[ubsan] Add support for reporting diagnostics to a monitor process

[vsk]

Summary

Add support to the ubsan runtime for reporting diagnostics to a monitor
process (e.g a debugger).

The Xcode IDE uses this by setting a breakpoint on ubsan_on_report and
collecting diagnostic information via ubsan_get_current_report_data,
which it then surfaces to users in the editor UI.

Testing for this functionality already exists in upstream lldb, here:
lldb/packages/Python/lldbsuite/test/functionalities/ubsan

Apart from that, this is ninja check-ubsan clean.

[vitalybuka]

Does check-asan work?

It would be nice to test major xcode/lldb expectations here.

lib/ubsan/ubsan_monitor.cc

54

why do you need this?

[kubamracek]

Thanks, Vedant! This looks good to me.

There's some tests in LLDB, https://github.com/llvm-mirror/lldb/tree/master/packages/Python/lldbsuite/test/functionalities/ubsan that are testing this. But it should be possible to write a test in compiler-rt as well, see https://github.com/llvm-mirror/compiler-rt/blob/master/test/tsan/Darwin/debug_external.cc. But if that turns out to be too much work, I'm okay with just the LLDB test.

[vsk]

In D48446#1139655, @vitalybuka wrote:

Does check-asan work?

Yes.

it should be possible to write a test in compiler-rt as well

I've added test/ubsan/Misc/monitor.cpp.

lib/ubsan/ubsan_monitor.cc

54

This is a relatively noninvasive way of making sure the text of diagnostics can't begin with a lowercase letter. I'll add a comment.

[vitalybuka]

lib/ubsan/ubsan_monitor.cc

54

Thanks. That's clear from the code.
I am rather curios why it's important. Is this always upper case for messages from other components passed to monitor?

[vsk]

lib/ubsan/ubsan_monitor.cc

54

Oh, good question. I'm not sure how the other sanitizers handle capitalization.

W.r.t ubsan integration into Xcode, I was simply asked to make diagnostics start with proper capitalization during internal review. Because of loose coupling between compiler-rt and Xcode, it was more convenient to do the capitalization here, although it would be cleaner to move this into Xcode.

[vitalybuka]

lib/ubsan/ubsan_monitor.h

37

I'd prefer interface consistent with similar one from TSAN:
__tsan_on_report(void *report) {

__tsan_get_report_loc(report.....
__tsan_get_report_loc_object_type(report.....

}

Also this will avoid having state set by RegisterUndefinedBehaviorReport

[vsk]

lib/ubsan/ubsan_monitor.h

37

Point taken, it would be a bit simpler this way. However, we can't make this change because it would break debuggability of code compiled with Xcode 9.

[vitalybuka]

lib/ubsan/ubsan_monitor.h

37

Does Xcode 9 works for tsan?

[vsk]

lib/ubsan/ubsan_monitor.h

37

Are you asking if IDE diagnostics for tsan issues found in a binary compiled with Xcode 9, work when running under Xcode (9+K)? I'm not sure. Generally we try to make it possible to debug old binaries.

[vitalybuka]

lib/ubsan/ubsan_monitor.h

37

I am confused. Could you please elaborate why change in non existing yet API will break code compiled with Xcode 9?

To clarify, I propose to have:

__ubsan_on_report(void *report) {
    __ubsan_get_report_loc(report.....
    __ubsan_get_report_other_stuff(report.....
}
...
similar to tsan

[kubamracek]

lib/ubsan/ubsan_monitor.h

37

Yes, Xcode 9 supports TSan and UBSan. I think we really need to keep the interface as it is, at least for this initial commit. Changes in the interface should then try to be as compatible as possible. Every time TSan's debugging interface changed, we did that in a backwards-compatible manner (debugging old binaries works), and forwards-compatible way as well (worst case is you'll miss some data in the report).

[vitalybuka]

lib/ubsan/ubsan_monitor.h

37

Not sure I understand the answer.
Does Xcode 9 already expects ubsan_on_report and ubsan_get_current_report_data as is?

[vsk]

lib/ubsan/ubsan_monitor.h

37

Yes, I'd like to upstream the compiler-rt support. One benefit to the community is that downloadable open-source toolchains will become compatible with Xcode's ubsan support.

[vitalybuka]

lib/ubsan/ubsan_monitor.h

37

Thanks. I see now.

[cryptoad]

This seems to have broken the Windows build.
vc:\b\slave\sanitizer-windows\llvm\projects\compiler-rt\lib\ubsan\ubsan_interface.inc(55): error C2065: '__ubsan_on_report': undeclared identifier
http://lab.llvm.org:8011/builders/sanitizer-windows/builds/30528/steps/build%20compiler-rt/logs/stdio

[vsk]

Taking a look now.

