phase 01: add new command line flag to enable UAR in 3 modes (always, [runtime], never).

[kda]

I think this patch is near completion.
But the new code generated for the 'Always' case is definitely wrong.
I could use some coaching. I will eventually figure it out, but an interactive session would probably help me along.

[kda]

fixed tests for asan_interface.inc.

[vitalybuka]

Smaller incremental patches are highly encouraged. But I assume it's WIP.
In the first I'd recommend to try to land clang pieces and leave llvm and compiler-rt parts unchanged.

And I can with interactive session next week.

[kda]

will attempt in smaller pieces.

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

3317–3334

I think this is where things start going wrong, but after a few hours looking, I'm not sure what the code should look like.
I know I don't want a branch, but I don't know how to just stick the call in to the stack allocator.
I think once that is right, then the pieces after it follow in a straightforwad manner.

clang/docs/AddressSanitizer.rst

 ================
 AddressSanitizer
 ================
 
 .. contents::
    :local:
 
 Introduction
 ============
 
 AddressSanitizer is a fast memory error detector. It consists of a compiler
 instrumentation module and a run-time library. The tool can detect the
 following types of bugs:
 
 * Out-of-bounds accesses to heap, stack and globals
 * Use-after-free
-* Use-after-return (runtime flag `ASAN_OPTIONS=detect_stack_use_after_return=1`)
+* Use-after-return (clang flag `-fsanitize-address-detect-stack-use-after-return=(always|runtime|never)` default: runtime)
+  * Add runtime flag `ASAN_OPTIONS=detect_stack_use_after_return=1` to enable when compiled with `-fsanitize-address-detect-stack-use-after-return=runtime`)
 * Use-after-scope (clang flag `-fsanitize-address-use-after-scope`)
 * Double-free, invalid free
 * Memory leaks (experimental)
 
 Typical slowdown introduced by AddressSanitizer is **2x**.
 
 How to build
 ============

clang/docs/ClangCommandLineReference.rst

 These destructors are emitted to unregister instrumented global variables when
 code is unloaded (e.g. via `dlclose()`).
 
 Valid options are:
 
 * ``global`` - Emit module destructors that are called via a platform specific array (see `llvm.global_dtors`).
 * ``none`` - Do not emit module destructors.
 
+.. option:: -fsanitize-address-detect-stack-use-after-return=<arg>
+
+Select the enabling method of detect-stack-use-after-return in AddressSanitizer.
+
+Valid options are:
+* ``always`` - Always detect use-after-return.  (Code generated and always enabled.)
+* ``runtime`` - Detect use-after-return at runtime if enabled by runtime command line (flag `ASAN_OPTIONS=detect_stack_use_after_return=1`)
+* ``never`` - Never detect use-after-return.  (Code not generated for detection.)
+
 .. option:: -fsanitize-blacklist=<arg>
 
 Path to blacklist file for sanitizers
 
 .. option:: -fsanitize-cfi-canonical-jump-tables, -fno-sanitize-cfi-canonical-jump-tables
 
 Make the jump table addresses canonical in the symbol table
 

clang/include/clang/Basic/CodeGenOptions.def

 CODEGENOPT(SanitizeAddressGlobalsDeadStripping, 1, 0) ///< Enable linker dead stripping
                                                       ///< of globals in AddressSanitizer
 CODEGENOPT(SanitizeAddressUseOdrIndicator, 1, 0) ///< Enable ODR indicator globals
 CODEGENOPT(SanitizeMemoryTrackOrigins, 2, 0) ///< Enable tracking origins in
                                              ///< MemorySanitizer
 ENUM_CODEGENOPT(SanitizeAddressDtorKind, llvm::AsanDtorKind, 2,
                 llvm::AsanDtorKind::Global)  ///< Set how ASan global
                                              ///< destructors are emitted.
+ENUM_CODEGENOPT(SanitizeAddressDetectStackUseAfterReturnMode,
+                llvm::AsanDetectStackUseAfterReturnMode, 2 /* ??? */,
+                llvm::AsanDetectStackUseAfterReturnMode::Runtime
+                ) ///< Set detection mode for stack-use-after-return.
 CODEGENOPT(SanitizeMemoryUseAfterDtor, 1, 0) ///< Enable use-after-delete detection
                                              ///< in MemorySanitizer
 CODEGENOPT(SanitizeCfiCrossDso, 1, 0) ///< Enable cross-dso support in CFI.
 CODEGENOPT(SanitizeMinimalRuntime, 1, 0) ///< Use "_minimal" sanitizer runtime for
                                          ///< diagnostics.
 CODEGENOPT(SanitizeCfiICallGeneralizePointers, 1, 0) ///< Generalize pointer types in
                                                      ///< CFI icall function signatures
 CODEGENOPT(SanitizeCfiCanonicalJumpTables, 1, 0) ///< Make jump table symbols canonical

clang/include/clang/Basic/Sanitizers.h

return SanitizerKind::CFI | SanitizerKind::Integer |
          SanitizerKind::ImplicitConversion | SanitizerKind::Nullability |
          SanitizerKind::Undefined | SanitizerKind::FloatDivideByZero;
 }
 
 StringRef AsanDtorKindToString(llvm::AsanDtorKind kind);
 
 llvm::AsanDtorKind AsanDtorKindFromString(StringRef kind);
 
+StringRef AsanDetectStackUseAfterReturnModeToString(
+    llvm::AsanDetectStackUseAfterReturnMode mode);
+
+llvm::AsanDetectStackUseAfterReturnMode
+AsanDetectStackUseAfterReturnModeFromString(StringRef modeStr);
+
 } // namespace clang
 
