1 ; RUN: opt < %s -msan -msan-check-access-address=0 -S | FileCheck %s
2 ; RUN: opt < %s -msan -msan-check-access-address=0 -msan-track-origins=1 -S | FileCheck -check-prefix=CHECK-ORIGINS %s
3 target datalayout = "e-p:64:64:64-i1:8:8-i8:8:8-i16:16:16-i32:32:32-i64:64:64-f32:32:32-f64:64:64-v64:64:64-v128:128:128-a0:0:64-s0:64:64-f80:128:128-n8:16:32:64-S128"
4 target triple = "x86_64-unknown-linux-gnu"
6 ; Check the presence of __msan_init
7 ; CHECK: @llvm.global_ctors {{.*}} @__msan_init
9 ; Check the presence and the linkage type of __msan_track_origins and
10 ; other interface symbols.
11 ; CHECK: @__msan_track_origins = weak_odr constant i32 0
12 ; CHECK: @__msan_keep_going = weak_odr constant i32 0
13 ; CHECK: @__msan_retval_tls = external thread_local(initialexec) global [{{.*}}]
14 ; CHECK: @__msan_retval_origin_tls = external thread_local(initialexec) global i32
15 ; CHECK: @__msan_param_tls = external thread_local(initialexec) global [{{.*}}]
16 ; CHECK: @__msan_param_origin_tls = external thread_local(initialexec) global [{{.*}}]
17 ; CHECK: @__msan_va_arg_tls = external thread_local(initialexec) global [{{.*}}]
18 ; CHECK: @__msan_va_arg_overflow_size_tls = external thread_local(initialexec) global i64
19 ; CHECK: @__msan_origin_tls = external thread_local(initialexec) global i32
22 ; Check instrumentation of stores
24 define void @Store(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
26 store i32 %x, i32* %p, align 4
31 ; CHECK: load {{.*}} @__msan_param_tls
35 ; CHECK-ORIGINS: @Store
36 ; CHECK-ORIGINS: load {{.*}} @__msan_param_tls
37 ; CHECK-ORIGINS: store
39 ; CHECK-ORIGINS: br i1
40 ; CHECK-ORIGINS: <label>
41 ; CHECK-ORIGINS: store
42 ; CHECK-ORIGINS: br label
43 ; CHECK-ORIGINS: <label>
44 ; CHECK-ORIGINS: store
45 ; CHECK-ORIGINS: ret void
48 ; Check instrumentation of aligned stores
49 ; Shadow store has the same alignment as the original store; origin store
50 ; does not specify explicit alignment.
52 define void @AlignedStore(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
54 store i32 %x, i32* %p, align 32
58 ; CHECK: @AlignedStore
59 ; CHECK: load {{.*}} @__msan_param_tls
60 ; CHECK: store {{.*}} align 32
61 ; CHECK: store {{.*}} align 32
63 ; CHECK-ORIGINS: @AlignedStore
64 ; CHECK-ORIGINS: load {{.*}} @__msan_param_tls
65 ; CHECK-ORIGINS: store {{.*}} align 32
67 ; CHECK-ORIGINS: br i1
68 ; CHECK-ORIGINS: <label>
69 ; CHECK-ORIGINS: store {{.*}} align 32
70 ; CHECK-ORIGINS: br label
71 ; CHECK-ORIGINS: <label>
72 ; CHECK-ORIGINS: store {{.*}} align 32
73 ; CHECK-ORIGINS: ret void
76 ; load followed by cmp: check that we load the shadow and call __msan_warning.
77 define void @LoadAndCmp(i32* nocapture %a) nounwind uwtable sanitize_memory {
79 %0 = load i32* %a, align 4
80 %tobool = icmp eq i32 %0, 0
81 br i1 %tobool, label %if.end, label %if.then
83 if.then: ; preds = %entry
84 tail call void (...)* @foo() nounwind
87 if.end: ; preds = %entry, %if.then
91 declare void @foo(...)