[thakis]

test/ubsan/TestCases/Misc/monitor.cpp

2

This test fails on Windows: https://logs.chromium.org/v/?s=chromium%2Fbb%2Ftryserver.chromium.win%2Fwin_upload_clang%2F361%2F%2B%2Frecipes%2Fsteps%2Fpackage_clang%2F0%2Fstdout

$ ":" "RUN: at line 1"
$ "C:/b/rr/tmpnnvph5/w/src/third_party/llvm-bootstrap/./bin/clang.exe" "-w" "-fsanitize=bool" "C:\b\rr\tmpnnvph5\w\src\third_party\llvm\projects\compiler-rt\test\ubsan\TestCases\Misc\monitor.cpp" "-o" "C:\b\rr\tmpnnvph5\w\src\third_party\llvm-bootstrap\projects\compiler-rt\test\ubsan\Standalone-x86_64\TestCases\Misc\Output\monitor.cpp.tmp"
# command output:
clang_rt.ubsan_standalone-x86_64.lib(ubsan_monitor.cc.obj) : error LNK2005: __ubsan_on_report already defined in monitor-c1dd53.o
   Creating library C:\b\rr\tmpnnvph5\w\src\third_party\llvm-bootstrap\projects\compiler-rt\test\ubsan\Standalone-x86_64\TestCases\Misc\Output\monitor.cpp.lib and object C:\b\rr\tmpnnvph5\w\src\third_party\llvm-bootstrap\projects\compiler-rt\test\ubsan\Standalone-x86_64\TestCases\Misc\Output\monitor.cpp.exp
monitor-c1dd53.o : warning LNK4217: locally defined symbol __std_terminate imported in function "int `public: static unsigned __int64 __cdecl std::char_traits<char>::length(char const * const)'::`1'::dtor$2" (?dtor$2@?0??length@?$char_traits@D@std@@SA_KQEBD@Z@4HA)
monitor-c1dd53.o : warning LNK4217: locally defined symbol _CxxThrowException imported in function "public: void __cdecl std::ios_base::clear(int,bool)" (?clear@ios_base@std@@QEAAXH_N@Z)
C:\b\rr\tmpnnvph5\w\src\third_party\llvm-bootstrap\projects\compiler-rt\test\ubsan\Standalone-x86_64\TestCases\Misc\Output\monitor.cpp.tmp : fatal error LNK1169: one or more multiply defined symbols found
# command stderr:
clang.exe: error: linker command failed with exit code 1169 (use -v to see invocation)

I'll note that no other ubsan test includes iostream. clang tests at least try to not use system headers; I'm guessing this is probably true for compiler-rt tests as well?

If there's no quick fix, please revert while investigating to get the build back to green for now.

(That bot uses msvc2017; the llvm buildbot bots maybe use something older.)

[kubamracek]

test/ubsan/TestCases/Misc/monitor.cpp

2

@vsk, I guess this is because of the weak definition of __ubsan_on_report. Should we just mark the test as UNSUPPORTED: win32?

[thakis]

test/ubsan/TestCases/Misc/monitor.cpp

2

Looks like the test got disabled on win in r335523, thanks!

lib/ubsan/CMakeLists.txt

 # Build for the undefined behavior sanitizer runtime support library.
 
 set(UBSAN_SOURCES
   ubsan_diag.cc
   ubsan_init.cc
   ubsan_flags.cc
   ubsan_handlers.cc
+  ubsan_monitor.cc
   ubsan_value.cc
   )
 
 set(UBSAN_STANDALONE_SOURCES
   ubsan_diag_standalone.cc
   ubsan_init_standalone.cc
   ubsan_signals_standalone.cc
   )

lib/ubsan/ubsan_diag.h

 /// \brief A C++ type name. Really just a strong typedef for 'const char*'.
 class TypeName {
   const char *Name;
 public:
   TypeName(const char *Name) : Name(Name) {}
   const char *getName() const { return Name; }
 };
 
+enum class ErrorType {
+#define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) Name,
+#include "ubsan_checks.inc"
+#undef UBSAN_CHECK
+};
+
 /// \brief Representation of an in-flight diagnostic.
 ///
 /// Temporary \c Diag instances are created by the handler routines to
 /// accumulate arguments for a diagnostic. The destructor emits the diagnostic
 /// message.
 class Diag {
   /// The location at which the problem occurred.
   Location Loc;
 
   /// The diagnostic level.
   DiagLevel Level;
 
+  /// The error type.
+  ErrorType ET;
+
   /// The message which will be emitted, with %0, %1, ... placeholders for
   /// arguments.
   const char *Message;
 
 public:
   /// Kinds of arguments, corresponding to members of \c Arg's union.
   enum ArgKind {
     AK_String, ///< A string argument, displayed as-is.
Diag &AddRange(Range A) {
     return *this;
   }
 
   /// \c Diag objects are not copyable.
   Diag(const Diag &); // NOT IMPLEMENTED
   Diag &operator=(const Diag &);
 
 public:
-  Diag(Location Loc, DiagLevel Level, const char *Message)
-    : Loc(Loc), Level(Level), Message(Message), NumArgs(0), NumRanges(0) {}
+  Diag(Location Loc, DiagLevel Level, ErrorType ET, const char *Message)
+      : Loc(Loc), Level(Level), ET(ET), Message(Message), NumArgs(0),
+        NumRanges(0) {}
   ~Diag();
 
