1 ; RUN: opt < %s -msan -msan-check-access-address=0 -S | FileCheck %s
2 ; RUN: opt < %s -msan -msan-check-access-address=0 -msan-track-origins=1 -S | FileCheck -check-prefix=CHECK-ORIGINS %s
3 ; RUN: opt < %s -msan -msan-check-access-address=1 -S | FileCheck %s -check-prefix=CHECK-AA
5 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
6 target triple = "x86_64-unknown-linux-gnu"
8 ; Check the presence of __msan_init
9 ; CHECK: @llvm.global_ctors {{.*}} @__msan_init
11 ; Check the presence and the linkage type of __msan_track_origins and
12 ; other interface symbols.
13 ; CHECK-NOT: @__msan_track_origins
14 ; CHECK-ORIGINS: @__msan_track_origins = weak_odr constant i32 1
15 ; CHECK-NOT: @__msan_keep_going = weak_odr constant i32 0
16 ; CHECK: @__msan_retval_tls = external thread_local(initialexec) global [{{.*}}]
17 ; CHECK: @__msan_retval_origin_tls = external thread_local(initialexec) global i32
18 ; CHECK: @__msan_param_tls = external thread_local(initialexec) global [{{.*}}]
19 ; CHECK: @__msan_param_origin_tls = external thread_local(initialexec) global [{{.*}}]
20 ; CHECK: @__msan_va_arg_tls = external thread_local(initialexec) global [{{.*}}]
21 ; CHECK: @__msan_va_arg_overflow_size_tls = external thread_local(initialexec) global i64
22 ; CHECK: @__msan_origin_tls = external thread_local(initialexec) global i32
25 ; Check instrumentation of stores
27 define void @Store(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
29 store i32 %x, i32* %p, align 4
34 ; CHECK: load {{.*}} @__msan_param_tls
38 ; CHECK-ORIGINS: @Store
39 ; CHECK-ORIGINS: load {{.*}} @__msan_param_tls
40 ; CHECK-ORIGINS: store
42 ; CHECK-ORIGINS: br i1
43 ; CHECK-ORIGINS: <label>
44 ; CHECK-ORIGINS: store
45 ; CHECK-ORIGINS: br label
46 ; CHECK-ORIGINS: <label>
47 ; CHECK-ORIGINS: store
48 ; CHECK-ORIGINS: ret void
51 ; Check instrumentation of aligned stores
52 ; Shadow store has the same alignment as the original store; origin store
53 ; does not specify explicit alignment.
55 define void @AlignedStore(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
57 store i32 %x, i32* %p, align 32
61 ; CHECK: @AlignedStore
62 ; CHECK: load {{.*}} @__msan_param_tls
63 ; CHECK: store {{.*}} align 32
64 ; CHECK: store {{.*}} align 32
66 ; CHECK-ORIGINS: @AlignedStore
67 ; CHECK-ORIGINS: load {{.*}} @__msan_param_tls
68 ; CHECK-ORIGINS: store {{.*}} align 32
70 ; CHECK-ORIGINS: br i1
71 ; CHECK-ORIGINS: <label>
72 ; CHECK-ORIGINS: store {{.*}} align 32
73 ; CHECK-ORIGINS: br label
74 ; CHECK-ORIGINS: <label>
75 ; CHECK-ORIGINS: store {{.*}} align 32
76 ; CHECK-ORIGINS: ret void
79 ; load followed by cmp: check that we load the shadow and call __msan_warning.
80 define void @LoadAndCmp(i32* nocapture %a) nounwind uwtable sanitize_memory {
82 %0 = load i32* %a, align 4
83 %tobool = icmp eq i32 %0, 0
84 br i1 %tobool, label %if.end, label %if.then
86 if.then: ; preds = %entry
87 tail call void (...)* @foo() nounwind
90 if.end: ; preds = %entry, %if.then
94 declare void @foo(...)
99 ; CHECK: call void @__msan_warning_noreturn()
100 ; CHECK-NEXT: call void asm sideeffect
101 ; CHECK-NEXT: unreachable
104 ; Check that we store the shadow for the retval.
