[compiler-rt][ubsan] Implicit Conversion Sanitizer - integer sign change - compiler-rt part

[lebedev.ri]

Summary

This is a compiler-rt part.
The clang part is D50250.

See PR21530, https://github.com/google/sanitizers/issues/940.

[lebedev.ri]

Rebased ontop of revised D50250.

[lebedev.ri]

Rebased ontop of revised D50250.

[lebedev.ri]

Rebased, ping.

[lebedev.ri]

Depends on D50902.
(which should land first, ideally.)

[lebedev.ri]

Rebased ontop of D50902.

[lebedev.ri]

ping.

[lebedev.ri]

Ping.

[lebedev.ri]

Ping once again :)

[lebedev.ri]

Ping.

[lebedev.ri]

Ping.

[lebedev.ri]

Ping.
The prerequisite "split truncation sanitizer into unsigned and signed cases" has landed.
Would be awesome to get this going :)

[lebedev.ri]

And another ping.

[lebedev.ri]

Rebased.
The clang part D50250 finally got reviewed, so i'm wondering if someone could review this, please? :)

[mclow.lists]

The non-test bits look really straightforward to me.

[filcab]

I have minor questions in inline comments, but sorry, I'll request a big change :-/

Please match the types of casts and parameters. You're often matching uint32_t to unsigned int (also a signed char with int8_t (not as problematic here, though), etc). We don't have a guarantee, and the "assuming int is 32-bit" part might cause problems eventually. I'm ok with either version:

• Always use sized types like uint32_t
• Always use "platform types" like unsigned int (or whatever the standard names them)

Otherwise, this looks good.

Thank you,
Filipe

P.S: Yay, I managed not to ask about the ubsan-standalone feature! (sorry about that in the earlier reviews :-) )

lib/ubsan/ubsan_handlers.cc

467

This means *both* errors got triggered, right? Or can we have this one with just one being triggered?
If it's always both, I'd rather have an And instead of Or in its name.

test/fuzzer/ImplicitSignedIntegerTruncationOrSignChangeTest.cpp

13 ↗

(On Diff #170953)

Please cast it to the same type. An unsigned int is not necessarily the same as a uint32_t.

[lebedev.ri]

In D50251#1280267, @filcab wrote:

I have minor questions in inline comments, but sorry, I'll request a big change :-/

Please match the types of casts and parameters. You're often matching uint32_t to unsigned int (also a signed char with int8_t (not as problematic here, though), etc). We don't have a guarantee, and the "assuming int is 32-bit" part might cause problems eventually. I'm ok with either version:

• Always use sized types like uint32_t
• Always use "platform types" like unsigned int (or whatever the standard names them)

Otherwise, this looks good.

Yay, thank you for the feedback!

Thank you,
Filipe

P.S: Yay, I managed not to ask about the ubsan-standalone feature! (sorry about that in the earlier reviews :-) )

:)

lib/ubsan/ubsan_handlers.cc

467

We emit ICCK_SignedIntegerTruncationOrSignChange in the case of truncation (src len > dst len) from unsigned to signed.
We could do this as a two *separate* checks:

• truncation (and emit ICCK_SignedIntegerTruncation) All the truncated bits should be the same as the sign bit of the dst.
• sign change (ICCK_IntegerSignChange) The src is unsigned (i.e. implicitly non-negative), therefore the dst should be non-negative too. I.e., the dst sign bit should be unset.

But then we do two checks for per one implicit cast, which results in code bloat, etc.
But if we combine these two checks, we end up with:
All the truncated bits should be the same as the sign bit of the dst AND the dst sign bit should be unset.
Which is optimized down to src <= std::numeric_limits<decltype(dst)>::max().

You can have a cast which is sign-changing, but does not result in a truncation:
unsigned(0b1111) -> char(0b11) - it's not a truncation, all the bits are the same, but it is a sign change.

So no, this really is an or.

[filcab]

lib/ubsan/ubsan_handlers.cc

467

Sounds good. My only request is the types being consistent then. Otherwise LGTM!

[lebedev.ri]

Rebased, changed types in ImplicitSignedIntegerTruncationOrSignChangeTest fuzzer test.
I will do the rest of type streamlining in a separate review.

[filcab]

LGTMing.

[lebedev.ri]

In D50251#1280851, @filcab wrote:

LGTMing.

