Don't add sanitizer init function directly into module constructors

[ismailp]

Summary

AddressSanitizer creates a function within the module, which calls
__asan_init. This function is then added to the module's constructors.
ThreadSanitizer, and MemorySanitizer, however, add their respective init
functions directly to module constructors. This prevents these
sanitizers be used in certain cases, where module constructor must be
implemented in instrumented object itself. This patch unifies how
sanitizer constructor functions are created, and how init functions are
called across all sanitizers.

Moved checkInterfaceFunction into ModuleUtils.

[kcc]

This prevents these sanitizers be used in certain cases,

Can you give an example?

Also, please add tests to test/Instrumentation/*Sanitizer

The change touches 3 sanitizers that have 3 different primary maintainers
It might be simpler to split this patch into several:

• move checkInterfaceFunction w/o other functionality changes
• update each of the sanitizers.

lib/Transforms/Instrumentation/AddressSanitizer.cpp

1220

here and below, please use a file-static named constant (e.g. kSanitizerName)

lib/Transforms/Utils/ModuleUtils.cpp

109

You can just print "Sanitizer interface function" to make the code simpler.

[ismailp]

Thanks for quick response!

In D8754#150169, @kcc wrote:

This prevents these sanitizers be used in certain cases,

Can you give an example?

Yes; Darwin. Dynamic linker is expecting module initializer to be defined within the module itself, otherwise it says:
dyld: initializer function <address> not in mapped image

Also, please add tests to test/Instrumentation/*Sanitizer

Yes, this is clearly forgotten. I was rushing to submit this.

The change touches 3 sanitizers that have 3 different primary maintainers
It might be simpler to split this patch into several:

• move checkInterfaceFunction w/o other functionality changes
• update each of the sanitizers.

Makes sense; will do that. I am abandoning this revision, and will submit 2/3 new. Could you please let me know who are primary maintainers for each sanitizer, so that I add correct reviewers?

[kcc]

Yes; Darwin. Dynamic linker is expecting module initializer to be defined within the module itself, otherwise it says:
dyld: initializer function <address> not in mapped image

Interesting. Does this mean that you are porting tsan/msan to Darwin?
This, especially for msan, could be a great challenge.

The change touches 3 sanitizers that have 3 different primary maintainers
It might be simpler to split this patch into several:

• move checkInterfaceFunction w/o other functionality changes
• update each of the sanitizers.

Makes sense; will do that. I am abandoning this revision, and will submit 2/3 new. Could you please let me know who are primary maintainers for each sanitizer, so that I add correct reviewers?

Let's do like this:
asan/common: samsonov@
msan: eugenis@
tsan: dvyukov@
CC me to all of them.

[ismailp]

In D8754#150182, @kcc wrote:

Yes; Darwin. Dynamic linker is expecting module initializer to be defined within the module itself, otherwise it says:
dyld: initializer function <address> not in mapped image

Interesting. Does this mean that you are porting tsan/msan to Darwin?
This, especially for msan, could be a great challenge.

Yes, tsan on Darwin. It's mostly working. TLS is the biggest problem. My patches are far from submission quality right now, but I am working on it. Basically;

• cur_thread() cannot use cur_thread_placeholder, because its storage initialized too late. I will certainly need help with this one. I use malloc to obtain storage, and store this pointer with pthread_setspecific, where key is the finalize key (and that is still a problem :) )
• Race report doesn't print function name - I think this is easy to fix, although I didn't carefully check yet. I have found TSan's report format is slightly different with ASan's, and ASan report prints function name. Maybe it's really that easy, maybe not...
• I mostly copied pthread_barrier implementation from FreeBSD, as some tests use this.

After getting TSan to run on Darwin, I can try MSan as well.

include/llvm/Transforms/Utils/ModuleUtils.h

 //===-- ModuleUtils.h - Functions to manipulate Modules ---------*- C++ -*-===//
 //
 //                     The LLVM Compiler Infrastructure
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 //
 // This family of functions perform manipulations on Modules.
 //
 //===----------------------------------------------------------------------===//
 
 #ifndef LLVM_TRANSFORMS_UTILS_MODULEUTILS_H
 #define LLVM_TRANSFORMS_UTILS_MODULEUTILS_H
 
+#include "llvm/ADT/ArrayRef.h"
+
 namespace llvm {
 
 class Module;
 class Function;
 class GlobalValue;
 class GlobalVariable;
+class Constant;
+class StringRef;
+class Value;
+class Type;
 template <class PtrType> class SmallPtrSetImpl;
 
 /// Append F to the list of global ctors of module M with the given Priority.
 /// This wraps the function in the appropriate structure and stores it along
 /// side other global constructors. For details see
 /// http://llvm.org/docs/LangRef.html#intg_global_ctors
 void appendToGlobalCtors(Module &M, Function *F, int Priority);
 
 /// Same as appendToGlobalCtors(), but for global dtors.
 void appendToGlobalDtors(Module &M, Function *F, int Priority);
 
 /// \brief Given "llvm.used" or "llvm.compiler.used" as a global name, collect
 /// the initializer elements of that global in Set and return the global itself.
 GlobalVariable *collectUsedGlobalVariables(Module &M,
                                            SmallPtrSetImpl<GlobalValue *> &Set,
                                            bool CompilerUsed);
+
+// Validate the result of Module::getOrInsertFunction called for an interface
+// function of given sanitizer. If the instrumented module defines a function
+// with the same name, their prototypes must match, otherwise
+// getOrInsertFunction returns a bitcast.
+Function *checkInterfaceFunction(StringRef Sanitizer, Constant *FuncOrBitcast);
+
+/// \brief Creates sanitizer constructor function, and calls sanitizer's init
+/// function from it.
+Function *createSanitizerCtor(Module &M, StringRef Sanitizer,
+                              StringRef CtorName, StringRef InitName,
+                              ArrayRef<Type *> InitType = ArrayRef<Type *>(),
+                              ArrayRef<Value *> InitArgs = ArrayRef<Value *>(),
+                              Function **InitFunctionPtr = nullptr);
+Function *createSanitizerCtor(Module &M, StringRef Sanitizer,
+                              StringRef CtorName, StringRef InitName,
+                              Function **InitFunctionPtr);
 } // End llvm namespace
 