105 define i32 @ReturnInt() nounwind uwtable readnone sanitize_memory {
111 ; CHECK: store i32 0,{{.*}}__msan_retval_tls
114 ; Check that we get the shadow for the retval.
115 define void @CopyRetVal(i32* nocapture %a) nounwind uwtable sanitize_memory {
117 %call = tail call i32 @ReturnInt() nounwind
118 store i32 %call, i32* %a, align 4
123 ; CHECK: load{{.*}}__msan_retval_tls
129 ; Check that we generate PHIs for shadow.
130 define void @FuncWithPhi(i32* nocapture %a, i32* %b, i32* nocapture %c) nounwind uwtable sanitize_memory {
132 %tobool = icmp eq i32* %b, null
133 br i1 %tobool, label %if.else, label %if.then
135 if.then: ; preds = %entry
136 %0 = load i32* %b, align 4
139 if.else: ; preds = %entry
140 %1 = load i32* %c, align 4
143 if.end: ; preds = %if.else, %if.then
144 %t.0 = phi i32 [ %0, %if.then ], [ %1, %if.else ]
145 store i32 %t.0, i32* %a, align 4
149 ; CHECK: @FuncWithPhi
156 ; Compute shadow for "x << 10"
157 define void @ShlConst(i32* nocapture %x) nounwind uwtable sanitize_memory {
159 %0 = load i32* %x, align 4
161 store i32 %1, i32* %x, align 4
174 ; Compute shadow for "10 << x": it should have 'sext i1'.
175 define void @ShlNonConst(i32* nocapture %x) nounwind uwtable sanitize_memory {
177 %0 = load i32* %x, align 4
179 store i32 %1, i32* %x, align 4
183 ; CHECK: @ShlNonConst
192 define void @SExt(i32* nocapture %a, i16* nocapture %b) nounwind uwtable sanitize_memory {
194 %0 = load i16* %b, align 2
195 %1 = sext i16 %0 to i32
196 store i32 %1, i32* %a, align 4
211 define void @MemSet(i8* nocapture %x) nounwind uwtable sanitize_memory {
213 call void @llvm.memset.p0i8.i64(i8* %x, i8 42, i64 10, i32 1, i1 false)
217 declare void @llvm.memset.p0i8.i64(i8* nocapture, i8, i64, i32, i1) nounwind
220 ; CHECK: call i8* @__msan_memset
225 define void @MemCpy(i8* nocapture %x, i8* nocapture %y) nounwind uwtable sanitize_memory {
227 call void @llvm.memcpy.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i32 1, i1 false)
231 declare void @llvm.memcpy.p0i8.p0i8.i64(i8* nocapture, i8* nocapture, i64, i32, i1) nounwind
234 ; CHECK: call i8* @__msan_memcpy
238 ; memmove is lowered to a call
239 define void @MemMove(i8* nocapture %x, i8* nocapture %y) nounwind uwtable sanitize_memory {
241 call void @llvm.memmove.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i32 1, i1 false)
245 declare void @llvm.memmove.p0i8.p0i8.i64(i8* nocapture, i8* nocapture, i64, i32, i1) nounwind
248 ; CHECK: call i8* @__msan_memmove
252 ; Check that we propagate shadow for "select"
254 define i32 @Select(i32 %a, i32 %b, i32 %c) nounwind uwtable readnone sanitize_memory {
256 %tobool = icmp ne i32 %c, 0
257 %cond = select i1 %tobool, i32 %a, i32 %b
263 ; CHECK-NEXT: sext i1 {{.*}} to i32
269 ; Check that we propagate origin for "select" with vector condition.