 #endif // LLVM_CLANG_BASIC_SANITIZERS_H

clang/include/clang/Driver/Options.td

: Joined<["-"], "fsanitize-address-destructor-kind=">,
       MetaVarName<"<kind>">,
       Flags<[CC1Option]>,
       HelpText<"Set destructor type used in ASan instrumentation">,
       Group<f_clang_Group>,
       Values<"none,global">,
       NormalizedValuesScope<"llvm::AsanDtorKind">,
       NormalizedValues<["None", "Global"]>,
       MarshallingInfoEnum<CodeGenOpts<"SanitizeAddressDtorKind">, "Global">;
+def sanitize_address_detect_stack_use_after_return_EQ
+    : Joined<["-"], "fsanitize-address-detect-stack-use-after-return=">,
+      MetaVarName<"<mode>">,
+      Flags<[CC1Option]>,
+      HelpText<"Select the enabling method of detect-stack-use-after-return in AddressSanitizer">,
+      Group<f_clang_Group>,
+      Values<"always,runtime,never">,
+      NormalizedValuesScope<"llvm::AsanDetectStackUseAfterReturnMode">,
+      NormalizedValues<["Always", "Runtime", "Never"]>,
+      MarshallingInfoEnum<CodeGenOpts<"SanitizeAddressDetectStackUseAfterReturnMode">, "Runtime">;
 // Note: This flag was introduced when it was necessary to distinguish between
 //       ABI for correct codegen.  This is no longer needed, but the flag is
 //       not removed since targeting either ABI will behave the same.
 //       This way we cause no disturbance to existing scripts & code, and if we
 //       want to use this flag in the future we will cause no disturbance then
 //       either.
 def fsanitize_hwaddress_abi_EQ
     : Joined<["-"], "fsanitize-hwaddress-abi=">,

clang/include/clang/Driver/SanitizerArgs.h

class SanitizerArgs {
   bool SharedRuntime = false;
   bool AsanUseAfterScope = true;
   bool AsanPoisonCustomArrayCookie = false;
   bool AsanGlobalsDeadStripping = false;
   bool AsanUseOdrIndicator = false;
   bool AsanInvalidPointerCmp = false;
   bool AsanInvalidPointerSub = false;
   llvm::AsanDtorKind AsanDtorKind = llvm::AsanDtorKind::Invalid;
+  llvm::AsanDetectStackUseAfterReturnMode AsanDetectStackUseAfterReturnMode =
+      llvm::AsanDetectStackUseAfterReturnMode::Runtime;
   std::string HwasanAbi;
   bool LinkRuntimes = true;
   bool LinkCXXRuntimes = false;
   bool NeedPIE = false;
   bool SafeStackRuntime = false;
   bool Stats = false;
   bool TsanMemoryAccess = true;
   bool TsanFuncEntryExit = true;

clang/lib/Basic/Sanitizers.cpp

 
 llvm::AsanDtorKind AsanDtorKindFromString(StringRef kindStr) {
   return llvm::StringSwitch<llvm::AsanDtorKind>(kindStr)
       .Case("none", llvm::AsanDtorKind::None)
       .Case("global", llvm::AsanDtorKind::Global)
       .Default(llvm::AsanDtorKind::Invalid);
 }
 
+StringRef AsanDetectStackUseAfterReturnModeToString(
+    llvm::AsanDetectStackUseAfterReturnMode mode) {
+  switch (mode) {
+  case llvm::AsanDetectStackUseAfterReturnMode::Always:
+    return "always";
+  case llvm::AsanDetectStackUseAfterReturnMode::Runtime:
+    return "runtime";
+  case llvm::AsanDetectStackUseAfterReturnMode::Never:
+    return "never";
+  case llvm::AsanDetectStackUseAfterReturnMode::Invalid:
+    return "invalid";
+  }
+  return "invalid";
+}
+
+llvm::AsanDetectStackUseAfterReturnMode
+AsanDetectStackUseAfterReturnModeFromString(StringRef modeStr) {
+  return llvm::StringSwitch<llvm::AsanDetectStackUseAfterReturnMode>(modeStr)
+      .Case("always", llvm::AsanDetectStackUseAfterReturnMode::Always)
+      .Case("runtime", llvm::AsanDetectStackUseAfterReturnMode::Runtime)
+      .Case("never", llvm::AsanDetectStackUseAfterReturnMode::Never)
+      .Default(llvm::AsanDetectStackUseAfterReturnMode::Invalid);
+}
+
 } // namespace clang

clang/lib/CodeGen/BackendUtil.cpp

 #include "llvm/Transforms/IPO.h"
 #include "llvm/Transforms/IPO/AlwaysInliner.h"
 #include "llvm/Transforms/IPO/LowerTypeTests.h"
 #include "llvm/Transforms/IPO/PassManagerBuilder.h"
 #include "llvm/Transforms/IPO/ThinLTOBitcodeWriter.h"
 #include "llvm/Transforms/InstCombine/InstCombine.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Instrumentation/AddressSanitizer.h"
+#include "llvm/Transforms/Instrumentation/AddressSanitizerOptions.h"
 #include "llvm/Transforms/Instrumentation/BoundsChecking.h"
 #include "llvm/Transforms/Instrumentation/DataFlowSanitizer.h"
 #include "llvm/Transforms/Instrumentation/GCOVProfiler.h"
 #include "llvm/Transforms/Instrumentation/HWAddressSanitizer.h"
 #include "llvm/Transforms/Instrumentation/InstrProfiling.h"
 #include "llvm/Transforms/Instrumentation/MemProfiler.h"
 #include "llvm/Transforms/Instrumentation/MemorySanitizer.h"
 #include "llvm/Transforms/Instrumentation/SanitizerCoverage.h"
const PassManagerBuilderWrapper &BuilderWrapper =
       static_cast<const PassManagerBuilderWrapper&>(Builder);
   const Triple &T = BuilderWrapper.getTargetTriple();
   const CodeGenOptions &CGOpts = BuilderWrapper.getCGOpts();
   bool Recover = CGOpts.SanitizeRecover.has(SanitizerKind::Address);
   bool UseAfterScope = CGOpts.SanitizeAddressUseAfterScope;
   bool UseOdrIndicator = CGOpts.SanitizeAddressUseOdrIndicator;
   bool UseGlobalsGC = asanUseGlobalsGC(T, CGOpts);
   llvm::AsanDtorKind DestructorKind = CGOpts.getSanitizeAddressDtorKind();
+  llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode =
+      CGOpts.getSanitizeAddressDetectStackUseAfterReturnMode();
   PM.add(createAddressSanitizerFunctionPass(/*CompileKernel*/ false, Recover,
-                                            UseAfterScope));
+                                            UseAfterScope,
+                                            DetectStackUseAfterReturnMode));
   PM.add(createModuleAddressSanitizerLegacyPassPass(
       /*CompileKernel*/ false, Recover, UseGlobalsGC, UseOdrIndicator,
       DestructorKind));
 }
 