 #endif //  LLVM_TRANSFORMS_UTILS_MODULEUTILS_H

lib/Transforms/Instrumentation/AddressSanitizer.cpp

if ((TypeSize == 8 || TypeSize == 16 || TypeSize == 32 || TypeSize == 64 ||
        TypeSize == 128) &&
       (Alignment >= Granularity || Alignment == 0 || Alignment >= TypeSize / 8))
     return instrumentAddress(I, I, Addr, TypeSize, IsWrite, nullptr, UseCalls,
                              Exp);
   instrumentUnusualSizeOrAlignment(I, Addr, TypeSize, IsWrite, nullptr,
                                    UseCalls, Exp);
 }
 
-// Validate the result of Module::getOrInsertFunction called for an interface
-// function of AddressSanitizer. If the instrumented module defines a function
-// with the same name, their prototypes must match, otherwise
-// getOrInsertFunction returns a bitcast.
-static Function *checkInterfaceFunction(Constant *FuncOrBitcast) {
-  if (isa<Function>(FuncOrBitcast)) return cast<Function>(FuncOrBitcast);
-  FuncOrBitcast->dump();
-  report_fatal_error(
-      "trying to redefine an AddressSanitizer "
-      "interface function");
-}
-
 Instruction *AddressSanitizer::generateCrashCode(Instruction *InsertBefore,
                                                  Value *Addr, bool IsWrite,
                                                  size_t AccessSizeIndex,
                                                  Value *SizeArgument,
                                                  uint32_t Exp) {
   IRBuilder<> IRB(InsertBefore);
   Value *ExpVal = Exp == 0 ? nullptr : ConstantInt::get(IRB.getInt32Ty(), Exp);
   CallInst *Call = nullptr;
bool AddressSanitizerModule::ShouldInstrumentGlobal(GlobalVariable *G) {
   }
 
   return true;
 }
 
 void AddressSanitizerModule::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(*C);
   // Declare our poisoning and unpoisoning functions.
-  AsanPoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction(
-      kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy, nullptr));
+  AsanPoisonGlobals = checkInterfaceFunction(
+      "AddressSanitizer",
+      M.getOrInsertFunction(kAsanPoisonGlobalsName, IRB.getVoidTy(), IntptrTy,
+                            nullptr));
   AsanPoisonGlobals->setLinkage(Function::ExternalLinkage);
-  AsanUnpoisonGlobals = checkInterfaceFunction(M.getOrInsertFunction(
-      kAsanUnpoisonGlobalsName, IRB.getVoidTy(), nullptr));
+  AsanUnpoisonGlobals = checkInterfaceFunction(
+      "AddressSanitizer", M.getOrInsertFunction(kAsanUnpoisonGlobalsName,
+                                                IRB.getVoidTy(), nullptr));
   AsanUnpoisonGlobals->setLinkage(Function::ExternalLinkage);
   // Declare functions that register/unregister globals.
-  AsanRegisterGlobals = checkInterfaceFunction(M.getOrInsertFunction(
-      kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr));
+  AsanRegisterGlobals = checkInterfaceFunction(
+      "AddressSanitizer",
+      M.getOrInsertFunction(kAsanRegisterGlobalsName, IRB.getVoidTy(), IntptrTy,
+                            IntptrTy, nullptr));
   AsanRegisterGlobals->setLinkage(Function::ExternalLinkage);
   AsanUnregisterGlobals = checkInterfaceFunction(
+      "AddressSanitizer",
       M.getOrInsertFunction(kAsanUnregisterGlobalsName, IRB.getVoidTy(),
                             IntptrTy, IntptrTy, nullptr));
   AsanUnregisterGlobals->setLinkage(Function::ExternalLinkage);
 }
 