   Diag &operator<<(const char *Str) { return AddArg(Str); }
   Diag &operator<<(TypeName TN) { return AddArg(TN); }
   Diag &operator<<(unsigned long long V) { return AddArg(UIntMax(V)); }
   Diag &operator<<(const void *V) { return AddArg(V); }
   Diag &operator<<(const TypeDescriptor &V);
   Diag &operator<<(const Value &V);
   Diag &operator<<(const Range &R) { return AddRange(R); }
 };
 
 struct ReportOptions {
   // If FromUnrecoverableHandler is specified, UBSan runtime handler is not
   // expected to return.
   bool FromUnrecoverableHandler;
   /// pc/bp are used to unwind the stack trace.
   uptr pc;
   uptr bp;
 };
 
-enum class ErrorType {
-#define UBSAN_CHECK(Name, SummaryKind, FSanitizeFlagName) Name,
-#include "ubsan_checks.inc"
-#undef UBSAN_CHECK
-};
-
 bool ignoreReport(SourceLocation SLoc, ReportOptions Opts, ErrorType ET);
 
 #define GET_REPORT_OPTIONS(unrecoverable_handler) \
     GET_CALLER_PC_BP; \
     ReportOptions Opts = {unrecoverable_handler, pc, bp}
 
 void GetStackTrace(BufferedStackTrace *stack, uptr max_depth, uptr pc, uptr bp,
                    void *context, bool fast);

lib/ubsan/ubsan_diag.cc

 //
 //===----------------------------------------------------------------------===//
 
 #include "ubsan_platform.h"
 #if CAN_SANITIZE_UB
 #include "ubsan_diag.h"
 #include "ubsan_init.h"
 #include "ubsan_flags.h"
+#include "ubsan_monitor.h"
 #include "sanitizer_common/sanitizer_placement_new.h"
 #include "sanitizer_common/sanitizer_report_decorator.h"
 #include "sanitizer_common/sanitizer_stacktrace.h"
 #include "sanitizer_common/sanitizer_stacktrace_printer.h"
 #include "sanitizer_common/sanitizer_suppressions.h"
 #include "sanitizer_common/sanitizer_symbolizer.h"
 #include <stdio.h>
 

 }
 
 Diag::~Diag() {
   // All diagnostics should be printed under report mutex.
   ScopedReport::CheckLocked();
   Decorator Decor;
   InternalScopedString Buffer(1024);
 
+  // Prepare a report that a monitor process can inspect.
+  if (Level == DL_Error) {
+    RenderText(&Buffer, Message, Args);
+    UndefinedBehaviorReport UBR{ConvertTypeToString(ET), Loc, Buffer};
+    Buffer.clear();
+  }
+
   Buffer.append(Decor.Bold());
   RenderLocation(&Buffer, Loc);
   Buffer.append(":");
 
   switch (Level) {
   case DL_Error:
     Buffer.append("%s runtime error: %s%s", Decor.Warning(), Decor.Default(),
                   Decor.Bold());

lib/ubsan/ubsan_handlers.cc

 // Error logging entry points for the UBSan runtime.
 //
 //===----------------------------------------------------------------------===//
 
 #include "ubsan_platform.h"
 #if CAN_SANITIZE_UB
 #include "ubsan_handlers.h"
 #include "ubsan_diag.h"
+#include "ubsan_monitor.h"
 
 #include "sanitizer_common/sanitizer_common.h"
 
 using namespace __sanitizer;
 using namespace __ubsan;
 
 namespace __ubsan {
 bool ignoreReport(SourceLocation SLoc, ReportOptions Opts, ErrorType ET) {
if (Data->Loc.isInvalid()) {
     FallbackLoc.reset(getCallerLocation(Opts.pc));
     Loc = FallbackLoc;
   }
 
   ScopedReport R(Opts, Loc, ET);
 
   switch (ET) {
   case ErrorType::NullPointerUse:
-    Diag(Loc, DL_Error, "%0 null pointer of type %1")
+    Diag(Loc, DL_Error, ET, "%0 null pointer of type %1")
         << TypeCheckKinds[Data->TypeCheckKind] << Data->Type;
     break;
   case ErrorType::MisalignedPointerUse:
-    Diag(Loc, DL_Error, "%0 misaligned address %1 for type %3, "
+    Diag(Loc, DL_Error, ET, "%0 misaligned address %1 for type %3, "
                         "which requires %2 byte alignment")
         << TypeCheckKinds[Data->TypeCheckKind] << (void *)Pointer << Alignment
         << Data->Type;
     break;
   case ErrorType::InsufficientObjectSize:
-    Diag(Loc, DL_Error, "%0 address %1 with insufficient space "
+    Diag(Loc, DL_Error, ET, "%0 address %1 with insufficient space "
                         "for an object of type %2")
         << TypeCheckKinds[Data->TypeCheckKind] << (void *)Pointer << Data->Type;
     break;
   default:
     UNREACHABLE("unexpected error type!");
   }
 
   if (Pointer)
-    Diag(Pointer, DL_Note, "pointer points here");
+    Diag(Pointer, DL_Note, ET, "pointer points here");
 }
 