 static void addKernelAddressSanitizerPasses(const PassManagerBuilder &Builder,
                                             legacy::PassManagerBase &PM) {
   PM.add(createAddressSanitizerFunctionPass(
-      /*CompileKernel*/ true, /*Recover*/ true, /*UseAfterScope*/ false));
+      /*CompileKernel*/ true, /*Recover*/ true, /*UseAfterScope*/ false,
+      /*DetectStackUseAfterReturnMode*/
+      llvm::AsanDetectStackUseAfterReturnMode::Never));
   PM.add(createModuleAddressSanitizerLegacyPassPass(
       /*CompileKernel*/ true, /*Recover*/ true, /*UseGlobalsGC*/ true,
       /*UseOdrIndicator*/ false));
 }
 
 static void addHWAddressSanitizerPasses(const PassManagerBuilder &Builder,
                                             legacy::PassManagerBase &PM) {
   const PassManagerBuilderWrapper &BuilderWrapper =
PB.registerOptimizerLastEPCallback([&](ModulePassManager &MPM,
     auto ASanPass = [&](SanitizerMask Mask, bool CompileKernel) {
       if (LangOpts.Sanitize.has(Mask)) {
         bool Recover = CodeGenOpts.SanitizeRecover.has(Mask);
         bool UseAfterScope = CodeGenOpts.SanitizeAddressUseAfterScope;
         bool ModuleUseAfterScope = asanUseGlobalsGC(TargetTriple, CodeGenOpts);
         bool UseOdrIndicator = CodeGenOpts.SanitizeAddressUseOdrIndicator;
         llvm::AsanDtorKind DestructorKind =
             CodeGenOpts.getSanitizeAddressDtorKind();
+        llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode =
+            CodeGenOpts.getSanitizeAddressDetectStackUseAfterReturnMode();
         MPM.addPass(RequireAnalysisPass<ASanGlobalsMetadataAnalysis, Module>());
         MPM.addPass(ModuleAddressSanitizerPass(
             CompileKernel, Recover, ModuleUseAfterScope, UseOdrIndicator,
             DestructorKind));
         MPM.addPass(createModuleToFunctionPassAdaptor(
-            AddressSanitizerPass(CompileKernel, Recover, UseAfterScope)));
+            AddressSanitizerPass(CompileKernel, Recover, UseAfterScope,
+                                 DetectStackUseAfterReturnMode)));
       }
     };
     ASanPass(SanitizerKind::Address, false);
     ASanPass(SanitizerKind::KernelAddress, true);
 
     auto HWASanPass = [&](SanitizerMask Mask, bool CompileKernel) {
       if (LangOpts.Sanitize.has(Mask)) {
         bool Recover = CodeGenOpts.SanitizeRecover.has(Mask);

clang/lib/Driver/SanitizerArgs.cpp

if (const auto *Arg =
       auto parsedAsanDtorKind = AsanDtorKindFromString(Arg->getValue());
       if (parsedAsanDtorKind == llvm::AsanDtorKind::Invalid) {
         TC.getDriver().Diag(clang::diag::err_drv_unsupported_option_argument)
             << Arg->getOption().getName() << Arg->getValue();
       }
       AsanDtorKind = parsedAsanDtorKind;
     }
 
+    if (const auto *Arg = Args.getLastArg(
+            options::OPT_sanitize_address_detect_stack_use_after_return_EQ)) {
+      auto parsedAsanDetectStackUseAfterReturnMode =
+          AsanDetectStackUseAfterReturnModeFromString(Arg->getValue());
+      if (parsedAsanDetectStackUseAfterReturnMode ==
+          llvm::AsanDetectStackUseAfterReturnMode::Invalid) {
+        TC.getDriver().Diag(clang::diag::err_drv_unsupported_option_argument)
+            << Arg->getOption().getName() << Arg->getValue();
+      }
+      AsanDetectStackUseAfterReturnMode =
+          parsedAsanDetectStackUseAfterReturnMode;
+    }
+
   } else {
     AsanUseAfterScope = false;
     // -fsanitize=pointer-compare/pointer-subtract requires -fsanitize=address.
     SanitizerMask DetectInvalidPointerPairs =
         SanitizerKind::PointerCompare | SanitizerKind::PointerSubtract;
     if (AllAddedKinds & DetectInvalidPointerPairs & ~AllRemove) {
       TC.getDriver().Diag(clang::diag::err_drv_argument_only_allowed_with)
           << lastArgumentForMask(D, Args,
void SanitizerArgs::addArgs(const ToolChain &TC, const llvm::opt::ArgList &Args,
 
   // Only pass the option to the frontend if the user requested,
   // otherwise the frontend will just use the codegen default.
   if (AsanDtorKind != llvm::AsanDtorKind::Invalid) {
     CmdArgs.push_back(Args.MakeArgString("-fsanitize-address-destructor-kind=" +
                                          AsanDtorKindToString(AsanDtorKind)));
   }
 
+  // Only pass the option to the frontend if the user requested,
+  // otherwise the frontend will just use the codegen default.
+  if (AsanDetectStackUseAfterReturnMode !=
+      llvm::AsanDetectStackUseAfterReturnMode::Runtime) {
+    CmdArgs.push_back(
+        Args.MakeArgString("-fsanitize-address-detect-stack-use-after-return=" +
+                           AsanDetectStackUseAfterReturnModeToString(
+                               AsanDetectStackUseAfterReturnMode)));
+  }
+
   if (!HwasanAbi.empty()) {
     CmdArgs.push_back("-default-function-attr");
     CmdArgs.push_back(Args.MakeArgString("hwasan-abi=" + HwasanAbi));
   }
 
   if (Sanitizers.has(SanitizerKind::HWAddress) && TC.getTriple().isAArch64()) {
     CmdArgs.push_back("-target-feature");
     CmdArgs.push_back("+tagged-globals");

compiler-rt/lib/asan/asan_fake_stack.cpp

 static FakeStack *GetFakeStackFast() {
   if (FakeStack *fs = GetTLSFakeStack())
     return fs;
   if (!__asan_option_detect_stack_use_after_return)
     return nullptr;
   return GetFakeStack();
 }
 