 // This function replaces all global variables with new variables that have
 // trailing redzones. It also creates a function that poisons
 // redzones and inserts this function into llvm.global_ctors.
void AddressSanitizer::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(*C);
   // Create __asan_report* callbacks.
   // IsWrite, TypeSize and Exp are encoded in the function name.
   for (int Exp = 0; Exp < 2; Exp++) {
     for (size_t AccessIsWrite = 0; AccessIsWrite <= 1; AccessIsWrite++) {
       const std::string TypeStr = AccessIsWrite ? "store" : "load";
       const std::string ExpStr = Exp ? "exp_" : "";
       const Type *ExpType = Exp ? Type::getInt32Ty(*C) : nullptr;
-      AsanErrorCallbackSized[AccessIsWrite][Exp] =
-          checkInterfaceFunction(M.getOrInsertFunction(
+      AsanErrorCallbackSized[AccessIsWrite][Exp] = checkInterfaceFunction(
+          "AddressSanitizer",
+          M.getOrInsertFunction(
               kAsanReportErrorTemplate + ExpStr + TypeStr + "_n",
               IRB.getVoidTy(), IntptrTy, IntptrTy, ExpType, nullptr));
       AsanMemoryAccessCallbackSized[AccessIsWrite][Exp] =
-          checkInterfaceFunction(M.getOrInsertFunction(
+          checkInterfaceFunction(
+              "AddressSanitizer",
+              M.getOrInsertFunction(
                   ClMemoryAccessCallbackPrefix + ExpStr + TypeStr + "N",
                   IRB.getVoidTy(), IntptrTy, IntptrTy, ExpType, nullptr));
       for (size_t AccessSizeIndex = 0; AccessSizeIndex < kNumberOfAccessSizes;
            AccessSizeIndex++) {
         const std::string Suffix = TypeStr + itostr(1 << AccessSizeIndex);
         AsanErrorCallback[AccessIsWrite][Exp][AccessSizeIndex] =
-            checkInterfaceFunction(M.getOrInsertFunction(
+            checkInterfaceFunction(
+                "AddressSanitizer",
+                M.getOrInsertFunction(
                     kAsanReportErrorTemplate + ExpStr + Suffix, IRB.getVoidTy(),
                     IntptrTy, ExpType, nullptr));
         AsanMemoryAccessCallback[AccessIsWrite][Exp][AccessSizeIndex] =
-            checkInterfaceFunction(M.getOrInsertFunction(
-                ClMemoryAccessCallbackPrefix + ExpStr + Suffix, IRB.getVoidTy(),
-                IntptrTy, ExpType, nullptr));
+            checkInterfaceFunction(
+                "AddressSanitizer",
+                M.getOrInsertFunction(
+                    ClMemoryAccessCallbackPrefix + ExpStr + Suffix,
+                    IRB.getVoidTy(), IntptrTy, ExpType, nullptr));
       }
     }
   }
 
-  AsanMemmove = checkInterfaceFunction(M.getOrInsertFunction(
-      ClMemoryAccessCallbackPrefix + "memmove", IRB.getInt8PtrTy(),
-      IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy, nullptr));
-  AsanMemcpy = checkInterfaceFunction(M.getOrInsertFunction(
-      ClMemoryAccessCallbackPrefix + "memcpy", IRB.getInt8PtrTy(),
-      IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IntptrTy, nullptr));
-  AsanMemset = checkInterfaceFunction(M.getOrInsertFunction(
-      ClMemoryAccessCallbackPrefix + "memset", IRB.getInt8PtrTy(),
-      IRB.getInt8PtrTy(), IRB.getInt32Ty(), IntptrTy, nullptr));
+  AsanMemmove = checkInterfaceFunction(
+      "AddressSanitizer",
+      M.getOrInsertFunction(ClMemoryAccessCallbackPrefix + "memmove",
+                            IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
+                            IRB.getInt8PtrTy(), IntptrTy, nullptr));
+  AsanMemcpy = checkInterfaceFunction(
+      "AddressSanitizer",
+      M.getOrInsertFunction(ClMemoryAccessCallbackPrefix + "memcpy",
+                            IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
+                            IRB.getInt8PtrTy(), IntptrTy, nullptr));
+  AsanMemset = checkInterfaceFunction(
+      "AddressSanitizer",
+      M.getOrInsertFunction(ClMemoryAccessCallbackPrefix + "memset",
+                            IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
+                            IRB.getInt32Ty(), IntptrTy, nullptr));
 
   AsanHandleNoReturnFunc = checkInterfaceFunction(
+      "AddressSanitizer",
       M.getOrInsertFunction(kAsanHandleNoReturnName, IRB.getVoidTy(), nullptr));
 
-  AsanPtrCmpFunction = checkInterfaceFunction(M.getOrInsertFunction(
-      kAsanPtrCmp, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr));
-  AsanPtrSubFunction = checkInterfaceFunction(M.getOrInsertFunction(
-      kAsanPtrSub, IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr));
+  AsanPtrCmpFunction = checkInterfaceFunction(
+      "AddressSanitizer", M.getOrInsertFunction(kAsanPtrCmp, IRB.getVoidTy(),
+                                                IntptrTy, IntptrTy, nullptr));
+  AsanPtrSubFunction = checkInterfaceFunction(
+      "AddressSanitizer", M.getOrInsertFunction(kAsanPtrSub, IRB.getVoidTy(),
+                                                IntptrTy, IntptrTy, nullptr));
   // We insert an empty inline asm after __asan_report* to avoid callback merge.
   EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
                             StringRef(""), StringRef(""),
                             /*hasSideEffects=*/true);
 }
 
 // virtual
 bool AddressSanitizer::doInitialization(Module &M) {
   // Initialize the private fields. No one has accessed them before.
 
   GlobalsMD.init(M);
 
   C = &(M.getContext());
   LongSize = M.getDataLayout().getPointerSizeInBits();
   IntptrTy = Type::getIntNTy(*C, LongSize);
   TargetTriple = Triple(M.getTargetTriple());
 
   AsanCtorFunction =
-      Function::Create(FunctionType::get(Type::getVoidTy(*C), false),
-                       GlobalValue::InternalLinkage, kAsanModuleCtorName, &M);
-  BasicBlock *AsanCtorBB = BasicBlock::Create(*C, "", AsanCtorFunction);
-  // call __asan_init in the module ctor.
-  IRBuilder<> IRB(ReturnInst::Create(*C, AsanCtorBB));
-  AsanInitFunction = checkInterfaceFunction(
-      M.getOrInsertFunction(kAsanInitName, IRB.getVoidTy(), nullptr));
-  AsanInitFunction->setLinkage(Function::ExternalLinkage);
-  IRB.CreateCall(AsanInitFunction);
+      createSanitizerCtor(M, "AddressSanitizer", kAsanModuleCtorName,
+                          kAsanInitName, &AsanInitFunction);
 