 void __ubsan::__ubsan_handle_type_mismatch_v1(TypeMismatchData *Data,
                                               ValueHandle Pointer) {
   GET_REPORT_OPTIONS(false);
   handleTypeMismatchImpl(Data, Pointer, Opts);
 }
 void __ubsan::__ubsan_handle_type_mismatch_v1_abort(TypeMismatchData *Data,
static void handleIntegerOverflowImpl(OverflowData *Data, ValueHandle LHS,
   ErrorType ET = IsSigned ? ErrorType::SignedIntegerOverflow
                           : ErrorType::UnsignedIntegerOverflow;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
-  Diag(Loc, DL_Error, "%0 integer overflow: "
+  Diag(Loc, DL_Error, ET, "%0 integer overflow: "
                           "%1 %2 %3 cannot be represented in type %4")
-    << (IsSigned ? "signed" : "unsigned")
-    << Value(Data->Type, LHS) << Operator << RHS << Data->Type;
+      << (IsSigned ? "signed" : "unsigned") << Value(Data->Type, LHS)
+      << Operator << RHS << Data->Type;
 }
 
 #define UBSAN_OVERFLOW_HANDLER(handler_name, op, unrecoverable)                \
   void __ubsan::handler_name(OverflowData *Data, ValueHandle LHS,              \
                              ValueHandle RHS) {                                \
     GET_REPORT_OPTIONS(unrecoverable);                                         \
     handleIntegerOverflowImpl(Data, LHS, op, Value(Data->Type, RHS), Opts);    \
     if (unrecoverable)                                                         \
ErrorType ET = IsSigned ? ErrorType::SignedIntegerOverflow
                           : ErrorType::UnsignedIntegerOverflow;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
   if (IsSigned)
-    Diag(Loc, DL_Error,
+    Diag(Loc, DL_Error, ET,
          "negation of %0 cannot be represented in type %1; "
          "cast to an unsigned type to negate this value to itself")
         << Value(Data->Type, OldVal) << Data->Type;
   else
-    Diag(Loc, DL_Error, "negation of %0 cannot be represented in type %1")
+    Diag(Loc, DL_Error, ET, "negation of %0 cannot be represented in type %1")
         << Value(Data->Type, OldVal) << Data->Type;
 }
 
 void __ubsan::__ubsan_handle_negate_overflow(OverflowData *Data,
                                              ValueHandle OldVal) {
   GET_REPORT_OPTIONS(false);
   handleNegateOverflowImpl(Data, OldVal, Opts);
 }
static void handleDivremOverflowImpl(OverflowData *Data, ValueHandle LHS,
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
   switch (ET) {
   case ErrorType::SignedIntegerOverflow:
-    Diag(Loc, DL_Error, "division of %0 by -1 cannot be represented in type %1")
+    Diag(Loc, DL_Error, ET,
+         "division of %0 by -1 cannot be represented in type %1")
         << LHSVal << Data->Type;
     break;
   default:
-    Diag(Loc, DL_Error, "division by zero");
+    Diag(Loc, DL_Error, ET, "division by zero");
     break;
   }
 }
 
 void __ubsan::__ubsan_handle_divrem_overflow(OverflowData *Data,
                                              ValueHandle LHS, ValueHandle RHS) {
   GET_REPORT_OPTIONS(false);
   handleDivremOverflowImpl(Data, LHS, RHS, Opts);
static void handleShiftOutOfBoundsImpl(ShiftOutOfBoundsData *Data,
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
   if (ET == ErrorType::InvalidShiftExponent) {
     if (RHSVal.isNegative())
-      Diag(Loc, DL_Error, "shift exponent %0 is negative") << RHSVal;
+      Diag(Loc, DL_Error, ET, "shift exponent %0 is negative") << RHSVal;
     else
-      Diag(Loc, DL_Error, "shift exponent %0 is too large for %1-bit type %2")
+      Diag(Loc, DL_Error, ET,
+           "shift exponent %0 is too large for %1-bit type %2")
           << RHSVal << Data->LHSType.getIntegerBitWidth() << Data->LHSType;
   } else {
     if (LHSVal.isNegative())
-      Diag(Loc, DL_Error, "left shift of negative value %0") << LHSVal;
+      Diag(Loc, DL_Error, ET, "left shift of negative value %0") << LHSVal;
     else
-      Diag(Loc, DL_Error,
+      Diag(Loc, DL_Error, ET,
            "left shift of %0 by %1 places cannot be represented in type %2")
           << LHSVal << RHSVal << Data->LHSType;
   }
 }
 
 void __ubsan::__ubsan_handle_shift_out_of_bounds(ShiftOutOfBoundsData *Data,
                                                  ValueHandle LHS,
                                                  ValueHandle RHS) {
static void handleOutOfBoundsImpl(OutOfBoundsData *Data, ValueHandle Index,
   ErrorType ET = ErrorType::OutOfBoundsIndex;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
   Value IndexVal(Data->IndexType, Index);
-  Diag(Loc, DL_Error, "index %0 out of bounds for type %1")
+  Diag(Loc, DL_Error, ET, "index %0 out of bounds for type %1")
     << IndexVal << Data->ArrayType;
 }
 