270 ; Select condition is flattened to i1, which is then used to select one of the
273 define <8 x i16> @SelectVector(<8 x i16> %a, <8 x i16> %b, <8 x i1> %c) nounwind uwtable readnone sanitize_memory {
275 %cond = select <8 x i1> %c, <8 x i16> %a, <8 x i16> %b
279 ; CHECK: @SelectVector
280 ; CHECK: select <8 x i1>
281 ; CHECK-NEXT: sext <8 x i1> {{.*}} to <8 x i16>
282 ; CHECK-NEXT: or <8 x i16>
283 ; CHECK-NEXT: select <8 x i1>
284 ; CHECK: ret <8 x i16>
286 ; CHECK-ORIGINS: @SelectVector
287 ; CHECK-ORIGINS: bitcast <8 x i1> {{.*}} to i8
288 ; CHECK-ORIGINS: icmp ne i8
289 ; CHECK-ORIGINS: select i1
290 ; CHECK-ORIGINS: ret <8 x i16>
293 define i8* @IntToPtr(i64 %x) nounwind uwtable readnone sanitize_memory {
295 %0 = inttoptr i64 %x to i8*
300 ; CHECK: load i64*{{.*}}__msan_param_tls
301 ; CHECK-NEXT: inttoptr
302 ; CHECK-NEXT: store i64{{.*}}__msan_retval_tls
306 define i8* @IntToPtr_ZExt(i16 %x) nounwind uwtable readnone sanitize_memory {
308 %0 = inttoptr i16 %x to i8*
312 ; CHECK: @IntToPtr_ZExt
314 ; CHECK-NEXT: inttoptr
318 ; Check that we insert exactly one check on udiv
319 ; (2nd arg shadow is checked, 1st arg shadow is propagated)
321 define i32 @Div(i32 %a, i32 %b) nounwind uwtable readnone sanitize_memory {
323 %div = udiv i32 %a, %b
329 ; CHECK: call void @__msan_warning
336 ; Check that we propagate shadow for x<0, x>=0, etc (i.e. sign bit tests)
338 define zeroext i1 @ICmpSLT(i32 %x) nounwind uwtable readnone sanitize_memory {
339 %1 = icmp slt i32 %x, 0
345 ; CHECK-NOT: call void @__msan_warning
347 ; CHECK-NOT: call void @__msan_warning
350 define zeroext i1 @ICmpSGE(i32 %x) nounwind uwtable readnone sanitize_memory {
351 %1 = icmp sge i32 %x, 0
357 ; CHECK-NOT: call void @__msan_warning
359 ; CHECK-NOT: call void @__msan_warning
362 define zeroext i1 @ICmpSGT(i32 %x) nounwind uwtable readnone sanitize_memory {
363 %1 = icmp sgt i32 0, %x
369 ; CHECK-NOT: call void @__msan_warning
371 ; CHECK-NOT: call void @__msan_warning
374 define zeroext i1 @ICmpSLE(i32 %x) nounwind uwtable readnone sanitize_memory {
375 %1 = icmp sle i32 0, %x
381 ; CHECK-NOT: call void @__msan_warning
383 ; CHECK-NOT: call void @__msan_warning
387 ; Check that we propagate shadow for x<0, x>=0, etc (i.e. sign bit tests)
388 ; of the vector arguments.
390 define <2 x i1> @ICmpSLT_vector(<2 x i32*> %x) nounwind uwtable readnone sanitize_memory {
391 %1 = icmp slt <2 x i32*> %x, zeroinitializer
395 ; CHECK: @ICmpSLT_vector
396 ; CHECK: icmp slt <2 x i64>
397 ; CHECK-NOT: call void @__msan_warning
398 ; CHECK: icmp slt <2 x i32*>
399 ; CHECK-NOT: call void @__msan_warning
400 ; CHECK: ret <2 x i1>
403 ; Check that we propagate shadow for unsigned relational comparisons with
406 define zeroext i1 @ICmpUGTConst(i32 %x) nounwind uwtable readnone sanitize_memory {
408 %cmp = icmp ugt i32 %x, 7
412 ; CHECK: @ICmpUGTConst
413 ; CHECK: icmp ugt i32
414 ; CHECK-NOT: call void @__msan_warning
415 ; CHECK: icmp ugt i32
416 ; CHECK-NOT: call void @__msan_warning
417 ; CHECK: icmp ugt i32
418 ; CHECK-NOT: call void @__msan_warning
422 ; Check that loads of shadow have the same aligment as the original loads.
423 ; Check that loads of origin have the aligment of max(4, original alignment).
