[ubsan] Check implicit casts in ObjC for-in statements

[vsk]

Summary

Check that the implicit cast from id used to construct the element
variable in an ObjC for-in statement is valid.

This check is included as part of a new objc-cast sanitizer, outside
of the main 'undefined' group, as (IIUC) the behavior it's checking for
is not technically UB.

The check can be extended to cover other kinds of invalid casts in ObjC.

Partially addresses: rdar://12903059, rdar://9542496

[delcypher]

compiler-rt/lib/ubsan/ubsan_value.cpp

30

The compiler-rt codebase tends to use SANITIZER_MAC macro (defined to be 1 if Apple otherwise it's 0) rather than __APPLE__.

38

You might want some sort of lock here (or atomic variable) to ensure we don't race and try to dlopen() multiple times.

[delcypher]

clang/lib/Driver/ToolChain.cpp

953 ↗

(On Diff #233881)

SanitizerKind::ObjCCast doesn't seem to fit the comment above. It is platform dependent (only really works for Apple platforms) and it does require runtime support (i.e. the Objective-C runtime).

[vsk]

Address review feedback.

clang/lib/Driver/ToolChain.cpp

953 ↗

(On Diff #233881)

The runtime dependency is optional, and there's nothing inherently Apple-specific about this check. However, perhaps it's best not to inadvertently advertise support for the GNU objc runtime before it's in tree.

compiler-rt/lib/ubsan/ubsan_value.cpp

30

I see. That seems problematic, as it makes it tricky to add macOS-specific (or iOS-specific) functionality down the road. I don't think SANITIZER_MAC should be defined unless TARGET_OS_MACOS is true.

38

Yes, thanks.

[vsk]

Avoid a static initializer.

[vsk]

Ignore an objc-cast report at a given SourceLocation after it's been reported once.

[delcypher]

compiler-rt/lib/ubsan/ubsan_value.cpp

30

Sorry I should clarify. SANITIZER_MAC is poorly named but it is defined to be 1 for Apple platforms and 0. I'm just pointing out the convention that exists today. You're absolutely right that we might want to do different things for different Apple platforms but I don't think we want to start doing a mass re-name until arm64e and arm64_32 support are completed landed in llvm's master.

[vsk]

compiler-rt/lib/ubsan/ubsan_value.cpp

30

I think 'SANITIZER_MAC' is confusing, and my preference would be to not use it. __APPLE__ seems clearer to me, and (IIUC) the plan is to replace usage of 'SANITIZER_MAC' with it down the line anyway?

[delcypher]

compiler-rt/lib/ubsan/ubsan_value.cpp

30

There aren't any plans to do it right now but cleaning this up seems like a reasonable thing to do. If you take a look at compiler-rt/lib/sanitizer_common/sanitizer_platform.h you'll see that we actually have SANITIZER_<platform> for the other platforms that seems to be set as you'd expect. It's just SANITIZER_MAC that's badly named.

I've filed a radar for this issue (rdar://problem/58124919). So if you prefer to use __APPLE__ could you leave a comment with something like

// TODO(dliew): Don't use unclear `SANITIZER_MAC` here. Instead wait for its replacement rdar://problem/58124919.

Note the TODO(<name>): style is enforced by the sanitizer specific linter so you have to put a name there.

[vsk]

compiler-rt/lib/ubsan/ubsan_value.cpp

30

Thanks, done!

[vsk]

Friendly ping.

[delcypher]

@vsk The compiler-rt side seems fine to me but I'm not very familiar with the Clang side of things. @arphaman @jfb @rjmccall any thoughts?

[vsk]

+ Erik and Akira for IRgen expertise.

[vsk]

Rebase.

[ahatanak]

clang/lib/CodeGen/CGObjC.cpp

1860

Can you use GetUnarySelector here?

1864

It looks like Args should be cleared before adding the argument. Or should the argument be added to IsKindOfClassArg?

[vsk]

clang/lib/CodeGen/CGObjC.cpp

1864

Thanks for catching this. The argument should be added to IsKindOfClassArg. This wasn't working correctly before: a leftover %struct.__objcFastEnumerationState* was included in the message-send. I've added a runtime test to ensure that the diagnostic does not fire when the implicit cast is correct.