 void __ubsan::__ubsan_handle_out_of_bounds(OutOfBoundsData *Data,
                                            ValueHandle Index) {
   GET_REPORT_OPTIONS(false);
   handleOutOfBoundsImpl(Data, Index, Opts);
 }
 void __ubsan::__ubsan_handle_out_of_bounds_abort(OutOfBoundsData *Data,
                                                  ValueHandle Index) {
   GET_REPORT_OPTIONS(true);
   handleOutOfBoundsImpl(Data, Index, Opts);
   Die();
 }
 
 static void handleBuiltinUnreachableImpl(UnreachableData *Data,
                                          ReportOptions Opts) {
-  ScopedReport R(Opts, Data->Loc, ErrorType::UnreachableCall);
-  Diag(Data->Loc, DL_Error, "execution reached an unreachable program point");
+  ErrorType ET = ErrorType::UnreachableCall;
+  ScopedReport R(Opts, Data->Loc, ET);
+  Diag(Data->Loc, DL_Error, ET,
+       "execution reached an unreachable program point");
 }
 
 void __ubsan::__ubsan_handle_builtin_unreachable(UnreachableData *Data) {
   GET_REPORT_OPTIONS(true);
   handleBuiltinUnreachableImpl(Data, Opts);
   Die();
 }
 
 static void handleMissingReturnImpl(UnreachableData *Data, ReportOptions Opts) {
-  ScopedReport R(Opts, Data->Loc, ErrorType::MissingReturn);
-  Diag(Data->Loc, DL_Error,
+  ErrorType ET = ErrorType::MissingReturn;
+  ScopedReport R(Opts, Data->Loc, ET);
+  Diag(Data->Loc, DL_Error, ET,
        "execution reached the end of a value-returning function "
        "without returning a value");
 }
 
 void __ubsan::__ubsan_handle_missing_return(UnreachableData *Data) {
   GET_REPORT_OPTIONS(true);
   handleMissingReturnImpl(Data, Opts);
   Die();
 }
 
 static void handleVLABoundNotPositive(VLABoundData *Data, ValueHandle Bound,
                                       ReportOptions Opts) {
   SourceLocation Loc = Data->Loc.acquire();
   ErrorType ET = ErrorType::NonPositiveVLAIndex;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
-  Diag(Loc, DL_Error, "variable length array bound evaluates to "
+  Diag(Loc, DL_Error, ET, "variable length array bound evaluates to "
                           "non-positive value %0")
       << Value(Data->Type, Bound);
 }
 
 void __ubsan::__ubsan_handle_vla_bound_not_positive(VLABoundData *Data,
                                                     ValueHandle Bound) {
   GET_REPORT_OPTIONS(false);
   handleVLABoundNotPositive(Data, Bound, Opts);
 }
 void __ubsan::__ubsan_handle_vla_bound_not_positive_abort(VLABoundData *Data,
if (ignoreReport(SLoc, Opts, ET))
       return;
     Loc = SLoc;
     FromType = &Data->FromType;
     ToType = &Data->ToType;
   }
 
   ScopedReport R(Opts, Loc, ET);
 
-  Diag(Loc, DL_Error,
+  Diag(Loc, DL_Error, ET,
        "%0 is outside the range of representable values of type %2")
       << Value(*FromType, From) << *FromType << *ToType;
 }
 
 void __ubsan::__ubsan_handle_float_cast_overflow(void *Data, ValueHandle From) {
   GET_REPORT_OPTIONS(false);
   handleFloatCastOverflow(Data, From, Opts);
 }
static void handleLoadInvalidValue(InvalidValueData *Data, ValueHandle Val,
   ErrorType ET =
       IsBool ? ErrorType::InvalidBoolLoad : ErrorType::InvalidEnumLoad;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
-  Diag(Loc, DL_Error,
+  Diag(Loc, DL_Error, ET,
        "load of value %0, which is not a valid value for type %1")
       << Value(Data->Type, Val) << Data->Type;
 }
 
 void __ubsan::__ubsan_handle_load_invalid_value(InvalidValueData *Data,
                                                 ValueHandle Val) {
   GET_REPORT_OPTIONS(false);
   handleLoadInvalidValue(Data, Val, Opts);
 }
 void __ubsan::__ubsan_handle_load_invalid_value_abort(InvalidValueData *Data,
                                                       ValueHandle Val) {
   GET_REPORT_OPTIONS(true);
   handleLoadInvalidValue(Data, Val, Opts);
   Die();
 }
 
 static void handleInvalidBuiltin(InvalidBuiltinData *Data, ReportOptions Opts) {
   SourceLocation Loc = Data->Loc.acquire();
   ErrorType ET = ErrorType::InvalidBuiltin;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
-  Diag(Loc, DL_Error,
+  Diag(Loc, DL_Error, ET,
        "passing zero to %0, which is not a valid argument")
     << ((Data->Kind == BCK_CTZPassedZero) ? "ctz()" : "clz()");
 }
 
 void __ubsan::__ubsan_handle_invalid_builtin(InvalidBuiltinData *Data) {
   GET_REPORT_OPTIONS(true);
   handleInvalidBuiltin(Data, Opts);
 }
static void handleFunctionTypeMismatch(FunctionTypeMismatchData *Data,
 
   ScopedReport R(Opts, CallLoc, ET);
 