   Mapping = getShadowMapping(TargetTriple, LongSize);
 
   appendToGlobalCtors(M, AsanCtorFunction, kAsanCtorAndDtorPriority);
   return true;
 }
 
 bool AddressSanitizer::maybeInsertAsanInitAtFunctionEntry(Function &F) {
bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) {
   // We have inline assembly with quite a few arguments.
   return true;
 }
 
 void FunctionStackPoisoner::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(*C);
   for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) {
     std::string Suffix = itostr(i);
-    AsanStackMallocFunc[i] = checkInterfaceFunction(M.getOrInsertFunction(
-        kAsanStackMallocNameTemplate + Suffix, IntptrTy, IntptrTy, nullptr));
+    AsanStackMallocFunc[i] = checkInterfaceFunction(
+        "AddressSanitizer",
+        M.getOrInsertFunction(kAsanStackMallocNameTemplate + Suffix, IntptrTy,
+                              IntptrTy, nullptr));
     AsanStackFreeFunc[i] = checkInterfaceFunction(
+        "AddressSanitizer",
         M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix,
                               IRB.getVoidTy(), IntptrTy, IntptrTy, nullptr));
   }
   AsanPoisonStackMemoryFunc = checkInterfaceFunction(
+      "AddressSanitizer",
       M.getOrInsertFunction(kAsanPoisonStackMemoryName, IRB.getVoidTy(),
                             IntptrTy, IntptrTy, nullptr));
   AsanUnpoisonStackMemoryFunc = checkInterfaceFunction(
+      "AddressSanitizer",
       M.getOrInsertFunction(kAsanUnpoisonStackMemoryName, IRB.getVoidTy(),
                             IntptrTy, IntptrTy, nullptr));
 }
 
 void FunctionStackPoisoner::poisonRedZones(ArrayRef<uint8_t> ShadowBytes,
                                            IRBuilder<> &IRB, Value *ShadowBase,
                                            bool DoPoison) {
   size_t n = ShadowBytes.size();

lib/Transforms/Instrumentation/MemorySanitizer.cpp

 
 // This is an experiment to enable handling of cases where shadow is a non-zero
 // compile-time constant. For some unexplainable reason they were silently
 // ignored in the instrumentation.
 static cl::opt<bool> ClCheckConstantShadow("msan-check-constant-shadow",
        cl::desc("Insert checks for constant shadow values"),
        cl::Hidden, cl::init(false));
 
+static const char *const kMsanModuleCtorName = "msan.module_ctor";
+static const char *const kMsanInitName = "__msan_init";
+
 namespace {
 
 // Memory map parameters used in application-to-shadow address calculation.
 // Offset = (Addr & ~AndMask) ^ XorMask
 // Shadow = ShadowBase + Offset
 // Origin = OriginBase + Offset
 struct MemoryMapParams {
   uint64_t AndMask;
private:
   /// \brief Memory map parameters used in application-to-shadow calculation.
   const MemoryMapParams *MapParams;
 
   MDNode *ColdCallWeights;
   /// \brief Branch weights for origin store.
   MDNode *OriginStoreWeights;
   /// \brief An empty volatile inline asm that prevents callback merge.
   InlineAsm *EmptyAsm;
+  Function *MsanCtorFunction;
 
   friend struct MemorySanitizerVisitor;
   friend struct VarArgAMD64Helper;
   friend struct VarArgMIPS64Helper;
 };
 }  // namespace
 
 char MemorySanitizer::ID = 0;
bool MemorySanitizer::doInitialization(Module &M) {
   C = &(M.getContext());
   IRBuilder<> IRB(*C);
   IntptrTy = IRB.getIntPtrTy(DL);
   OriginTy = IRB.getInt32Ty();
 
   ColdCallWeights = MDBuilder(*C).createBranchWeights(1, 1000);
   OriginStoreWeights = MDBuilder(*C).createBranchWeights(1, 1000);
 
-  // Insert a call to __msan_init/__msan_track_origins into the module's CTORs.
-  appendToGlobalCtors(M, cast<Function>(M.getOrInsertFunction(
-                      "__msan_init", IRB.getVoidTy(), nullptr)), 0);
+  MsanCtorFunction = createSanitizerCtor(M, "MemorySanitizer",
+                                         kMsanModuleCtorName, kMsanInitName);
+
+  appendToGlobalCtors(M, MsanCtorFunction, 0);
 
   if (TrackOrigins)
     new GlobalVariable(M, IRB.getInt32Ty(), true, GlobalValue::WeakODRLinkage,
                        IRB.getInt32(TrackOrigins), "__msan_track_origins");
 
   if (ClKeepGoing)
     new GlobalVariable(M, IRB.getInt32Ty(), true, GlobalValue::WeakODRLinkage,
                        IRB.getInt32(ClKeepGoing), "__msan_keep_going");
else if (TargetTriple.getArch() == llvm::Triple::mips64 ||
     return new VarArgMIPS64Helper(Func, Msan, Visitor);
   else
     return new VarArgNoOpHelper(Func, Msan, Visitor);
 }
 
 }  // namespace
 
 bool MemorySanitizer::runOnFunction(Function &F) {
+  if (&F == MsanCtorFunction)
+    return false;
   MemorySanitizerVisitor Visitor(F, *this);
 
   // Clear out readonly/readnone attributes.
   AttrBuilder B;
   B.addAttribute(Attribute::ReadOnly)
     .addAttribute(Attribute::ReadNone);
   F.removeAttributes(AttributeSet::FunctionIndex,
                      AttributeSet::get(F.getContext(),
                                        AttributeSet::FunctionIndex, B));
 
   return Visitor.runOnFunction();
 }

lib/Transforms/Instrumentation/SanitizerCoverage.cpp

private:
   GlobalVariable *GuardArray;
   GlobalVariable *EightBitCounterArray;
 
   int CoverageLevel;
 };
 
