1 ; RUN: opt < %s -msan -msan-check-access-address=0 -S | FileCheck %s
2 ; RUN: opt < %s -msan -msan-check-access-address=0 -msan-track-origins=1 -S | FileCheck -check-prefix=CHECK -check-prefix=CHECK-ORIGINS %s
4 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
5 target triple = "x86_64-unknown-linux-gnu"
7 ; Check the presence of __msan_init
8 ; CHECK: @llvm.global_ctors {{.*}} @__msan_init
10 ; Check the presence and the linkage type of __msan_track_origins and
11 ; other interface symbols.
12 ; CHECK-NOT: @__msan_track_origins
13 ; CHECK-ORIGINS: @__msan_track_origins = weak_odr constant i32 1
14 ; CHECK-NOT: @__msan_keep_going = weak_odr constant i32 0
15 ; CHECK: @__msan_retval_tls = external thread_local(initialexec) global [{{.*}}]
16 ; CHECK: @__msan_retval_origin_tls = external thread_local(initialexec) global i32
17 ; CHECK: @__msan_param_tls = external thread_local(initialexec) global [{{.*}}]
18 ; CHECK: @__msan_param_origin_tls = external thread_local(initialexec) global [{{.*}}]
19 ; CHECK: @__msan_va_arg_tls = external thread_local(initialexec) global [{{.*}}]
20 ; CHECK: @__msan_va_arg_overflow_size_tls = external thread_local(initialexec) global i64
21 ; CHECK: @__msan_origin_tls = external thread_local(initialexec) global i32
24 ; Check instrumentation of stores
26 define void @Store(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
28 store i32 %x, i32* %p, align 4
33 ; CHECK: load {{.*}} @__msan_param_tls
34 ; CHECK-ORIGINS: load {{.*}} @__msan_param_origin_tls
37 ; CHECK-ORIGINS: br i1
38 ; CHECK-ORIGINS: <label>
39 ; CHECK-ORIGINS: store
40 ; CHECK-ORIGINS: br label
41 ; CHECK-ORIGINS: <label>
46 ; Check instrumentation of aligned stores
47 ; Shadow store has the same alignment as the original store; origin store
48 ; does not specify explicit alignment.
50 define void @AlignedStore(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
52 store i32 %x, i32* %p, align 32
56 ; CHECK: @AlignedStore
57 ; CHECK: load {{.*}} @__msan_param_tls
58 ; CHECK-ORIGINS: load {{.*}} @__msan_param_origin_tls
59 ; CHECK: store {{.*}} align 32
61 ; CHECK-ORIGINS: br i1
62 ; CHECK-ORIGINS: <label>
63 ; CHECK-ORIGINS: store {{.*}} align 32
64 ; CHECK-ORIGINS: br label
65 ; CHECK-ORIGINS: <label>
66 ; CHECK: store {{.*}} align 32
70 ; load followed by cmp: check that we load the shadow and call __msan_warning.
71 define void @LoadAndCmp(i32* nocapture %a) nounwind uwtable sanitize_memory {
73 %0 = load i32* %a, align 4
74 %tobool = icmp eq i32 %0, 0
75 br i1 %tobool, label %if.end, label %if.then
77 if.then: ; preds = %entry
78 tail call void (...)* @foo() nounwind
81 if.end: ; preds = %entry, %if.then
85 declare void @foo(...)
90 ; CHECK: call void @__msan_warning_noreturn()
91 ; CHECK-NEXT: call void asm sideeffect
92 ; CHECK-NEXT: unreachable
95 ; Check that we store the shadow for the retval.
96 define i32 @ReturnInt() nounwind uwtable readnone sanitize_memory {
102 ; CHECK: store i32 0,{{.*}}__msan_retval_tls
105 ; Check that we get the shadow for the retval.
106 define void @CopyRetVal(i32* nocapture %a) nounwind uwtable sanitize_memory {
108 %call = tail call i32 @ReturnInt() nounwind
109 store i32 %call, i32* %a, align 4
114 ; CHECK: load{{.*}}__msan_retval_tls
120 ; Check that we generate PHIs for shadow.
