Inline asm constraints: allow ICE-like pointers for the "n" constraint (PR40890)

[hans]

Summary

Apparently GCC allows this, and there's code relying on it (see bug, which is a release blocker for llvm 8).

The idea is to allow expression that would have been allowed if they were cast to int. So I based the code on how such a cast would be done (the CK_PointerToIntegral case in IntExprEvaluator::VisitCastExpr()).

I'm unfamiliar with this code, especially the LValue variant of APValue, so please take a careful look.

[void]

My opinion doesn't carry as much weight as others who are more familiar with the front-end code, but LGTM.

One question, the code you added looks similar. Is there a way to extrapolate it into its own function? Maybe yet another EvaluateAs* method?

clang/lib/Sema/SemaStmtAsm.cpp

389 ↗

(On Diff #188887)

s/allows/allow/

[efriedma]

clang/lib/CodeGen/CGStmt.cpp

1852 ↗

(On Diff #188887)

This always returns an APSInt with width 64; is that really right? I guess it might not really matter given that it's only going to be used as an immediate constant anyway, but it seems weird.

clang/lib/Sema/SemaStmtAsm.cpp

394 ↗

(On Diff #188887)

APValue::isNullPointer() asserts that the value is an LValue; do you need to check for that explicitly here?

399 ↗

(On Diff #188887)

I think it makes sense to add a method to APValue specifically to do the conversion from LValue to an APSInt, whether or not isNullPointer() is true, and use it both here and in IntExprEvaluator::VisitCastExpr in lib/AST/ExprConstant.cpp. The logic is sort of subtle (and I'm not completely sure it's right for targets where null is not zero, but you shouldn't try to fix that here).

[joerg]

Can you include a patch for something like (int *)0xdeadbeeeeeef on amd64? That's a valid value for "n", but clearly too large for int. Thanks for looking at this, it is one of the two large remaining show stoppers for the asm constraint check.

[hans]

In D58821#1416212, @joerg wrote:

Can you include a patch for something like (int *)0xdeadbeeeeeef on amd64? That's a valid value for "n", but clearly too large for int. Thanks for looking at this, it is one of the two large remaining show stoppers for the asm constraint check.

You mean to check that we don't truncate or otherwise choke on it? Sure, I'll add it.

clang/lib/CodeGen/CGStmt.cpp

1852 ↗

(On Diff #188887)

I agree it seems a little strange, but I think in practice it's correct. EVResult.Val.getLValueOffset().getQuantity() returns an int64_t, so we're not losing any data.

The code that I lifted this from, is using the bitwidth of the casted-to integer type for the result. But it's still only got maximum 64 bits since the source, getLValueOffset().getQuantity(), is the same.

clang/lib/Sema/SemaStmtAsm.cpp

389 ↗

(On Diff #188887)

Done.

394 ↗

(On Diff #188887)

Yes I do. Thanks!

399 ↗

(On Diff #188887)

I agree (and this was also Bill's suggestion above) that it would be nice to have a utility method for this.

I'm not sure adding one to APValue would work for IntExprEvaluator::VisitCastExpr though, since that code is actually using its own LValue class, not an APValue until it's time to return a result.

I frankly also doesn't fully understand what that code is doing. If the LValue has a base value, it seems to just take that as result and ignore any offset? This is unknown territory to me, but the way I read it, if there's an lvalue base, the expression isn't going to come out as an integer constant. I think.

About null pointers, I'm calling getTargetNullPointerValue() so I think that should be okay, no?

[hans]

Address comments.

[hans]

In D58821#1416212, @joerg wrote:

Can you include a patch for something like (int *)0xdeadbeeeeeef on amd64? That's a valid value for "n", but clearly too large for int. Thanks for looking at this, it is one of the two large remaining show stoppers for the asm constraint check.

What's the other show stopper? Is that also something that regressed from the previous release since the "n" constraint got stricter?