 }  // namespace
 
-static Function *checkInterfaceFunction(Constant *FuncOrBitcast) {
-  if (Function *F = dyn_cast<Function>(FuncOrBitcast))
-     return F;
-  std::string Err;
-  raw_string_ostream Stream(Err);
-  Stream << "SanitizerCoverage interface function redefined: "
-         << *FuncOrBitcast;
-  report_fatal_error(Err);
-}
-
 bool SanitizerCoverageModule::runOnModule(Module &M) {
   if (!CoverageLevel) return false;
   C = &(M.getContext());
   DL = &M.getDataLayout();
   IntptrTy = Type::getIntNTy(*C, DL->getPointerSizeInBits());
   Type *VoidTy = Type::getVoidTy(*C);
   IRBuilder<> IRB(*C);
   Type *Int8PtrTy = PointerType::getUnqual(IRB.getInt8Ty());
   Type *Int32PtrTy = PointerType::getUnqual(IRB.getInt32Ty());
   Int64Ty = IRB.getInt64Ty();
 
-  Function *CtorFunc =
-      Function::Create(FunctionType::get(VoidTy, false),
-                       GlobalValue::InternalLinkage, kSanCovModuleCtorName, &M);
-  ReturnInst::Create(*C, BasicBlock::Create(*C, "", CtorFunc));
-  appendToGlobalCtors(M, CtorFunc, kSanCtorAndDtorPriority);
-
   SanCovFunction = checkInterfaceFunction(
+      "SanitizerCoverage",
       M.getOrInsertFunction(kSanCovName, VoidTy, Int32PtrTy, nullptr));
   SanCovWithCheckFunction = checkInterfaceFunction(
+      "SanitizerCoverage",
       M.getOrInsertFunction(kSanCovWithCheckName, VoidTy, Int32PtrTy, nullptr));
-  SanCovIndirCallFunction = checkInterfaceFunction(M.getOrInsertFunction(
-      kSanCovIndirCallName, VoidTy, IntptrTy, IntptrTy, nullptr));
-  SanCovTraceCmpFunction = checkInterfaceFunction(M.getOrInsertFunction(
-      kSanCovTraceCmp, VoidTy, Int64Ty, Int64Ty, Int64Ty, nullptr));
-
-  SanCovModuleInit = checkInterfaceFunction(M.getOrInsertFunction(
-      kSanCovModuleInitName, Type::getVoidTy(*C), Int32PtrTy, IntptrTy,
-      Int8PtrTy, Int8PtrTy, nullptr));
-  SanCovModuleInit->setLinkage(Function::ExternalLinkage);
+  SanCovIndirCallFunction = checkInterfaceFunction(
+      "SanitizerCoverage", M.getOrInsertFunction(kSanCovIndirCallName, VoidTy,
+                                                 IntptrTy, IntptrTy, nullptr));
+  SanCovTraceCmpFunction = checkInterfaceFunction(
+      "SanitizerCoverage",
+      M.getOrInsertFunction(kSanCovTraceCmp, VoidTy, Int64Ty, Int64Ty, Int64Ty,
+                            nullptr));
+
   // We insert an empty inline asm after cov callbacks to avoid callback merge.
   EmptyAsm = InlineAsm::get(FunctionType::get(IRB.getVoidTy(), false),
                             StringRef(""), StringRef(""),
                             /*hasSideEffects=*/true);
 
   if (ClExperimentalTracing) {
     SanCovTraceEnter = checkInterfaceFunction(
+        "SanitizerCoverage",
         M.getOrInsertFunction(kSanCovTraceEnter, VoidTy, Int32PtrTy, nullptr));
     SanCovTraceBB = checkInterfaceFunction(
+        "SanitizerCoverage",
         M.getOrInsertFunction(kSanCovTraceBB, VoidTy, Int32PtrTy, nullptr));
   }
 
   // At this point we create a dummy array of guards because we don't
   // know how many elements we will need.
   Type *Int32Ty = IRB.getInt32Ty();
   Type *Int8Ty = IRB.getInt8Ty();
 
bool SanitizerCoverageModule::runOnModule(Module &M) {
 
   // Create variable for module (compilation unit) name
   Constant *ModNameStrConst =
       ConstantDataArray::getString(M.getContext(), M.getName(), true);
   GlobalVariable *ModuleName =
       new GlobalVariable(M, ModNameStrConst->getType(), true,
                          GlobalValue::PrivateLinkage, ModNameStrConst);
 
-  // Call __sanitizer_cov_module_init
-  IRB.SetInsertPoint(CtorFunc->getEntryBlock().getTerminator());
-  IRB.CreateCall4(
-      SanCovModuleInit, IRB.CreatePointerCast(RealGuardArray, Int32PtrTy),
+  ArrayRef<Value *> InitArgs = {
+      IRB.CreatePointerCast(RealGuardArray, Int32PtrTy),
       ConstantInt::get(IntptrTy, N),
       ClUse8bitCounters
           ? IRB.CreatePointerCast(RealEightBitCounterArray, Int8PtrTy)
           : Constant::getNullValue(Int8PtrTy),
-      IRB.CreatePointerCast(ModuleName, Int8PtrTy));
+      IRB.CreatePointerCast(ModuleName, Int8PtrTy)};
+
+  Function *CtorFunc = createSanitizerCtor(
+      M, "SanitizerCoverage", kSanCovModuleCtorName, kSanCovModuleInitName,
+      {Int32PtrTy, IntptrTy, Int8PtrTy, Int8PtrTy}, InitArgs,
+      &SanCovModuleInit);
+
+  appendToGlobalCtors(M, CtorFunc, kSanCtorAndDtorPriority);
+
   return true;
 }
 