   SymbolizedStackHolder FLoc(getSymbolizedLocation(Function));
   const char *FName = FLoc.get()->info.function;
   if (!FName)
     FName = "(unknown)";
 
-  Diag(CallLoc, DL_Error,
+  Diag(CallLoc, DL_Error, ET,
        "call to function %0 through pointer to incorrect function type %1")
       << FName << Data->Type;
-  Diag(FLoc, DL_Note, "%0 defined here") << FName;
+  Diag(FLoc, DL_Note, ET, "%0 defined here") << FName;
 }
 
 void
 __ubsan::__ubsan_handle_function_type_mismatch(FunctionTypeMismatchData *Data,
                                                ValueHandle Function) {
   GET_REPORT_OPTIONS(false);
   handleFunctionTypeMismatch(Data, Function, Opts);
 }
static void handleNonNullReturn(NonNullReturnData *Data, SourceLocation *LocPtr,
   SourceLocation Loc = LocPtr->acquire();
   ErrorType ET = ErrorType::InvalidNullReturn;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
-  Diag(Loc, DL_Error, "null pointer returned from function declared to never "
-                      "return null");
+  Diag(Loc, DL_Error, ET,
+       "null pointer returned from function declared to never return null");
   if (!Data->AttrLoc.isInvalid())
-    Diag(Data->AttrLoc, DL_Note, "%0 specified here")
+    Diag(Data->AttrLoc, DL_Note, ET, "%0 specified here")
         << (IsAttr ? "returns_nonnull attribute"
                    : "_Nonnull return type annotation");
 }
 
 void __ubsan::__ubsan_handle_nonnull_return_v1(NonNullReturnData *Data,
                                                SourceLocation *LocPtr) {
   GET_REPORT_OPTIONS(false);
   handleNonNullReturn(Data, LocPtr, Opts, true);
static void handleNonNullArg(NonNullArgData *Data, ReportOptions Opts,
   SourceLocation Loc = Data->Loc.acquire();
   ErrorType ET = ErrorType::InvalidNullArgument;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
-  Diag(Loc, DL_Error,
+  Diag(Loc, DL_Error, ET,
        "null pointer passed as argument %0, which is declared to "
        "never be null")
       << Data->ArgIndex;
   if (!Data->AttrLoc.isInvalid())
-    Diag(Data->AttrLoc, DL_Note, "%0 specified here")
+    Diag(Data->AttrLoc, DL_Note, ET, "%0 specified here")
         << (IsAttr ? "nonnull attribute" : "_Nonnull type annotation");
 }
 
 void __ubsan::__ubsan_handle_nonnull_arg(NonNullArgData *Data) {
   GET_REPORT_OPTIONS(false);
   handleNonNullArg(Data, Opts, true);
 }
 
static void handlePointerOverflowImpl(PointerOverflowData *Data,
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
   if ((sptr(Base) >= 0) == (sptr(Result) >= 0)) {
     if (Base > Result)
-      Diag(Loc, DL_Error, "addition of unsigned offset to %0 overflowed to %1")
+      Diag(Loc, DL_Error, ET,
+           "addition of unsigned offset to %0 overflowed to %1")
           << (void *)Base << (void *)Result;
     else
-      Diag(Loc, DL_Error,
+      Diag(Loc, DL_Error, ET,
            "subtraction of unsigned offset from %0 overflowed to %1")
           << (void *)Base << (void *)Result;
   } else {
-    Diag(Loc, DL_Error,
+    Diag(Loc, DL_Error, ET,
          "pointer index expression with base %0 overflowed to %1")
         << (void *)Base << (void *)Result;
   }
 }
 
 void __ubsan::__ubsan_handle_pointer_overflow(PointerOverflowData *Data,
                                               ValueHandle Base,
                                               ValueHandle Result) {
static void handleCFIBadIcall(CFICheckFailData *Data, ValueHandle Function,
   SourceLocation Loc = Data->Loc.acquire();
   ErrorType ET = ErrorType::CFIBadType;
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   ScopedReport R(Opts, Loc, ET);
 
-  Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
-                      "indirect function call")
+  Diag(Loc, DL_Error, ET,
+       "control flow integrity check for type %0 failed during "
       << Data->Type;
 
   SymbolizedStackHolder FLoc(getSymbolizedLocation(Function));
   const char *FName = FLoc.get()->info.function;
   if (!FName)
     FName = "(unknown)";
-  Diag(FLoc, DL_Note, "%0 defined here") << FName;
+  Diag(FLoc, DL_Note, ET, "%0 defined here") << FName;
 }
 
 namespace __ubsan {
 
 #ifdef UBSAN_CAN_USE_CXXABI
 
 #ifdef _WIN32
 

lib/ubsan/ubsan_handlers_cxx.cc

static bool HandleDynamicTypeCacheMiss(
 
   SourceLocation Loc = Data->Loc.acquire();
   ErrorType ET = ErrorType::DynamicTypeMismatch;
   if (ignoreReport(Loc, Opts, ET))
     return false;
 
   ScopedReport R(Opts, Loc, ET);
 
-  Diag(Loc, DL_Error,
+  Diag(Loc, DL_Error, ET,
        "%0 address %1 which does not point to an object of type %2")
     << TypeCheckKinds[Data->TypeCheckKind] << (void*)Pointer << Data->Type;
 
