[msan] Set cmpxchg shadow precisely

[stephan.yichao.zhao]

Summary

In terms of https://llvm.org/docs/LangRef.html#cmpxchg-instruction,
the return type of chmpxchg is a pair {ty, i1}, while I think we
only wanted to set the shadow for the address 0th op, and it has type
ty.

[eugenis]

LGTM
Nice catch!

llvm/lib/Transforms/Instrumentation/MemorySanitizer.cpp

if (ClCheckAccessAddress)
       insertShadowCheck(I.getPointerOperand(), &I);
   }
 
   void handleCASOrRMW(Instruction &I) {
     assert(isa<AtomicRMWInst>(I) || isa<AtomicCmpXchgInst>(I));
 
     IRBuilder<> IRB(&I);
     Value *Addr = I.getOperand(0);
-    Value *ShadowPtr = getShadowOriginPtr(Addr, IRB, I.getType(), Align(1),
+    Value *Val = I.getOperand(1);
+    Value *ShadowPtr = getShadowOriginPtr(Addr, IRB, Val->getType(), Align(1),
                                           /*isStore*/ true)
                            .first;
 
     if (ClCheckAccessAddress)
       insertShadowCheck(Addr, &I);
 
     // Only test the conditional argument of cmpxchg instruction.
     // The other argument can potentially be uninitialized, but we can not
     // detect this situation reliably without possible false positives.
     if (isa<AtomicCmpXchgInst>(I))
-      insertShadowCheck(I.getOperand(1), &I);
+      insertShadowCheck(Val, &I);
 
-    IRB.CreateStore(getCleanShadow(&I), ShadowPtr);
+    IRB.CreateStore(getCleanShadow(Val), ShadowPtr);
 
     setShadow(&I, getCleanShadow(&I));
     setOrigin(&I, getCleanOrigin());
   }
 
   void visitAtomicRMWInst(AtomicRMWInst &I) {
     handleCASOrRMW(I);
     I.setOrdering(addReleaseOrdering(I.getOrdering()));

llvm/test/Instrumentation/MemorySanitizer/atomics.ll

 define i32 @Cmpxchg(i32* %p, i32 %a, i32 %b) sanitize_memory {
 entry:
   %pair = cmpxchg i32* %p, i32 %a, i32 %b seq_cst seq_cst
   %0 = extractvalue { i32, i1 } %pair, 0
   ret i32 %0
 }
 
 ; CHECK-LABEL: @Cmpxchg
-; CHECK: store { i32, i1 } zeroinitializer,
+; CHECK: store i32 0,
 ; CHECK: icmp
 ; CHECK: br
 ; CHECK: @__msan_warning_with_origin
 ; CHECK: cmpxchg {{.*}} seq_cst seq_cst
 ; CHECK: store i32 0, {{.*}} @__msan_retval_tls
 ; CHECK: ret i32
 
 
 ; relaxed cmpxchg: bump up to "release monotonic"
 
 define i32 @CmpxchgMonotonic(i32* %p, i32 %a, i32 %b) sanitize_memory {
 entry:
   %pair = cmpxchg i32* %p, i32 %a, i32 %b monotonic monotonic
   %0 = extractvalue { i32, i1 } %pair, 0
   ret i32 %0
 }
 
 ; CHECK-LABEL: @CmpxchgMonotonic
-; CHECK: store { i32, i1 } zeroinitializer,
+; CHECK: store i32 0,
 ; CHECK: icmp
 ; CHECK: br
 ; CHECK: @__msan_warning_with_origin
 ; CHECK: cmpxchg {{.*}} release monotonic
 ; CHECK: store i32 0, {{.*}} @__msan_retval_tls
 ; CHECK: ret i32