Thank you for the review!

lib/ubsan/ubsan_checks.inc

 UBSAN_CHECK(UnsignedIntegerOverflow, "unsigned-integer-overflow",
             "unsigned-integer-overflow")
 UBSAN_CHECK(IntegerDivideByZero, "integer-divide-by-zero",
             "integer-divide-by-zero")
 UBSAN_CHECK(FloatDivideByZero, "float-divide-by-zero", "float-divide-by-zero")
 UBSAN_CHECK(InvalidBuiltin, "invalid-builtin-use", "invalid-builtin-use")
 UBSAN_CHECK(ImplicitIntegerTruncation, "implicit-integer-truncation",
             "implicit-integer-truncation")
+UBSAN_CHECK(ImplicitIntegerSignChange, "implicit-integer-sign-change",
+            "implicit-integer-sign-change")
 UBSAN_CHECK(InvalidShiftBase, "invalid-shift-base", "shift-base")
 UBSAN_CHECK(InvalidShiftExponent, "invalid-shift-exponent", "shift-exponent")
 UBSAN_CHECK(OutOfBoundsIndex, "out-of-bounds-index", "bounds")
 UBSAN_CHECK(UnreachableCall, "unreachable-call", "unreachable")
 UBSAN_CHECK(MissingReturn, "missing-return", "return")
 UBSAN_CHECK(NonPositiveVLAIndex, "non-positive-vla-index", "vla-bound")
 UBSAN_CHECK(FloatCastOverflow, "float-cast-overflow", "float-cast-overflow")
 UBSAN_CHECK(InvalidBoolLoad, "invalid-bool-load", "bool")
 UBSAN_CHECK(InvalidEnumLoad, "invalid-enum-load", "enum")
 UBSAN_CHECK(FunctionTypeMismatch, "function-type-mismatch", "function")
 UBSAN_CHECK(InvalidNullReturn, "invalid-null-return",
             "returns-nonnull-attribute")
 UBSAN_CHECK(InvalidNullArgument, "invalid-null-argument", "nonnull-attribute")
 UBSAN_CHECK(DynamicTypeMismatch, "dynamic-type-mismatch", "vptr")
 UBSAN_CHECK(CFIBadType, "cfi-bad-type", "cfi")

lib/ubsan/ubsan_handlers.h

 
 /// \brief Handle a load of an invalid value for the type.
 RECOVERABLE(load_invalid_value, InvalidValueData *Data, ValueHandle Val)
 
 /// Known implicit conversion check kinds.
 /// Keep in sync with the enum of the same name in CGExprScalar.cpp
 enum ImplicitConversionCheckKind : unsigned char {
   ICCK_IntegerTruncation = 0,
+  ICCK_IntegerSignChange = 1,
 };
 
 struct ImplicitConversionData {
   SourceLocation Loc;
   const TypeDescriptor &FromType;
   const TypeDescriptor &ToType;
   /* ImplicitConversionCheckKind */ unsigned char Kind;
 };

lib/ubsan/ubsan_handlers.cc

static void handleImplicitConversion(ImplicitConversionData *Data,
                                      ValueHandle Dst) {
   SourceLocation Loc = Data->Loc.acquire();
   ErrorType ET = ErrorType::GenericUB;
 
   switch (Data->Kind) {
   case ICCK_IntegerTruncation:
     ET = ErrorType::ImplicitIntegerTruncation;
     break;
+  case ICCK_IntegerSignChange:
+    ET = ErrorType::ImplicitIntegerSignChange;
+    break;
   }
 
   if (ignoreReport(Loc, Opts, ET))
     return;
 
   const TypeDescriptor &SrcTy = Data->FromType;
   const TypeDescriptor &DstTy = Data->ToType;
 
   ScopedReport R(Opts, Loc, ET);

test/fuzzer/ImplicitIntegerSignChangeTest.cpp

+// This file is distributed under the University of Illinois Open Source
+// License. See LICENSE.TXT for details.
+
+// Test for implicit-integer-sign-change.
+#include <assert.h>
+#include <climits>
+#include <cstddef>
+#include <cstdint>
+#include <cstdlib>
+#include <iostream>
+
+static volatile unsigned int Sink;
+static volatile   signed int Storage = -1;
+
+extern "C" int LLVMFuzzerTestOneInput(const uint8_t *Data, size_t Size) {
+  assert(Data);
+  if (Size > 0 && Data[0] == 'H') {
+    Sink = 1;
+    if (Size > 1 && Data[1] == 'i') {
+    Sink = 2;
+      if (Size > 2 && Data[2] == '!') {
+        Sink = Storage;  // 'sign change'.
+      }
+    }
+  }
+  return 0;
+}

test/fuzzer/fuzzer-implicit-integer-sign-change.test

+RUN: rm -f %t-ImplicitIntegerSignChangeTest-Ubsan
+RUN: %cpp_compiler -fsanitize=implicit-integer-sign-change -fno-sanitize-recover=all %S/ImplicitIntegerSignChangeTest.cpp -o %t-ImplicitIntegerSignChangeTest-Ubsan
+RUN: not %run %t-ImplicitIntegerSignChangeTest-Ubsan 2>&1 | FileCheck %s
+CHECK: ImplicitIntegerSignChangeTest.cpp:22:16: runtime error: implicit conversion from type 'int' of value -1 (32-bit, signed) to type 'unsigned int' changed the value to 4294967295 (32-bit, unsigned)
+CHECK: Test unit written to ./crash-