[vsk]

Use the IsKindOfClass CallArgList when emitting the check, and add a runtime test to ensure that an objc-cast diagnostic is not emitted on correct code.

[ahatanak]

Thank you, LGTM.

clang/docs/UndefinedBehaviorSanitizer.rst

Available checks are:
   -  ``-fsanitize=null``: Use of a null pointer or creation of a null
      reference.
   -  ``-fsanitize=nullability-arg``: Passing null as a function parameter
      which is annotated with ``_Nonnull``.
   -  ``-fsanitize=nullability-assign``: Assigning null to an lvalue which
      is annotated with ``_Nonnull``.
   -  ``-fsanitize=nullability-return``: Returning null from a function with
      a return type annotated with ``_Nonnull``.
+  -  ``-fsanitize=objc-cast``: Invalid implicit cast of an ObjC object pointer
+     to an incompatible type. This is often unintentional, but is not undefined
+     behavior, therefore the check is not a part of the ``undefined`` group.
+     Currently only supported on Darwin.
   -  ``-fsanitize=object-size``: An attempt to potentially use bytes which
      the optimizer can determine are not part of the object being accessed.
      This will also detect some types of undefined behavior that may not
      directly access memory, but are provably incorrect given the size of
      the objects involved, such as invalid downcasts and calling methods on
      invalid pointers. These checks are made in terms of
      ``__builtin_object_size``, and consequently may be able to detect more
      problems at higher optimization levels.

clang/include/clang/Basic/Sanitizers.def

SANITIZER_GROUP("implicit-integer-truncation", ImplicitIntegerTruncation,
                     ImplicitSignedIntegerTruncation)
 
 SANITIZER("implicit-integer-sign-change", ImplicitIntegerSignChange)
 
 SANITIZER_GROUP("implicit-integer-arithmetic-value-change",
                 ImplicitIntegerArithmeticValueChange,
                 ImplicitIntegerSignChange | ImplicitSignedIntegerTruncation)
 
+SANITIZER("objc-cast", ObjCCast)
+
 // FIXME:
 //SANITIZER_GROUP("implicit-integer-conversion", ImplicitIntegerConversion,
 //                ImplicitIntegerArithmeticValueChange |
 //                    ImplicitUnsignedIntegerTruncation)
 //SANITIZER_GROUP("implicit-conversion", ImplicitConversion,
 //                ImplicitIntegerConversion)
 
 SANITIZER_GROUP("implicit-conversion", ImplicitConversion,

clang/lib/CodeGen/CGObjC.cpp

llvm::Value *EnumStateItems =
     Builder.CreateLoad(StateItemsPtr, "stateitems");
 
   // Fetch the value at the current index from the buffer.
   llvm::Value *CurrentItemPtr =
     Builder.CreateGEP(EnumStateItems, index, "currentitem.ptr");
   llvm::Value *CurrentItem =
     Builder.CreateAlignedLoad(CurrentItemPtr, getPointerAlign());
 
+  if (SanOpts.has(SanitizerKind::ObjCCast)) {
+    // Before using an item from the collection, check that the implicit cast
+    // from id to the element type is valid. This is done with instrumentation
+    // roughly corresponding to:
+    //
+    //   if (![item isKindOfClass:expectedCls]) { /* emit diagnostic */ }
+    SanitizerScope SanScope(this);
+    const ObjCObjectPointerType *ObjPtrTy =
+        elementType->getAsObjCInterfacePointerType();
+    const ObjCInterfaceType *InterfaceTy =
+        ObjPtrTy ? ObjPtrTy->getInterfaceType() : nullptr;
+    if (InterfaceTy) {
+      auto &C = CGM.getContext();
+      assert(InterfaceTy->getDecl() && "No decl for ObjC interface type");
+      IdentifierInfo *IsKindOfClassII[] = {&C.Idents.get("isKindOfClass")};
+      Selector IsKindOfClassSel = C.Selectors.getSelector(
+          llvm::array_lengthof(IsKindOfClassII), &IsKindOfClassII[0]);
+      CallArgList IsKindOfClassArgs;
+      llvm::Value *Cls =
+          CGM.getObjCRuntime().GetClass(*this, InterfaceTy->getDecl());
+      Args.add(RValue::get(Cls), C.getObjCClassType());
+      llvm::Value *IsClass =
+          CGM.getObjCRuntime()
+              .GenerateMessageSend(*this, ReturnValueSlot(), C.BoolTy,
+                                   IsKindOfClassSel, CurrentItem, Args)
+              .getScalarVal();
+      llvm::Constant *StaticData[] = {
+          EmitCheckSourceLocation(S.getBeginLoc()),
+          EmitCheckTypeDescriptor(QualType(InterfaceTy, 0))};
+      EmitCheck({{IsClass, SanitizerKind::ObjCCast}},
+                SanitizerHandler::InvalidObjCCast,
+                ArrayRef<llvm::Constant *>(StaticData), CurrentItem);
+    }
+  }
+
   // Cast that value to the right type.
   CurrentItem = Builder.CreateBitCast(CurrentItem, convertedElementType,
                                       "currentitem");
 
