[PassManager/Sanitizer] Port of AddresSanitizer pass from legacy to new PassManager

[leonardchan]

Summary

This patch ports the legacy pass manager to the new one to take advantage of the benefits of the new PM. This involved moving a lot of the declarations for AddressSantizer to a header so that it can be publicly used via PassRegistry.def which I believe contains all the passes managed by the new PM.

This patch essentially decouples the instrumentation from the legacy PM such that it can be used by both legacy and new PM infrastructure.

[leonardchan]

• Added LLVM header description

[philip.pfaffe]

Thank you for moving this along!

You can greatly reduce this change by pulling most of the functionality out of the pass, and just wrapping it up in per-PassManager wrapper passes. You also don't have to move all that code into the header and can keep it local in the implementation.

[fedor.sergeev]

In D52739#1251533, @philip.pfaffe wrote:

Thank you for moving this along!

You can greatly reduce this change by pulling most of the functionality out of the pass, and just wrapping it up in per-PassManager wrapper passes. You also don't have to move all that code into the header and can keep it local in the implementation.

Well, it will be a bit tricky to avoid moving the interfaces around, since AddressSanitizer contains quite a load of state, so you cant have a wrapper w/o introducing
definitions of this state other than playing tricks with indirection.
Though yes, making wrapper passes that have a pointer to opaque AddressSanitizer might do the dirty trick.

[leonardchan]

• Reduce size of patch by adding per-PM wrappers for AddressSanitizer and AddressSanitizerModule. The passes exposed to the new PM use opaque pointers to these wrappers.

[fedor.sergeev]

include/llvm/IR/AddressSanitizerPass.h

24

I dont believe you need any extra wrappers in addition to AddressSanitizer*Pass ones.

Just use class AddressSanitizer/AddresSanitizerModule here.

[leonardchan]

include/llvm/IR/AddressSanitizerPass.h

24

Done, but this would require moving AddressSanitizer, AddressSanitizerModule, and FunctionStackPoisoner outside of their anonymous namespace.

[philip.pfaffe]

Well, it will be a bit tricky to avoid moving the interfaces around, since AddressSanitizer contains quite a load of state

What kind of state is asan tracking that persists across functions or modules?

[leonardchan]

In D52739#1254912, @philip.pfaffe wrote:

Well, it will be a bit tricky to avoid moving the interfaces around, since AddressSanitizer contains quite a load of state

What kind of state is asan tracking that persists across functions or modules?

For AddressSanitizer I think this might refer to the GlobalsMetaData and ShadowMapping made during initialization, but I think they get reset on each function run. All tests with the legacy PM still seem to pass though which I think indicates that the logic is still sound even with the ASan functionality separated from the legacy pass.

[philip.pfaffe]

Actually I was asking this because as far as I can tell, asan doesn't track state across functions and modules. Which means there's no point in _retaining_ the state, i.e. you don't have to keep an instance of it around.

[leonardchan]

*Ping*

Are there any other changes that would be necessary before getting revision acceptance?

[philip.pfaffe]

See my latest comment. If there is no state to be kept, that state need not be on the exported interface.

[leonardchan]

In D52739#1257533, @philip.pfaffe wrote:

See my latest comment. If there is no state to be kept, that state need not be on the exported interface.

My bad. I misinterpreted it. Removed the sanitizer as a member so it is created locally on new runs and readded AddressSanitizer and AddressSanitizerModule back to their anonymous namespaces.

[philip.pfaffe]

Some comments inline. Does it make sense to merge the module and function passes into one? Is it really necessary to distinguish the passes?

include/llvm/IR/AddressSanitizerPass.h

24

The PassInfoMixin takes care of the name function for you.

38

Use the PassInfoMixin.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

660

This isn't a pass anymore, it doesn't need this function.

676

Unneeded function.

940

The convention is to name it AddressSanitizerLegacyPass

956

Just make this an if.

963

As above, just make this an if

974

The convention is to name it AddressSanitizerModuleLegacyPass

2258

Instead of doing this kind of lazy initialization, just do it in the constructor.

[leonardchan]

In D52739#1258087, @philip.pfaffe wrote:

Some comments inline. Does it make sense to merge the module and function passes into one? Is it really necessary to distinguish the passes?

This I'm not sure of since it seems that they both do different things that work independently of each other, though I can't find an example/test where they are used on their own. @vitalybuka may be able to offer more insight into this. Otherwise if it's necessary to combine the passes, I can create a separate patch that does this and changes any relevant tests.

include/llvm/IR/AddressSanitizerPass.h

24

Moved them back into their anonymous namespace.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

2258

This initialization requires access to the Module that this pass runs over but I don't think I have access to that in the constructor.

[philip.pfaffe]

In D52739#1258171, @leonardchan wrote:

This I'm not sure of since it seems that they both do different things that work independently of each other, though I can't find an example/test where they are used on their own.

I meant just merging the passes. In the sense that you have one pass class with one module run() method and one function run() method. The question then is whether you'll ever want to use different options for the different IRUnits.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

2258

Yes you do. You're now constructing one instance of this per pass run, you can just pass along the module there.

[leonardchan]

I meant just merging the passes. In the sense that you have one pass class with one module run() method and one function run() method. The question then is whether you'll ever want to use different options for the different IRUnits.

I see. As far as I can tell, both passes actually use the same options for CompileKernel and Recover when creating new passes, but UseAfterScope is different for both in that the option is passed from a code gen option for AddressSanitizer whereas AddressSanitizerModule sets UseAfterScope as true by default and is dependent on if ASan uses garbage collection friendly instrumentation for globals. I think this is a reason to keep them separate.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

2258

My bad. Didn't notice that.

[philip.pfaffe]

In D52739#1258469, @leonardchan wrote:

I see. As far as I can tell, both passes actually use the same options for CompileKernel and Recover when creating new passes, but UseAfterScope is different for both in that the option is passed from a code gen option for AddressSanitizer whereas AddressSanitizerModule sets UseAfterScope as true by default and is dependent on if ASan uses garbage collection friendly instrumentation for globals.

These are different per instance though. Even if merged, you're free to create one instance with options A and one instance with options B and run the first instance on a function pipeline and the second on a module pipeline.

include/llvm/IR/AddressSanitizerPass.h

18

Why is this include required?

Also, you're missing PassManager.h for AnalysisManager and PassInfoMixin

24

These classes need comments.

[philip.pfaffe]

I also noticed you got the header in the wrong place. It should live in Transforms/Instrumentation, not in IR.

[leonardchan]

These are different per instance though. Even if merged, you're free to create one instance with options A and one instance with options B and run the first instance on a function pipeline and the second on a module pipeline.

In that case then, it seems like there's nothing wrong with combining them since for any pipeline you could create different instances of this combined pass with different options.

[philip.pfaffe]

We're getting there! Some more tiny nits.

include/llvm/Transforms/Instrumentation/AddressSanitizerPass.h

32 ↗

(On Diff #168839)

These are called FunctionAnalysisManager and ModuleAnalysisManager. Coincidentally these are just typedefs for the same things, but that's not guaranteed, e.g. AnalysisManager<Loop> != LoopAnalysisManager.

38 ↗

(On Diff #168839)

No, this shouldn't be needed. You will be using one instance per PM type.

lib/Passes/PassRegistry.def

43

The module suffix is superfluous.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

2256–2257

I'd find it nicer if the DomintarTree were passed during construction instead.