test/fuzzer/fuzzer-implicit-integer-truncation.test

 RUN: rm -f %t-ImplicitIntegerTruncationTest-Ubsan
 RUN: %cpp_compiler -fsanitize=implicit-integer-truncation -fno-sanitize-recover=all %S/ImplicitIntegerTruncationTest.cpp -o %t-ImplicitIntegerTruncationTest-Ubsan
 RUN: not %run %t-ImplicitIntegerTruncationTest-Ubsan 2>&1 | FileCheck %s
-CHECK: runtime error: implicit conversion from type 'int' of value 256 (32-bit, signed) to type 'unsigned char' changed the value to 0 (8-bit, unsigned)
+CHECK: ImplicitIntegerTruncationTest.cpp:22:17: runtime error: implicit conversion from type 'int' of value 256 (32-bit, signed) to type 'unsigned char' changed the value to 0 (8-bit, unsigned)
 CHECK: Test unit written to ./crash-

test/ubsan/TestCases/ImplicitConversion/integer-sign-change-blacklist.c

+// FIXME: https://code.google.com/p/address-sanitizer/issues/detail?id=316
+// I'm not sure this is actually *that* issue, but this seems oddly similar to the other XFAIL'ed cases.
+// XFAIL: android
+// UNSUPPORTED: ios
+
+// RUN: %clang -fsanitize=implicit-integer-sign-change -fno-sanitize-recover=implicit-integer-sign-change                           -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion"
+// RUN: %clang -fsanitize=implicit-integer-sign-change -fno-sanitize-recover=implicit-integer-sign-change                           -O1 %s -o %t && not %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion"
+// RUN: %clang -fsanitize=implicit-integer-sign-change -fno-sanitize-recover=implicit-integer-sign-change                           -O2 %s -o %t && not %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion"
+// RUN: %clang -fsanitize=implicit-integer-sign-change -fno-sanitize-recover=implicit-integer-sign-change                           -O3 %s -o %t && not %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion"
+
+// RUN: rm -f %tmp
+// RUN: echo "[implicit-integer-sign-change]" >> %tmp
+// RUN: echo "fun:implicitSignChange" >> %tmp
+// RUN: %clang -fsanitize=implicit-integer-sign-change -fno-sanitize-recover=implicit-integer-sign-change -fsanitize-blacklist=%tmp -O0 %s -o %t && not %run %t 2>&1 | not FileCheck %s
+// RUN: %clang -fsanitize=implicit-integer-sign-change -fno-sanitize-recover=implicit-integer-sign-change -fsanitize-blacklist=%tmp -O1 %s -o %t && not %run %t 2>&1 | not FileCheck %s
+// RUN: %clang -fsanitize=implicit-integer-sign-change -fno-sanitize-recover=implicit-integer-sign-change -fsanitize-blacklist=%tmp -O2 %s -o %t && not %run %t 2>&1 | not FileCheck %s
+// RUN: %clang -fsanitize=implicit-integer-sign-change -fno-sanitize-recover=implicit-integer-sign-change -fsanitize-blacklist=%tmp -O3 %s -o %t && not %run %t 2>&1 | not FileCheck %s
+
+signed int implicitSignChange(unsigned int argc) {
+  return argc; // BOOM
+// CHECK: {{.*}}integer-sign-change-blacklist.c:[[@LINE-1]]:10: runtime error: implicit conversion from type 'unsigned int' of value 4294967295 (32-bit, unsigned) to type 'int' changed the value to -1 (32-bit, signed)
+}
+
+int main(int argc, char **argv) {
+  return implicitSignChange(~0U);
+}

test/ubsan/TestCases/ImplicitConversion/integer-sign-change-summary.cpp

+// RUN: %clangxx -fsanitize=implicit-integer-sign-change %s -o %t
+// RUN: %run %t 2>&1 | FileCheck %s --check-prefix=CHECK-NOTYPE
+// RUN: %env_ubsan_opts=report_error_type=1 %run %t 2>&1 | FileCheck %s --check-prefix=CHECK-TYPE
+// REQUIRES: !ubsan-standalone && !ubsan-standalone-static
+
+#include <stdint.h>
+
+int main() {
+  int32_t t0 = (~(uint32_t(0)));
+  // CHECK-NOTYPE: SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior {{.*}}summary.cpp:[[@LINE-1]]:16
+  // CHECK-TYPE: SUMMARY: UndefinedBehaviorSanitizer: implicit-integer-sign-change {{.*}}summary.cpp:[[@LINE-2]]:16
+  return 0;
+}

