[WebAssembly] Implement Address Sanitizer for Emscripten

[quantum]

Summary

This diff enables address sanitizer on Emscripten.

On Emscripten, real memory starts at the value passed to --global-base.

All memory before this is used as shadow memory, and thus the shadow mapping
function is simply dividing by 8.

[sbc100]

lld/wasm/Writer.cpp

228

Surly if emscripten is passing in --global-base it already knows this value?

Otherwise lgtm. Perhaps split of the lld part into a separate change?

[sbc100]

I wonder if we should use the linux/unix convention or edata etext and end? Terrible names obviously but there is precedent. I can't remember why I didn't do that for data_end and heap_base.

If not, then perhaps this should be called data_start to match the existing data_end? Of course this means that command line flag is somewhat misnamed then.

[quantum]

As for the name, I think __global_base matches the command line flag and makes it more clear what controls it, so I lean towards that.

lld/wasm/Writer.cpp

228

In theory, emscripten knows this value. But as some library code needs this information, the alternative would be to have build an object file with this information and link it in. Since we already have __data_end and __heap_base, I think it makes sense for this information to be available too.

[quantum]

Split wasm-ld change into D63833.

[sbc100]

Remember to remove "A symbol __global_base is added so that code may know where the shadow
memory ends and real memory begins." from the CL description.

clang/lib/Driver/ToolChains/WebAssembly.cpp

void WebAssembly::AddCXXStdlibLibArgs(const llvm::opt::ArgList &Args,
   case ToolChain::CST_Libstdcxx:
     llvm_unreachable("invalid stdlib name");
   }
 }
 
 SanitizerMask WebAssembly::getSupportedSanitizers() const {
   SanitizerMask Res = ToolChain::getSupportedSanitizers();
   if (getTriple().isOSEmscripten()) {
-    Res |= SanitizerKind::Vptr | SanitizerKind::Leak;
+    Res |= SanitizerKind::Vptr | SanitizerKind::Leak | SanitizerKind::Address;
   }
   return Res;
 }
 
 Tool *WebAssembly::buildLinker() const {
   return new tools::wasm::Linker(*this);
 }

clang/test/Driver/wasm-toolchain.c

 // '-pthread' sets '-target-feature +atomics' and '--shared-memory'
 // RUN: %clang -### -no-canonical-prefixes -target wasm32-unknown-unknown --sysroot=/foo %s -fuse-ld=wasm-ld -pthread 2>&1 | FileCheck -check-prefix=PTHREAD %s
 // PTHREAD: clang{{.*}}" "-cc1" {{.*}} "-target-feature" "+atomics"
 // PTHREAD: wasm-ld{{.*}}" "-lpthread" "--shared-memory"
 
 // '-pthread' not allowed with '-mno-atomics'
 // RUN: %clang -### -no-canonical-prefixes -target wasm32-unknown-unknown --sysroot=/foo %s -pthread -mno-atomics 2>&1 | FileCheck -check-prefix=PTHREAD_NO_ATOMICS %s
 // PTHREAD_NO_ATOMICS: invalid argument '-pthread' not allowed with '-mno-atomics'
+
+// RUN: %clang %s -### -fsanitize=address -target wasm32-unknown-emscripten 2>&1 | FileCheck -check-prefix=CHECK-ASAN-EMSCRIPTEN %s
+// CHECK-ASAN-EMSCRIPTEN: "-fsanitize=address"
+// CHECK-ASAN-EMSCRIPTEN: "-fsanitize-address-globals-dead-stripping"