[philip.pfaffe]

This looks great now, thank you!

include/llvm/IR/AddressSanitizerPass.h

+#ifndef LLVM_IR_ADDRESSSANITIZERNEWPASS_H
+#define LLVM_IR_ADDRESSSANITIZERNEWPASS_H
+
+#include "llvm/Analysis/MemoryBuiltins.h"
+#include "llvm/IR/Dominators.h"
+#include "llvm/IR/Instructions.h"
+#include "llvm/IR/Value.h"
+
+namespace llvm {
+
+// Accesses sizes are powers of two: 1, 2, 4, 8, 16.
+static const size_t kNumberOfAccessSizes = 5;
+
+/// This struct defines the shadow mapping using the rule:
+///   shadow = (mem >> Scale) ADD-or-OR Offset.
+/// If InGlobal is true, then
+///   extern char __asan_shadow[];
+///   shadow = (mem >> Scale) + &__asan_shadow
+struct ShadowMapping {
+  int Scale;
+  uint64_t Offset;
+  bool OrShadowOffset;
+  bool InGlobal;
+};
+
+/// Frontend-provided metadata for source location.
+struct LocationMetadata {
+  StringRef Filename;
+  int LineNo = 0;
+  int ColumnNo = 0;
+
+  LocationMetadata() = default;
+
+  bool empty() const { return Filename.empty(); }
+
+  void parse(MDNode *MDN) {
+    assert(MDN->getNumOperands() == 3);
+    MDString *DIFilename = cast<MDString>(MDN->getOperand(0));
+    Filename = DIFilename->getString();
+    LineNo =
+        mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue();
+    ColumnNo =
+        mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue();
+  }
+};
+
+/// Frontend-provided metadata for global variables.
+class GlobalsMetadata {
+public:
+  struct Entry {
+    LocationMetadata SourceLoc;
+    StringRef Name;
+    bool IsDynInit = false;
+    bool IsBlacklisted = false;
+
+    Entry() = default;
+  };
+
+  GlobalsMetadata() = default;
+
+  void reset() {
+    inited_ = false;
+    Entries.clear();
+  }
+
+  void init(Module &M);
+
+  /// Returns metadata entry for a given global.
+  Entry get(GlobalVariable *G) const {
+    auto Pos = Entries.find(G);
+    return (Pos != Entries.end()) ? Pos->second : Entry();
+  }
+
+private:
+  bool inited_ = false;
+  DenseMap<GlobalVariable *, Entry> Entries;
+};
+
+struct FunctionStackPoisoner;
+
+class AddressSanitizer {
+public:
+  explicit AddressSanitizer(bool CompileKernel = false, bool Recover = false,
+                            bool UseAfterScope = false);
+
+  /// Return true if the function changed.
+  bool instrument(Function &F, DominatorTree *DTree,
+                  const TargetLibraryInfo *TLI);
+  PreservedAnalyses run(Function &F, AnalysisManager<Function> &AM);
+
+  static StringRef name() { return "AddressSanitizerFunctionPass"; }
+
+  bool maybeInsertAsanInitAtFunctionEntry(Function &F);
+  void initializeCallbacks(Module &M);
+  void maybeInsertDynamicShadowAtFunctionEntry(Function &F);
+  void markEscapedLocalAllocas(Function &F);
+  bool isInterestingAlloca(const AllocaInst &AI);
+  void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, Instruction *I,
+                     bool UseCalls, const DataLayout &DL);
+
+  /// If it is an interesting memory access, return the PointerOperand
+  /// and set IsWrite/Alignment. Otherwise return nullptr.
+  /// MaybeMask is an output parameter for the mask Value, if we're looking at a
+  /// masked load/store.
+  Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite,
+                                   uint64_t *TypeSize, unsigned *Alignment,
+                                   Value **MaybeMask = nullptr);
+  void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore,
+                         Value *Addr, uint32_t TypeSize, bool IsWrite,
+                         Value *SizeArgument, bool UseCalls, uint32_t Exp);
+  void instrumentUnusualSizeOrAlignment(Instruction *I,
+                                        Instruction *InsertBefore, Value *Addr,
+                                        uint32_t TypeSize, bool IsWrite,
+                                        Value *SizeArgument, bool UseCalls,
+                                        uint32_t Exp);
+  Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
+  Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
+                           Value *ShadowValue, uint32_t TypeSize);
+  Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
+                                 bool IsWrite, size_t AccessSizeIndex,
+                                 Value *SizeArgument, uint32_t Exp);
+  void instrumentMemIntrinsic(MemIntrinsic *MI);
+  void instrumentPointerComparisonOrSubtraction(Instruction *I);
+
+  uint64_t getAllocaSizeInBytes(const AllocaInst &AI) const {
+    uint64_t ArraySize = 1;
+    if (AI.isArrayAllocation()) {
+      const ConstantInt *CI = dyn_cast<ConstantInt>(AI.getArraySize());
+      assert(CI && "non-constant array size");
+      ArraySize = CI->getZExtValue();
+    }
+    Type *Ty = AI.getAllocatedType();
+    uint64_t SizeInBytes = AI.getModule()->getDataLayout().getTypeAllocSize(Ty);
+    return SizeInBytes * ArraySize;
+  }
+
+  DominatorTree &getDominatorTree() const { return *DT; }
+
+private:
+  friend struct FunctionStackPoisoner;
+
+  /// Helper to cleanup per-function state.
+  struct FunctionStateRAII {
+    AddressSanitizer *Pass;
+
+    FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) {
+      assert(Pass->ProcessedAllocas.empty() &&
+             "last pass forgot to clear cache");
+      assert(!Pass->LocalDynamicShadow);
+    }
+
+    ~FunctionStateRAII() {
+      Pass->LocalDynamicShadow = nullptr;
+      Pass->ProcessedAllocas.clear();
+    }
+  };
+
+  bool LooksLikeCodeInBug11395(Instruction *I);
+  bool GlobalIsLinkerInitialized(GlobalVariable *G);
+  bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr,
+                    uint64_t TypeSize) const;
+
+  bool Inited = false;
+  LLVMContext *C;
+  Triple TargetTriple;
+  int LongSize;
+  bool CompileKernel;
+  bool Recover;
+  bool UseAfterScope;
+  Type *IntptrTy;
+  ShadowMapping Mapping;
+  DominatorTree *DT;
+  Function *AsanHandleNoReturnFunc;
+  Function *AsanPtrCmpFunction, *AsanPtrSubFunction;
+  Constant *AsanShadowGlobal;
+
+  // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize).
+  Function *AsanErrorCallback[2][2][kNumberOfAccessSizes];
+  Function *AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes];
+
+  // These arrays is indexed by AccessIsWrite and Experiment.
+  Function *AsanErrorCallbackSized[2][2];
+  Function *AsanMemoryAccessCallbackSized[2][2];
+
+  Function *AsanMemmove, *AsanMemcpy, *AsanMemset;
+  InlineAsm *EmptyAsm;
+  Value *LocalDynamicShadow = nullptr;
+  GlobalsMetadata GlobalsMD;
+  DenseMap<const AllocaInst *, bool> ProcessedAllocas;
+};
+
+class AddressSanitizerModule {
+public:
+  explicit AddressSanitizerModule(bool CompileKernel = false,
+                                  bool Recover = false,
+                                  bool UseGlobalsGC = true);
+
+  PreservedAnalyses run(Module &M, AnalysisManager<Module> &AM);
+
+  /// Returns true if the module was modified.
+  bool instrument(Module &M);
+
+  static StringRef name() { return "AddressSanitizerModule"; }
+
+private:
+  void initializeCallbacks(Module &M);
+  int GetAsanVersion(const Module &M) const;
+  bool InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat);
+  bool ShouldInstrumentGlobal(GlobalVariable *G);
+  size_t MinRedzoneSizeForGlobal() const;
+  void InstrumentGlobalsELF(IRBuilder<> &IRB, Module &M,
+                            ArrayRef<GlobalVariable *> ExtendedGlobals,
+                            ArrayRef<Constant *> MetadataInitializers,
+                            const std::string &UniqueModuleId);
+  void InstrumentGlobalsCOFF(IRBuilder<> &IRB, Module &M,
+                             ArrayRef<GlobalVariable *> ExtendedGlobals,
+                             ArrayRef<Constant *> MetadataInitializers);
+  bool ShouldUseMachOGlobalsSection() const;
+  void InstrumentGlobalsMachO(IRBuilder<> &IRB, Module &M,
+                              ArrayRef<GlobalVariable *> ExtendedGlobals,
+                              ArrayRef<Constant *> MetadataInitializers);
+  void
+  InstrumentGlobalsWithMetadataArray(IRBuilder<> &IRB, Module &M,
+                                     ArrayRef<GlobalVariable *> ExtendedGlobals,
+                                     ArrayRef<Constant *> MetadataInitializers);
+  void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName);
+  void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName);
+  GlobalVariable *CreateMetadataGlobal(Module &M, Constant *Initializer,
+                                       StringRef OriginalName);
+  void SetComdatForGlobalMetadata(GlobalVariable *G, GlobalVariable *Metadata,
+                                  StringRef InternalSuffix);
+  StringRef getGlobalMetadataSection() const;
+  IRBuilder<> CreateAsanModuleDtor(Module &M);
+
+  GlobalsMetadata GlobalsMD;
+  bool CompileKernel;
+  bool Recover;
+  bool UseGlobalsGC;
+  bool UseCtorComdat;
+  Type *IntptrTy;
+  LLVMContext *C;
+  Triple TargetTriple;
+  ShadowMapping Mapping;
+  Function *AsanPoisonGlobals;
+  Function *AsanUnpoisonGlobals;
+  Function *AsanRegisterGlobals;
+  Function *AsanUnregisterGlobals;
+  Function *AsanRegisterImageGlobals;
+  Function *AsanUnregisterImageGlobals;
+  Function *AsanRegisterElfGlobals;
+  Function *AsanUnregisterElfGlobals;
+
+  Function *AsanCtorFunction = nullptr;
+  Function *AsanDtorFunction = nullptr;
+};
+
+} // namespace llvm
+
+#endif