   // Make sure we have an l-value.  Yes, this gets evaluated every
   // time through the loop.
   if (!elementIsVariable) {
     elementLValue = EmitLValue(cast<Expr>(S.getElement()));

clang/lib/CodeGen/CodeGenFunction.h

#define LIST_SANITIZER_CHECKS                                                  \
   SANITIZER_CHECK(BuiltinUnreachable, builtin_unreachable, 0)                  \
   SANITIZER_CHECK(CFICheckFail, cfi_check_fail, 0)                             \
   SANITIZER_CHECK(DivremOverflow, divrem_overflow, 0)                          \
   SANITIZER_CHECK(DynamicTypeCacheMiss, dynamic_type_cache_miss, 0)            \
   SANITIZER_CHECK(FloatCastOverflow, float_cast_overflow, 0)                   \
   SANITIZER_CHECK(FunctionTypeMismatch, function_type_mismatch, 1)             \
   SANITIZER_CHECK(ImplicitConversion, implicit_conversion, 0)                  \
   SANITIZER_CHECK(InvalidBuiltin, invalid_builtin, 0)                          \
+  SANITIZER_CHECK(InvalidObjCCast, invalid_objc_cast, 0)                       \
   SANITIZER_CHECK(LoadInvalidValue, load_invalid_value, 0)                     \
   SANITIZER_CHECK(MissingReturn, missing_return, 0)                            \
   SANITIZER_CHECK(MulOverflow, mul_overflow, 0)                                \
   SANITIZER_CHECK(NegateOverflow, negate_overflow, 0)                          \
   SANITIZER_CHECK(NullabilityArg, nullability_arg, 0)                          \
   SANITIZER_CHECK(NullabilityReturn, nullability_return, 1)                    \
   SANITIZER_CHECK(NonnullArg, nonnull_arg, 0)                                  \
   SANITIZER_CHECK(NonnullReturn, nonnull_return, 1)                            \

clang/lib/Driver/SanitizerArgs.cpp

 
 using namespace clang;
 using namespace clang::driver;
 using namespace llvm::opt;
 