lld/test/wasm/global-base.ll

+; RUN: llc -filetype=obj %s -o %t.o
+
+target triple = "wasm32-unknown-unknown"
+
+; RUN: wasm-ld -no-gc-sections --export=__global_base --export=__data_end --allow-undefined --no-entry -o %t.wasm %t.o
+; RUN: obj2yaml %t.wasm | FileCheck %s  -check-prefix=CHECK-1024
+; CHECK-1024:       - Type:            GLOBAL
+; CHECK-1024-NEXT:    Globals:         
+; CHECK-1024-NEXT:      - Index:           0
+; CHECK-1024-NEXT:        Type:            I32
+; CHECK-1024-NEXT:        Mutable:         true
+; CHECK-1024-NEXT:        InitExpr:        
+; CHECK-1024-NEXT:          Opcode:          I32_CONST
+; CHECK-1024-NEXT:          Value:           66560
+; CHECK-1024-NEXT:      - Index:           1
+; CHECK-1024-NEXT:        Type:            I32
+; CHECK-1024-NEXT:        Mutable:         false
+; CHECK-1024-NEXT:        InitExpr:        
+; CHECK-1024-NEXT:          Opcode:          I32_CONST
+; CHECK-1024-NEXT:          Value:           1024
+; CHECK-1024-NEXT:      - Index:           2
+; CHECK-1024-NEXT:        Type:            I32
+; CHECK-1024-NEXT:        Mutable:         false
+; CHECK-1024-NEXT:        InitExpr:        
+; CHECK-1024-NEXT:          Opcode:          I32_CONST
+; CHECK-1024-NEXT:          Value:           1024
+
+; CHECK-1024:       - Type:            EXPORT
+; CHECK-1024-NEXT:    Exports:         
+; CHECK-1024-NEXT:      - Name:            memory
+; CHECK-1024-NEXT:        Kind:            MEMORY
+; CHECK-1024-NEXT:        Index:           0
+; CHECK-1024-NEXT:      - Name:            __data_end
+; CHECK-1024-NEXT:        Kind:            GLOBAL
+; CHECK-1024-NEXT:        Index:           1
+; CHECK-1024-NEXT:      - Name:            __global_base
+; CHECK-1024-NEXT:        Kind:            GLOBAL
+; CHECK-1024-NEXT:        Index:           2
+
+; RUN: wasm-ld -no-gc-sections --export=__global_base --export=__data_end --allow-undefined --global-base=16777216 --no-entry -o %t.wasm %t.o
+; RUN: obj2yaml %t.wasm | FileCheck %s  -check-prefix=CHECK-16777216
+; CHECK-16777216:       - Type:            GLOBAL
+; CHECK-16777216-NEXT:    Globals:         
+; CHECK-16777216-NEXT:      - Index:           0
+; CHECK-16777216-NEXT:        Type:            I32
+; CHECK-16777216-NEXT:        Mutable:         true
+; CHECK-16777216-NEXT:        InitExpr:        
+; CHECK-16777216-NEXT:          Opcode:          I32_CONST
+; CHECK-16777216-NEXT:          Value:           16842752
+; CHECK-16777216-NEXT:      - Index:           1
+; CHECK-16777216-NEXT:        Type:            I32
+; CHECK-16777216-NEXT:        Mutable:         false
+; CHECK-16777216-NEXT:        InitExpr:        
+; CHECK-16777216-NEXT:          Opcode:          I32_CONST
+; CHECK-16777216-NEXT:          Value:           16777216
+; CHECK-16777216-NEXT:      - Index:           2
+; CHECK-16777216-NEXT:        Type:            I32
+; CHECK-16777216-NEXT:        Mutable:         false
+; CHECK-16777216-NEXT:        InitExpr:        
+; CHECK-16777216-NEXT:          Opcode:          I32_CONST
+; CHECK-16777216-NEXT:          Value:           16777216
+
+; CHECK-16777216:       - Type:            EXPORT
+; CHECK-16777216-NEXT:    Exports:         
+; CHECK-16777216-NEXT:      - Name:            memory
+; CHECK-16777216-NEXT:        Kind:            MEMORY
+; CHECK-16777216-NEXT:        Index:           0
+; CHECK-16777216-NEXT:      - Name:            __data_end
+; CHECK-16777216-NEXT:        Kind:            GLOBAL
+; CHECK-16777216-NEXT:        Index:           1
+; CHECK-16777216-NEXT:      - Name:            __global_base
+; CHECK-16777216-NEXT:        Kind:            GLOBAL
+; CHECK-16777216-NEXT:        Index:           2

lld/wasm/Driver.cpp

if (Config->Shared) {
     StackPointer->Live = true;
     // For non-PIC code
     // TODO(sbc): Remove WASM_SYMBOL_VISIBILITY_HIDDEN when the mutable global
     // spec proposal is implemented in all major browsers.
     // See: https://github.com/WebAssembly/mutable-global
     WasmSym::StackPointer = Symtab->addSyntheticGlobal(
         "__stack_pointer", WASM_SYMBOL_VISIBILITY_HIDDEN, StackPointer);
     WasmSym::DataEnd = Symtab->addOptionalDataSymbol("__data_end");
+    WasmSym::GlobalBase = Symtab->addOptionalDataSymbol("__global_base");
     WasmSym::HeapBase = Symtab->addOptionalDataSymbol("__heap_base");
   }
 
   if (Config->Pic) {
     // For PIC code, we import two global variables (__memory_base and
     // __table_base) from the environment and use these as the offset at
     // which to load our static data and function table.
     // See:

lld/wasm/Symbols.h

public:
   const WasmSignature *Signature = nullptr;
 
 private:
   llvm::object::Archive::Symbol ArchiveSymbol;
 };
 
 // linker-generated symbols
 struct WasmSym {
+  // __global_base
+  // Symbol marking the start of the global section.
+  static DefinedData *GlobalBase;
+
   // __stack_pointer
   // Global that holds the address of the top of the explicit value stack in
   // linear memory.
   static GlobalSymbol *StackPointer;
 
   // __data_end
   // Symbol marking the end of the data and bss.
   static DefinedData *DataEnd;

lld/wasm/Symbols.cpp

 using namespace llvm::wasm;
 using namespace lld;
 using namespace lld::wasm;
 