[joerg]

The other problem is that we don't use the CFG machinery to prune dead branches. Consider the x86 in/out instructions: one variant takes an immediate, the other a register. The classic way to deal with that is something like

static inline void outl(unsigned port, uint32_t value)
{
  if (__builtin_constant_p(port) && port < 0x100) {
    __asm volatile("outl %0,%w1" : : "a" (data), "id" (port));
  } else {
   __asm volatile("outl %0,%w1" : : "a" (data), "d" (port));
  }
}

This fails with the new asm constraint checks, since the dead branch is never pruned. For other architectures it makes an even greater difference. The main reason it is a show stopper: there is no sane workaround that doesn't regress code quality.

[efriedma]

This fails with the new asm constraint checks, since the dead branch is never pruned.

As far as I know, we didn't touch "i", only "n". Is there a bug filed for the issue you're describing?

clang/lib/CodeGen/CGStmt.cpp

1852 ↗

(On Diff #188887)

The concern isn't that we would lose data. I'm more concerned the backend might not be prepared for a value of the "wrong" width.

clang/lib/Sema/SemaStmtAsm.cpp

399 ↗

(On Diff #188887)

Oh, I didn't realize IntExprEvaluator::VisitCastExpr wasn't using the same class to represent the value; that makes it harder to usefully refactor. But still, it would be good to reduce the duplicated code between here and CodeGen.

If the LValue has a base value, it seems to just take that as result and ignore any offset?

If there's a base value, it returns the whole LValue, including the base and offset.

I'm calling getTargetNullPointerValue() so I think that should be okay

The issue would be the case where you have a null pointer with an offset, like the case in the bug. It's sort of inconsistent if null==-1, but null+1==1. But it's not something we handle consistently elsewhere, anyway, so I guess we can ignore it for now.

[joerg]

Well, that was a sample to illustrate the point. A full working (and now failing) example is:

static inline void outl(unsigned port, unsigned data) {
  if (__builtin_constant_p(port) && port < 0x100) {
    __asm volatile("outl %0,%w1" : : "a"(data), "n"(port));
  } else {
    __asm volatile("outl %0,%w1" : : "a"(data), "d"(port));
  }
}

void f(unsigned port) { outl(1, 1); }

[hans]

clang/lib/CodeGen/CGStmt.cpp

1852 ↗

(On Diff #188887)

Oh, I see. I'll change the code to use ASTContext::MakeIntValue with the source type. Apparently this works even if the source type is a pointer type; I guess that yields an integer of the same width. I think maybe that's the best we can do?

clang/lib/Sema/SemaStmtAsm.cpp

399 ↗

(On Diff #188887)

Ah, the null pointer issue is interesting, but like you say we don't seem to handle this in the cast code I was inspired by here either.

[hans]

Extract code to a new method in APValue.

Eli, what do you think about something like this? Suggestions for better name welcome :-)

[efriedma]

LGTM

include/clang/AST/APValue.h

public:
   APSInt &getInt() {
     assert(isInt() && "Invalid accessor");
     return *(APSInt*)(char*)Data.buffer;
   }
   const APSInt &getInt() const {
     return const_cast<APValue*>(this)->getInt();
   }
 
+  /// Try to convert this value to an integral constant. This works if it's an
+  /// integer, null pointer, or offset from a null pointer. Returns true on
+  /// success.
+  bool toIntegralConstant(APSInt &Result, QualType SrcTy,
+                          const ASTContext &Ctx) const;
+
   APFloat &getFloat() {
     assert(isFloat() && "Invalid accessor");
     return *(APFloat*)(char*)Data.buffer;
   }
   const APFloat &getFloat() const {
     return const_cast<APValue*>(this)->getFloat();
   }
 

lib/AST/APValue.cpp

 std::string APValue::getAsString(ASTContext &Ctx, QualType Ty) const {
   std::string Result;
   llvm::raw_string_ostream Out(Result);
   printPretty(Out, Ctx, Ty);
   Out.flush();
   return Result;
 }
 
