT: @llvm.launder.invariant.group
+
+  // The information is already stripped
+  auto i = (uintptr_t)v;
+}
+
+// CHECK-NEW-LABEL: define void @_Z9testCast3y(
+void testCast3(uintptr_t i) {
+  // CHECK-NEW-NOT: @llvm.strip.invariant.group
+  // CHECK-NEW: @llvm.launder.invariant.group
+  A *a3 = (A *)i;
+  (void)a3;
+
+  auto *v2 = (void *)i;
+
+  // CHECK-NEW: @llvm.launder.invariant.group
+  A *a2 = (A *)v2;
+  (void)a2;
+
+  // CHECK-NEW-NOT: @llvm.launder.invariant.group
+  auto *v3 = (void *)i;
+  (void)v3;
+}
+
+// CHECK-NEW-LABEL: define void @_Z9testCast4y(
+void testCast4(uintptr_t i) {
+  // CHECK-NEW-NOT: @llvm.strip.invariant.group
+  // CHECK-NEW: @llvm.launder.invariant.group
+  auto *a3 = (Incomplete *)i;
+  (void)a3;
+
+  // CHECK-NEW: @llvm.launder.invariant.group
+  auto *v2 = (void *)i;
+  // CHECK-NEW-NOT: @llvm.launder.invariant.group
+  auto *a2 = (Incomplete *)v2;
+  (void)a2;
+}
+
+// CHECK-NEW-LABEL: define void @_Z9testCast5P1B(
+void testCast5(B *b) {
+  // CHECK-NEW-NOT: @llvm.strip.invariant.group
+  // CHECK-NEW-NOT: @llvm.launder.invariant.group
+  A *a = b;
+  (void)a;
+
+  auto *b2 = (B *)a;
+  (void)b2;
+}
+
+// CHECK-NEW-LABEL: define void @_Z9testCast6P1A(
+void testCast6(A *a) {
+
+  // CHECK-NEW: @llvm.strip.invariant.group
+  auto *I = (Incomplete *)a;
+  (void)I;
+  // CHECK-NEW: @llvm.launder.invariant.group
+  auto *a2 = (A *)I;
+  (void)a2;
+
+  // CHECK-NEW: @llvm.strip.invariant.group
+  auto *E = (Empty *)a;
+  (void)E;
+
+  // CHECK-NEW: @llvm.launder.invariant.group
+  auto *a3 = (A *)E;
+  (void)a3;
+
+  // CHECK-NEW-NOT: @llvm.strip.invariant.group
+  auto i = (uintptr_t)E;
+  (void)i;
+}
+
+class Incomplete2;
+// CHECK-NEW-LABEL: define void @_Z9testCast7P10Incomplete(
+void testCast7(Incomplete *I) {
+  // CHECK-NEW-NOT: @llvm.strip.invariant.group
+
+  // Incomplete2 could be dynamic where Incomplete may not be dynamic, thus
+  // launder is needed.  We don't strip firstly because launder is sufficient.
+
+  // CHECK-NEW: @llvm.launder.invariant.group
+  auto *I2 = (Incomplete2 *)I;
+  (void)I2;
+  // CHECK-NEW-LABEL: ret void
+}
+
+template <typename Base>
+struct PossiblyDerivingFromDynamicBase : Base {
+};
+
+// CHECK-NEW-LABEL: define void @_Z9testCast8P10Incomplete(
+void testCast8(Incomplete *I) {
+  // CHECK-NEW-NOT: @llvm.strip.invariant.group
+  // CHECK-NEW: @llvm.launder.invariant.group
+  auto *P = (PossiblyDerivingFromDynamicBase<Incomplete> *)I;
+  (void)P;
+
+  // CHECK-NEW: @llvm.launder.invariant.group
+  auto *P2 = (PossiblyDerivingFromDynamicBase<Empty> *)I;
+  (void)P2;
+
+  // CHECK-NEW: @llvm.launder.invariant.group
+  auto *P3 = (PossiblyDerivingFromDynamicBase<A> *)I;
+  (void)P3;
+
+  // CHECK-NEW-NOT: @llvm.launder.invariant.group
+  auto *a3 = (A *)P3;
+
+  // CHECK-NEW-LABEL: ret void
+}
+
+// CHECK-NEW-LABEL: define void @_Z9testCast9
+void testCast9(PossiblyDerivingFromDynamicBase<Incomplete> *P) {
+  // CHECK-NEW: @llvm.strip.invariant.group
+  auto *V = (void *)P;
+
+  // CHECK-NEW-LABEL: ret void
+}
+
 /** DTORS **/
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN10StaticBaseD2Ev(
 // CHECK-DTORS-NOT: call i8* @llvm.launder.invariant.group.p0i8(
 // CHECK-DTORS-LABEL: {{^}}}
 
-
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN25DynamicFromVirtualStatic2D2Ev(
 // CHECK-DTORS-NOT: invariant.barrier
 // CHECK-DTORS-LABEL: {{^}}}
 
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN17DynamicFromStaticD2Ev
 // CHECK-DTORS-NOT: call i8* @llvm.launder.invariant.group.p0i8(
 // CHECK-DTORS-LABEL: {{^}}}
 
-
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN22DynamicDerivedMultipleD2Ev(
 
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN12DynamicBase2D2Ev(
 // CHECK-DTORS: call i8* @llvm.launder.invariant.group.p0i8(
 // CHECK-DTORS-LABEL: {{^}}}
 
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN12DynamicBase1D2Ev
 // CHECK-DTORS: call i8* @llvm.launder.invariant.group.p0i8(
 // CHECK-DTORS-LABEL: {{^}}}
 
 // CHECK-DTORS-LABEL: define linkonce_odr void @_ZN14DynamicDerivedD2Ev
 // CHECK-DTORS-NOT: call i8* @llvm.launder.invariant.group.p0i8(
 // CHECK-DTORS-LABEL: {{^}}}
 
-
 // CHECK-LINK-REQ: !llvm.module.flags = !{![[FIRST:[0-9]+]], ![[SEC:[0-9]+]]{{.*}}}
 
 // CHECK-LINK-REQ: ![[FIRST]] = !{i32 1, !"StrictVTablePointers", i32 1}
 // CHECK-LINK-REQ: ![[SEC]] = !{i32 3, !"StrictVTablePointersRequirement", ![[META:.*]]}
 // CHECK-LINK-REQ: ![[META]] = !{!"StrictVTablePointers", i32 1}
-