+static FakeStack *GetFakeStackFastFlagless() {
+  if (FakeStack *fs = GetTLSFakeStack())
+    return fs;
+  return GetFakeStack();
+}
+
 ALWAYS_INLINE uptr OnMalloc(uptr class_id, uptr size) {
   FakeStack *fs = GetFakeStackFast();
   if (!fs) return 0;
   uptr local_stack;
   uptr real_stack = reinterpret_cast<uptr>(&local_stack);
   FakeFrame *ff = fs->Allocate(fs->stack_size_log(), class_id, real_stack);
   if (!ff) return 0;  // Out of fake stack.
   uptr ptr = reinterpret_cast<uptr>(ff);
   SetShadow(ptr, size, class_id, 0);
   return ptr;
 }
 
+ALWAYS_INLINE uptr OnMallocFlagless(uptr class_id, uptr size) {
+  FakeStack *fs = GetFakeStackFastFlagless();
+  if (!fs)
+    return 0;
+  uptr local_stack;
+  uptr real_stack = reinterpret_cast<uptr>(&local_stack);
+  FakeFrame *ff = fs->Allocate(fs->stack_size_log(), class_id, real_stack);
+  if (!ff)
+    return 0;  // Out of fake stack.
+  uptr ptr = reinterpret_cast<uptr>(ff);
+  SetShadow(ptr, size, class_id, 0);
+  return ptr;
+}
+
 ALWAYS_INLINE void OnFree(uptr ptr, uptr class_id, uptr size) {
   FakeStack::Deallocate(ptr, class_id);
   SetShadow(ptr, size, class_id, kMagic8);
 }
 
 } // namespace __asan
 
 // ---------------------- Interface ---------------- {{{1

 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(3)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(4)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(5)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(6)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(7)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(8)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(9)
 DEFINE_STACK_MALLOC_FREE_WITH_CLASS_ID(10)
+
+using namespace __asan;
+#define DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(class_id) \
+  extern "C" SANITIZER_INTERFACE_ATTRIBUTE uptr              \
+      __asan_stack_flagless_malloc_##class_id(uptr size) {   \
+    return OnMallocFlagless(class_id, size);                 \
+  }
+
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(0)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(1)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(2)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(3)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(4)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(5)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(6)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(7)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(8)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(9)
+DEFINE_STACK_FLAGLESS_MALLOC_WITH_CLASS_ID(10)
 extern "C" {
 SANITIZER_INTERFACE_ATTRIBUTE
 void *__asan_get_current_fake_stack() { return GetFakeStackFast(); }
 
 SANITIZER_INTERFACE_ATTRIBUTE
+void *__asan_get_current_fake_stack_flagless() {
+  return GetFakeStackFastFlagless();
+}
+
+SANITIZER_INTERFACE_ATTRIBUTE
 void *__asan_addr_is_in_fake_stack(void *fake_stack, void *addr, void **beg,
                                    void **end) {
   FakeStack *fs = reinterpret_cast<FakeStack*>(fake_stack);
   if (!fs) return nullptr;
   uptr frame_beg, frame_end;
   FakeFrame *frame = reinterpret_cast<FakeFrame *>(fs->AddrIsInFakeStack(
       reinterpret_cast<uptr>(addr), &frame_beg, &frame_end));
   if (!frame) return nullptr;

compiler-rt/lib/asan/asan_interface.inc

 //===-- asan_interface.inc ------------------------------------------------===//
 //
 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
 // See https://llvm.org/LICENSE.txt for license information.
 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
 //
 //===----------------------------------------------------------------------===//
 // Asan interface list.
 //===----------------------------------------------------------------------===//
 INTERFACE_FUNCTION(__asan_addr_is_in_fake_stack)
 INTERFACE_FUNCTION(__asan_address_is_poisoned)
 INTERFACE_FUNCTION(__asan_after_dynamic_init)
 INTERFACE_FUNCTION(__asan_alloca_poison)
 INTERFACE_FUNCTION(__asan_allocas_unpoison)
 INTERFACE_FUNCTION(__asan_before_dynamic_init)
 INTERFACE_FUNCTION(__asan_describe_address)
 INTERFACE_FUNCTION(__asan_exp_load1)
 INTERFACE_FUNCTION(__asan_exp_load2)
 INTERFACE_FUNCTION(__asan_exp_load4)
 INTERFACE_FUNCTION(__asan_exp_load8)
 INTERFACE_FUNCTION(__asan_exp_load16)
 INTERFACE_FUNCTION(__asan_exp_loadN)
 INTERFACE_FUNCTION(__asan_exp_store1)
 INTERFACE_FUNCTION(__asan_exp_store2)
 INTERFACE_FUNCTION(__asan_exp_store4)
 INTERFACE_FUNCTION(__asan_exp_store8)
 INTERFACE_FUNCTION(__asan_exp_store16)
 INTERFACE_FUNCTION(__asan_exp_storeN)
 INTERFACE_FUNCTION(__asan_get_alloc_stack)
 INTERFACE_FUNCTION(__asan_get_current_fake_stack)
+INTERFACE_FUNCTION(__asan_get_current_fake_stack_flagless)
 INTERFACE_FUNCTION(__asan_get_free_stack)
 INTERFACE_FUNCTION(__asan_get_report_access_size)
 INTERFACE_FUNCTION(__asan_get_report_access_type)
 INTERFACE_FUNCTION(__asan_get_report_address)
 INTERFACE_FUNCTION(__asan_get_report_bp)
 INTERFACE_FUNCTION(__asan_get_report_description)
 INTERFACE_FUNCTION(__asan_get_report_pc)
 INTERFACE_FUNCTION(__asan_get_report_sp)

 INTERFACE_FUNCTION(__asan_stack_malloc_3)
 INTERFACE_FUNCTION(__asan_stack_malloc_4)
 INTERFACE_FUNCTION(__asan_stack_malloc_5)
 INTERFACE_FUNCTION(__asan_stack_malloc_6)
 INTERFACE_FUNCTION(__asan_stack_malloc_7)
 INTERFACE_FUNCTION(__asan_stack_malloc_8)
 INTERFACE_FUNCTION(__asan_stack_malloc_9)
 INTERFACE_FUNCTION(__asan_stack_malloc_10)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_0)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_1)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_2)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_3)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_4)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_5)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_6)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_7)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_8)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_9)
+INTERFACE_FUNCTION(__asan_stack_flagless_malloc_10)
 INTERFACE_FUNCTION(__asan_store1)
 INTERFACE_FUNCTION(__asan_store2)
 INTERFACE_FUNCTION(__asan_store4)
 INTERFACE_FUNCTION(__asan_store8)
 INTERFACE_FUNCTION(__asan_store16)
 INTERFACE_FUNCTION(__asan_storeN)
 INTERFACE_FUNCTION(__asan_store1_noabort)
 INTERFACE_FUNCTION(__asan_store2_noabort)