 static const SanitizerMask NeedsUbsanRt =
     SanitizerKind::Undefined | SanitizerKind::Integer |
     SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |
-    SanitizerKind::CFI | SanitizerKind::FloatDivideByZero;
+    SanitizerKind::CFI | SanitizerKind::FloatDivideByZero |
+    SanitizerKind::ObjCCast;
 static const SanitizerMask NeedsUbsanCxxRt =
     SanitizerKind::Vptr | SanitizerKind::CFI;
 static const SanitizerMask NotAllowedWithTrap = SanitizerKind::Vptr;
 static const SanitizerMask NotAllowedWithMinimalRuntime =
     SanitizerKind::Function | SanitizerKind::Vptr;
 static const SanitizerMask RequiresPIE =
     SanitizerKind::DataFlow | SanitizerKind::HWAddress | SanitizerKind::Scudo;
 static const SanitizerMask NeedsUnwindTables =
     SanitizerKind::Address | SanitizerKind::HWAddress | SanitizerKind::Thread |
     SanitizerKind::Memory | SanitizerKind::DataFlow;
 static const SanitizerMask SupportsCoverage =
     SanitizerKind::Address | SanitizerKind::HWAddress |
     SanitizerKind::KernelAddress | SanitizerKind::KernelHWAddress |
     SanitizerKind::MemTag | SanitizerKind::Memory |
     SanitizerKind::KernelMemory | SanitizerKind::Leak |
     SanitizerKind::Undefined | SanitizerKind::Integer |
     SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |
     SanitizerKind::DataFlow | SanitizerKind::Fuzzer |
     SanitizerKind::FuzzerNoLink | SanitizerKind::FloatDivideByZero |
-    SanitizerKind::SafeStack | SanitizerKind::ShadowCallStack;
+    SanitizerKind::SafeStack | SanitizerKind::ShadowCallStack |
+    SanitizerKind::ObjCCast;
 static const SanitizerMask RecoverableByDefault =
     SanitizerKind::Undefined | SanitizerKind::Integer |
     SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |
-    SanitizerKind::FloatDivideByZero;
+    SanitizerKind::FloatDivideByZero | SanitizerKind::ObjCCast;
 static const SanitizerMask Unrecoverable =
     SanitizerKind::Unreachable | SanitizerKind::Return;
 static const SanitizerMask AlwaysRecoverable =
     SanitizerKind::KernelAddress | SanitizerKind::KernelHWAddress;
 static const SanitizerMask LegacyFsanitizeRecoverMask =
     SanitizerKind::Undefined | SanitizerKind::Integer;
 static const SanitizerMask NeedsLTO = SanitizerKind::CFI;
 static const SanitizerMask TrappingSupported =
     (SanitizerKind::Undefined & ~SanitizerKind::Vptr) |
     SanitizerKind::UnsignedIntegerOverflow | SanitizerKind::ImplicitConversion |
     SanitizerKind::Nullability | SanitizerKind::LocalBounds |
-    SanitizerKind::CFI | SanitizerKind::FloatDivideByZero;
+    SanitizerKind::CFI | SanitizerKind::FloatDivideByZero |
+    SanitizerKind::ObjCCast;
 static const SanitizerMask TrappingDefault = SanitizerKind::CFI;
 static const SanitizerMask CFIClasses =
     SanitizerKind::CFIVCall | SanitizerKind::CFINVCall |
     SanitizerKind::CFIMFCall | SanitizerKind::CFIDerivedCast |
     SanitizerKind::CFIUnrelatedCast;
 static const SanitizerMask CompatibleWithMinimalRuntime =
     TrappingSupported | SanitizerKind::Scudo | SanitizerKind::ShadowCallStack;
 

clang/lib/Driver/ToolChains/Darwin.cpp

SanitizerMask Darwin::getSupportedSanitizers() const {
   SanitizerMask Res = ToolChain::getSupportedSanitizers();
   Res |= SanitizerKind::Address;
   Res |= SanitizerKind::PointerCompare;
   Res |= SanitizerKind::PointerSubtract;
   Res |= SanitizerKind::Leak;
   Res |= SanitizerKind::Fuzzer;
   Res |= SanitizerKind::FuzzerNoLink;
   Res |= SanitizerKind::Function;
+  Res |= SanitizerKind::ObjCCast;
 
   // Prior to 10.9, macOS shipped a version of the C++ standard library without
   // C++11 support. The same is true of iOS prior to version 5. These OS'es are
   // incompatible with -fsanitize=vptr.
   if (!(isTargetMacOS() && isMacosxVersionLT(10, 9))
       && !(isTargetIPhoneOS() && isIPhoneOSVersionLT(5, 0)))
     Res |= SanitizerKind::Vptr;
 

clang/test/CodeGenObjC/for-in.m

-// RUN: %clang_cc1 -emit-llvm %s -o %t
+// RUN: %clang_cc1 %s -verify -o /dev/null
+// RUN: %clang_cc1 %s -triple x86_64-apple-darwin -emit-llvm -fsanitize=objc-cast -o - | FileCheck %s
 
 void p(const char*, ...);
 
 @interface NSArray
 +(NSArray*) arrayWithObjects: (id) first, ...;
 -(unsigned) count;
 @end
 @interface NSString
 -(const char*) cString;
 @end
 