test/ubsan/TestCases/ImplicitConversion/integer-sign-change.c

+// RUN: %clang   -x c   -fsanitize=implicit-integer-sign-change %s -DV0 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V0
+// RUN: %clang   -x c   -fsanitize=implicit-integer-sign-change %s -DV1 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V1
+// RUN: %clang   -x c   -fsanitize=implicit-integer-sign-change %s -DV2 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V2
+// RUN: %clang   -x c   -fsanitize=implicit-integer-sign-change %s -DV3 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V3
+// RUN: %clang   -x c   -fsanitize=implicit-integer-sign-change %s -DV4 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V4
+// RUN: %clang   -x c   -fsanitize=implicit-integer-sign-change %s -DV5 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V5
+
+// RUN: %clang   -x c++ -fsanitize=implicit-integer-sign-change %s -DV0 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V0
+// RUN: %clang   -x c++ -fsanitize=implicit-integer-sign-change %s -DV1 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V1
+// RUN: %clang   -x c++ -fsanitize=implicit-integer-sign-change %s -DV2 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V2
+// RUN: %clang   -x c++ -fsanitize=implicit-integer-sign-change %s -DV3 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V3
+// RUN: %clang   -x c++ -fsanitize=implicit-integer-sign-change %s -DV4 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V4
+// RUN: %clang   -x c++ -fsanitize=implicit-integer-sign-change %s -DV5 -o %t && %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion" --check-prefixes=CHECK-V5
+
+#include <stdint.h>
+
+// Test plan:
+//  * Two types - int and char
+//  * Two signs - signed and unsigned
+//  * Square that - we have input and output types.
+// Thus, there are total of (2*2)^2 == 16 tests.
+// These are all the possible variations/combinations of casts.
+// However, not all of them should result in the check.
+// So here, we *only* check which should and which should not result in checks.
+
+//============================================================================//
+// Half of the cases do not need the check.                                   //
+//============================================================================//
+
+uint32_t negative0_convert_unsigned_int_to_unsigned_int(uint32_t x) {
+  return x;
+}
+
+uint8_t negative1_convert_unsigned_char_to_unsigned_char(uint8_t x) {
+  return x;
+}
+
+int32_t negative2_convert_signed_int_to_signed_int(int32_t x) {
+  return x;
+}
+
+int8_t negative3_convert_signed_char_to_signed_char(int8_t x) {
+  return x;
+}
+
+uint8_t negative4_convert_unsigned_int_to_unsigned_char(uint32_t x) {
+  return x;
+}
+
+uint32_t negative5_convert_unsigned_char_to_unsigned_int(uint8_t x) {
+  return x;
+}
+
+int32_t negative6_convert_unsigned_char_to_signed_int(uint8_t x) {
+  return x;
+}
+
+int32_t negative7_convert_signed_char_to_signed_int(int8_t x) {
+  return x;
+}
+
+void test_negatives() {
+  // No bits set.
+  negative0_convert_unsigned_int_to_unsigned_int(0);
+  negative1_convert_unsigned_char_to_unsigned_char(0);
+  negative2_convert_signed_int_to_signed_int(0);
+  negative3_convert_signed_char_to_signed_char(0);
+  negative4_convert_unsigned_int_to_unsigned_char(0);
+  negative5_convert_unsigned_char_to_unsigned_int(0);
+  negative6_convert_unsigned_char_to_signed_int(0);
+  negative7_convert_signed_char_to_signed_int(0);
+
+  // One lowest bit set.
+  negative0_convert_unsigned_int_to_unsigned_int(1);
+  negative1_convert_unsigned_char_to_unsigned_char(1);
+  negative2_convert_signed_int_to_signed_int(1);
+  negative3_convert_signed_char_to_signed_char(1);
+  negative4_convert_unsigned_int_to_unsigned_char(1);
+  negative5_convert_unsigned_char_to_unsigned_int(1);
+  negative6_convert_unsigned_char_to_signed_int(1);
+  negative7_convert_signed_char_to_signed_int(1);
+
+  // All source bits set.
+  negative0_convert_unsigned_int_to_unsigned_int((uint32_t)UINT32_MAX);
+  negative1_convert_unsigned_char_to_unsigned_char((uint8_t)UINT8_MAX);
+  negative2_convert_signed_int_to_signed_int((int32_t)INT32_MAX);
+  negative3_convert_signed_char_to_signed_char((int8_t)INT8_MAX);
+  negative4_convert_unsigned_int_to_unsigned_char((uint32_t)UINT32_MAX);
+  negative5_convert_unsigned_char_to_unsigned_int((uint8_t)UINT8_MAX);
+  negative6_convert_unsigned_char_to_signed_int((uint8_t)UINT8_MAX);
+  negative7_convert_signed_char_to_signed_int((int8_t)INT8_MAX);
+
+  // Source 'sign' bit set.