compiler-rt/test/asan/TestCases/Posix/stack-use-after-return.cpp

 // RUN: %clangxx_asan  -O0 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O1 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O2 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %clangxx_asan  -O3 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
 // RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t
+// run: %clangxx_asan -fsanitize-address-detect-stack-use-after-return=always -O1 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
+// run: %env_asan_opts=detect_stack_use_after_return=0 not %run %t 2>&1 | FileCheck %s
+// RUN: %clangxx_asan -fsanitize-address-detect-stack-use-after-return=runtime -O1 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck %s
+// RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t
+// RUN: %clangxx_asan -fsanitize-address-detect-stack-use-after-return=never -O1 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 %run %t
+// RUN: %env_asan_opts=detect_stack_use_after_return=0 %run %t
 // Regression test for a CHECK failure with small stack size and large frame.
 // RUN: %clangxx_asan  -O3 %s -pthread -o %t -DkSize=10000 -DUseThread -DkStackSize=131072 && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck --check-prefix=THREAD %s
 //
 // Test that we can find UAR in a thread other than main:
 // RUN: %clangxx_asan  -DUseThread -O2 %s -pthread -o %t && %env_asan_opts=detect_stack_use_after_return=1 not %run %t 2>&1 | FileCheck --check-prefix=THREAD %s
 //
 // Test the max_uar_stack_size_log/min_uar_stack_size_log flag.
 //
#ifdef PTHREAD_STACK_MIN
     }
 #endif
 
     int ret = pthread_attr_setstacksize(&attr, desired_stack_size);
     if (ret != 0) {
       fprintf(stderr, "pthread_attr_setstacksize returned %d\n", ret);
       abort();
     }
-    
     size_t stacksize_check;
     ret = pthread_attr_getstacksize(&attr, &stacksize_check);
     if (ret != 0) {
       fprintf(stderr, "pthread_attr_getstacksize returned %d\n", ret);
       abort();
     }
 
     if (stacksize_check != desired_stack_size) {
       fprintf(stderr, "Unable to set stack size to %d, the stack size is %d.\n",
               (int)desired_stack_size, (int)stacksize_check);
-      abort(); 
+      abort();
     }
   }
   pthread_t t;
   pthread_create(&t, &attr, Thread, 0);
   pthread_attr_destroy(&attr);
   pthread_join(t, 0);
 #else
   Func2(Func1());
 #endif
   return 0;
 }

llvm/include/llvm/Transforms/Instrumentation/AddressSanitizer.h

 //===----------------------------------------------------------------------===//
 #ifndef LLVM_TRANSFORMS_INSTRUMENTATION_ADDRESSSANITIZER_H
 #define LLVM_TRANSFORMS_INSTRUMENTATION_ADDRESSSANITIZER_H
 
 #include "llvm/IR/Function.h"
 #include "llvm/IR/Module.h"
 #include "llvm/IR/PassManager.h"
 #include "llvm/Transforms/Instrumentation/AddressSanitizerOptions.h"
+#include "llvm/Transforms/Instrumentation/HWAddressSanitizer.h"
 
 namespace llvm {
 
 /// Frontend-provided metadata for source location.
 struct LocationMetadata {
   StringRef Filename;
   int LineNo = 0;
   int ColumnNo = 0;

 /// check for various memory errors at runtime.
 ///
 /// The sanitizer itself is a function pass that works by inserting various
 /// calls to the ASan runtime library functions. The runtime library essentially
 /// replaces malloc() and free() with custom implementations that allow regions
 /// surrounding requested memory to be checked for invalid accesses.
 class AddressSanitizerPass : public PassInfoMixin<AddressSanitizerPass> {
 public:
-  explicit AddressSanitizerPass(bool CompileKernel = false,
-                                bool Recover = false,
-                                bool UseAfterScope = false);
+  explicit AddressSanitizerPass(
+      bool CompileKernel = false, bool Recover = false,
+      bool UseAfterScope = false,
+      llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode =
+          llvm::AsanDetectStackUseAfterReturnMode::Never);
   PreservedAnalyses run(Function &F, FunctionAnalysisManager &AM);
   static bool isRequired() { return true; }
 
 private:
   bool CompileKernel;
   bool Recover;
   bool UseAfterScope;
+  llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode;
 };
 
 /// Public interface to the address sanitizer module pass for instrumenting code
 /// to check for various memory errors.
 ///
 /// This adds 'asan.module_ctor' to 'llvm.global_ctors'. This pass may also
 /// run intependently of the function address sanitizer.
 class ModuleAddressSanitizerPass
private:
   bool CompileKernel;
   bool Recover;
   bool UseGlobalGC;
   bool UseOdrIndicator;
   AsanDtorKind DestructorKind;
 };
 
 // Insert AddressSanitizer (address sanity checking) instrumentation
-FunctionPass *createAddressSanitizerFunctionPass(bool CompileKernel = false,
-                                                 bool Recover = false,
-                                                 bool UseAfterScope = false);
+FunctionPass *createAddressSanitizerFunctionPass(
+    bool CompileKernel = false, bool Recover = false,
+    bool UseAfterScope = false,
+    llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode =
+        llvm::AsanDetectStackUseAfterReturnMode::Never);
 ModulePass *createModuleAddressSanitizerLegacyPassPass(
     bool CompileKernel = false, bool Recover = false, bool UseGlobalsGC = true,
     bool UseOdrIndicator = true,
     AsanDtorKind DestructorKind = AsanDtorKind::Global);
 