121 define void @FuncWithPhi(i32* nocapture %a, i32* %b, i32* nocapture %c) nounwind uwtable sanitize_memory {
123 %tobool = icmp eq i32* %b, null
124 br i1 %tobool, label %if.else, label %if.then
126 if.then: ; preds = %entry
127 %0 = load i32* %b, align 4
130 if.else: ; preds = %entry
131 %1 = load i32* %c, align 4
134 if.end: ; preds = %if.else, %if.then
135 %t.0 = phi i32 [ %0, %if.then ], [ %1, %if.else ]
136 store i32 %t.0, i32* %a, align 4
140 ; CHECK: @FuncWithPhi
147 ; Compute shadow for "x << 10"
148 define void @ShlConst(i32* nocapture %x) nounwind uwtable sanitize_memory {
150 %0 = load i32* %x, align 4
152 store i32 %1, i32* %x, align 4
165 ; Compute shadow for "10 << x": it should have 'sext i1'.
166 define void @ShlNonConst(i32* nocapture %x) nounwind uwtable sanitize_memory {
168 %0 = load i32* %x, align 4
170 store i32 %1, i32* %x, align 4
174 ; CHECK: @ShlNonConst
183 define void @SExt(i32* nocapture %a, i16* nocapture %b) nounwind uwtable sanitize_memory {
185 %0 = load i16* %b, align 2
186 %1 = sext i16 %0 to i32
187 store i32 %1, i32* %a, align 4
202 define void @MemSet(i8* nocapture %x) nounwind uwtable sanitize_memory {
204 call void @llvm.memset.p0i8.i64(i8* %x, i8 42, i64 10, i32 1, i1 false)
208 declare void @llvm.memset.p0i8.i64(i8* nocapture, i8, i64, i32, i1) nounwind
211 ; CHECK: call i8* @__msan_memset
216 define void @MemCpy(i8* nocapture %x, i8* nocapture %y) nounwind uwtable sanitize_memory {
218 call void @llvm.memcpy.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i32 1, i1 false)
222 declare void @llvm.memcpy.p0i8.p0i8.i64(i8* nocapture, i8* nocapture, i64, i32, i1) nounwind
225 ; CHECK: call i8* @__msan_memcpy
229 ; memmove is lowered to a call
230 define void @MemMove(i8* nocapture %x, i8* nocapture %y) nounwind uwtable sanitize_memory {
232 call void @llvm.memmove.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i32 1, i1 false)
236 declare void @llvm.memmove.p0i8.p0i8.i64(i8* nocapture, i8* nocapture, i64, i32, i1) nounwind
239 ; CHECK: call i8* @__msan_memmove
243 ; Check that we propagate shadow for "select"
245 define i32 @Select(i32 %a, i32 %b, i1 %c) nounwind uwtable readnone sanitize_memory {
247 %cond = select i1 %c, i32 %a, i32 %b
253 ; CHECK-NEXT: sext i1 {{.*}} to i32
256 ; CHECK-ORIGINS: select
257 ; CHECK-ORIGINS: select
262 ; Check that we propagate origin for "select" with vector condition.
263 ; Select condition is flattened to i1, which is then used to select one of the
266 define <8 x i16> @SelectVector(<8 x i16> %a, <8 x i16> %b, <8 x i1> %c) nounwind uwtable readnone sanitize_memory {
268 %cond = select <8 x i1> %c, <8 x i16> %a, <8 x i16> %b
272 ; CHECK: @SelectVector
273 ; CHECK: select <8 x i1>
274 ; CHECK-NEXT: sext <8 x i1> {{.*}} to <8 x i16>
275 ; CHECK-NEXT: or <8 x i16>
276 ; CHECK-ORIGINS: bitcast <8 x i1> {{.*}} to i8
277 ; CHECK-ORIGINS: icmp ne i8 {{.*}}, 0
278 ; CHECK-ORIGINS: bitcast <8 x i1> {{.*}} to i8
279 ; CHECK-ORIGINS: icmp ne i8 {{.*}}, 0
280 ; CHECK-ORIGINS: select i1
281 ; CHECK-ORIGINS: select i1
282 ; CHECK: select <8 x i1>
283 ; CHECK: ret <8 x i16>
287 ; Check that we propagate origin for "select" with scalar condition and vector
288 ; arguments. Select condition shadow is sign-extended to the vector type and
289 ; mixed into the result shadow.