 #define S(n) @#n
 #define L1(n) S(n+0),S(n+1)
 #define L2(n) L1(n+0),L1(n+2)
 #define L3(n) L2(n+0),L2(n+4)
 #define L4(n) L3(n+0),L3(n+8)
 #define L5(n) L4(n+0),L4(n+16)
 #define L6(n) L5(n+0),L5(n+32)
 
+// CHECK-LABEL: define void @t0
 void t0() {
   NSArray *array = [NSArray arrayWithObjects: L1(0), (void*)0];
 
   p("array.length: %d\n", [array count]);
   unsigned index = 0;
   for (NSString *i in array) {  // expected-warning {{collection expression type 'NSArray *' may not respond}}
+
+    // CHECK:      [[expectedCls:%.*]] = load %struct._class_t*, {{.*}}, !nosanitize
+    // CHECK-NEXT: [[kindOfClassSel:%.*]] = load i8*, i8** @OBJC_SELECTOR_REFERENCES{{.*}}, !nosanitize
+    // CHECK-NEXT: [[expectedClsI8:%.*]] = bitcast %struct._class_t* [[expectedCls]] to i8*, !nosanitize
+    // CHECK-NEXT: [[isCls:%.*]] = call zeroext i1 bitcast {{.*}}@objc_msgSend to i1 (i8*, i8*, %struct.__objcFastEnumerationState*, {{.*}})(i8* [[theItem:%.*]], i8* [[kindOfClassSel]], %struct.__objcFastEnumerationState* {{.*}}, i8* [[expectedClsI8]]), !nosanitize
+    // CHECK: br i1 [[isCls]]
+
+    // CHECK: ptrtoint i8* [[theItem]] to i64, !nosanitize
+    // CHECK-NEXT: call void @__ubsan_handle_invalid_objc_cast
+    // CHECK-NEXT: unreachable, !nosanitize
+
+    // CHECK: bitcast i8* [[theItem]]
+
     p("element %d: %s\n", index++, [i cString]);
   }
 }
 
 void t1() {
   NSArray *array = [NSArray arrayWithObjects: L6(0), (void*)0];
 
   p("array.length: %d\n", [array count]);

compiler-rt/lib/ubsan/ubsan_checks.inc

 UBSAN_CHECK(SignedIntegerOverflow, "signed-integer-overflow",
             "signed-integer-overflow")
 UBSAN_CHECK(UnsignedIntegerOverflow, "unsigned-integer-overflow",
             "unsigned-integer-overflow")
 UBSAN_CHECK(IntegerDivideByZero, "integer-divide-by-zero",
             "integer-divide-by-zero")
 UBSAN_CHECK(FloatDivideByZero, "float-divide-by-zero", "float-divide-by-zero")
 UBSAN_CHECK(InvalidBuiltin, "invalid-builtin-use", "invalid-builtin-use")
+UBSAN_CHECK(InvalidObjCCast, "invalid-objc-cast", "invalid-objc-cast")
 UBSAN_CHECK(ImplicitUnsignedIntegerTruncation,
             "implicit-unsigned-integer-truncation",
             "implicit-unsigned-integer-truncation")
 UBSAN_CHECK(ImplicitSignedIntegerTruncation,
             "implicit-signed-integer-truncation",
             "implicit-signed-integer-truncation")
 UBSAN_CHECK(ImplicitIntegerSignChange,
             "implicit-integer-sign-change",

compiler-rt/lib/ubsan/ubsan_handlers.h

 struct InvalidBuiltinData {
   SourceLocation Loc;
   unsigned char Kind;
 };
 
 /// Handle a builtin called in an invalid way.
 RECOVERABLE(invalid_builtin, InvalidBuiltinData *Data)
 
+struct InvalidObjCCast {
+  SourceLocation Loc;
+  const TypeDescriptor &ExpectedType;
+};
+
+/// Handle an invalid ObjC cast.
+RECOVERABLE(invalid_objc_cast, InvalidObjCCast *Data, ValueHandle Pointer)
+
 struct NonNullReturnData {
   SourceLocation AttrLoc;
 };
 