include/llvm/InitializePasses.h

 
 /// Initialize all passes linked into the CodeGen library.
 void initializeTarget(PassRegistry&);
 
 void initializeAAEvalLegacyPassPass(PassRegistry&);
 void initializeAAResultsWrapperPassPass(PassRegistry&);
 void initializeADCELegacyPassPass(PassRegistry&);
 void initializeAddDiscriminatorsLegacyPassPass(PassRegistry&);
-void initializeAddressSanitizerModulePass(PassRegistry&);
-void initializeAddressSanitizerPass(PassRegistry&);
+void initializeAddressSanitizerModuleLegacyPass(PassRegistry &);
+void initializeAddressSanitizerLegacyPass(PassRegistry &);
 void initializeAggressiveInstCombinerLegacyPassPass(PassRegistry&);
 void initializeAliasSetPrinterPass(PassRegistry&);
 void initializeAlignmentFromAssumptionsPass(PassRegistry&);
 void initializeAlwaysInlinerLegacyPassPass(PassRegistry&);
 void initializeArgPromotionPass(PassRegistry&);
 void initializeAssumptionCacheTrackerPass(PassRegistry&);
 void initializeAtomicExpandPass(PassRegistry&);
 void initializeBDCELegacyPassPass(PassRegistry&);

lib/Passes/PassBuilder.cpp

 #include "llvm/Analysis/ScalarEvolution.h"
 #include "llvm/Analysis/ScalarEvolutionAliasAnalysis.h"
 #include "llvm/Analysis/ScopedNoAliasAA.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/Analysis/TargetTransformInfo.h"
 #include "llvm/Analysis/TypeBasedAliasAnalysis.h"
 #include "llvm/CodeGen/PreISelIntrinsicLowering.h"
 #include "llvm/CodeGen/UnreachableBlockElim.h"
+#include "llvm/IR/AddressSanitizerPass.h"
 #include "llvm/IR/Dominators.h"
 #include "llvm/IR/IRPrintingPasses.h"
 #include "llvm/IR/PassManager.h"
 #include "llvm/IR/Verifier.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/Regex.h"
 #include "llvm/Target/TargetMachine.h"
 #include "llvm/Transforms/AggressiveInstCombine/AggressiveInstCombine.h"
-#include "llvm/Transforms/Instrumentation/CGProfile.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
 #include "llvm/Transforms/IPO/ArgumentPromotion.h"
 #include "llvm/Transforms/IPO/CalledValuePropagation.h"
 #include "llvm/Transforms/IPO/ConstantMerge.h"
 #include "llvm/Transforms/IPO/CrossDSOCFI.h"
 #include "llvm/Transforms/IPO/DeadArgumentElimination.h"
 #include "llvm/Transforms/IPO/ElimAvailExtern.h"
 #include "llvm/Transforms/IPO/ForceFunctionAttrs.h"

 #include "llvm/Transforms/IPO/PartialInlining.h"
 #include "llvm/Transforms/IPO/SCCP.h"
 #include "llvm/Transforms/IPO/SampleProfile.h"
 #include "llvm/Transforms/IPO/StripDeadPrototypes.h"
 #include "llvm/Transforms/IPO/SyntheticCountsPropagation.h"
 #include "llvm/Transforms/IPO/WholeProgramDevirt.h"
 #include "llvm/Transforms/InstCombine/InstCombine.h"
 #include "llvm/Transforms/Instrumentation/BoundsChecking.h"
+#include "llvm/Transforms/Instrumentation/CGProfile.h"
 #include "llvm/Transforms/Instrumentation/ControlHeightReduction.h"
 #include "llvm/Transforms/Instrumentation/GCOVProfiler.h"
 #include "llvm/Transforms/Instrumentation/InstrProfiling.h"
 #include "llvm/Transforms/Instrumentation/PGOInstrumentation.h"
 #include "llvm/Transforms/Scalar/ADCE.h"
 #include "llvm/Transforms/Scalar/AlignmentFromAssumptions.h"
 #include "llvm/Transforms/Scalar/BDCE.h"
 #include "llvm/Transforms/Scalar/CallSiteSplitting.h"

lib/Passes/PassRegistry.def

 MODULE_ALIAS_ANALYSIS("globals-aa", GlobalsAA())
 #undef MODULE_ALIAS_ANALYSIS
 #undef MODULE_ANALYSIS
 
 #ifndef MODULE_PASS
 #define MODULE_PASS(NAME, CREATE_PASS)
 #endif
 MODULE_PASS("always-inline", AlwaysInlinerPass())
+MODULE_PASS("asan-module", AddressSanitizerModule())
 MODULE_PASS("called-value-propagation", CalledValuePropagationPass())
 MODULE_PASS("cg-profile", CGProfilePass())
 MODULE_PASS("constmerge", ConstantMergePass())
 MODULE_PASS("cross-dso-cfi", CrossDSOCFIPass())
 MODULE_PASS("deadargelim", DeadArgumentEliminationPass())
 MODULE_PASS("elim-avail-extern", EliminateAvailableExternallyPass())
 MODULE_PASS("forceattrs", ForceFunctionAttrsPass())
 MODULE_PASS("function-import", FunctionImportPass())

 #ifndef FUNCTION_PASS
 #define FUNCTION_PASS(NAME, CREATE_PASS)
 #endif
 FUNCTION_PASS("aa-eval", AAEvaluator())
 FUNCTION_PASS("adce", ADCEPass())
 FUNCTION_PASS("add-discriminators", AddDiscriminatorsPass())
 FUNCTION_PASS("aggressive-instcombine", AggressiveInstCombinePass())
 FUNCTION_PASS("alignment-from-assumptions", AlignmentFromAssumptionsPass())
+FUNCTION_PASS("asan", AddressSanitizer())
 FUNCTION_PASS("bdce", BDCEPass())
 FUNCTION_PASS("bounds-checking", BoundsCheckingPass())
 FUNCTION_PASS("break-crit-edges", BreakCriticalEdgesPass())
 FUNCTION_PASS("callsite-splitting", CallSiteSplittingPass())
 FUNCTION_PASS("consthoist", ConstantHoistingPass())
 FUNCTION_PASS("chr", ControlHeightReductionPass())
 FUNCTION_PASS("correlated-propagation", CorrelatedValuePropagationPass())
 FUNCTION_PASS("dce", DCEPass())

lib/Transforms/Instrumentation/AddressSanitizer.cpp

 #include "llvm/ADT/SmallVector.h"
 #include "llvm/ADT/Statistic.h"
 #include "llvm/ADT/StringExtras.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Analysis/MemoryBuiltins.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
-#include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Analysis/ValueTracking.h"
 #include "llvm/BinaryFormat/MachO.h"
+#include "llvm/IR/AddressSanitizerPass.h"
 #include "llvm/IR/Argument.h"
 #include "llvm/IR/Attributes.h"
 #include "llvm/IR/BasicBlock.h"
 #include "llvm/IR/CallSite.h"
 #include "llvm/IR/Comdat.h"
 #include "llvm/IR/Constant.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/DIBuilder.h"