 } // namespace llvm
 
 #endif

llvm/include/llvm/Transforms/Instrumentation/AddressSanitizerOptions.h

 
 /// Types of ASan module destructors supported
 enum class AsanDtorKind {
   None,    ///< Do not emit any destructors for ASan
   Global,  ///< Append to llvm.global_dtors
   Invalid, ///< Not a valid destructor Kind.
   // TODO(dliew): Add more more kinds.
 };
+
+/// Modes of ASan detect stack use after return
+enum class AsanDetectStackUseAfterReturnMode {
+  Always,  ///< Always detect stack use after return.
+  Runtime, ///< Detect stack use after return if runtime flag is enabled
+           ///< (ASAN_OPTIONS=detect_stack_use_after_return=1)
+  Never,   ///< Never detect stack use after return.
+  Invalid, ///< Not a valid detect mode.
+};
+
 } // namespace llvm
+
 #endif

llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp

 #include "llvm/ADT/StringExtras.h"
 #include "llvm/ADT/StringRef.h"
 #include "llvm/ADT/Triple.h"
 #include "llvm/ADT/Twine.h"
 #include "llvm/Analysis/MemoryBuiltins.h"
 #include "llvm/Analysis/TargetLibraryInfo.h"
 #include "llvm/Analysis/ValueTracking.h"
 #include "llvm/BinaryFormat/MachO.h"
+#include "llvm/CodeGen/CodeGenPassBuilder.h"
 #include "llvm/IR/Argument.h"
 #include "llvm/IR/Attributes.h"
 #include "llvm/IR/BasicBlock.h"
 #include "llvm/IR/Comdat.h"
 #include "llvm/IR/Constant.h"
 #include "llvm/IR/Constants.h"
 #include "llvm/IR/DIBuilder.h"
 #include "llvm/IR/DataLayout.h"

 #include "llvm/Support/CommandLine.h"
 #include "llvm/Support/Debug.h"
 #include "llvm/Support/ErrorHandling.h"
 #include "llvm/Support/MathExtras.h"
 #include "llvm/Support/ScopedPrinter.h"
 #include "llvm/Support/raw_ostream.h"
 #include "llvm/Transforms/Instrumentation.h"
 #include "llvm/Transforms/Instrumentation/AddressSanitizerCommon.h"
+#include "llvm/Transforms/Instrumentation/AddressSanitizerOptions.h"
 #include "llvm/Transforms/Utils/ASanStackFrameLayout.h"
 #include "llvm/Transforms/Utils/BasicBlockUtils.h"
 #include "llvm/Transforms/Utils/Local.h"
 #include "llvm/Transforms/Utils/ModuleUtils.h"
 #include "llvm/Transforms/Utils/PromoteMemToReg.h"
 #include <algorithm>
 #include <cassert>
 #include <cstddef>

 const char kAsanUnpoisonGlobalsName[] = "__asan_after_dynamic_init";
 const char kAsanInitName[] = "__asan_init";
 const char kAsanVersionCheckNamePrefix[] = "__asan_version_mismatch_check_v";
 const char kAsanPtrCmp[] = "__sanitizer_ptr_cmp";
 const char kAsanPtrSub[] = "__sanitizer_ptr_sub";
 const char kAsanHandleNoReturnName[] = "__asan_handle_no_return";
 static const int kMaxAsanStackMallocSizeClass = 10;
 const char kAsanStackMallocNameTemplate[] = "__asan_stack_malloc_";
+const char kAsanStackFlaglessMallocNameTemplate[] =
+    "__asan_stack_flagless_malloc_";
 const char kAsanStackFreeNameTemplate[] = "__asan_stack_free_";
 const char kAsanGenPrefix[] = "___asan_gen_";
 const char kODRGenPrefix[] = "__odr_asan_gen_";
 const char kSanCovGenPrefix[] = "__sancov_gen_";
 const char kAsanSetShadowPrefix[] = "__asan_set_shadow_";
 const char kAsanPoisonStackMemoryName[] = "__asan_poison_stack_memory";
 const char kAsanUnpoisonStackMemoryName[] = "__asan_unpoison_stack_memory";
 

 private:
   GlobalsMetadata GlobalsMD;
 };
 
 char ASanGlobalsMetadataWrapperPass::ID = 0;
 
 /// AddressSanitizer: instrument the code in module to find memory bugs.
 struct AddressSanitizer {
-  AddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD,
-                   bool CompileKernel = false, bool Recover = false,
-                   bool UseAfterScope = false)
+  AddressSanitizer(
+      Module &M, const GlobalsMetadata *GlobalsMD, bool CompileKernel = false,
+      bool Recover = false, bool UseAfterScope = false,
+      llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode =
+          llvm::AsanDetectStackUseAfterReturnMode::Never)
       : CompileKernel(ClEnableKasan.getNumOccurrences() > 0 ? ClEnableKasan
                                                             : CompileKernel),
         Recover(ClRecover.getNumOccurrences() > 0 ? ClRecover : Recover),
-        UseAfterScope(UseAfterScope || ClUseAfterScope), GlobalsMD(*GlobalsMD) {
+        UseAfterScope(UseAfterScope || ClUseAfterScope),
+        DetectStackUseAfterReturnMode(DetectStackUseAfterReturnMode),
+        GlobalsMD(*GlobalsMD) {
     C = &(M.getContext());
     LongSize = M.getDataLayout().getPointerSizeInBits();
     IntptrTy = Type::getIntNTy(*C, LongSize);
     TargetTriple = Triple(M.getTargetTriple());
 
     Mapping = getShadowMapping(TargetTriple, LongSize, this->CompileKernel);
   }
 
private:
   };
 
   LLVMContext *C;
   Triple TargetTriple;
   int LongSize;
   bool CompileKernel;
   bool Recover;
   bool UseAfterScope;
+  llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode;
   Type *IntptrTy;
   ShadowMapping Mapping;
   FunctionCallee AsanHandleNoReturnFunc;
   FunctionCallee AsanPtrCmpFunction, AsanPtrSubFunction;
   Constant *AsanShadowGlobal;
 
   // These arrays is indexed by AccessIsWrite, Experiment and log2(AccessSize).
   FunctionCallee AsanErrorCallback[2][2][kNumberOfAccessSizes];
   FunctionCallee AsanMemoryAccessCallback[2][2][kNumberOfAccessSizes];
 
   // These arrays is indexed by AccessIsWrite and Experiment.
   FunctionCallee AsanErrorCallbackSized[2][2];
   FunctionCallee AsanMemoryAccessCallbackSized[2][2];
 
   FunctionCallee AsanMemmove, AsanMemcpy, AsanMemset;
   Value *LocalDynamicShadow = nullptr;
   const GlobalsMetadata &GlobalsMD;
   DenseMap<const AllocaInst *, bool> ProcessedAllocas;
 };
 
 class AddressSanitizerLegacyPass : public FunctionPass {
 public:
   static char ID;
 