 bool SanitizerCoverageModule::runOnFunction(Function &F) {
   if (F.empty()) return false;
   if (F.getName().find(".module_ctor") != std::string::npos)
     return false;  // Should not instrument sanitizer init functions.
   if (CoverageLevel >= 3)

lib/Transforms/Instrumentation/ThreadSanitizer.cpp

 STATISTIC(NumAccessesWithBadSize, "Number of accesses with bad size");
 STATISTIC(NumInstrumentedVtableWrites, "Number of vtable ptr writes");
 STATISTIC(NumInstrumentedVtableReads, "Number of vtable ptr reads");
 STATISTIC(NumOmittedReadsFromConstantGlobals,
           "Number of reads from constant globals");
 STATISTIC(NumOmittedReadsFromVtable, "Number of vtable reads");
 STATISTIC(NumOmittedNonCaptured, "Number of accesses ignored due to capturing");
 
+static const char *const kTsanModuleCtorName = "tsan.module_ctor";
+static const char *const kTsanInitName = "__tsan_init";
+
 namespace {
 
 /// ThreadSanitizer: instrument the code in module to find races.
 struct ThreadSanitizer : public FunctionPass {
   ThreadSanitizer() : FunctionPass(ID) {}
   const char *getPassName() const override;
   bool runOnFunction(Function &F) override;
   bool doInitialization(Module &M) override;
private:
   Function *TsanAtomicStore[kNumberOfAccessSizes];
   Function *TsanAtomicRMW[AtomicRMWInst::LAST_BINOP + 1][kNumberOfAccessSizes];
   Function *TsanAtomicCAS[kNumberOfAccessSizes];
   Function *TsanAtomicThreadFence;
   Function *TsanAtomicSignalFence;
   Function *TsanVptrUpdate;
   Function *TsanVptrLoad;
   Function *MemmoveFn, *MemcpyFn, *MemsetFn;
+  Function *TsanCtorFunction;
 };
 }  // namespace
 
 char ThreadSanitizer::ID = 0;
 INITIALIZE_PASS(ThreadSanitizer, "tsan",
     "ThreadSanitizer: detects data races.",
     false, false)
 
 const char *ThreadSanitizer::getPassName() const {
   return "ThreadSanitizer";
 }
 
 FunctionPass *llvm::createThreadSanitizerPass() {
   return new ThreadSanitizer();
 }
 
-static Function *checkInterfaceFunction(Constant *FuncOrBitcast) {
-  if (Function *F = dyn_cast<Function>(FuncOrBitcast))
-     return F;
-  FuncOrBitcast->dump();
-  report_fatal_error("ThreadSanitizer interface function redefined");
-}
-
 void ThreadSanitizer::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(M.getContext());
   // Initialize the callbacks.
-  TsanFuncEntry = checkInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_func_entry", IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
-  TsanFuncExit = checkInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_func_exit", IRB.getVoidTy(), nullptr));
+  TsanFuncEntry = checkInterfaceFunction(
+      "ThreadSanitizer",
+      M.getOrInsertFunction("__tsan_func_entry", IRB.getVoidTy(),
+                            IRB.getInt8PtrTy(), nullptr));
+  TsanFuncExit = checkInterfaceFunction(
+      "ThreadSanitizer",
+      M.getOrInsertFunction("__tsan_func_exit", IRB.getVoidTy(), nullptr));
   OrdTy = IRB.getInt32Ty();
   for (size_t i = 0; i < kNumberOfAccessSizes; ++i) {
     const size_t ByteSize = 1 << i;
     const size_t BitSize = ByteSize * 8;
     SmallString<32> ReadName("__tsan_read" + itostr(ByteSize));
-    TsanRead[i] = checkInterfaceFunction(M.getOrInsertFunction(
-        ReadName, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+    TsanRead[i] = checkInterfaceFunction(
+        "ThreadSanitizer", M.getOrInsertFunction(ReadName, IRB.getVoidTy(),
+                                                 IRB.getInt8PtrTy(), nullptr));
 
     SmallString<32> WriteName("__tsan_write" + itostr(ByteSize));
-    TsanWrite[i] = checkInterfaceFunction(M.getOrInsertFunction(
-        WriteName, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+    TsanWrite[i] = checkInterfaceFunction(
+        "ThreadSanitizer", M.getOrInsertFunction(WriteName, IRB.getVoidTy(),
+                                                 IRB.getInt8PtrTy(), nullptr));
 
     SmallString<64> UnalignedReadName("__tsan_unaligned_read" +
         itostr(ByteSize));
-    TsanUnalignedRead[i] = checkInterfaceFunction(M.getOrInsertFunction(
-        UnalignedReadName, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+    TsanUnalignedRead[i] = checkInterfaceFunction(
+        "ThreadSanitizer",
+        M.getOrInsertFunction(UnalignedReadName, IRB.getVoidTy(),
+                              IRB.getInt8PtrTy(), nullptr));
 
     SmallString<64> UnalignedWriteName("__tsan_unaligned_write" +
         itostr(ByteSize));
-    TsanUnalignedWrite[i] = checkInterfaceFunction(M.getOrInsertFunction(
-        UnalignedWriteName, IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
+    TsanUnalignedWrite[i] = checkInterfaceFunction(
+        "ThreadSanitizer",
+        M.getOrInsertFunction(UnalignedWriteName, IRB.getVoidTy(),
+                              IRB.getInt8PtrTy(), nullptr));
 