   // If possible, say what type it actually points to.
   if (!DTI.isValid()) {
     if (DTI.getOffset() < -VptrMaxOffsetToTop || DTI.getOffset() > VptrMaxOffsetToTop) {
-      Diag(Pointer, DL_Note, "object has a possibly invalid vptr: abs(offset to top) too big")
+      Diag(Pointer, DL_Note, ET,
+           "object has a possibly invalid vptr: abs(offset to top) too big")
           << TypeName(DTI.getMostDerivedTypeName())
           << Range(Pointer, Pointer + sizeof(uptr), "possibly invalid vptr");
     } else {
-      Diag(Pointer, DL_Note, "object has invalid vptr")
+      Diag(Pointer, DL_Note, ET, "object has invalid vptr")
           << TypeName(DTI.getMostDerivedTypeName())
           << Range(Pointer, Pointer + sizeof(uptr), "invalid vptr");
     }
   } else if (!DTI.getOffset())
-    Diag(Pointer, DL_Note, "object is of type %0")
+    Diag(Pointer, DL_Note, ET, "object is of type %0")
         << TypeName(DTI.getMostDerivedTypeName())
         << Range(Pointer, Pointer + sizeof(uptr), "vptr for %0");
   else
     // FIXME: Find the type at the specified offset, and include that
     //        in the note.
-    Diag(Pointer - DTI.getOffset(), DL_Note,
+    Diag(Pointer - DTI.getOffset(), DL_Note, ET,
          "object is base class subobject at offset %0 within object of type %1")
         << DTI.getOffset() << TypeName(DTI.getMostDerivedTypeName())
         << TypeName(DTI.getSubobjectTypeName())
         << Range(Pointer, Pointer + sizeof(uptr),
                  "vptr for %2 base class of %1");
   return true;
 }
 
case CFITCK_DerivedCast:
     break;
   case CFITCK_UnrelatedCast:
     CheckKindStr = "cast to unrelated type";
     break;
   case CFITCK_ICall:
     Die();
   }
 
-  Diag(Loc, DL_Error, "control flow integrity check for type %0 failed during "
-                      "%1 (vtable address %2)")
+  Diag(Loc, DL_Error, ET,
+       "control flow integrity check for type %0 failed during "
       << Data->Type << CheckKindStr << (void *)Vtable;
 
   // If possible, say what type it actually points to.
   if (!DTI.isValid()) {
     const char *module = Symbolizer::GetOrInit()->GetModuleNameForPc(Vtable);
     if (module)
-      Diag(Vtable, DL_Note, "invalid vtable in module %0") << module;
+      Diag(Vtable, DL_Note, ET, "invalid vtable in module %0") << module;
     else
-      Diag(Vtable, DL_Note, "invalid vtable");
+      Diag(Vtable, DL_Note, ET, "invalid vtable");
   } else {
-    Diag(Vtable, DL_Note, "vtable is of type %0")
+    Diag(Vtable, DL_Note, ET, "vtable is of type %0")
         << TypeName(DTI.getMostDerivedTypeName());
   }
 }
 }  // namespace __ubsan
 
 #endif // CAN_SANITIZE_UB

lib/ubsan/ubsan_interface.inc

 INTERFACE_FUNCTION(__ubsan_handle_shift_out_of_bounds_abort)
 INTERFACE_FUNCTION(__ubsan_handle_sub_overflow)
 INTERFACE_FUNCTION(__ubsan_handle_sub_overflow_abort)
 INTERFACE_FUNCTION(__ubsan_handle_type_mismatch_v1)
 INTERFACE_FUNCTION(__ubsan_handle_type_mismatch_v1_abort)
 INTERFACE_FUNCTION(__ubsan_handle_vla_bound_not_positive)
 INTERFACE_FUNCTION(__ubsan_handle_vla_bound_not_positive_abort)
 INTERFACE_WEAK_FUNCTION(__ubsan_default_options)
+INTERFACE_WEAK_FUNCTION(__ubsan_on_report)
+INTERFACE_FUNCTION(__ubsan_get_current_report_data)

lib/ubsan/ubsan_monitor.h

+//===-- ubsan_monitor.h -----------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Hooks which allow a monitor process to inspect UBSan's diagnostics.
+//
+//===----------------------------------------------------------------------===//
+
+#ifndef UBSAN_MONITOR_H
+#define UBSAN_MONITOR_H
+
+#include "ubsan_diag.h"
+#include "ubsan_value.h"
+
+namespace __ubsan {
+
+struct UndefinedBehaviorReport {
+  const char *IssueKind;
+  Location &Loc;
+  InternalScopedString Buffer;
+
+  UndefinedBehaviorReport(const char *IssueKind, Location &Loc,
+                          InternalScopedString &Msg);
+};
+
+SANITIZER_INTERFACE_ATTRIBUTE void
+RegisterUndefinedBehaviorReport(UndefinedBehaviorReport *UBR);
+
+/// Called after a report is prepared. This serves to alert monitor processes
+/// that a UB report is available.
+extern "C" SANITIZER_INTERFACE_ATTRIBUTE void __ubsan_on_report(void);
+
+/// Used by the monitor process to extract information from a UB report. The
+/// data is only available until the next time __ubsan_on_report is called. The
+/// caller is responsible for copying and preserving the data if needed.
+extern "C" SANITIZER_INTERFACE_ATTRIBUTE void
+__ubsan_get_current_report_data(const char **OutIssueKind,
+                                const char **OutMessage,
+                                const char **OutFilename, unsigned *OutLine,
+                                unsigned *OutCol, char **OutMemoryAddr);
+
+} // end namespace __ubsan
+
+#endif // UBSAN_MONITOR_H