 DefinedFunction *WasmSym::CallCtors;
 DefinedFunction *WasmSym::ApplyRelocs;
 DefinedData *WasmSym::DsoHandle;
 DefinedData *WasmSym::DataEnd;
+DefinedData *WasmSym::GlobalBase;
 DefinedData *WasmSym::HeapBase;
 GlobalSymbol *WasmSym::StackPointer;
 UndefinedGlobal *WasmSym::TableBase;
 UndefinedGlobal *WasmSym::MemoryBase;
 
 WasmSymbolType Symbol::getWasmType() const {
   if (isa<FunctionSymbol>(this))
     return WASM_SYMBOL_TYPE_FUNCTION;

lld/wasm/Writer.cpp

void Writer::layoutMemory() {
 
   if (Config->StackFirst) {
     PlaceStack();
   } else {
     MemoryPtr = Config->GlobalBase;
     log("mem: global base = " + Twine(Config->GlobalBase));
   }
 
+  if (WasmSym::GlobalBase)
+    WasmSym::GlobalBase->setVirtualAddress(Config->GlobalBase);
+
   uint32_t DataStart = MemoryPtr;
 
   // Arbitrarily set __dso_handle handle to point to the start of the data
   // segments.
   if (WasmSym::DsoHandle)
     WasmSym::DsoHandle->setVirtualAddress(DataStart);
 
   Out.DylinkSec->MemAlign = 0;

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

 static const uint64_t kAArch64_ShadowOffset64 = 1ULL << 36;
 static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30;
 static const uint64_t kFreeBSD_ShadowOffset64 = 1ULL << 46;
 static const uint64_t kNetBSD_ShadowOffset32 = 1ULL << 30;
 static const uint64_t kNetBSD_ShadowOffset64 = 1ULL << 46;
 static const uint64_t kNetBSDKasan_ShadowOffset64 = 0xdfff900000000000;
 static const uint64_t kPS4CPU_ShadowOffset64 = 1ULL << 40;
 static const uint64_t kWindowsShadowOffset32 = 3ULL << 28;
+static const uint64_t kEmscriptenShadowOffset = 0;
 
 static const uint64_t kMyriadShadowScale = 5;
 static const uint64_t kMyriadMemoryOffset32 = 0x80000000ULL;
 static const uint64_t kMyriadMemorySize32 = 0x20000000ULL;
 static const uint64_t kMyriadTagShift = 29;
 static const uint64_t kMyriadDDRTag = 4;
 static const uint64_t kMyriadCacheBitMask32 = 0x40000000ULL;
 
static ShadowMapping getShadowMapping(Triple &TargetTriple, int LongSize,
   bool IsX86_64 = TargetTriple.getArch() == Triple::x86_64;
   bool IsMIPS32 = TargetTriple.isMIPS32();
   bool IsMIPS64 = TargetTriple.isMIPS64();
   bool IsArmOrThumb = TargetTriple.isARM() || TargetTriple.isThumb();
   bool IsAArch64 = TargetTriple.getArch() == Triple::aarch64;
   bool IsWindows = TargetTriple.isOSWindows();
   bool IsFuchsia = TargetTriple.isOSFuchsia();
   bool IsMyriad = TargetTriple.getVendor() == llvm::Triple::Myriad;
+  bool IsEmscripten = TargetTriple.isOSEmscripten();
 
   ShadowMapping Mapping;
 
   Mapping.Scale = IsMyriad ? kMyriadShadowScale : kDefaultShadowScale;
   if (ClMappingScale.getNumOccurrences() > 0) {
     Mapping.Scale = ClMappingScale;
   }
 
   if (LongSize == 32) {
     if (IsAndroid)
       Mapping.Offset = kDynamicShadowSentinel;
     else if (IsMIPS32)
       Mapping.Offset = kMIPS32_ShadowOffset32;
     else if (IsFreeBSD)
       Mapping.Offset = kFreeBSD_ShadowOffset32;
     else if (IsNetBSD)
       Mapping.Offset = kNetBSD_ShadowOffset32;
     else if (IsIOS)
       // If we're targeting iOS and x86, the binary is built for iOS simulator.
       Mapping.Offset = IsX86 ? kIOSSimShadowOffset32 : kIOSShadowOffset32;
     else if (IsWindows)
       Mapping.Offset = kWindowsShadowOffset32;
+    else if (IsEmscripten)
+      Mapping.Offset = kEmscriptenShadowOffset;
     else if (IsMyriad) {
       uint64_t ShadowOffset = (kMyriadMemoryOffset32 + kMyriadMemorySize32 -
                                (kMyriadMemorySize32 >> Mapping.Scale));
       Mapping.Offset = ShadowOffset - (kMyriadMemoryOffset32 >> Mapping.Scale);
     }
     else
       Mapping.Offset = kDefaultShadowOffset32;
   } else {  // LongSize == 64