 #include "llvm/Support/Debug.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/MathExtras.h"
 #include "llvm/Support/ScopedPrinter.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Utils/ASanStackFrameLayout.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
+#include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 #include "llvm/Transforms/Utils/PromoteMemToReg.h"
 #include <algorithm>
 #include <cassert>
 #include <cstddef>
 #include <cstdint>
 #include <iomanip>
 #include <limits>
static const char *const kAsanOptionDetectUseAfterReturn =
     "__asan_option_detect_stack_use_after_return";
 
 static const char *const kAsanShadowMemoryDynamicAddress =
     "__asan_shadow_memory_dynamic_address";
 
 static const char *const kAsanAllocaPoison = "__asan_alloca_poison";
 static const char *const kAsanAllocasUnpoison = "__asan_allocas_unpoison";
 
-// Accesses sizes are powers of two: 1, 2, 4, 8, 16.
-static const size_t kNumberOfAccessSizes = 5;
-
 static const unsigned kAllocaRzSize = 32;
 
 // Command-line flags.
 
 static cl::opt<bool> ClEnableKasan(
     "asan-kernel", cl::desc("Enable KernelAddressSanitizer instrumentation"),
     cl::Hidden, cl::init(false));
 

 STATISTIC(NumInstrumentedWrites, "Number of instrumented writes");
 STATISTIC(NumOptimizedAccessesToGlobalVar,
           "Number of optimized accesses to global vars");
 STATISTIC(NumOptimizedAccessesToStackVar,
           "Number of optimized accesses to stack vars");
 
 namespace {
 
-/// Frontend-provided metadata for source location.
-struct LocationMetadata {
-  StringRef Filename;
-  int LineNo = 0;
-  int ColumnNo = 0;
-
-  LocationMetadata() = default;
-
-  bool empty() const { return Filename.empty(); }
-
-  void parse(MDNode *MDN) {
-    assert(MDN->getNumOperands() == 3);
-    MDString *DIFilename = cast<MDString>(MDN->getOperand(0));
-    Filename = DIFilename->getString();
-    LineNo =
-        mdconst::extract<ConstantInt>(MDN->getOperand(1))->getLimitedValue();
-    ColumnNo =
-        mdconst::extract<ConstantInt>(MDN->getOperand(2))->getLimitedValue();
-  }
-};
-
-/// Frontend-provided metadata for global variables.
-class GlobalsMetadata {
-public:
-  struct Entry {
-    LocationMetadata SourceLoc;
-    StringRef Name;
-    bool IsDynInit = false;
-    bool IsBlacklisted = false;
-
-    Entry() = default;
-  };
-
-  GlobalsMetadata() = default;
-
-  void reset() {
-    inited_ = false;
-    Entries.clear();
-  }
-
-  void init(Module &M) {
-    assert(!inited_);
-    inited_ = true;
-    NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals");
-    if (!Globals) return;
-    for (auto MDN : Globals->operands()) {
-      // Metadata node contains the global and the fields of "Entry".
-      assert(MDN->getNumOperands() == 5);
-      auto *GV = mdconst::extract_or_null<GlobalVariable>(MDN->getOperand(0));
-      // The optimizer may optimize away a global entirely.
-      if (!GV) continue;
-      // We can already have an entry for GV if it was merged with another
-      // global.
-      Entry &E = Entries[GV];
-      if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1)))
-        E.SourceLoc.parse(Loc);
-      if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2)))
-        E.Name = Name->getString();
-      ConstantInt *IsDynInit =
-          mdconst::extract<ConstantInt>(MDN->getOperand(3));
-      E.IsDynInit |= IsDynInit->isOne();
-      ConstantInt *IsBlacklisted =
-          mdconst::extract<ConstantInt>(MDN->getOperand(4));
-      E.IsBlacklisted |= IsBlacklisted->isOne();
-    }
-  }
-
-  /// Returns metadata entry for a given global.
-  Entry get(GlobalVariable *G) const {
-    auto Pos = Entries.find(G);
-    return (Pos != Entries.end()) ? Pos->second : Entry();
-  }
-
-private:
-  bool inited_ = false;
-  DenseMap<GlobalVariable *, Entry> Entries;
-};
-
-/// This struct defines the shadow mapping using the rule:
-///   shadow = (mem >> Scale) ADD-or-OR Offset.
-/// If InGlobal is true, then
-///   extern char __asan_shadow[];
-///   shadow = (mem >> Scale) + &__asan_shadow
-struct ShadowMapping {
-  int Scale;
-  uint64_t Offset;
-  bool OrShadowOffset;
-  bool InGlobal;
-};
-
 } // end anonymous namespace
 
 static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize,
                                       bool IsKasan) {
   bool IsAndroid = TargetTriple.isAndroid();
   bool IsIOS = TargetTriple.isiOS() || TargetTriple.isWatchOS();
   bool IsFreeBSD = TargetTriple.isOSFreeBSD();
   bool IsNetBSD = TargetTriple.isOSNetBSD();

 }
 
 static size_t RedzoneSizeForScale(int MappingScale) {
   // Redzone used for stack and globals is at least 32 bytes.
   // For scales 6 and 7, the redzone has to be 64 and 128 bytes respectively.
   return std::max(32U, 1U << MappingScale);
 }
 
-namespace {
-
-/// AddressSanitizer: instrument the code in module to find memory bugs.
-struct AddressSanitizer : public FunctionPass {
-  // Pass identification, replacement for typeid
-  static char ID;
-
-  explicit AddressSanitizer(bool CompileKernel = false, bool Recover = false,
-                            bool UseAfterScope = false)
-      : FunctionPass(ID), UseAfterScope(UseAfterScope || ClUseAfterScope) {
-    this->Recover = ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover;
-    this->CompileKernel = ClEnableKasan.getNumOccurrences() > 0 ?
-        ClEnableKasan : CompileKernel;
-    initializeAddressSanitizerPass(*PassRegistry::getPassRegistry());
-  }
+size_t AddressSanitizerModule::MinRedzoneSizeForGlobal() const {
+  return RedzoneSizeForScale(Mapping.Scale);
 
-  StringRef getPassName() const override {
-    return "AddressSanitizerFunctionPass";
+bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) {
+  // For each NSObject descendant having a +load method, this method is invoked
+  // by the ObjC runtime before any of the static constructors is called.
+  // Therefore we need to instrument such methods with a call to __asan_init
+  // at the beginning in order to initialize our runtime before any access to
+  // the shadow memory.
+  // We cannot just ignore these methods, because they may call other
+  // instrumented functions.
+  if (F.getName().find(" load]") != std::string::npos) {
+    Function *AsanInitFunction =
+        declareSanitizerInitFunction(*F.getParent(), kAsanInitName, {});
+    IRBuilder<> IRB(&F.front(), F.front().begin());
+    IRB.CreateCall(AsanInitFunction, {});
+    return true;
   }
-
-  void getAnalysisUsage(AnalysisUsage &AU) const override {
-    AU.addRequired<DominatorTreeWrapperPass>();
-    AU.addRequired<TargetLibraryInfoWrapperPass>();
-  }
+  return false;
 