291 define <8 x i16> @SelectVector2(<8 x i16> %a, <8 x i16> %b, i1 %c) nounwind uwtable readnone sanitize_memory {
293 %cond = select i1 %c, <8 x i16> %a, <8 x i16> %b
297 ; CHECK: @SelectVector2
299 ; CHECK: sext i1 {{.*}} to i128
300 ; CHECK: bitcast i128 {{.*}} to <8 x i16>
301 ; CHECK: or <8 x i16>
302 ; CHECK-ORIGINS: select i1
303 ; CHECK-ORIGINS: select i1
305 ; CHECK: ret <8 x i16>
308 define { i64, i64 } @SelectStruct(i1 zeroext %x, { i64, i64 } %a, { i64, i64 } %b) readnone sanitize_memory {
310 %c = select i1 %x, { i64, i64 } %a, { i64, i64 } %b
314 ; CHECK: @SelectStruct
315 ; CHECK: select i1 {{.*}}, { i64, i64 }
316 ; CHECK-NEXT: select i1 {{.*}}, { i64, i64 } { i64 -1, i64 -1 }, { i64, i64 }
317 ; CHECK-ORIGINS: select i1
318 ; CHECK-ORIGINS: select i1
319 ; CHECK-NEXT: select i1 {{.*}}, { i64, i64 }
320 ; CHECK: ret { i64, i64 }
323 define i8* @IntToPtr(i64 %x) nounwind uwtable readnone sanitize_memory {
325 %0 = inttoptr i64 %x to i8*
330 ; CHECK: load i64*{{.*}}__msan_param_tls
331 ; CHECK-ORIGINS-NEXT: load i32*{{.*}}__msan_param_origin_tls
332 ; CHECK-NEXT: inttoptr
333 ; CHECK-NEXT: store i64{{.*}}__msan_retval_tls
337 define i8* @IntToPtr_ZExt(i16 %x) nounwind uwtable readnone sanitize_memory {
339 %0 = inttoptr i16 %x to i8*
343 ; CHECK: @IntToPtr_ZExt
344 ; CHECK: load i16*{{.*}}__msan_param_tls
346 ; CHECK-NEXT: inttoptr
347 ; CHECK-NEXT: store i64{{.*}}__msan_retval_tls
351 ; Check that we insert exactly one check on udiv
352 ; (2nd arg shadow is checked, 1st arg shadow is propagated)
354 define i32 @Div(i32 %a, i32 %b) nounwind uwtable readnone sanitize_memory {
356 %div = udiv i32 %a, %b
362 ; CHECK: call void @__msan_warning
369 ; Check that we propagate shadow for x<0, x>=0, etc (i.e. sign bit tests)
371 define zeroext i1 @ICmpSLT(i32 %x) nounwind uwtable readnone sanitize_memory {
372 %1 = icmp slt i32 %x, 0
378 ; CHECK-NOT: call void @__msan_warning
380 ; CHECK-NOT: call void @__msan_warning
383 define zeroext i1 @ICmpSGE(i32 %x) nounwind uwtable readnone sanitize_memory {
384 %1 = icmp sge i32 %x, 0
390 ; CHECK-NOT: call void @__msan_warning
392 ; CHECK-NOT: call void @__msan_warning
395 define zeroext i1 @ICmpSGT(i32 %x) nounwind uwtable readnone sanitize_memory {
396 %1 = icmp sgt i32 0, %x
402 ; CHECK-NOT: call void @__msan_warning
404 ; CHECK-NOT: call void @__msan_warning
407 define zeroext i1 @ICmpSLE(i32 %x) nounwind uwtable readnone sanitize_memory {
408 %1 = icmp sle i32 0, %x
414 ; CHECK-NOT: call void @__msan_warning
416 ; CHECK-NOT: call void @__msan_warning
420 ; Check that we propagate shadow for x<0, x>=0, etc (i.e. sign bit tests)
421 ; of the vector arguments.