+  negative0_convert_unsigned_int_to_unsigned_int((uint32_t)INT32_MIN);
+  negative1_convert_unsigned_char_to_unsigned_char((uint8_t)INT8_MIN);
+  negative2_convert_signed_int_to_signed_int((int32_t)INT32_MIN);
+  negative3_convert_signed_char_to_signed_char((int8_t)INT8_MIN);
+  negative4_convert_unsigned_int_to_unsigned_char((uint32_t)INT32_MIN);
+  negative5_convert_unsigned_char_to_unsigned_int((uint8_t)INT8_MIN);
+  negative6_convert_unsigned_char_to_signed_int((uint8_t)INT8_MIN);
+  negative7_convert_signed_char_to_signed_int((int8_t)INT8_MIN);
+}
+
+//============================================================================//
+// The remaining 8 cases *do* need the check.   //
+//============================================================================//
+
+int32_t positive0_convert_unsigned_int_to_signed_int(uint32_t x) {
+#line 100
+  return x;
+}
+
+uint32_t positive1_convert_signed_int_to_unsigned_int(int32_t x) {
+#line 200
+  return x;
+}
+
+uint8_t positive2_convert_signed_int_to_unsigned_char(int32_t x) {
+#line 300
+  return x;
+}
+
+uint8_t positive3_convert_signed_char_to_unsigned_char(int8_t x) {
+#line 400
+  return x;
+}
+
+int8_t positive4_convert_unsigned_char_to_signed_char(uint8_t x) {
+#line 500
+  return x;
+}
+
+uint32_t positive5_convert_signed_char_to_unsigned_int(int8_t x) {
+#line 600
+  return x;
+}
+
+int8_t positive6_convert_unsigned_int_to_signed_char(uint32_t x) {
+#line 700
+  return x;
+}
+
+int8_t positive7_convert_signed_int_to_signed_char(int32_t x) {
+#line 800
+  return x;
+}
+
+#line 1120 // !!!
+
+void test_positives() {
+  // No bits set.
+  positive0_convert_unsigned_int_to_signed_int(0);
+  positive1_convert_signed_int_to_unsigned_int(0);
+  positive2_convert_signed_int_to_unsigned_char(0);
+  positive3_convert_signed_char_to_unsigned_char(0);
+  positive4_convert_unsigned_char_to_signed_char(0);
+  positive5_convert_signed_char_to_unsigned_int(0);
+  positive6_convert_unsigned_int_to_signed_char(0);
+  positive7_convert_signed_int_to_signed_char(0);
+
+  // One lowest bit set.
+  positive0_convert_unsigned_int_to_signed_int(1);
+  positive1_convert_signed_int_to_unsigned_int(1);
+  positive2_convert_signed_int_to_unsigned_char(1);
+  positive3_convert_signed_char_to_unsigned_char(1);
+  positive4_convert_unsigned_char_to_signed_char(1);
+  positive5_convert_signed_char_to_unsigned_int(1);
+  positive6_convert_unsigned_int_to_signed_char(1);
+  positive7_convert_signed_int_to_signed_char(1);
+
+#if defined(V0)
+  // All source bits set.
+  positive0_convert_unsigned_int_to_signed_int((uint32_t)UINT32_MAX);
+// CHECK-V0: {{.*}}integer-sign-change.c:100:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'int32_t' (aka 'int') changed the value to -1 (32-bit, signed)
+  positive1_convert_signed_int_to_unsigned_int((int32_t)UINT32_MAX);
+// CHECK-V0: {{.*}}integer-sign-change.c:200:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -1 (32-bit, signed) to type 'uint32_t' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned)
+  positive2_convert_signed_int_to_unsigned_char((int32_t)UINT32_MAX);
+// CHECK-V0: {{.*}}integer-sign-change.c:300:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -1 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
+  positive3_convert_signed_char_to_unsigned_char((int8_t)UINT8_MAX);
+// CHECK-V0: {{.*}}integer-sign-change.c:400:10: runtime error: implicit conversion from type 'int8_t' (aka 'signed char') of value -1 (8-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
+  positive4_convert_unsigned_char_to_signed_char((uint8_t)UINT8_MAX);
+// CHECK-V0: {{.*}}integer-sign-change.c:500:10: runtime error: implicit conversion from type 'uint8_t' (aka 'unsigned char') of value 255 (8-bit, unsigned) to type 'int8_t' (aka 'signed char') changed the value to -1 (8-bit, signed)
+  positive5_convert_signed_char_to_unsigned_int((int8_t)UINT8_MAX);
+// CHECK-V0: {{.*}}integer-sign-change.c:600:10: runtime error: implicit conversion from type 'int8_t' (aka 'signed char') of value -1 (8-bit, signed) to type 'uint32_t' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned)
+  positive6_convert_unsigned_int_to_signed_char((uint32_t)UINT32_MAX);
+// CHECK-V0: {{.*}}integer-sign-change.c:700:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'int8_t' (aka 'signed char') changed the value to -1 (8-bit, signed)
+  positive7_convert_signed_int_to_signed_char((int32_t)UINT32_MAX);
+#elif defined(V1)
+  // Source 'Sign' bit set.
+  positive0_convert_unsigned_int_to_signed_int((uint32_t)INT32_MIN);