425 define i32 @ShadowLoadAlignmentLarge() nounwind uwtable sanitize_memory {
426 %y = alloca i32, align 64
427 %1 = load volatile i32* %y, align 64
431 ; CHECK: @ShadowLoadAlignmentLarge
432 ; CHECK: load i32* {{.*}} align 64
433 ; CHECK: load volatile i32* {{.*}} align 64
436 define i32 @ShadowLoadAlignmentSmall() nounwind uwtable sanitize_memory {
437 %y = alloca i32, align 2
438 %1 = load volatile i32* %y, align 2
442 ; CHECK: @ShadowLoadAlignmentSmall
443 ; CHECK: load i32* {{.*}} align 2
444 ; CHECK: load volatile i32* {{.*}} align 2
447 ; CHECK-ORIGINS: @ShadowLoadAlignmentSmall
448 ; CHECK-ORIGINS: load i32* {{.*}} align 2
449 ; CHECK-ORIGINS: load i32* {{.*}} align 4
450 ; CHECK-ORIGINS: load volatile i32* {{.*}} align 2
451 ; CHECK-ORIGINS: ret i32
454 ; Test vector manipulation instructions.
455 ; Check that the same bit manipulation is applied to the shadow values.
456 ; Check that there is a zero test of the shadow of %idx argument, where present.
458 define i32 @ExtractElement(<4 x i32> %vec, i32 %idx) sanitize_memory {
459 %x = extractelement <4 x i32> %vec, i32 %idx
463 ; CHECK: @ExtractElement
464 ; CHECK: extractelement
465 ; CHECK: call void @__msan_warning
466 ; CHECK: extractelement
469 define <4 x i32> @InsertElement(<4 x i32> %vec, i32 %idx, i32 %x) sanitize_memory {
470 %vec1 = insertelement <4 x i32> %vec, i32 %x, i32 %idx
474 ; CHECK: @InsertElement
475 ; CHECK: insertelement
476 ; CHECK: call void @__msan_warning
477 ; CHECK: insertelement
478 ; CHECK: ret <4 x i32>
480 define <4 x i32> @ShuffleVector(<4 x i32> %vec, <4 x i32> %vec1) sanitize_memory {
481 %vec2 = shufflevector <4 x i32> %vec, <4 x i32> %vec1,
482 <4 x i32> <i32 0, i32 4, i32 1, i32 5>
486 ; CHECK: @ShuffleVector
487 ; CHECK: shufflevector
488 ; CHECK-NOT: call void @__msan_warning
489 ; CHECK: shufflevector
490 ; CHECK: ret <4 x i32>
493 ; Test bswap intrinsic instrumentation
494 define i32 @BSwap(i32 %x) nounwind uwtable readnone sanitize_memory {
495 %y = tail call i32 @llvm.bswap.i32(i32 %x)
499 declare i32 @llvm.bswap.i32(i32) nounwind readnone
502 ; CHECK-NOT: call void @__msan_warning
503 ; CHECK: @llvm.bswap.i32
504 ; CHECK-NOT: call void @__msan_warning
505 ; CHECK: @llvm.bswap.i32
506 ; CHECK-NOT: call void @__msan_warning
512 define void @StoreIntrinsic(i8* %p, <4 x float> %x) nounwind uwtable sanitize_memory {
513 call void @llvm.x86.sse.storeu.ps(i8* %p, <4 x float> %x)
517 declare void @llvm.x86.sse.storeu.ps(i8*, <4 x float>) nounwind
519 ; CHECK: @StoreIntrinsic
522 ; CHECK: store <4 x i32> {{.*}} align 1
523 ; CHECK: call void @llvm.x86.sse.storeu.ps
529 define <16 x i8> @LoadIntrinsic(i8* %p) nounwind uwtable sanitize_memory {
530 %call = call <16 x i8> @llvm.x86.sse3.ldu.dq(i8* %p)
534 declare <16 x i8> @llvm.x86.sse3.ldu.dq(i8* %p) nounwind
536 ; CHECK: @LoadIntrinsic
537 ; CHECK: load <16 x i8>* {{.*}} align 1
540 ; CHECK: call <16 x i8> @llvm.x86.sse3.ldu.dq
541 ; CHECK: store <16 x i8> {{.*}} @__msan_retval_tls
542 ; CHECK: ret <16 x i8>
544 ; CHECK-ORIGINS: @LoadIntrinsic
545 ; CHECK-ORIGINS: [[ORIGIN:%[01-9a-z]+]] = load i32* {{.*}}
546 ; CHECK-ORIGINS: call <16 x i8> @llvm.x86.sse3.ldu.dq
547 ; CHECK-ORIGINS: store i32 {{.*}}[[ORIGIN]], i32* @__msan_retval_origin_tls
548 ; CHECK-ORIGINS: ret <16 x i8>
551 ; Simple NoMem intrinsic
552 ; Check that shadow is OR'ed, and origin is Select'ed
553 ; And no shadow checks!