-  uint64_t getAllocaSizeInBytes(const AllocaInst &AI) const {
-    uint64_t ArraySize = 1;
-    if (AI.isArrayAllocation()) {
-      const ConstantInt *CI = dyn_cast<ConstantInt>(AI.getArraySize());
-      assert(CI && "non-constant array size");
-      ArraySize = CI->getZExtValue();
-    }
-    Type *Ty = AI.getAllocatedType();
-    uint64_t SizeInBytes =
-        AI.getModule()->getDataLayout().getTypeAllocSize(Ty);
-    return SizeInBytes * ArraySize;
+void AddressSanitizer::initializeCallbacks(Module &M) {
+  IRBuilder<> IRB(*C);
+  // Create __asan_report* callbacks.
+  // IsWrite, TypeSize and Exp are encoded in the function name.
+  for (int Exp = 0; Exp < 2; Exp++) {
+    for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) {
+      const std::string TypeStr = AccessIsWrite ? "store" : "load";
+      const std::string ExpStr = Exp ? "exp_" : "";
+      const std::string EndingStr = Recover ? "_noabort" : "";
+
+      SmallVector<Type *, 3> Args2 = {IntptrTy, IntptrTy};
+      SmallVector<Type *, 2> Args1{1, IntptrTy};
+      if (Exp) {
+        Type *ExpType = Type::getInt32Ty(*C);
+        Args2.push_back(ExpType);
+        Args1.push_back(ExpType);
       }
+      AsanErrorCallbackSized[AccessIsWrite][Exp] =
+          checkSanitizerInterfaceFunction(M.getOrInsertFunction(
+              kAsanReportErrorTemplate + ExpStr + TypeStr + "_n" + EndingStr,
+              FunctionType::get(IRB.getVoidTy(), Args2, false)));
 
-  /// Check if we want (and can) handle this alloca.
-  bool isInterestingAlloca(const AllocaInst &AI);
+      AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] =
+          checkSanitizerInterfaceFunction(M.getOrInsertFunction(
+              ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr,
+              FunctionType::get(IRB.getVoidTy(), Args2, false)));
 
-  /// If it is an interesting memory access, return the PointerOperand
-  /// and set IsWrite/Alignment. Otherwise return nullptr.
-  /// MaybeMask is an output parameter for the mask Value, if we're looking at a
-  /// masked load/store.
-  Value *isInterestingMemoryAccess(Instruction *I, bool *IsWrite,
-                                   uint64_t *TypeSize, unsigned *Alignment,
-                                   Value **MaybeMask = nullptr);
-
-  void instrumentMop(ObjectSizeOffsetVisitor &ObjSizeVis, Instruction *I,
-                     bool UseCalls, const DataLayout &DL);
-  void instrumentPointerComparisonOrSubtraction(Instruction *I);
-  void instrumentAddress(Instruction *OrigIns, Instruction *InsertBefore,
-                         Value *Addr, uint32_t TypeSize, bool IsWrite,
-                         Value *SizeArgument, bool UseCalls, uint32_t Exp);
-  void instrumentUnusualSizeOrAlignment(Instruction *I,
-                                        Instruction *InsertBefore, Value *Addr,
-                                        uint32_t TypeSize, bool IsWrite,
-                                        Value *SizeArgument, bool UseCalls,
-                                        uint32_t Exp);
-  Value *createSlowPathCmp(IRBuilder<> &IRB, Value *AddrLong,
-                           Value *ShadowValue, uint32_t TypeSize);
-  Instruction *generateCrashCode(Instruction *InsertBefore, Value *Addr,
-                                 bool IsWrite, size_t AccessSizeIndex,
-                                 Value *SizeArgument, uint32_t Exp);
-  void instrumentMemIntrinsic(MemIntrinsic *MI);
-  Value *memToShadow(Value *Shadow, IRBuilder<> &IRB);
-  bool runOnFunction(Function &F) override;
-  bool maybeInsertAsanInitAtFunctionEntry(Function &F);
-  void maybeInsertDynamicShadowAtFunctionEntry(Function &F);
-  void markEscapedLocalAllocas(Function &F);
-  bool doInitialization(Module &M) override;
-  bool doFinalization(Module &M) override;
+      for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes;
+           AccessSizeIndex++) {
+        const std::string Suffix = TypeStr + itostr(1ULL << AccessSizeIndex);
+        AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] =
+            checkSanitizerInterfaceFunction(M.getOrInsertFunction(
+                kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr,
+                FunctionType::get(IRB.getVoidTy(), Args1, false)));
 
-  DominatorTree &getDominatorTree() const { return *DT; }
+        AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] =
+            checkSanitizerInterfaceFunction(M.getOrInsertFunction(
+                ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr,
+                FunctionType::get(IRB.getVoidTy(), Args1, false)));
+      }
+    }
+  }
 
-private:
-  friend struct FunctionStackPoisoner;
+  const std::string MemIntrinCallbackPrefix =
+      CompileKernel ? std::string("") : ClMemoryAccessCallbackPrefix;
+  AsanMemmove = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
+      MemIntrinCallbackPrefix + "memmove", IRB.getInt8PtrTy(),
+      IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy));
+  AsanMemcpy = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
+      MemIntrinCallbackPrefix + "memcpy", IRB.getInt8PtrTy(),
+      IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy));
+  AsanMemset = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
+      MemIntrinCallbackPrefix + "memset", IRB.getInt8PtrTy(),
+      IRB.getInt8PtrTy(), IRB.getInt32Ty(), IntptrTy));
 
-  void initializeCallbacks(Module &M);
+  AsanHandleNoReturnFunc = checkSanitizerInterfaceFunction(
+      M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy()));
 
-  bool LooksLikeCodeInBug11395(Instruction *I);
-  bool GlobalIsLinkerInitialized(GlobalVariable *G);
-  bool isSafeAccess(ObjectSizeOffsetVisitor &ObjSizeVis, Value *Addr,
-                    uint64_t TypeSize) const;
-
-  /// Helper to cleanup per-function state.
-  struct FunctionStateRAII {
-    AddressSanitizer *Pass;
-
-    FunctionStateRAII(AddressSanitizer *Pass) : Pass(Pass) {
-      assert(Pass->ProcessedAllocas.empty() &&
-             "last pass forgot to clear cache");
-      assert(!Pass->LocalDynamicShadow);
-    }
-
-    ~FunctionStateRAII() {
-      Pass->LocalDynamicShadow = nullptr;
-      Pass->ProcessedAllocas.clear();
-    }
-  };
+  AsanPtrCmpFunction = checkSanitizerInterfaceFunction(
+      M.getOrInsertFunction(kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy));
+  AsanPtrSubFunction = checkSanitizerInterfaceFunction(
+      M.getOrInsertFunction(kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy));
+  // We insert an empty inline asm after __asan_report* to avoid callback merge.
+  EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
+                            StringRef(""), StringRef(""),
+                            /*hasSideEffects=*/true);
+  if (Mapping.InGlobal)
+    AsanShadowGlobal = M.getOrInsertGlobal("__asan_shadow",
+                                           ArrayType::get(IRB.getInt8Ty(), 0));
 
-  LLVMContext *C;
-  Triple TargetTriple;
-  int LongSize;
-  bool CompileKernel;
-  bool Recover;
-  bool UseAfterScope;
-  Type *IntptrTy;
-  ShadowMapping Mapping;
-  DominatorTree *DT;
-  Function *AsanHandleNoReturnFunc;
-  Function *AsanPtrCmpFunction, *AsanPtrSubFunction;
-  Constant *AsanShadowGlobal;
-
-  // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize).
-  Function *AsanErrorCallback[2][2][kNumberOfAccessSizes];
-  Function *AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes];
-
-  // These arrays is indexed by AccessIsWrite and Experiment.
-  Function *AsanErrorCallbackSized[2][2];
-  Function *AsanMemoryAccessCallbackSized[2][2];
-
-  Function *AsanMemmove, *AsanMemcpy, *AsanMemset;
-  InlineAsm *EmptyAsm;
-  Value *LocalDynamicShadow = nullptr;
-  GlobalsMetadata GlobalsMD;
-  DenseMap<const AllocaInst *, bool> ProcessedAllocas;
-};
-
-class AddressSanitizerModule : public ModulePass {
-public:
-  // Pass identification, replacement for typeid
-  static char ID;
-
-  explicit AddressSanitizerModule(bool CompileKernel = false,
-                                  bool Recover = false,
-                                  bool UseGlobalsGC = true)
-      : ModulePass(ID),
-        UseGlobalsGC(UseGlobalsGC && ClUseGlobalsGC),
-        // Not a typo: ClWithComdat is almost completely pointless without
-        // ClUseGlobalsGC (because then it only works on modules without
-        // globals, which are rare); it is a prerequisite for ClUseGlobalsGC;
-        // and both suffer from gold PR19002 for which UseGlobalsGC constructor
-        // argument is designed as workaround. Therefore, disable both
-        // ClWithComdat and ClUseGlobalsGC unless the frontend says it's ok to
-        // do globals-gc.
-        UseCtorComdat(UseGlobalsGC && ClWithComdat) {
-          this->Recover = ClRecover.getNumOccurrences() > 0 ?
-              ClRecover : Recover;
-          this->CompileKernel = ClEnableKasan.getNumOccurrences() > 0 ?
-              ClEnableKasan : CompileKernel;
-  }
+AddressSanitizerModule::AddressSanitizerModule(bool CompileKernel, bool Recover,
+                                               bool UseGlobalsGC)
+    : UseGlobalsGC(UseGlobalsGC && ClUseGlobalsGC),
+  this->Recover = ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover;
+  this->CompileKernel =
+      ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan : CompileKernel;
 