423 define <2 x i1> @ICmpSLT_vector(<2 x i32*> %x) nounwind uwtable readnone sanitize_memory {
424 %1 = icmp slt <2 x i32*> %x, zeroinitializer
428 ; CHECK: @ICmpSLT_vector
429 ; CHECK: icmp slt <2 x i64>
430 ; CHECK-NOT: call void @__msan_warning
431 ; CHECK: icmp slt <2 x i32*>
432 ; CHECK-NOT: call void @__msan_warning
433 ; CHECK: ret <2 x i1>
436 ; Check that we propagate shadow for unsigned relational comparisons with
439 define zeroext i1 @ICmpUGTConst(i32 %x) nounwind uwtable readnone sanitize_memory {
441 %cmp = icmp ugt i32 %x, 7
445 ; CHECK: @ICmpUGTConst
446 ; CHECK: icmp ugt i32
447 ; CHECK-NOT: call void @__msan_warning
448 ; CHECK: icmp ugt i32
449 ; CHECK-NOT: call void @__msan_warning
450 ; CHECK: icmp ugt i32
451 ; CHECK-NOT: call void @__msan_warning
455 ; Check that loads of shadow have the same aligment as the original loads.
456 ; Check that loads of origin have the aligment of max(4, original alignment).
458 define i32 @ShadowLoadAlignmentLarge() nounwind uwtable sanitize_memory {
459 %y = alloca i32, align 64
460 %1 = load volatile i32* %y, align 64
464 ; CHECK: @ShadowLoadAlignmentLarge
465 ; CHECK: load volatile i32* {{.*}} align 64
466 ; CHECK: load i32* {{.*}} align 64
469 define i32 @ShadowLoadAlignmentSmall() nounwind uwtable sanitize_memory {
470 %y = alloca i32, align 2
471 %1 = load volatile i32* %y, align 2
475 ; CHECK: @ShadowLoadAlignmentSmall
476 ; CHECK: load volatile i32* {{.*}} align 2
477 ; CHECK: load i32* {{.*}} align 2
478 ; CHECK-ORIGINS: load i32* {{.*}} align 4
482 ; Test vector manipulation instructions.
483 ; Check that the same bit manipulation is applied to the shadow values.
484 ; Check that there is a zero test of the shadow of %idx argument, where present.
486 define i32 @ExtractElement(<4 x i32> %vec, i32 %idx) sanitize_memory {
487 %x = extractelement <4 x i32> %vec, i32 %idx
491 ; CHECK: @ExtractElement
492 ; CHECK: extractelement
493 ; CHECK: call void @__msan_warning
494 ; CHECK: extractelement
497 define <4 x i32> @InsertElement(<4 x i32> %vec, i32 %idx, i32 %x) sanitize_memory {
498 %vec1 = insertelement <4 x i32> %vec, i32 %x, i32 %idx
502 ; CHECK: @InsertElement
503 ; CHECK: insertelement
504 ; CHECK: call void @__msan_warning
505 ; CHECK: insertelement
506 ; CHECK: ret <4 x i32>
508 define <4 x i32> @ShuffleVector(<4 x i32> %vec, <4 x i32> %vec1) sanitize_memory {
509 %vec2 = shufflevector <4 x i32> %vec, <4 x i32> %vec1,
510 <4 x i32> <i32 0, i32 4, i32 1, i32 5>
514 ; CHECK: @ShuffleVector
515 ; CHECK: shufflevector
516 ; CHECK-NOT: call void @__msan_warning
517 ; CHECK: shufflevector
518 ; CHECK: ret <4 x i32>
521 ; Test bswap intrinsic instrumentation
522 define i32 @BSwap(i32 %x) nounwind uwtable readnone sanitize_memory {
523 %y = tail call i32 @llvm.bswap.i32(i32 %x)
527 declare i32 @llvm.bswap.i32(i32) nounwind readnone