+// CHECK-V1: {{.*}}integer-sign-change.c:100:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 2147483648 (32-bit, unsigned) to type 'int32_t' (aka 'int') changed the value to -2147483648 (32-bit, signed)
+  positive1_convert_signed_int_to_unsigned_int((int32_t)INT32_MIN);
+// CHECK-V1: {{.*}}integer-sign-change.c:200:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -2147483648 (32-bit, signed) to type 'uint32_t' (aka 'unsigned int') changed the value to 2147483648 (32-bit, unsigned)
+  positive2_convert_signed_int_to_unsigned_char((int32_t)INT32_MIN);
+// CHECK-V1: {{.*}}integer-sign-change.c:300:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -2147483648 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 0 (8-bit, unsigned)
+  positive3_convert_signed_char_to_unsigned_char((int8_t)INT8_MIN);
+// CHECK-V1: {{.*}}integer-sign-change.c:400:10: runtime error: implicit conversion from type 'int8_t' (aka 'signed char') of value -128 (8-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 128 (8-bit, unsigned)
+  positive4_convert_unsigned_char_to_signed_char((uint8_t)INT8_MIN);
+// CHECK-V1: {{.*}}integer-sign-change.c:500:10: runtime error: implicit conversion from type 'uint8_t' (aka 'unsigned char') of value 128 (8-bit, unsigned) to type 'int8_t' (aka 'signed char') changed the value to -128 (8-bit, signed)
+  positive5_convert_signed_char_to_unsigned_int((int8_t)INT8_MIN);
+// CHECK-V1: {{.*}}integer-sign-change.c:600:10: runtime error: implicit conversion from type 'int8_t' (aka 'signed char') of value -128 (8-bit, signed) to type 'uint32_t' (aka 'unsigned int') changed the value to 4294967168 (32-bit, unsigned)
+  positive6_convert_unsigned_int_to_signed_char((uint32_t)INT32_MIN);
+  positive7_convert_signed_int_to_signed_char((int32_t)INT32_MIN);
+// CHECK-V1: {{.*}}integer-sign-change.c:800:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -2147483648 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to 0 (8-bit, signed)
+#elif defined(V2)
+  // All bits except the source 'Sign' bit are set.
+  positive0_convert_unsigned_int_to_signed_int((uint32_t)INT32_MAX);
+  positive1_convert_signed_int_to_unsigned_int((int32_t)INT32_MAX);
+  positive2_convert_signed_int_to_unsigned_char((int32_t)INT32_MAX);
+  positive3_convert_signed_char_to_unsigned_char((int8_t)INT8_MAX);
+  positive4_convert_unsigned_char_to_signed_char((uint8_t)INT8_MAX);
+  positive5_convert_signed_char_to_unsigned_int((int8_t)INT8_MAX);
+  positive6_convert_unsigned_int_to_signed_char((uint32_t)INT32_MAX);
+// CHECK-V2: {{.*}}integer-sign-change.c:700:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 2147483647 (32-bit, unsigned) to type 'int8_t' (aka 'signed char') changed the value to -1 (8-bit, signed)
+  positive7_convert_signed_int_to_signed_char((int32_t)INT32_MAX);
+// CHECK-V2: {{.*}}integer-sign-change.c:800:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value 2147483647 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to -1 (8-bit, signed)
+#elif defined(V3)
+  // All destination bits set.
+  positive0_convert_unsigned_int_to_signed_int((uint32_t)UINT32_MAX);
+// CHECK-V3: {{.*}}integer-sign-change.c:100:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 4294967295 (32-bit, unsigned) to type 'int32_t' (aka 'int') changed the value to -1 (32-bit, signed)
+  positive1_convert_signed_int_to_unsigned_int((int32_t)UINT32_MAX);
+// CHECK-V3: {{.*}}integer-sign-change.c:200:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -1 (32-bit, signed) to type 'uint32_t' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned)
+  positive2_convert_signed_int_to_unsigned_char((int32_t)UINT8_MAX);
+  positive3_convert_signed_char_to_unsigned_char((int8_t)UINT8_MAX);
+// CHECK-V3: {{.*}}integer-sign-change.c:400:10: runtime error: implicit conversion from type 'int8_t' (aka 'signed char') of value -1 (8-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 255 (8-bit, unsigned)
+  positive4_convert_unsigned_char_to_signed_char((uint8_t)UINT8_MAX);
+// CHECK-V3: {{.*}}integer-sign-change.c:500:10: runtime error: implicit conversion from type 'uint8_t' (aka 'unsigned char') of value 255 (8-bit, unsigned) to type 'int8_t' (aka 'signed char') changed the value to -1 (8-bit, signed)
+  positive5_convert_signed_char_to_unsigned_int((int8_t)UINT32_MAX);
+// CHECK-V3: {{.*}}integer-sign-change.c:600:10: runtime error: implicit conversion from type 'int8_t' (aka 'signed char') of value -1 (8-bit, signed) to type 'uint32_t' (aka 'unsigned int') changed the value to 4294967295 (32-bit, unsigned)
+  positive6_convert_unsigned_int_to_signed_char((uint32_t)UINT8_MAX);