-  bool runOnModule(Module &M) override;
-  StringRef getPassName() const override { return "AddressSanitizerModule"; }
+void GlobalsMetadata::init(Module &M) {
+  assert(!inited_);
+  inited_ = true;
+  NamedMDNode *Globals = M.getNamedMetadata("llvm.asan.globals");
+  if (!Globals)
+    return;
+  for (auto MDN : Globals->operands()) {
+    // Metadata node contains the global and the fields of "Entry".
+    assert(MDN->getNumOperands() == 5);
+    auto *GV = mdconst::extract_or_null<GlobalVariable>(MDN->getOperand(0));
+    // The optimizer may optimize away a global entirely.
+    if (!GV)
+      continue;
+    // We can already have an entry for GV if it was merged with another
+    // global.
+    Entry &E = Entries[GV];
+    if (auto *Loc = cast_or_null<MDNode>(MDN->getOperand(1)))
+      E.SourceLoc.parse(Loc);
+    if (auto *Name = cast_or_null<MDString>(MDN->getOperand(2)))
+      E.Name = Name->getString();
+    ConstantInt *IsDynInit = mdconst::extract<ConstantInt>(MDN->getOperand(3));
+    E.IsDynInit |= IsDynInit->isOne();
+    ConstantInt *IsBlacklisted =
+        mdconst::extract<ConstantInt>(MDN->getOperand(4));
+    E.IsBlacklisted |= IsBlacklisted->isOne();
+  }
+}
 
-private:
-  void initializeCallbacks(Module &M);
+namespace {
 
-  bool InstrumentGlobals(IRBuilder<> &IRB, Module &M, bool *CtorComdat);
-  void InstrumentGlobalsCOFF(IRBuilder<> &IRB, Module &M,
-                             ArrayRef<GlobalVariable *> ExtendedGlobals,
-                             ArrayRef<Constant *> MetadataInitializers);
-  void InstrumentGlobalsELF(IRBuilder<> &IRB, Module &M,
-                            ArrayRef<GlobalVariable *> ExtendedGlobals,
-                            ArrayRef<Constant *> MetadataInitializers,
-                            const std::string &UniqueModuleId);
-  void InstrumentGlobalsMachO(IRBuilder<> &IRB, Module &M,
-                              ArrayRef<GlobalVariable *> ExtendedGlobals,
-                              ArrayRef<Constant *> MetadataInitializers);
-  void
-  InstrumentGlobalsWithMetadataArray(IRBuilder<> &IRB, Module &M,
-                                     ArrayRef<GlobalVariable *> ExtendedGlobals,
-                                     ArrayRef<Constant *> MetadataInitializers);
-
-  GlobalVariable *CreateMetadataGlobal(Module &M, Constant *Initializer,
-                                       StringRef OriginalName);
-  void SetComdatForGlobalMetadata(GlobalVariable *G, GlobalVariable *Metadata,
-                                  StringRef InternalSuffix);
-  IRBuilder<> CreateAsanModuleDtor(Module &M);
-
-  bool ShouldInstrumentGlobal(GlobalVariable *G);
-  bool ShouldUseMachOGlobalsSection() const;
-  StringRef getGlobalMetadataSection() const;
-  void poisonOneInitializer(Function &GlobalInit, GlobalValue *ModuleName);
-  void createInitializerPoisonCalls(Module &M, GlobalValue *ModuleName);
-  size_t MinRedzoneSizeForGlobal() const {
-    return RedzoneSizeForScale(Mapping.Scale);
+// Legacy AddressSanitizer pass. Uses AddressSanitizer compliant with new
+// PassManager infrastructure.
+struct AddressSanitizerLegacy : public FunctionPass {
+  // Pass identification, replacement for typeid
+  static char ID;
+
+  explicit AddressSanitizerLegacy(bool CompileKernel = false,
+                                  bool Recover = false,
+                                  bool UseAfterScope = false)
+      : FunctionPass(ID), Sanitizer(CompileKernel, Recover, UseAfterScope) {}
+
+  StringRef getPassName() const override { return Sanitizer.name(); }
+
+  void getAnalysisUsage(AnalysisUsage &AU) const override {
+    AU.addRequired<DominatorTreeWrapperPass>();
+    AU.addRequired<TargetLibraryInfoWrapperPass>();
   }
-  int GetAsanVersion(const Module &M) const;
 
-  GlobalsMetadata GlobalsMD;
-  bool CompileKernel;
-  bool Recover;
-  bool UseGlobalsGC;
-  bool UseCtorComdat;
-  Type *IntptrTy;
-  LLVMContext *C;
-  Triple TargetTriple;
-  ShadowMapping Mapping;
-  Function *AsanPoisonGlobals;
-  Function *AsanUnpoisonGlobals;
-  Function *AsanRegisterGlobals;
-  Function *AsanUnregisterGlobals;
-  Function *AsanRegisterImageGlobals;
-  Function *AsanUnregisterImageGlobals;
-  Function *AsanRegisterElfGlobals;
-  Function *AsanUnregisterElfGlobals;
+  bool runOnFunction(Function &F) override;
 
-  Function *AsanCtorFunction = nullptr;
-  Function *AsanDtorFunction = nullptr;
+private:
+  AddressSanitizer Sanitizer;
 };
 
+// Legacy AddressSanitizerModule pass. Uses AddressSanitizerModule compliant
+// with new PassManager infrastructure.
+class AddressSanitizerModuleLegacy : public ModulePass {
+public:
+  // Pass identification, replacement for typeid
+  static char ID;
+
+  explicit AddressSanitizerModuleLegacy(bool CompileKernel = false,
+                                        bool Recover = false,
+                                        bool UseGlobalsGC = true)
+      : ModulePass(ID), Sanitizer(CompileKernel, Recover, UseGlobalsGC) {}
+
+  bool runOnModule(Module &M) override { return Sanitizer.instrument(M); }
+
+  StringRef getPassName() const override { return Sanitizer.name(); }
+
+private:
+  AddressSanitizerModule Sanitizer;
+};
+
+} // end anonymous namespace
+
 // Stack poisoning does not play well with exception handling.
 // When an exception is thrown, we essentially bypass the code
 // that unpoisones the stack. This is why the run-time library has
 // to intercept __cxa_throw (as well as longjmp, etc) and unpoison the entire
 // stack in the interceptor. This however does not work inside the
 // actual function which catches the exception. Most likely because the
 // compiler hoists the load of the shadow value somewhere too high.
 // This causes asan to report a non-existing bug on 453.povray.
 // It sounds like an LLVM bug.
-struct FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
+struct llvm::FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
   Function &F;
   AddressSanitizer &ASan;
   DIBuilder DIB;
   LLVMContext *C;
   Type *IntptrTy;
   Type *IntptrPtrTy;
   ShadowMapping Mapping;
 
struct llvm::FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
 
   bool runOnFunction() {
     if (!ClStack) return false;
 
     if (ClRedzoneByvalArgs)
       copyArgsPassedByValToAllocas();
 
     // Collect alloca, ret, lifetime instructions etc.
-    for (BasicBlock *BB : depth_first(&F.getEntryBlock())) visit(*BB);
+    for (BasicBlock *BB : depth_first(&F.getEntryBlock()))
+      this->visit(*BB);
 
     if (AllocaVec.empty() && DynamicAllocaVec.empty()) return false;
 
     initializeCallbacks(*F.getParent());
 
     processDynamicAllocas();
     processStaticAllocas();
 
struct llvm::FunctionStackPoisoner : public InstVisitor<FunctionStackPoisoner> {
   void poisonAlloca(Value *V, uint64_t Size, IRBuilder<> &IRB, bool DoPoison);
 