     Type *Ty = Type::getIntNTy(M.getContext(), BitSize);
     Type *PtrTy = Ty->getPointerTo();
     SmallString<32> AtomicLoadName("__tsan_atomic" + itostr(BitSize) +
                                    "_load");
-    TsanAtomicLoad[i] = checkInterfaceFunction(M.getOrInsertFunction(
-        AtomicLoadName, Ty, PtrTy, OrdTy, nullptr));
+    TsanAtomicLoad[i] = checkInterfaceFunction(
+        "ThreadSanitizer",
+        M.getOrInsertFunction(AtomicLoadName, Ty, PtrTy, OrdTy, nullptr));
 
     SmallString<32> AtomicStoreName("__tsan_atomic" + itostr(BitSize) +
                                     "_store");
-    TsanAtomicStore[i] = checkInterfaceFunction(M.getOrInsertFunction(
-        AtomicStoreName, IRB.getVoidTy(), PtrTy, Ty, OrdTy,
-        nullptr));
+    TsanAtomicStore[i] = checkInterfaceFunction(
+        "ThreadSanitizer",
+        M.getOrInsertFunction(AtomicStoreName, IRB.getVoidTy(), PtrTy, Ty,
+                              OrdTy, nullptr));
 
     for (int op = AtomicRMWInst::FIRST_BINOP;
         op <= AtomicRMWInst::LAST_BINOP; ++op) {
       TsanAtomicRMW[op][i] = nullptr;
       const char *NamePart = nullptr;
       if (op == AtomicRMWInst::Xchg)
         NamePart = "_exchange";
       else if (op == AtomicRMWInst::Add)
         NamePart = "_fetch_add";
       else if (op == AtomicRMWInst::Sub)
         NamePart = "_fetch_sub";
       else if (op == AtomicRMWInst::And)
         NamePart = "_fetch_and";
       else if (op == AtomicRMWInst::Or)
         NamePart = "_fetch_or";
       else if (op == AtomicRMWInst::Xor)
         NamePart = "_fetch_xor";
       else if (op == AtomicRMWInst::Nand)
         NamePart = "_fetch_nand";
       else
         continue;
       SmallString<32> RMWName("__tsan_atomic" + itostr(BitSize) + NamePart);
-      TsanAtomicRMW[op][i] = checkInterfaceFunction(M.getOrInsertFunction(
-          RMWName, Ty, PtrTy, Ty, OrdTy, nullptr));
+      TsanAtomicRMW[op][i] = checkInterfaceFunction(
+          "ThreadSanitizer",
+          M.getOrInsertFunction(RMWName, Ty, PtrTy, Ty, OrdTy, nullptr));
     }
 
     SmallString<32> AtomicCASName("__tsan_atomic" + itostr(BitSize) +
                                   "_compare_exchange_val");
-    TsanAtomicCAS[i] = checkInterfaceFunction(M.getOrInsertFunction(
-        AtomicCASName, Ty, PtrTy, Ty, Ty, OrdTy, OrdTy, nullptr));
-  }
-  TsanVptrUpdate = checkInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_vptr_update", IRB.getVoidTy(), IRB.getInt8PtrTy(),
+    TsanAtomicCAS[i] = checkInterfaceFunction(
+        "ThreadSanitizer", M.getOrInsertFunction(AtomicCASName, Ty, PtrTy, Ty,
+                                                 Ty, OrdTy, OrdTy, nullptr));
+  }
+  TsanVptrUpdate = checkInterfaceFunction(
+      "ThreadSanitizer",
+      M.getOrInsertFunction("__tsan_vptr_update", IRB.getVoidTy(),
+                            IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), nullptr));
+  TsanVptrLoad = checkInterfaceFunction(
+      "ThreadSanitizer",
+      M.getOrInsertFunction("__tsan_vptr_read", IRB.getVoidTy(),
                             IRB.getInt8PtrTy(), nullptr));
-  TsanVptrLoad = checkInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_vptr_read", IRB.getVoidTy(), IRB.getInt8PtrTy(), nullptr));
-  TsanAtomicThreadFence = checkInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_atomic_thread_fence", IRB.getVoidTy(), OrdTy, nullptr));
-  TsanAtomicSignalFence = checkInterfaceFunction(M.getOrInsertFunction(
-      "__tsan_atomic_signal_fence", IRB.getVoidTy(), OrdTy, nullptr));
-
-  MemmoveFn = checkInterfaceFunction(M.getOrInsertFunction(
-    "memmove", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
+  TsanAtomicThreadFence = checkInterfaceFunction(
+      "ThreadSanitizer",
+      M.getOrInsertFunction("__tsan_atomic_thread_fence", IRB.getVoidTy(),
+                            OrdTy, nullptr));
+  TsanAtomicSignalFence = checkInterfaceFunction(
+      "ThreadSanitizer",
+      M.getOrInsertFunction("__tsan_atomic_signal_fence", IRB.getVoidTy(),
+                            OrdTy, nullptr));
+
+  MemmoveFn = checkInterfaceFunction(
+      "ThreadSanitizer",
+      M.getOrInsertFunction("memmove", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
                             IRB.getInt8PtrTy(), IntptrTy, nullptr));
-  MemcpyFn = checkInterfaceFunction(M.getOrInsertFunction(
-    "memcpy", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
-    IntptrTy, nullptr));
-  MemsetFn = checkInterfaceFunction(M.getOrInsertFunction(
-    "memset", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(), IRB.getInt32Ty(),
-    IntptrTy, nullptr));
+  MemcpyFn = checkInterfaceFunction(
+      "ThreadSanitizer",
+      M.getOrInsertFunction("memcpy", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
+                            IRB.getInt8PtrTy(), IntptrTy, nullptr));
+  MemsetFn = checkInterfaceFunction(
+      "ThreadSanitizer",
+      M.getOrInsertFunction("memset", IRB.getInt8PtrTy(), IRB.getInt8PtrTy(),
+                            IRB.getInt32Ty(), IntptrTy, nullptr));
 }
 
 bool ThreadSanitizer::doInitialization(Module &M) {
   const DataLayout &DL = M.getDataLayout();
+  IntptrTy = DL.getIntPtrType(M.getContext());
+  TsanCtorFunction = createSanitizerCtor(M, "ThreadSanitizer",
+                                         kTsanModuleCtorName, kTsanInitName);
 