 /// \brief Handle returning null from function with the returns_nonnull
 /// attribute, or a return type annotated with _Nonnull.
 RECOVERABLE(nonnull_return_v1, NonNullReturnData *Data, SourceLocation *Loc)
 RECOVERABLE(nullability_return_v1, NonNullReturnData *Data, SourceLocation *Loc)

compiler-rt/lib/ubsan/ubsan_handlers.cpp

 //===----------------------------------------------------------------------===//
 
 #include "ubsan_platform.h"
 #if CAN_SANITIZE_UB
 #include "ubsan_handlers.h"
 #include "ubsan_diag.h"
 #include "ubsan_flags.h"
 #include "ubsan_monitor.h"
+#include "ubsan_value.h"
 
 #include "sanitizer_common/sanitizer_common.h"
 
 using namespace __sanitizer;
 using namespace __ubsan;
 
 namespace __ubsan {
 bool ignoreReport(SourceLocation SLoc, ReportOptions Opts, ErrorType ET) {
void __ubsan::__ubsan_handle_invalid_builtin(InvalidBuiltinData *Data) {
   handleInvalidBuiltin(Data, Opts);
 }
 void __ubsan::__ubsan_handle_invalid_builtin_abort(InvalidBuiltinData *Data) {
   GET_REPORT_OPTIONS(true);
   handleInvalidBuiltin(Data, Opts);
   Die();
 }
 
+static void handleInvalidObjCCast(InvalidObjCCast *Data, ValueHandle Pointer,
+                                  ReportOptions Opts) {
+  SourceLocation Loc = Data->Loc.acquire();
+  ErrorType ET = ErrorType::InvalidObjCCast;
+
+  if (ignoreReport(Loc, Opts, ET))
+    return;
+
+  ScopedReport R(Opts, Loc, ET);
+
+  const char *GivenClass = getObjCClassName(Pointer);
+  const char *GivenClassStr = GivenClass ? GivenClass : "<unknown type>";
+
+  Diag(Loc, DL_Error, ET,
+       "invalid ObjC cast, object is a '%0', but expected a %1")
+      << GivenClassStr << Data->ExpectedType;
+}
+
+void __ubsan::__ubsan_handle_invalid_objc_cast(InvalidObjCCast *Data,
+                                               ValueHandle Pointer) {
+  GET_REPORT_OPTIONS(true);
+  handleInvalidObjCCast(Data, Pointer, Opts);
+}
+void __ubsan::__ubsan_handle_invalid_objc_cast_abort(InvalidObjCCast *Data,
+                                                     ValueHandle Pointer) {
+  GET_REPORT_OPTIONS(true);
+  handleInvalidObjCCast(Data, Pointer, Opts);
+  Die();
+}
+
 static void handleNonNullReturn(NonNullReturnData *Data, SourceLocation *LocPtr,
                                 ReportOptions Opts, bool IsAttr) {
   if (!LocPtr)
     UNREACHABLE("source location pointer is null!");
 
   SourceLocation Loc = LocPtr->acquire();
   ErrorType ET = ErrorType::InvalidNullReturn;
 

compiler-rt/lib/ubsan/ubsan_value.h

unsigned getFloatBitWidth() const {
     CHECK(isFloatTy());
     return TypeInfo;
   }
 };
 
 /// \brief An opaque handle to a value.
 typedef uptr ValueHandle;
 
+/// Returns the class name of the given ObjC object, or null if the name
+/// cannot be found.
+const char *getObjCClassName(ValueHandle Pointer);
 
 /// \brief Representation of an operand value provided by the instrumented code.
 ///
 /// This is a combination of a TypeDescriptor (which is emitted as constant data
 /// as an operand to a handler function) and a ValueHandle (which is passed at
 /// runtime when a check failure occurs).
 class Value {
   /// The type of the value.

compiler-rt/lib/ubsan/ubsan_value.cpp

 //
 //===----------------------------------------------------------------------===//
 
 #include "ubsan_platform.h"
 #if CAN_SANITIZE_UB
 #include "ubsan_value.h"
 #include "sanitizer_common/sanitizer_common.h"
 #include "sanitizer_common/sanitizer_libc.h"
+#include "sanitizer_common/sanitizer_mutex.h"
+
+#if defined(__APPLE__)
+#include <dlfcn.h>
+#endif
 
 using namespace __ubsan;
 