   Value *createAllocaForLayout(IRBuilder<> &IRB, const ASanStackFrameLayout &L,
                                bool Dynamic);
   PHINode *createPHI(IRBuilder<> &IRB, Value *Cond, Value *ValueIfTrue,
                      Instruction *ThenTerm, Value *ValueIfFalse);
 };
 
-} // end anonymous namespace
-
-char AddressSanitizer::ID = 0;
+char AddressSanitizerLegacy::ID = 0;
 
 INITIALIZE_PASS_BEGIN(
-    AddressSanitizer, "asan",
+    AddressSanitizerLegacy, "asan",
     "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,
     false)
 INITIALIZE_PASS_DEPENDENCY(DominatorTreeWrapperPass)
 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
 INITIALIZE_PASS_END(
-    AddressSanitizer, "asan",
+    AddressSanitizerLegacy, "asan",
     "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,
     false)
 
 FunctionPass *llvm::createAddressSanitizerFunctionPass(bool CompileKernel,
                                                        bool Recover,
                                                        bool UseAfterScope) {
   assert(!CompileKernel || Recover);
-  return new AddressSanitizer(CompileKernel, Recover, UseAfterScope);
+  return new AddressSanitizerLegacy(CompileKernel, Recover, UseAfterScope);
 }
 
-char AddressSanitizerModule::ID = 0;
+char AddressSanitizerModuleLegacy::ID = 0;
 
 INITIALIZE_PASS(
-    AddressSanitizerModule, "asan-module",
+    AddressSanitizerModuleLegacy, "asan-module",
     "AddressSanitizer: detects use-after-free and out-of-bounds bugs."
     "ModulePass",
     false, false)
 
 ModulePass *llvm::createAddressSanitizerModulePass(bool CompileKernel,
                                                    bool Recover,
                                                    bool UseGlobalsGC) {
   assert(!CompileKernel || Recover);
-  return new AddressSanitizerModule(CompileKernel, Recover, UseGlobalsGC);
+  return new AddressSanitizerModuleLegacy(CompileKernel, Recover, UseGlobalsGC);
 }
 
 static size_t TypeSizeToSizeIndex(uint32_t TypeSize) {
   size_t Res = countTrailingZeros(TypeSize / 8);
   assert(Res < kNumberOfAccessSizes);
   return Res;
 }
 
 // Create a constant for Str so that we can pass it to the run-time lib.
 static GlobalVariable *createPrivateGlobalForString(Module &M, StringRef Str,
int AddressSanitizerModule::GetAsanVersion(const Module &M) const {
   bool isAndroid = Triple(M.getTargetTriple()).isAndroid();
   int Version = 8;
   // 32-bit Android is one version ahead because of the switch to dynamic
   // shadow.
   Version += (LongSize == 32 && isAndroid);
   return Version;
 }
 
-bool AddressSanitizerModule::runOnModule(Module &M) {
+PreservedAnalyses AddressSanitizerModule::run(Module &M,
+                                              AnalysisManager<Module> &AM) {
+  return instrument(M) ? PreservedAnalyses::none() : PreservedAnalyses::all();
+}
+
+bool AddressSanitizerModule::instrument(Module &M) {
   C = &(M.getContext());
   int LongSize = M.getDataLayout().getPointerSizeInBits();
   IntptrTy = Type::getIntNTy(*C, LongSize);
   TargetTriple = Triple(M.getTargetTriple());
   Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel);
   initializeCallbacks(M);
 
   if (CompileKernel)
if (UseCtorComdat && TargetTriple.isOSBinFormatELF() && CtorComdat) {
     appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndDtorPriority);
     if (AsanDtorFunction)
       appendToGlobalDtors(M, AsanDtorFunction, kAsanCtorAndDtorPriority);
   }
 
   return Changed;
 }
 
-void AddressSanitizer::initializeCallbacks(Module &M) {
-  IRBuilder<> IRB(*C);
-  // Create __asan_report* callbacks.
-  // IsWrite, TypeSize and Exp are encoded in the function name.
-  for (int Exp = 0; Exp < 2; Exp++) {
-    for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) {
-      const std::string TypeStr = AccessIsWrite ? "store" : "load";
-      const std::string ExpStr = Exp ? "exp_" : "";
-      const std::string EndingStr = Recover ? "_noabort" : "";
-
-      SmallVector<Type *, 3> Args2 = {IntptrTy, IntptrTy};
-      SmallVector<Type *, 2> Args1{1, IntptrTy};
-      if (Exp) {
-        Type *ExpType = Type::getInt32Ty(*C);
-        Args2.push_back(ExpType);
-        Args1.push_back(ExpType);
-      }
-      AsanErrorCallbackSized[AccessIsWrite][Exp] =
-          checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-              kAsanReportErrorTemplate + ExpStr + TypeStr + "_n" + EndingStr,
-              FunctionType::get(IRB.getVoidTy(), Args2, false)));
-
-      AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] =
-          checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-              ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N" + EndingStr,
-              FunctionType::get(IRB.getVoidTy(), Args2, false)));
-
-      for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes;
-           AccessSizeIndex++) {
-        const std::string Suffix = TypeStr + itostr(1ULL << AccessSizeIndex);
-        AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] =
-            checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-                kAsanReportErrorTemplate + ExpStr + Suffix + EndingStr,
-                FunctionType::get(IRB.getVoidTy(), Args1, false)));
-
-        AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] =
-            checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-                ClMemoryAccessCallbackPrefix + ExpStr + Suffix + EndingStr,
-                FunctionType::get(IRB.getVoidTy(), Args1, false)));
-      }
-    }
-  }
-
-  const std::string MemIntrinCallbackPrefix =
-      CompileKernel ? std::string("") : ClMemoryAccessCallbackPrefix;
-  AsanMemmove = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-      MemIntrinCallbackPrefix + "memmove", IRB.getInt8PtrTy(),
-      IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy));
-  AsanMemcpy = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-      MemIntrinCallbackPrefix + "memcpy", IRB.getInt8PtrTy(),
-      IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy));
-  AsanMemset = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-      MemIntrinCallbackPrefix + "memset", IRB.getInt8PtrTy(),
-      IRB.getInt8PtrTy(), IRB.getInt32Ty(), IntptrTy));
-
-  AsanHandleNoReturnFunc = checkSanitizerInterfaceFunction(
-      M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy()));
-
-  AsanPtrCmpFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-      kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy));
-  AsanPtrSubFunction = checkSanitizerInterfaceFunction(M.getOrInsertFunction(
-      kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy));
-  // We insert an empty inline asm after __asan_report* to avoid callback merge.
-  EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
-                            StringRef(""), StringRef(""),
-                            /*hasSideEffects=*/true);
-  if (Mapping.InGlobal)
-    AsanShadowGlobal = M.getOrInsertGlobal("__asan_shadow",
-                                           ArrayType::get(IRB.getInt8Ty(), 0));
-}
-
-// virtual
-bool AddressSanitizer::doInitialization(Module &M) {
-  // Initialize the private fields. No one has accessed them before.
-  GlobalsMD.init(M);
-
-  C = &(M.getContext());
-  LongSize = M.getDataLayout().getPointerSizeInBits();
-  IntptrTy = Type::getIntNTy(*C, LongSize);
-  TargetTriple = Triple(M.getTargetTriple());
-
-  Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel);
-  return true;
-}
-
-bool AddressSanitizer::doFinalization(Module &M) {
-  GlobalsMD.reset();
-  return false;
-}
-
-bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) {
-  // For each NSObject descendant having a +load method, this method is invoked
-  // by the ObjC runtime before any of the static constructors is called.
-  // Therefore we need to instrument such methods with a call to __asan_init
-  // at the beginning in order to initialize our runtime before any access to
-  // the shadow memory.
-  // We cannot just ignore these methods, because they may call other
-  // instrumented functions.
-  if (F.getName().find(" load]") != std::string::npos) {
-    Function *AsanInitFunction =
-        declareSanitizerInitFunction(*F.getParent(), kAsanInitName, {});
-    IRBuilder<> IRB(&F.front(), F.front().begin());
-    IRB.CreateCall(AsanInitFunction, {});
-    return true;
-  }
-  return false;
-}
-
 void AddressSanitizer::maybeInsertDynamicShadowAtFunctionEntry(Function &F) {
   // Generate code only when dynamic addressing is needed.
   if (Mapping.Offset != kDynamicShadowSentinel)
     return;
 