530 ; CHECK-NOT: call void @__msan_warning
531 ; CHECK: @llvm.bswap.i32
532 ; CHECK-NOT: call void @__msan_warning
533 ; CHECK: @llvm.bswap.i32
534 ; CHECK-NOT: call void @__msan_warning
540 define void @StoreIntrinsic(i8* %p, <4 x float> %x) nounwind uwtable sanitize_memory {
541 call void @llvm.x86.sse.storeu.ps(i8* %p, <4 x float> %x)
545 declare void @llvm.x86.sse.storeu.ps(i8*, <4 x float>) nounwind
547 ; CHECK: @StoreIntrinsic
550 ; CHECK: store <4 x i32> {{.*}} align 1
551 ; CHECK: call void @llvm.x86.sse.storeu.ps
557 define <16 x i8> @LoadIntrinsic(i8* %p) nounwind uwtable sanitize_memory {
558 %call = call <16 x i8> @llvm.x86.sse3.ldu.dq(i8* %p)
562 declare <16 x i8> @llvm.x86.sse3.ldu.dq(i8* %p) nounwind
564 ; CHECK: @LoadIntrinsic
565 ; CHECK: load <16 x i8>* {{.*}} align 1
566 ; CHECK-ORIGINS: [[ORIGIN:%[01-9a-z]+]] = load i32* {{.*}}
569 ; CHECK: call <16 x i8> @llvm.x86.sse3.ldu.dq
570 ; CHECK: store <16 x i8> {{.*}} @__msan_retval_tls
571 ; CHECK-ORIGINS: store i32 {{.*}}[[ORIGIN]], i32* @__msan_retval_origin_tls
572 ; CHECK: ret <16 x i8>
575 ; Simple NoMem intrinsic
576 ; Check that shadow is OR'ed, and origin is Select'ed
577 ; And no shadow checks!
579 define <8 x i16> @Paddsw128(<8 x i16> %a, <8 x i16> %b) nounwind uwtable sanitize_memory {
580 %call = call <8 x i16> @llvm.x86.sse2.padds.w(<8 x i16> %a, <8 x i16> %b)
584 declare <8 x i16> @llvm.x86.sse2.padds.w(<8 x i16> %a, <8 x i16> %b) nounwind
587 ; CHECK-NEXT: load <8 x i16>* {{.*}} @__msan_param_tls
588 ; CHECK-ORIGINS: load i32* {{.*}} @__msan_param_origin_tls
589 ; CHECK-NEXT: load <8 x i16>* {{.*}} @__msan_param_tls
590 ; CHECK-ORIGINS: load i32* {{.*}} @__msan_param_origin_tls
591 ; CHECK-NEXT: = or <8 x i16>
592 ; CHECK-ORIGINS: = bitcast <8 x i16> {{.*}} to i128
593 ; CHECK-ORIGINS-NEXT: = icmp ne i128 {{.*}}, 0
594 ; CHECK-ORIGINS-NEXT: = select i1 {{.*}}, i32 {{.*}}, i32
595 ; CHECK-NEXT: call <8 x i16> @llvm.x86.sse2.padds.w
596 ; CHECK-NEXT: store <8 x i16> {{.*}} @__msan_retval_tls
597 ; CHECK-ORIGINS: store i32 {{.*}} @__msan_retval_origin_tls
598 ; CHECK-NEXT: ret <8 x i16>
601 ; Test handling of vectors of pointers.
602 ; Check that shadow of such vector is a vector of integers.
604 define <8 x i8*> @VectorOfPointers(<8 x i8*>* %p) nounwind uwtable sanitize_memory {
605 %x = load <8 x i8*>* %p
609 ; CHECK: @VectorOfPointers
610 ; CHECK: load <8 x i8*>*
611 ; CHECK: load <8 x i64>*
612 ; CHECK: store <8 x i64> {{.*}} @__msan_retval_tls
613 ; CHECK: ret <8 x i8*>
615 ; Test handling of va_copy.
617 declare void @llvm.va_copy(i8*, i8*) nounwind
619 define void @VACopy(i8* %p1, i8* %p2) nounwind uwtable sanitize_memory {
620 call void @llvm.va_copy(i8* %p1, i8* %p2) nounwind
625 ; CHECK: call void @llvm.memset.p0i8.i64({{.*}}, i8 0, i64 24, i32 8, i1 false)
629 ; Test that va_start instrumentation does not use va_arg_tls*.