+typedef const char *(*ObjCGetClassNameTy)(void *);
+
+const char *__ubsan::getObjCClassName(ValueHandle Pointer) {
+#if defined(__APPLE__)
+  // We need to query the ObjC runtime for some information, but do not want
+  // to introduce a static dependency from the ubsan runtime onto ObjC. Try to
+  // grab a handle to the ObjC runtime used by the process.
+  static bool AttemptedDlopen = false;
+  static void *ObjCHandle = nullptr;
+  static void *ObjCObjectGetClassName = nullptr;
+
+  // Prevent threads from racing to dlopen().
+  static __sanitizer::SpinMutex Lock;
+  {
+    __sanitizer::GenericScopedLock<__sanitizer::SpinMutex> Guard(&Lock);
+
+    if (!AttemptedDlopen) {
+      ObjCHandle = dlopen(
+          "/usr/lib/libobjc.A.dylib",
+          RTLD_LAZY         // Only bind symbols when used.
+              | RTLD_LOCAL  // Only make symbols available via the handle.
+              | RTLD_NOLOAD // Do not load the dylib, just grab a handle if the
+                            // image is already loaded.
+              | RTLD_FIRST  // Only search the image pointed-to by the handle.
+      );
+      AttemptedDlopen = true;
+      if (!ObjCHandle)
+        return nullptr;
+      ObjCObjectGetClassName = dlsym(ObjCHandle, "object_getClassName");
+    }
+  }
+
+  if (!ObjCObjectGetClassName)
+    return nullptr;
+
+  return ObjCGetClassNameTy(ObjCObjectGetClassName)((void *)Pointer);
+#else
+  return nullptr;
+#endif
+}
+
 SIntMax Value::getSIntValue() const {
   CHECK(getType().isSignedIntegerTy());
   if (isInlineInt()) {
     // Val was zero-extended to ValueHandle. Sign-extend from original width
     // to SIntMax.
     const unsigned ExtraBits =
       sizeof(SIntMax) * 8 - getType().getIntegerBitWidth();
     return SIntMax(Val) << ExtraBits >> ExtraBits;

compiler-rt/lib/ubsan_minimal/ubsan_minimal_handlers.cpp

 HANDLER(shift_out_of_bounds, "shift-out-of-bounds")
 HANDLER(out_of_bounds, "out-of-bounds")
 HANDLER_RECOVER(builtin_unreachable, "builtin-unreachable")
 HANDLER_RECOVER(missing_return, "missing-return")
 HANDLER(vla_bound_not_positive, "vla-bound-not-positive")
 HANDLER(float_cast_overflow, "float-cast-overflow")
 HANDLER(load_invalid_value, "load-invalid-value")
 HANDLER(invalid_builtin, "invalid-builtin")
+HANDLER(invalid_objc_cast, "invalid-objc-cast")
 HANDLER(function_type_mismatch, "function-type-mismatch")
 HANDLER(implicit_conversion, "implicit-conversion")
 HANDLER(nonnull_arg, "nonnull-arg")
 HANDLER(nonnull_return, "nonnull-return")
 HANDLER(nullability_arg, "nullability-arg")
 HANDLER(nullability_return, "nullability-return")
 HANDLER(pointer_overflow, "pointer-overflow")
 HANDLER(cfi_check_fail, "cfi-check-fail")

compiler-rt/test/ubsan/TestCases/Misc/objc-cast.m

+// REQUIRES: darwin
+//
+// RUN: %clang -framework Foundation -fsanitize=objc-cast %s -O1 -o %t
+// RUN: %run %t 2>&1 | FileCheck %s
+//
+// RUN: %clang -framework Foundation -fsanitize=objc-cast -fno-sanitize-recover=objc-cast %s -O1 -o %t.trap
+// RUN: not %run %t.trap 2>&1 | FileCheck %s
+
+#include <Foundation/Foundation.h>
+
+int main() {
+  NSArray *array = [NSArray arrayWithObjects: @1, @2, @3, (void *)0];
+  // CHECK: objc-cast.m:[[@LINE+1]]:{{.*}}: runtime error: invalid ObjC cast, object is a '__NSCFNumber', but expected a 'NSString'
+  for (NSString *str in array) {
+    NSLog(@"%@", str);
+  }
+  return 0;
+}