555 define <8 x i16> @Paddsw128(<8 x i16> %a, <8 x i16> %b) nounwind uwtable sanitize_memory {
556 %call = call <8 x i16> @llvm.x86.sse2.padds.w(<8 x i16> %a, <8 x i16> %b)
560 declare <8 x i16> @llvm.x86.sse2.padds.w(<8 x i16> %a, <8 x i16> %b) nounwind
563 ; CHECK-NEXT: load <8 x i16>* {{.*}} @__msan_param_tls
564 ; CHECK-NEXT: load <8 x i16>* {{.*}} @__msan_param_tls
565 ; CHECK-NEXT: = or <8 x i16>
566 ; CHECK-NEXT: call <8 x i16> @llvm.x86.sse2.padds.w
567 ; CHECK-NEXT: store <8 x i16> {{.*}} @__msan_retval_tls
568 ; CHECK-NEXT: ret <8 x i16>
570 ; CHECK-ORIGINS: @Paddsw128
571 ; CHECK-ORIGINS: load i32* {{.*}} @__msan_param_origin_tls
572 ; CHECK-ORIGINS: load i32* {{.*}} @__msan_param_origin_tls
573 ; CHECK-ORIGINS: = bitcast <8 x i16> {{.*}} to i128
574 ; CHECK-ORIGINS-NEXT: = icmp ne i128 {{.*}}, 0
575 ; CHECK-ORIGINS-NEXT: = select i1 {{.*}}, i32 {{.*}}, i32
576 ; CHECK-ORIGINS: call <8 x i16> @llvm.x86.sse2.padds.w
577 ; CHECK-ORIGINS: store i32 {{.*}} @__msan_retval_origin_tls
578 ; CHECK-ORIGINS: ret <8 x i16>
581 ; Test handling of vectors of pointers.
582 ; Check that shadow of such vector is a vector of integers.
584 define <8 x i8*> @VectorOfPointers(<8 x i8*>* %p) nounwind uwtable sanitize_memory {
585 %x = load <8 x i8*>* %p
589 ; CHECK: @VectorOfPointers
590 ; CHECK: load <8 x i64>*
591 ; CHECK: load <8 x i8*>*
592 ; CHECK: store <8 x i64> {{.*}} @__msan_retval_tls
593 ; CHECK: ret <8 x i8*>
595 ; Test handling of va_copy.
597 declare void @llvm.va_copy(i8*, i8*) nounwind
599 define void @VACopy(i8* %p1, i8* %p2) nounwind uwtable sanitize_memory {
600 call void @llvm.va_copy(i8* %p1, i8* %p2) nounwind
605 ; CHECK: call void @llvm.memset.p0i8.i64({{.*}}, i8 0, i64 24, i32 8, i1 false)
609 ; Test that va_start instrumentation does not use va_arg_tls*.
610 ; It should work with a local stack copy instead.
612 %struct.__va_list_tag = type { i32, i32, i8*, i8* }
613 declare void @llvm.va_start(i8*) nounwind
615 ; Function Attrs: nounwind uwtable
616 define void @VAStart(i32 %x, ...) {
618 %x.addr = alloca i32, align 4
619 %va = alloca [1 x %struct.__va_list_tag], align 16
620 store i32 %x, i32* %x.addr, align 4
621 %arraydecay = getelementptr inbounds [1 x %struct.__va_list_tag]* %va, i32 0, i32 0
622 %arraydecay1 = bitcast %struct.__va_list_tag* %arraydecay to i8*
623 call void @llvm.va_start(i8* %arraydecay1)
628 ; CHECK: call void @llvm.va_start
629 ; CHECK-NOT: @__msan_va_arg_tls
630 ; CHECK-NOT: @__msan_va_arg_overflow_size_tls
634 ; Test handling of volatile stores.