-  explicit AddressSanitizerLegacyPass(bool CompileKernel = false,
-                                      bool Recover = false,
-                                      bool UseAfterScope = false)
+  explicit AddressSanitizerLegacyPass(
+      bool CompileKernel = false, bool Recover = false,
+      bool UseAfterScope = false,
+      llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode =
+          llvm::AsanDetectStackUseAfterReturnMode::Never)
       : FunctionPass(ID), CompileKernel(CompileKernel), Recover(Recover),
-        UseAfterScope(UseAfterScope) {
+        UseAfterScope(UseAfterScope),
+        DetectStackUseAfterReturnMode(DetectStackUseAfterReturnMode) {
     initializeAddressSanitizerLegacyPassPass(*PassRegistry::getPassRegistry());
   }
 
   StringRef getPassName() const override {
     return "AddressSanitizerFunctionPass";
   }
 
   void getAnalysisUsage(AnalysisUsage &AU) const override {
     AU.addRequired<ASanGlobalsMetadataWrapperPass>();
     AU.addRequired<TargetLibraryInfoWrapperPass>();
   }
 
   bool runOnFunction(Function &F) override {
     GlobalsMetadata &GlobalsMD =
         getAnalysis<ASanGlobalsMetadataWrapperPass>().getGlobalsMD();
     const TargetLibraryInfo *TLI =
         &getAnalysis<TargetLibraryInfoWrapperPass>().getTLI(F);
     AddressSanitizer ASan(*F.getParent(), &GlobalsMD, CompileKernel, Recover,
-                          UseAfterScope);
+                          UseAfterScope, DetectStackUseAfterReturnMode);
     return ASan.instrumentFunction(F, TLI);
   }
 
 private:
   bool CompileKernel;
   bool Recover;
   bool UseAfterScope;
+  llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode;
 };
 
 class ModuleAddressSanitizer {
 public:
   ModuleAddressSanitizer(Module &M, const GlobalsMetadata *GlobalsMD,
                          bool CompileKernel = false, bool Recover = false,
                          bool UseGlobalsGC = true, bool UseOdrIndicator = false,
                          AsanDtorKind DestructorKind = AsanDtorKind::Global)

 
 AnalysisKey ASanGlobalsMetadataAnalysis::Key;
 
 GlobalsMetadata ASanGlobalsMetadataAnalysis::run(Module &M,
                                                  ModuleAnalysisManager &AM) {
   return GlobalsMetadata(M);
 }
 
-AddressSanitizerPass::AddressSanitizerPass(bool CompileKernel, bool Recover,
-                                           bool UseAfterScope)
+AddressSanitizerPass::AddressSanitizerPass(
+    bool CompileKernel, bool Recover, bool UseAfterScope,
+    llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode)
     : CompileKernel(CompileKernel), Recover(Recover),
-      UseAfterScope(UseAfterScope) {}
+      UseAfterScope(UseAfterScope),
+      DetectStackUseAfterReturnMode(DetectStackUseAfterReturnMode) {}
 
 PreservedAnalyses AddressSanitizerPass::run(Function &F,
                                             AnalysisManager<Function> &AM) {
   auto &MAMProxy = AM.getResult<ModuleAnalysisManagerFunctionProxy>(F);
   Module &M = *F.getParent();
   if (auto *R = MAMProxy.getCachedResult<ASanGlobalsMetadataAnalysis>(M)) {
     const TargetLibraryInfo *TLI = &AM.getResult<TargetLibraryAnalysis>(F);
-    AddressSanitizer Sanitizer(M, R, CompileKernel, Recover, UseAfterScope);
+    AddressSanitizer Sanitizer(M, R, CompileKernel, Recover, UseAfterScope,
+                               DetectStackUseAfterReturnMode);
     if (Sanitizer.instrumentFunction(F, TLI))
       return PreservedAnalyses::none();
     return PreservedAnalyses::all();
   }
 
   report_fatal_error(
       "The ASanGlobalsMetadataAnalysis is required to run before "
       "AddressSanitizer can run");
INITIALIZE_PASS_BEGIN(
     false)
 INITIALIZE_PASS_DEPENDENCY(ASanGlobalsMetadataWrapperPass)
 INITIALIZE_PASS_DEPENDENCY(TargetLibraryInfoWrapperPass)
 INITIALIZE_PASS_END(
     AddressSanitizerLegacyPass, "asan",
     "AddressSanitizer: detects use-after-free and out-of-bounds bugs.", false,
     false)
 
-FunctionPass *llvm::createAddressSanitizerFunctionPass(bool CompileKernel,
-                                                       bool Recover,
-                                                       bool UseAfterScope) {
+FunctionPass *llvm::createAddressSanitizerFunctionPass(
+    bool CompileKernel, bool Recover, bool UseAfterScope,
+    llvm::AsanDetectStackUseAfterReturnMode DetectStackUseAfterReturnMode) {
   assert(!CompileKernel || Recover);
-  return new AddressSanitizerLegacyPass(CompileKernel, Recover, UseAfterScope);
+  return new AddressSanitizerLegacyPass(CompileKernel, Recover, UseAfterScope,
+                                        DetectStackUseAfterReturnMode);
 }
 
 char ModuleAddressSanitizerLegacyPass::ID = 0;
 
 INITIALIZE_PASS(
     ModuleAddressSanitizerLegacyPass, "asan-module",
     "AddressSanitizer: detects use-after-free and out-of-bounds bugs."
     "ModulePass",
bool AddressSanitizer::LooksLikeCodeInBug11395(Instruction *I) {
   if (!CI || !CI->isInlineAsm()) return false;
   if (CI->getNumArgOperands() <= 5) return false;
   // We have inline assembly with quite a few arguments.
   return true;
 }
 