lib/ubsan/ubsan_monitor.cc

+//===-- ubsan_monitor.cc ----------------------------------------*- C++ -*-===//
+//
+//                     The LLVM Compiler Infrastructure
+//
+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+//
+//===----------------------------------------------------------------------===//
+//
+// Hooks which allow a monitor process to inspect UBSan's diagnostics.
+//
+//===----------------------------------------------------------------------===//
+
+#include "ubsan_monitor.h"
+
+using namespace __ubsan;
+
+UndefinedBehaviorReport::UndefinedBehaviorReport(const char *IssueKind,
+                                                 Location &Loc,
+                                                 InternalScopedString &Msg)
+    : IssueKind(IssueKind), Loc(Loc), Buffer(Msg.length() + 1) {
+  // We have the common sanitizer reporting lock, so it's safe to register a
+  // new UB report.
+  RegisterUndefinedBehaviorReport(this);
+
+  // Make a copy of the diagnostic.
+  Buffer.append("%s", Msg.data());
+
+  // Let the monitor know that a report is available.
+  __ubsan_on_report();
+}
+
+static UndefinedBehaviorReport *CurrentUBR;
+
+void __ubsan::RegisterUndefinedBehaviorReport(UndefinedBehaviorReport *UBR) {
+  CurrentUBR = UBR;
+}
+
+SANITIZER_WEAK_DEFAULT_IMPL
+void __ubsan::__ubsan_on_report(void) {}
+
+void __ubsan::__ubsan_get_current_report_data(const char **OutIssueKind,
+                                              const char **OutMessage,
+                                              const char **OutFilename,
+                                              unsigned *OutLine,
+                                              unsigned *OutCol,
+                                              char **OutMemoryAddr) {
+  if (!OutIssueKind || !OutMessage || !OutFilename || !OutLine || !OutCol ||
+      !OutMemoryAddr)
+    UNREACHABLE("Invalid arguments passed to __ubsan_get_current_report_data");
+
+  InternalScopedString &Buf = CurrentUBR->Buffer;
+
+  // Ensure that the first character of the diagnostic text can't start with a
+  // lowercase letter.
+  char FirstChar = Buf.data()[0];
+  if (FirstChar >= 'a' && FirstChar <= 'z')
+    Buf.data()[0] = FirstChar - 'a' + 'A';
+
+  *OutIssueKind = CurrentUBR->IssueKind;
+  *OutMessage = Buf.data();
+  if (!CurrentUBR->Loc.isSourceLocation()) {
+    *OutFilename = "<unknown>";
+    *OutLine = *OutCol = 0;
+  } else {
+    SourceLocation SL = CurrentUBR->Loc.getSourceLocation();
+    *OutFilename = SL.getFilename();
+    *OutLine = SL.getLine();
+    *OutCol = SL.getColumn();
+  }
+
+  if (CurrentUBR->Loc.isMemoryLocation())
+    *OutMemoryAddr = (char *)CurrentUBR->Loc.getMemoryLocation();
+  else
+    *OutMemoryAddr = nullptr;
+}

test/ubsan/TestCases/Misc/monitor.cpp

+// RUN: %clangxx -w -fsanitize=bool %s -o %t
+// RUN: %run %t 2>&1 | FileCheck %s
+
+#include <iostream>
+
+extern "C" {
+void __ubsan_get_current_report_data(const char **OutIssueKind,
+                                     const char **OutMessage,
+                                     const char **OutFilename,
+                                     unsigned *OutLine, unsigned *OutCol,
+                                     char **OutMemoryAddr);
+
+// Override the weak definition of __ubsan_on_report from the runtime, just
+// for testing purposes.
+void __ubsan_on_report(void) {
+  const char *IssueKind, *Message, *Filename;
+  unsigned Line, Col;
+  char *Addr;
+  __ubsan_get_current_report_data(&IssueKind, &Message, &Filename, &Line, &Col,
+                                  &Addr);
+
+  std::cout << "Issue: " << IssueKind << "\n"
+            << "Location: " << Filename << ":" << Line << ":" << Col << "\n"
+            << "Message: " << Message << std::endl;
+
+  (void)Addr;
+}
+}
+
+int main() {
+  char C = 3;
+  bool B = *(bool *)&C;
+  // CHECK: Issue: invalid-bool-load
+  // CHECK-NEXT: Location: {{.*}}monitor.cpp:[[@LINE-2]]:12
+  // CHECK-NEXT: Message: Load of value 3, which is not a valid value for type 'bool'
+  return 0;
+}