+// CHECK-V3: {{.*}}integer-sign-change.c:700:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 255 (32-bit, unsigned) to type 'int8_t' (aka 'signed char') changed the value to -1 (8-bit, signed)
+  positive7_convert_signed_int_to_signed_char((int32_t)UINT8_MAX);
+// CHECK-V3: {{.*}}integer-sign-change.c:800:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value 255 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to -1 (8-bit, signed)
+#elif defined(V4)
+  // Destination 'sign' bit set.
+  positive0_convert_unsigned_int_to_signed_int((uint32_t)INT32_MIN);
+// CHECK-V4: {{.*}}integer-sign-change.c:100:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 2147483648 (32-bit, unsigned) to type 'int32_t' (aka 'int') changed the value to -2147483648 (32-bit, signed)
+  positive1_convert_signed_int_to_unsigned_int((int32_t)INT32_MIN);
+// CHECK-V4: {{.*}}integer-sign-change.c:200:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -2147483648 (32-bit, signed) to type 'uint32_t' (aka 'unsigned int') changed the value to 2147483648 (32-bit, unsigned)
+  positive2_convert_signed_int_to_unsigned_char((int32_t)INT8_MIN);
+// CHECK-V4: {{.*}}integer-sign-change.c:300:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -128 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 128 (8-bit, unsigned)
+  positive3_convert_signed_char_to_unsigned_char((int8_t)INT8_MIN);
+// CHECK-V4: {{.*}}integer-sign-change.c:400:10: runtime error: implicit conversion from type 'int8_t' (aka 'signed char') of value -128 (8-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 128 (8-bit, unsigned)
+  positive4_convert_unsigned_char_to_signed_char((uint8_t)INT8_MIN);
+// CHECK-V4: {{.*}}integer-sign-change.c:500:10: runtime error: implicit conversion from type 'uint8_t' (aka 'unsigned char') of value 128 (8-bit, unsigned) to type 'int8_t' (aka 'signed char') changed the value to -128 (8-bit, signed)
+  positive5_convert_signed_char_to_unsigned_int((int8_t)INT32_MIN);
+  positive6_convert_unsigned_int_to_signed_char((uint32_t)INT8_MIN);
+// CHECK-V4: {{.*}}integer-sign-change.c:700:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 4294967168 (32-bit, unsigned) to type 'int8_t' (aka 'signed char') changed the value to -128 (8-bit, signed)
+  positive7_convert_signed_int_to_signed_char((int32_t)INT8_MIN);
+#elif defined(V5)
+  // All bits except the destination 'sign' bit are set.
+  positive0_convert_unsigned_int_to_signed_int((uint32_t)INT32_MIN);
+// CHECK-V5: {{.*}}integer-sign-change.c:100:10: runtime error: implicit conversion from type 'uint32_t' (aka 'unsigned int') of value 2147483648 (32-bit, unsigned) to type 'int32_t' (aka 'int') changed the value to -2147483648 (32-bit, signed)
+  positive1_convert_signed_int_to_unsigned_int((int32_t)INT32_MIN);
+// CHECK-V5: {{.*}}integer-sign-change.c:200:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -2147483648 (32-bit, signed) to type 'uint32_t' (aka 'unsigned int') changed the value to 2147483648 (32-bit, unsigned)
+  positive2_convert_signed_int_to_unsigned_char((int32_t)(~((uint32_t)(uint8_t)INT8_MIN)));
+// CHECK-V5: {{.*}}integer-sign-change.c:300:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -129 (32-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 127 (8-bit, unsigned)
+  positive3_convert_signed_char_to_unsigned_char((int8_t)(INT8_MIN));
+// CHECK-V5: {{.*}}integer-sign-change.c:400:10: runtime error: implicit conversion from type 'int8_t' (aka 'signed char') of value -128 (8-bit, signed) to type 'uint8_t' (aka 'unsigned char') changed the value to 128 (8-bit, unsigned)
+  positive4_convert_unsigned_char_to_signed_char((uint8_t)(INT8_MIN));
+// CHECK-V5: {{.*}}integer-sign-change.c:500:10: runtime error: implicit conversion from type 'uint8_t' (aka 'unsigned char') of value 128 (8-bit, unsigned) to type 'int8_t' (aka 'signed char') changed the value to -128 (8-bit, signed)
+  positive5_convert_signed_char_to_unsigned_int((int8_t)(INT32_MIN));
+  positive6_convert_unsigned_int_to_signed_char(~((uint32_t)(uint8_t)INT8_MIN));
+  positive7_convert_signed_int_to_signed_char((int32_t)(~((uint32_t)((uint8_t)INT8_MIN))));
+// CHECK-V5: {{.*}}integer-sign-change.c:800:10: runtime error: implicit conversion from type 'int32_t' (aka 'int') of value -129 (32-bit, signed) to type 'int8_t' (aka 'signed char') changed the value to 127 (8-bit, signed)
+#else
+#error Some V* needs to be defined!
+#endif
+}
+
+// CHECK-NOT: implicit conversion
+
+int main() {
+  test_negatives();
+  test_positives();
+
+  return 0;
+}