+bool APValue::toIntegralConstant(APSInt &Result, QualType SrcTy,
+                                 const ASTContext &Ctx) const {
+  if (isInt()) {
+    Result = getInt();
+    return true;
+  }
+
+  if (isLValue() && isNullPointer()) {
+    Result = Ctx.MakeIntValue(Ctx.getTargetNullPointerValue(SrcTy), SrcTy);
+    return true;
+  }
+
+  if (isLValue() && !getLValueBase()) {
+    Result = Ctx.MakeIntValue(getLValueOffset().getQuantity(), SrcTy);
+    return true;
+  }
+
+  return false;
+}
+
 const APValue::LValueBase APValue::getLValueBase() const {
   assert(isLValue() && "Invalid accessor");
   return ((const LV*)(const void*)Data.buffer)->Base;
 }
 
 bool APValue::isLValueOnePastTheEnd() const {
   assert(isLValue() && "Invalid accessor");
   return ((const LV*)(const void*)Data.buffer)->IsOnePastTheEnd;

lib/AST/ExprConstant.cpp

if (LV.getLValueBase()) {
       if (Info.Ctx.getTypeSize(DestType) != Info.Ctx.getTypeSize(SrcType))
         return Error(E);
 
       LV.Designator.setInvalid();
       LV.moveInto(Result);
       return true;
     }
 
-    uint64_t V;
-    if (LV.isNullPointer())
-      V = Info.Ctx.getTargetNullPointerValue(SrcType);
-    else
-      V = LV.getLValueOffset().getQuantity();
+    APSInt AsInt;
+    APValue V;
+    LV.moveInto(V);
+    if (!V.toIntegralConstant(AsInt, SrcType, Info.Ctx))
+      llvm_unreachable("Can't cast this!");
 
-    APSInt AsInt = Info.Ctx.MakeIntValue(V, SrcType);
     return Success(HandleIntToIntCast(Info, E, DestType, SrcType, AsInt), E);
   }
 
   case CK_IntegralComplexToReal: {
     ComplexValue C;
     if (!EvaluateComplex(SubExpr, C, Info))
       return false;
     return Success(C.getComplexIntReal(), E);

lib/CodeGen/CGStmt.cpp

 llvm::Value* CodeGenFunction::EmitAsmInput(
                                          const TargetInfo::ConstraintInfo &Info,
                                            const Expr *InputExpr,
                                            std::string &ConstraintStr) {
   // If this can't be a register or memory, i.e., has to be a constant
   // (immediate or symbolic), try to emit it as such.
   if (!Info.allowsRegister() && !Info.allowsMemory()) {
     if (Info.requiresImmediateConstant()) {
-      llvm::APSInt AsmConst = InputExpr->EvaluateKnownConstInt(getContext());
-      return llvm::ConstantInt::get(getLLVMContext(), AsmConst);
+      Expr::EvalResult EVResult;
+      InputExpr->EvaluateAsRValue(EVResult, getContext(), true);
+
+      llvm::APSInt IntResult;
+      if (!EVResult.Val.toIntegralConstant(IntResult, InputExpr->getType(),
+                                           getContext()))
+        llvm_unreachable("Invalid immediate constant!");
+
+      return llvm::ConstantInt::get(getLLVMContext(), IntResult);
     }
 
     Expr::EvalResult Result;
     if (InputExpr->EvaluateAsInt(Result, getContext()))
       return llvm::ConstantInt::get(getLLVMContext(), Result.Val.getInt());
   }
 
   if (Info.allowsRegister() || !Info.allowsMemory())

lib/Sema/SemaStmtAsm.cpp

if (Info.allowsMemory() && !Info.allowsRegister()) {
                          << InputExpr->getSourceRange());
     } else if (Info.requiresImmediateConstant() && !Info.allowsRegister()) {
       if (!InputExpr->isValueDependent()) {
         Expr::EvalResult EVResult;
         if (!InputExpr->EvaluateAsRValue(EVResult, Context, true))
           return StmtError(
               Diag(InputExpr->getBeginLoc(), diag::err_asm_immediate_expected)
               << Info.getConstraintStr() << InputExpr->getSourceRange());
-        llvm::APSInt Result = EVResult.Val.getInt();
-        if (!Info.isValidAsmImmediate(Result))
+
+        // For compatibility with GCC, we also allow pointers that would be
+        // integral constant expressions if they were cast to int.
+        llvm::APSInt IntResult;
+        if (!EVResult.Val.toIntegralConstant(IntResult, InputExpr->getType(),
+                                             Context))
+          return StmtError(
+              Diag(InputExpr->getBeginLoc(), diag::err_asm_immediate_expected)
+              << Info.getConstraintStr() << InputExpr->getSourceRange());
+
+        if (!Info.isValidAsmImmediate(IntResult))
           return StmtError(Diag(InputExpr->getBeginLoc(),
                                 diag::err_invalid_asm_value_for_constraint)
-                           << Result.toString(10) << Info.getConstraintStr()
+                           << IntResult.toString(10) << Info.getConstraintStr()
                            << InputExpr->getSourceRange());
       }
 