 void FunctionStackPoisoner::initializeCallbacks(Module &M) {
   IRBuilder<> IRB(*C);
+  switch (ASan.DetectStackUseAfterReturnMode) {
+  case llvm::AsanDetectStackUseAfterReturnMode::Always:
+    for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) {
+      std::string Suffix = itostr(i);
+      AsanStackMallocFunc[i] = M.getOrInsertFunction(
+          kAsanStackFlaglessMallocNameTemplate + Suffix, IntptrTy, IntptrTy);
+      AsanStackFreeFunc[i] =
+          M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix,
+                                IRB.getVoidTy(), IntptrTy, IntptrTy);
+    }
+    break;
+  case llvm::AsanDetectStackUseAfterReturnMode::Runtime:
     for (int i = 0; i <= kMaxAsanStackMallocSizeClass; i++) {
       std::string Suffix = itostr(i);
       AsanStackMallocFunc[i] = M.getOrInsertFunction(
           kAsanStackMallocNameTemplate + Suffix, IntptrTy, IntptrTy);
       AsanStackFreeFunc[i] =
           M.getOrInsertFunction(kAsanStackFreeNameTemplate + Suffix,
                                 IRB.getVoidTy(), IntptrTy, IntptrTy);
     }
+    break;
+  case llvm::AsanDetectStackUseAfterReturnMode::Never:
+    // Do Nothing
+    break;
+  case llvm::AsanDetectStackUseAfterReturnMode::Invalid:
+    // Do Nothing
+    break;
+  }
   if (ASan.UseAfterScope) {
     AsanPoisonStackMemoryFunc = M.getOrInsertFunction(
         kAsanPoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy);
     AsanUnpoisonStackMemoryFunc = M.getOrInsertFunction(
         kAsanUnpoisonStackMemoryName, IRB.getVoidTy(), IntptrTy, IntptrTy);
   }
 
   for (size_t Val : {0x00, 0xf1, 0xf2, 0xf3, 0xf5, 0xf8}) {
void FunctionStackPoisoner::processStaticAllocas() {
   // Don't do dynamic alloca or stack malloc if:
   // 1) There is inline asm: too often it makes assumptions on which registers
   //    are available.
   // 2) There is a returns_twice call (typically setjmp), which is
   //    optimization-hostile, and doesn't play well with introduced indirect
   //    register-relative calculation of local variable addresses.
   DoDynamicAlloca &= !HasInlineAsm && !HasReturnsTwiceCall;
   DoStackMalloc &= !HasInlineAsm && !HasReturnsTwiceCall;
+  DoStackMalloc &= ASan.DetectStackUseAfterReturnMode !=
+                   llvm::AsanDetectStackUseAfterReturnMode::Never;
 
   Value *StaticAlloca =
       DoDynamicAlloca ? nullptr : createAllocaForLayout(IRB, L, false);
 
   Value *FakeStack;
   Value *LocalStackBase;
   Value *LocalStackBaseAlloca;
   uint8_t DIExprFlags = DIExpression::ApplyOffset;
 
   if (DoStackMalloc) {
     LocalStackBaseAlloca =
         IRB.CreateAlloca(IntptrTy, nullptr, "asan_local_stack_base");
     // void *FakeStack = __asan_option_detect_stack_use_after_return
     //     ? __asan_stack_malloc_N(LocalStackSize)
     //     : nullptr;
     // void *LocalStackBase = (FakeStack) ? FakeStack : alloca(LocalStackSize);
+    StackMallocIdx = StackMallocSizeClass(LocalStackSize);
+    assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass);
+    if (ASan.DetectStackUseAfterReturnMode ==
+        llvm::AsanDetectStackUseAfterReturnMode::Runtime) {
       Constant *OptionDetectUseAfterReturn = F.getParent()->getOrInsertGlobal(
           kAsanOptionDetectUseAfterReturn, IRB.getInt32Ty());
       Value *UseAfterReturnIsEnabled = IRB.CreateICmpNE(
           IRB.CreateLoad(IRB.getInt32Ty(), OptionDetectUseAfterReturn),
           Constant::getNullValue(IRB.getInt32Ty()));
       Instruction *Term =
           SplitBlockAndInsertIfThen(UseAfterReturnIsEnabled, InsBefore, false);
       IRBuilder<> IRBIf(Term);
-    StackMallocIdx = StackMallocSizeClass(LocalStackSize);
-    assert(StackMallocIdx <= kMaxAsanStackMallocSizeClass);
       Value *FakeStackValue =
           IRBIf.CreateCall(AsanStackMallocFunc[StackMallocIdx],
                            ConstantInt::get(IntptrTy, LocalStackSize));
       IRB.SetInsertPoint(InsBefore);
       FakeStack = createPHI(IRB, UseAfterReturnIsEnabled, FakeStackValue, Term,
                             ConstantInt::get(IntptrTy, 0));
 
       Value *NoFakeStack =
           IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy));
       Term = SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false);
       IRBIf.SetInsertPoint(Term);
+      Value *AllocaValue = DoDynamicAlloca
+                               ? createAllocaForLayout(IRBIf, L, true)
+                               : StaticAlloca;
+
+      IRB.SetInsertPoint(InsBefore);
+      LocalStackBase =
+          createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
+      IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca);
+      DIExprFlags |= DIExpression::DerefBefore;
+    } else {
+      // ASan.DetectStackUseAfterReturnMode ==
+      //    llvm::AsanDetectStackUseAfterReturnMode::Always
+      Value *FakeStackValue =
+          IRB.CreateCall(AsanStackMallocFunc[StackMallocIdx],
+                         ConstantInt::get(IntptrTy, LocalStackSize));
+      IRB.SetInsertPoint(InsBefore);
+      PHINode *FakeStack = IRB.CreatePHI(IntptrTy, 1);
+      FakeStack->addIncoming(FakeStackValue, InsBefore->getParent());
+
+      Value *NoFakeStack =
+          IRB.CreateICmpEQ(FakeStack, Constant::getNullValue(IntptrTy));
+      Instruction *Term =
+          SplitBlockAndInsertIfThen(NoFakeStack, InsBefore, false);
+      IRB.SetInsertPoint(Term);
       Value *AllocaValue =
-        DoDynamicAlloca ? createAllocaForLayout(IRBIf, L, true) : StaticAlloca;
+          DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca;
 
       IRB.SetInsertPoint(InsBefore);
-    LocalStackBase = createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
+      LocalStackBase =
+          createPHI(IRB, NoFakeStack, AllocaValue, Term, FakeStack);
       IRB.CreateStore(LocalStackBase, LocalStackBaseAlloca);
       DIExprFlags |= DIExpression::DerefBefore;
+    }
   } else {
     // void *FakeStack = nullptr;
     // void *LocalStackBase = alloca(LocalStackSize);
     FakeStack = ConstantInt::get(IntptrTy, 0);
     LocalStackBase =
         DoDynamicAlloca ? createAllocaForLayout(IRB, L, true) : StaticAlloca;
     LocalStackBaseAlloca = LocalStackBase;
   }