-  // Always insert a call to __tsan_init into the module's CTORs.
-  IRBuilder<> IRB(M.getContext());
-  IntptrTy = IRB.getIntPtrTy(DL);
-  Value *TsanInit = M.getOrInsertFunction("__tsan_init",
-                                          IRB.getVoidTy(), nullptr);
-  appendToGlobalCtors(M, cast<Function>(TsanInit), 0);
+  appendToGlobalCtors(M, TsanCtorFunction, 0);
 
   return true;
 }
 
 static bool isVtableAccess(Instruction *I) {
   if (MDNode *Tag = I->getMetadata(LLVMContext::MD_tbaa))
     return Tag->isTBAAVtableAccess();
   return false;
static bool isAtomic(Instruction *I) {
   if (isa<AtomicCmpXchgInst>(I))
     return true;
   if (isa<FenceInst>(I))
     return true;
   return false;
 }
 
 bool ThreadSanitizer::runOnFunction(Function &F) {
+  if (&F == TsanCtorFunction)
+    return false;
   initializeCallbacks(*F.getParent());
   SmallVector<Instruction*, 8> RetVec;
   SmallVector<Instruction*, 8> AllLoadsAndStores;
   SmallVector<Instruction*, 8> LocalLoadsAndStores;
   SmallVector<Instruction*, 8> AtomicAccesses;
   SmallVector<Instruction*, 8> MemIntrinCalls;
   bool Res = false;
   bool HasCalls = false;

lib/Transforms/Utils/ModuleUtils.cpp

 //===----------------------------------------------------------------------===//
 
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 #include "llvm/ADT/SmallPtrSet.h"
 #include "llvm/IR/DerivedTypes.h"
 #include "llvm/IR/Function.h"
 #include "llvm/IR/IRBuilder.h"
 #include "llvm/IR/Module.h"
+#include "llvm/Support/raw_ostream.h"
 
 using namespace llvm;
 
 static void appendToGlobalArray(const char *Array, 
                                 Module &M, Function *F, int Priority) {
   IRBuilder<> IRB(M.getContext());
   FunctionType *FnTy = FunctionType::get(IRB.getVoidTy(), false);
 
llvm::collectUsedGlobalVariables(Module &M, SmallPtrSetImpl<GlobalValue *> &Set,
   const ConstantArray *Init = cast<ConstantArray>(GV->getInitializer());
   for (unsigned I = 0, E = Init->getNumOperands(); I != E; ++I) {
     Value *Op = Init->getOperand(I);
     GlobalValue *G = cast<GlobalValue>(Op->stripPointerCastsNoFollowAliases());
     Set.insert(G);
   }
   return GV;
 }
+
+// Validate the result of Module::getOrInsertFunction called for an interface
+// function of sanitizer. If the instrumented module defines a function
+// with the same name, their prototypes must match, otherwise
+// getOrInsertFunction returns a bitcast.
+Function *llvm::checkInterfaceFunction(StringRef Sanitizer,
+                                       Constant *FuncOrBitcast) {
+  if (isa<Function>(FuncOrBitcast))
+    return cast<Function>(FuncOrBitcast);
+  FuncOrBitcast->dump();
+  std::string Err;
+  raw_string_ostream Stream(Err);
+  Stream << Sanitizer << " interface function redefined: " << *FuncOrBitcast;
+  report_fatal_error(Err);
+}
+
+Function *llvm::createSanitizerCtor(Module &M, StringRef Sanitizer,
+                                    llvm::StringRef CtorName,
+                                    llvm::StringRef InitName,
+                                    llvm::ArrayRef<Type *> InitType,
+                                    llvm::ArrayRef<Value *> InitArgs,
+                                    llvm::Function **InitFunctionPtr) {
+  assert(!InitName.empty() && "Expected init function name");
+  Function *Ctor = Function::Create(
+      FunctionType::get(Type::getVoidTy(M.getContext()), false),
+      GlobalValue::InternalLinkage, CtorName, &M);
+  BasicBlock *CtorBB = BasicBlock::Create(M.getContext(), "", Ctor);
+  IRBuilder<> IRB(ReturnInst::Create(M.getContext(), CtorBB));
+  Function *InitFunction = checkInterfaceFunction(
+      Sanitizer,
+      M.getOrInsertFunction(InitName,
+                            FunctionType::get(IRB.getVoidTy(), InitType, false),
+                            AttributeSet()));
+  InitFunction->setLinkage(Function::ExternalLinkage);
+  IRB.CreateCall(InitFunction, InitArgs);
+  if (InitFunctionPtr)
+    *InitFunctionPtr = InitFunction;
+  return Ctor;
+}
+
+Function *llvm::createSanitizerCtor(Module &M, StringRef Sanitizer,
+                                    llvm::StringRef CtorName,
+                                    llvm::StringRef InitName,
+                                    llvm::Function **InitFunctionPtr) {
+  return llvm::createSanitizerCtor(M, Sanitizer, CtorName, InitName, {}, {},
+                                   InitFunctionPtr);
+}