630 ; It should work with a local stack copy instead.
632 %struct.__va_list_tag = type { i32, i32, i8*, i8* }
633 declare void @llvm.va_start(i8*) nounwind
635 ; Function Attrs: nounwind uwtable
636 define void @VAStart(i32 %x, ...) {
638 %x.addr = alloca i32, align 4
639 %va = alloca [1 x %struct.__va_list_tag], align 16
640 store i32 %x, i32* %x.addr, align 4
641 %arraydecay = getelementptr inbounds [1 x %struct.__va_list_tag]* %va, i32 0, i32 0
642 %arraydecay1 = bitcast %struct.__va_list_tag* %arraydecay to i8*
643 call void @llvm.va_start(i8* %arraydecay1)
648 ; CHECK: call void @llvm.va_start
649 ; CHECK-NOT: @__msan_va_arg_tls
650 ; CHECK-NOT: @__msan_va_arg_overflow_size_tls
654 ; Test handling of volatile stores.
655 ; Check that MemorySanitizer does not add a check of the value being stored.
657 define void @VolatileStore(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
659 store volatile i32 %x, i32* %p, align 4
663 ; CHECK: @VolatileStore
664 ; CHECK-NOT: @__msan_warning
668 ; Test that checks are omitted but shadow propagation is kept if
669 ; sanitize_memory attribute is missing.
671 define i32 @NoSanitizeMemory(i32 %x) uwtable {
673 %tobool = icmp eq i32 %x, 0
674 br i1 %tobool, label %if.end, label %if.then
676 if.then: ; preds = %entry
677 tail call void @bar()
680 if.end: ; preds = %entry, %if.then
686 ; CHECK: @NoSanitizeMemory
687 ; CHECK-NOT: @__msan_warning
688 ; CHECK: load i32* {{.*}} @__msan_param_tls
689 ; CHECK-NOT: @__msan_warning
690 ; CHECK: store {{.*}} @__msan_retval_tls
691 ; CHECK-NOT: @__msan_warning
695 ; Test that stack allocations are unpoisoned in functions missing
696 ; sanitize_memory attribute
698 define i32 @NoSanitizeMemoryAlloca() {
700 %p = alloca i32, align 4
701 %x = call i32 @NoSanitizeMemoryAllocaHelper(i32* %p)
705 declare i32 @NoSanitizeMemoryAllocaHelper(i32* %p)
707 ; CHECK: @NoSanitizeMemoryAlloca
708 ; CHECK: call void @llvm.memset.p0i8.i64(i8* {{.*}}, i8 0, i64 4, i32 4, i1 false)
709 ; CHECK: call i32 @NoSanitizeMemoryAllocaHelper(i32*
713 ; Test that undef is unpoisoned in functions missing
714 ; sanitize_memory attribute
716 define i32 @NoSanitizeMemoryUndef() {
718 %x = call i32 @NoSanitizeMemoryUndefHelper(i32 undef)
722 declare i32 @NoSanitizeMemoryUndefHelper(i32 %x)
724 ; CHECK: @NoSanitizeMemoryAlloca
725 ; CHECK: store i32 0, i32* {{.*}} @__msan_param_tls
726 ; CHECK: call i32 @NoSanitizeMemoryUndefHelper(i32 undef)
730 ; Test argument shadow alignment
732 define <2 x i64> @ArgumentShadowAlignment(i64 %a, <2 x i64> %b) sanitize_memory {
737 ; CHECK: @ArgumentShadowAlignment
738 ; CHECK: load <2 x i64>* {{.*}} @__msan_param_tls {{.*}}, align 8
739 ; CHECK: store <2 x i64> {{.*}} @__msan_retval_tls {{.*}}, align 8
740 ; CHECK: ret <2 x i64>
743 ; Test origin propagation for insertvalue
745 define { i64, i32 } @make_pair_64_32(i64 %x, i32 %y) sanitize_memory {
747 %a = insertvalue { i64, i32 } undef, i64 %x, 0
748 %b = insertvalue { i64, i32 } %a, i32 %y, 1
752 ; CHECK-ORIGINS: @make_pair_64_32
753 ; First element shadow
754 ; CHECK-ORIGINS: insertvalue { i64, i32 } { i64 -1, i32 -1 }, i64 {{.*}}, 0
755 ; First element origin
756 ; CHECK-ORIGINS: icmp ne i64
757 ; CHECK-ORIGINS: select i1
758 ; First element app value
759 ; CHECK-ORIGINS: insertvalue { i64, i32 } undef, i64 {{.*}}, 0
760 ; Second element shadow
761 ; CHECK-ORIGINS: insertvalue { i64, i32 } {{.*}}, i32 {{.*}}, 1
762 ; Second element origin
763 ; CHECK-ORIGINS: icmp ne i32
764 ; CHECK-ORIGINS: select i1
765 ; Second element app value
766 ; CHECK-ORIGINS: insertvalue { i64, i32 } {{.*}}, i32 {{.*}}, 1
767 ; CHECK-ORIGINS: ret { i64, i32 }
770 ; Test shadow propagation for aggregates passed through ellipsis.