   IRBuilder<> IRB(&F.front().front());
   if (Mapping.InGlobal) {
     if (ClWithIfuncSuppressRemat) {
if (II && II->getIntrinsicID() == Intrinsic::localescape) {
         assert(AI && AI->isStaticAlloca() &&
                "non-static alloca arg to localescape");
         ProcessedAllocas[AI] = false;
       }
       break;
     }
   }
 }
 
-bool AddressSanitizer::runOnFunction(Function &F) {
-  if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage) return false;
-  if (!ClDebugFunc.empty() && ClDebugFunc == F.getName()) return false;
-  if (F.getName().startswith("__asan_")) return false;
+AddressSanitizer::AddressSanitizer(bool CompileKernel, bool Recover,
+                                   bool UseAfterScope)
+    : UseAfterScope(UseAfterScope || ClUseAfterScope) {
+  this->Recover = ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover;
+  this->CompileKernel =
+      ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan : CompileKernel;
+}
+
+PreservedAnalyses AddressSanitizer::run(Function &F,
+                                        AnalysisManager<Function> &AM) {
+  DominatorTree *DT = &AM.getResult<DominatorTreeAnalysis>(F);
+  const TargetLibraryInfo *TLI = &AM.getResult<TargetLibraryAnalysis>(F);
+  return instrument(F, DT, TLI) ? PreservedAnalyses::none()
+                                : PreservedAnalyses::all();
+}
+
+bool AddressSanitizer::instrument(Function &F, DominatorTree *DTree,
+                                  const TargetLibraryInfo *TLI) {
+  if (!Inited) {
+    // Initialize the private fields. No one has accessed them before.
+    Module &M = *F.getParent();
+    GlobalsMD.init(M);
+
+    C = &(M.getContext());
+    LongSize = M.getDataLayout().getPointerSizeInBits();
+    IntptrTy = Type::getIntNTy(*C, LongSize);
+    TargetTriple = Triple(M.getTargetTriple());
+
+    Mapping = getShadowMapping(TargetTriple, LongSize, CompileKernel);
+    Inited = true;
+  }
+
+  if (F.getLinkage() == GlobalValue::AvailableExternallyLinkage)
+    return false;
+  if (!ClDebugFunc.empty() && ClDebugFunc == F.getName())
+    return false;
+  if (F.getName().startswith("__asan_"))
+    return false;
 
   bool FunctionModified = false;
 
   // If needed, insert __asan_init before checking for SanitizeAddress attr.
   // This function needs to be called even if the function body is not
   // instrumented.
   if (maybeInsertAsanInitAtFunctionEntry(F))
     FunctionModified = true;
 
   // Leave if the function doesn't need instrumentation.
-  if (!F.hasFnAttribute(Attribute::SanitizeAddress)) return FunctionModified;
+  if (!F.hasFnAttribute(Attribute::SanitizeAddress))
+    return FunctionModified;
 
   LLVM_DEBUG(dbgs() << "ASAN instrumenting:\n" << F << "\n");
 
   initializeCallbacks(*F.getParent());
-  DT = &getAnalysis<DominatorTreeWrapperPass>().getDomTree();
+  DT = DTree;
 
   FunctionStateRAII CleanupObj(this);
 
   maybeInsertDynamicShadowAtFunctionEntry(F);
 
   // We can't instrument allocas used with llvm.localescape. Only static allocas
   // can be passed to that intrinsic.
   markEscapedLocalAllocas(F);
 
   // We want to instrument every address only once per basic block (unless there
   // are calls between uses).
   SmallPtrSet<Value *, 16> TempsToInstrument;
   SmallVector<Instruction *, 16> ToInstrument;
   SmallVector<Instruction *, 8> NoReturnCalls;
   SmallVector<BasicBlock *, 16> AllBlocks;
   SmallVector<Instruction *, 16> PointerComparisonsOrSubtracts;
   int NumAllocas = 0;
   bool IsWrite;
   unsigned Alignment;
   uint64_t TypeSize;
-  const TargetLibraryInfo *TLI =
-      &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
 
   // Fill the set of memory operations to instrument.
   for (auto &BB : F) {
     AllBlocks.push_back(&BB);
     TempsToInstrument.clear();
     int NumInsnsPerBB = 0;
     for (auto &Inst : BB) {
       if (LooksLikeCodeInBug11395(&Inst)) return false;
if (NumInstrumented > 0 || ChangedStack || !NoReturnCalls.empty())
     FunctionModified = true;
 
   LLVM_DEBUG(dbgs() << "ASAN done instrumenting: " << FunctionModified << " "
                     << F << "\n");
 
   return FunctionModified;
 }
 
+bool AddressSanitizerLegacy::runOnFunction(Function &F) {
+  DominatorTree *DTree = &getAnalysis<DominatorTreeWrapperPass>().getDomTree();
+  const TargetLibraryInfo *TLI =
+      &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI();
+  return Sanitizer.instrument(F, DTree, TLI);
+}
+
 // Workaround for bug 11395: we don't want to instrument stack in functions
 // with large assembly blobs (32-bit only), otherwise reg alloc may crash.
 // FIXME: remove once the bug 11395 is fixed.
 bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) {
   if (LongSize != 32) return false;
   CallInst *CI = dyn_cast<CallInst>(I);
   if (!CI || !CI->isInlineAsm()) return false;
   if (CI->getNumArgOperands() <= 5) return false;

lib/Transforms/Instrumentation/Instrumentation.cpp

if (KeepInEntry)
       IP = moveBeforeInsertPoint(I, IP);
   }
   return IP;
 }
 
 /// initializeInstrumentation - Initialize all passes in the TransformUtils
 /// library.
 void llvm::initializeInstrumentation(PassRegistry &Registry) {
-  initializeAddressSanitizerPass(Registry);
-  initializeAddressSanitizerModulePass(Registry);
+  initializeAddressSanitizerLegacyPass(Registry);
+  initializeAddressSanitizerModuleLegacyPass(Registry);
   initializeBoundsCheckingLegacyPassPass(Registry);
   initializeControlHeightReductionLegacyPassPass(Registry);
   initializeGCOVProfilerLegacyPassPass(Registry);
   initializePGOInstrumentationGenLegacyPassPass(Registry);
   initializePGOInstrumentationUseLegacyPassPass(Registry);
   initializePGOIndirectCallPromotionLegacyPassPass(Registry);
   initializePGOMemOPSizeOptLegacyPassPass(Registry);
   initializeInstrProfilingLegacyPassPass(Registry);

test/Instrumentation/AddressSanitizer/basic.ll

 ; Test basic address sanitizer instrumentation.
 ;
 ; RUN: opt < %s -asan -asan-module -S | FileCheck --check-prefixes=CHECK,CHECK-S3 %s
+; RUN: opt < %s -passes='function(asan),module(asan-module)' -S | FileCheck --check-prefixes=CHECK,CHECK-S3 %s
 ; RUN: opt < %s -asan -asan-module -asan-mapping-scale=5 -S | FileCheck --check-prefixes=CHECK,CHECK-S5 %s
+; RUN: opt < %s -passes='function(asan),module(asan-module)' -asan-mapping-scale=5 -S | FileCheck --check-prefixes=CHECK,CHECK-S5 %s
 
 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64"
 target triple = "x86_64-unknown-linux-gnu"
 ; CHECK: @llvm.global_ctors = {{.*}}@asan.module_ctor
 
 define i32 @test_load(i32* %a) sanitize_address {
 ; CHECK-LABEL: @test_load
 ; CHECK-NOT: load