     } else {
       ExprResult Result = DefaultFunctionArrayLvalueConversion(Exprs[i]);
       if (Result.isInvalid())
         return StmtError();
 

test/CodeGen/x86-64-inline-asm.c

 // REQUIRES: x86-registered-target
 // RUN: %clang_cc1 -triple x86_64 %s -S -o /dev/null -DWARN -verify
 // RUN: %clang_cc1 -triple x86_64 %s -S -o /dev/null -Werror -verify
+// RUN: %clang_cc1 -triple x86_64-linux-gnu %s -S -o - | FileCheck %s
 void f() {
   asm("movaps %xmm3, (%esi, 2)");
 // expected-note@1 {{instantiated into assembly here}}
 #ifdef WARN
 // expected-warning@-3 {{scale factor without index register is ignored}}
 #else
 // expected-error@-5 {{scale factor without index register is ignored}}
 #endif
 }
 
 static unsigned var[1] = {};
 void g(void) { asm volatile("movd %%xmm0, %0"
                             :
                             : "m"(var)); }
+
+void pr40890(void) {
+  struct s {
+    int a, b;
+  } s;
+  __asm__ __volatile__("\n#define S_A abcd%0\n" : : "n"(&((struct s*)0)->a));
+  __asm__ __volatile__("\n#define S_B abcd%0\n" : : "n"(&((struct s*)0)->b));
+  __asm__ __volatile__("\n#define BEEF abcd%0\n" : : "n"((int*)0xdeadbeeeeeef));
+
+// CHECK-LABEL: pr40890
+// CHECK: #define S_A abcd$0
+// CHECK: #define S_B abcd$4
+// CHECK: #define BEEF abcd$244837814038255
+}

test/Sema/inline-asm-validate-x86.c

 // RUN: %clang_cc1 -triple i686 -fsyntax-only -verify %s
-// RUN: %clang_cc1 -triple x86_64 -fsyntax-only -verify %s
+// RUN: %clang_cc1 -triple x86_64 -fsyntax-only -verify -DAMD64 %s
 
 void I(int i, int j) {
   static const int BelowMin = -1;
   static const int AboveMax = 32;
   __asm__("xorl %0,%2"
           : "=r"(i)
           : "0"(i), "I"(j)); // expected-error{{constraint 'I' expects an integer constant expression}}
   __asm__("xorl %0,%2"
void O(int i, int j) {
   __asm__("xorl %0,%2"
           : "=r"(i)
           : "0"(i), "O"(AboveMax)); // expected-error{{value '128' out of range for constraint 'O'}}
   __asm__("xorl %0,%2"
           : "=r"(i)
           : "0"(i), "O"(64)); // expected-no-error
 }
 
+void pr40890(void) {
+  struct s {
+    int a, b;
+  };
+  static struct s s;
+  // This null pointer can be used as an integer constant expression.
+  __asm__ __volatile__("\n#define S_A abcd%0\n" : : "n"(&((struct s*)0)->a));
+  // This offset-from-null pointer can be used as an integer constant expression.
+  __asm__ __volatile__("\n#define S_B abcd%0\n" : : "n"(&((struct s*)0)->b));
+  // This pointer cannot be used as an integer constant expression.
+  __asm__ __volatile__("\n#define GLOBAL_A abcd%0\n" : : "n"(&s.a)); // expected-error{{constraint 'n' expects an integer constant expression}}
+  // Floating-point is also not okay.
+  __asm__ __volatile__("\n#define PI abcd%0\n" : : "n"(3.14f)); // expected-error{{constraint 'n' expects an integer constant expression}}
+#ifdef AMD64
+  // This arbitrary pointer is fine.
+  __asm__ __volatile__("\n#define BEEF abcd%0\n" : : "n"((int*)0xdeadbeeeeeef));
+#endif
+}