772 %struct.StructByVal = type { i32, i32, i32, i32 }
774 declare void @VAArgStructFn(i32 %guard, ...)
776 define void @VAArgStruct(%struct.StructByVal* nocapture %s) sanitize_memory {
778 %agg.tmp2 = alloca %struct.StructByVal, align 8
779 %0 = bitcast %struct.StructByVal* %s to i8*
780 %agg.tmp.sroa.0.0..sroa_cast = bitcast %struct.StructByVal* %s to i64*
781 %agg.tmp.sroa.0.0.copyload = load i64* %agg.tmp.sroa.0.0..sroa_cast, align 4
782 %agg.tmp.sroa.2.0..sroa_idx = getelementptr inbounds %struct.StructByVal* %s, i64 0, i32 2
783 %agg.tmp.sroa.2.0..sroa_cast = bitcast i32* %agg.tmp.sroa.2.0..sroa_idx to i64*
784 %agg.tmp.sroa.2.0.copyload = load i64* %agg.tmp.sroa.2.0..sroa_cast, align 4
785 %1 = bitcast %struct.StructByVal* %agg.tmp2 to i8*
786 call void @llvm.memcpy.p0i8.p0i8.i64(i8* %1, i8* %0, i64 16, i32 4, i1 false)
787 call void (i32, ...)* @VAArgStructFn(i32 undef, i64 %agg.tmp.sroa.0.0.copyload, i64 %agg.tmp.sroa.2.0.copyload, i64 %agg.tmp.sroa.0.0.copyload, i64 %agg.tmp.sroa.2.0.copyload, %struct.StructByVal* byval align 8 %agg.tmp2)
791 ; "undef" and the first 2 structs go to general purpose registers;
792 ; the third struct goes to the overflow area byval
794 ; CHECK: @VAArgStruct
796 ; CHECK: store i32 -1, i32* {{.*}}@__msan_va_arg_tls {{.*}}, align 8
797 ; first struct through general purpose registers
798 ; CHECK: store i64 {{.*}}, i64* {{.*}}@__msan_va_arg_tls{{.*}}, i64 8){{.*}}, align 8
799 ; CHECK: store i64 {{.*}}, i64* {{.*}}@__msan_va_arg_tls{{.*}}, i64 16){{.*}}, align 8
800 ; second struct through general purpose registers
801 ; CHECK: store i64 {{.*}}, i64* {{.*}}@__msan_va_arg_tls{{.*}}, i64 24){{.*}}, align 8
802 ; CHECK: store i64 {{.*}}, i64* {{.*}}@__msan_va_arg_tls{{.*}}, i64 32){{.*}}, align 8
803 ; third struct through the overflow area byval
804 ; CHECK: ptrtoint %struct.StructByVal* {{.*}} to i64
805 ; CHECK: bitcast { i32, i32, i32, i32 }* {{.*}}@__msan_va_arg_tls {{.*}}, i64 176
806 ; CHECK: call void @llvm.memcpy.p0i8.p0i8.i64
807 ; CHECK: store i64 16, i64* @__msan_va_arg_overflow_size_tls
808 ; CHECK: call void (i32, ...)* @VAArgStructFn