635 ; Check that MemorySanitizer does not add a check of the value being stored.
637 define void @VolatileStore(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
639 store volatile i32 %x, i32* %p, align 4
643 ; CHECK: @VolatileStore
644 ; CHECK-NOT: @__msan_warning
648 ; Test that checks are omitted but shadow propagation is kept if
649 ; sanitize_memory attribute is missing.
651 define i32 @NoSanitizeMemory(i32 %x) uwtable {
653 %tobool = icmp eq i32 %x, 0
654 br i1 %tobool, label %if.end, label %if.then
656 if.then: ; preds = %entry
657 tail call void @bar()
660 if.end: ; preds = %entry, %if.then
666 ; CHECK: @NoSanitizeMemory
667 ; CHECK-NOT: @__msan_warning
668 ; CHECK: load i32* {{.*}} @__msan_param_tls
669 ; CHECK-NOT: @__msan_warning
670 ; CHECK: store {{.*}} @__msan_retval_tls
671 ; CHECK-NOT: @__msan_warning
675 ; Test that stack allocations are unpoisoned in functions missing
676 ; sanitize_memory attribute
678 define i32 @NoSanitizeMemoryAlloca() {
680 %p = alloca i32, align 4
681 %x = call i32 @NoSanitizeMemoryAllocaHelper(i32* %p)
685 declare i32 @NoSanitizeMemoryAllocaHelper(i32* %p)
687 ; CHECK: @NoSanitizeMemoryAlloca
688 ; CHECK: call void @llvm.memset.p0i8.i64(i8* {{.*}}, i8 0, i64 4, i32 4, i1 false)
689 ; CHECK: call i32 @NoSanitizeMemoryAllocaHelper(i32*
693 ; Test that undef is unpoisoned in functions missing
694 ; sanitize_memory attribute
696 define i32 @NoSanitizeMemoryUndef() {
698 %x = call i32 @NoSanitizeMemoryUndefHelper(i32 undef)
702 declare i32 @NoSanitizeMemoryUndefHelper(i32 %x)
704 ; CHECK: @NoSanitizeMemoryAlloca
705 ; CHECK: store i32 0, i32* {{.*}} @__msan_param_tls
706 ; CHECK: call i32 @NoSanitizeMemoryUndefHelper(i32 undef)
710 ; Test argument shadow alignment
712 define <2 x i64> @ArgumentShadowAlignment(i64 %a, <2 x i64> %b) sanitize_memory {
717 ; CHECK: @ArgumentShadowAlignment
718 ; CHECK: load <2 x i64>* {{.*}} @__msan_param_tls {{.*}}, align 8
719 ; CHECK: store <2 x i64> {{.*}} @__msan_retval_tls {{.*}}, align 8
720 ; CHECK: ret <2 x i64>
723 ; Test byval argument shadow alignment
725 define <2 x i64> @ByValArgumentShadowLargeAlignment(<2 x i64>* byval %p) sanitize_memory {
727 %x = load <2 x i64>* %p
731 ; CHECK-AA: @ByValArgumentShadowLargeAlignment
732 ; CHECK-AA: call void @llvm.memcpy.p0i8.p0i8.i64(i8* {{.*}}, i8* {{.*}}, i64 16, i32 8, i1 false)
733 ; CHECK-AA: ret <2 x i64>
736 define i16 @ByValArgumentShadowSmallAlignment(i16* byval %p) sanitize_memory {
742 ; CHECK-AA: @ByValArgumentShadowSmallAlignment
743 ; CHECK-AA: call void @llvm.memcpy.p0i8.p0i8.i64(i8* {{.*}}, i8* {{.*}}, i64 2, i32 2, i1 false)