test/ubsan/TestCases/ImplicitConversion/integer-truncation-blacklist.c

 // FIXME: https://code.google.com/p/address-sanitizer/issues/detail?id=316
 // I'm not sure this is actually *that* issue, but this seems oddly similar to the other XFAIL'ed cases.
 // XFAIL: android
 // UNSUPPORTED: ios
 
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation                           -O0 %s -o %t && not %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion"
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation                           -O1 %s -o %t && not %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion"
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation                           -O2 %s -o %t && not %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion"
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation                           -O3 %s -o %t && not %run %t 2>&1 | FileCheck %s --implicit-check-not="implicit conversion"
+
 // RUN: rm -f %tmp
 // RUN: echo "[implicit-integer-truncation]" >> %tmp
-// RUN: echo "fun:*implicitTruncation*" >> %tmp
-// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O0 %s -o %t && not %run %t 2>&1
-// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O1 %s -o %t && not %run %t 2>&1
-// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O2 %s -o %t && not %run %t 2>&1
-// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O3 %s -o %t && not %run %t 2>&1
+// RUN: echo "fun:implicitTruncation" >> %tmp
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O0 %s -o %t && not %run %t 2>&1 | not FileCheck %s
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O1 %s -o %t && not %run %t 2>&1 | not FileCheck %s
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O2 %s -o %t && not %run %t 2>&1 | not FileCheck %s
+// RUN: %clang -fsanitize=implicit-integer-truncation -fno-sanitize-recover=implicit-integer-truncation -fsanitize-blacklist=%tmp -O3 %s -o %t && not %run %t 2>&1 | not FileCheck %s
 
 unsigned char implicitTruncation(unsigned int argc) {
   return argc; // BOOM
+// CHECK: {{.*}}integer-truncation-blacklist.c:[[@LINE-1]]:10: runtime error: implicit conversion from type 'unsigned int' of value 4294967295 (32-bit, unsigned) to type 'unsigned char' changed the value to 255 (8-bit, unsigned)
 }
 
 int main(int argc, char **argv) {
   return implicitTruncation(~0U);
 }

test/ubsan_minimal/TestCases/implicit-integer-sign-change.c

+// RUN: %clang -fsanitize=implicit-integer-sign-change %s -o %t && %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
+
+#include <stdint.h>
+
+int main() {
+// CHECK-NOT: implicit-conversion
+
+  // Explicitly casting hides it,
+  int32_t n0 = (int32_t)(~((uint32_t)0));
+
+  // Positive tests.
+  int32_t t0 = (~((uint32_t)0));
+// CHECK: implicit-conversion
+// CHECK-NOT: implicit-conversion
+
+  return 0;
+}

test/ubsan_minimal/TestCases/implicit-integer-truncation.c

 // RUN: %clang -fsanitize=implicit-integer-truncation %s -o %t && %run %t 2>&1 | FileCheck %s --check-prefixes=CHECK
 
 #include <stdint.h>
 
 int main() {
-// CHECK-NOT: integer-truncation.c
+// CHECK-NOT: implicit-conversion
 
   // Negative tests. Even if they produce unexpected results, this sanitizer does not care.
   int8_t n0 = (~((uint32_t)(0))); // ~0 -> -1, but do not warn.
   uint8_t n2 = 128;
   uint8_t n3 = 255;
   // Bools do not count
   _Bool b0 = (~((uint32_t)(0)));
   _Bool b1 = 255;
 
   // Explicit and-ing of bits will silence it.
   uint8_t nc0 = ((~((uint32_t)(0))) & 255);
 
   // Positive tests.
   uint8_t t0 = (~((uint32_t)(0)));
 // CHECK: implicit-conversion
+// CHECK-NOT: implicit-conversion
 
   return 0;
 }