96 ; CHECK: call void @__msan_warning_noreturn()
97 ; CHECK-NEXT: call void asm sideeffect
98 ; CHECK-NEXT: unreachable
101 ; Check that we store the shadow for the retval.
102 define i32 @ReturnInt() nounwind uwtable readnone sanitize_memory {
108 ; CHECK: store i32 0,{{.*}}__msan_retval_tls
111 ; Check that we get the shadow for the retval.
112 define void @CopyRetVal(i32* nocapture %a) nounwind uwtable sanitize_memory {
114 %call = tail call i32 @ReturnInt() nounwind
115 store i32 %call, i32* %a, align 4
120 ; CHECK: load{{.*}}__msan_retval_tls
126 ; Check that we generate PHIs for shadow.
127 define void @FuncWithPhi(i32* nocapture %a, i32* %b, i32* nocapture %c) nounwind uwtable sanitize_memory {
129 %tobool = icmp eq i32* %b, null
130 br i1 %tobool, label %if.else, label %if.then
132 if.then: ; preds = %entry
133 %0 = load i32* %b, align 4
136 if.else: ; preds = %entry
137 %1 = load i32* %c, align 4
140 if.end: ; preds = %if.else, %if.then
141 %t.0 = phi i32 [ %0, %if.then ], [ %1, %if.else ]
142 store i32 %t.0, i32* %a, align 4
146 ; CHECK: @FuncWithPhi
153 ; Compute shadow for "x << 10"
154 define void @ShlConst(i32* nocapture %x) nounwind uwtable sanitize_memory {
156 %0 = load i32* %x, align 4
158 store i32 %1, i32* %x, align 4
171 ; Compute shadow for "10 << x": it should have 'sext i1'.
172 define void @ShlNonConst(i32* nocapture %x) nounwind uwtable sanitize_memory {
174 %0 = load i32* %x, align 4
176 store i32 %1, i32* %x, align 4
180 ; CHECK: @ShlNonConst
189 define void @SExt(i32* nocapture %a, i16* nocapture %b) nounwind uwtable sanitize_memory {
191 %0 = load i16* %b, align 2
192 %1 = sext i16 %0 to i32
193 store i32 %1, i32* %a, align 4
208 define void @MemSet(i8* nocapture %x) nounwind uwtable sanitize_memory {
210 call void @llvm.memset.p0i8.i64(i8* %x, i8 42, i64 10, i32 1, i1 false)
214 declare void @llvm.memset.p0i8.i64(i8* nocapture, i8, i64, i32, i1) nounwind
217 ; CHECK: call i8* @__msan_memset
222 define void @MemCpy(i8* nocapture %x, i8* nocapture %y) nounwind uwtable sanitize_memory {
224 call void @llvm.memcpy.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i32 1, i1 false)
228 declare void @llvm.memcpy.p0i8.p0i8.i64(i8* nocapture, i8* nocapture, i64, i32, i1) nounwind
231 ; CHECK: call i8* @__msan_memcpy
235 ; memmove is lowered to a call
236 define void @MemMove(i8* nocapture %x, i8* nocapture %y) nounwind uwtable sanitize_memory {
238 call void @llvm.memmove.p0i8.p0i8.i64(i8* %x, i8* %y, i64 10, i32 1, i1 false)
242 declare void @llvm.memmove.p0i8.p0i8.i64(i8* nocapture, i8* nocapture, i64, i32, i1) nounwind
245 ; CHECK: call i8* @__msan_memmove
249 ; Check that we propagate shadow for "select"
251 define i32 @Select(i32 %a, i32 %b, i32 %c) nounwind uwtable readnone sanitize_memory {
253 %tobool = icmp ne i32 %c, 0
254 %cond = select i1 %tobool, i32 %a, i32 %b
264 ; Check that we propagate origin for "select" with vector condition.
265 ; Select condition is flattened to i1, which is then used to select one of the
268 define <8 x i16> @SelectVector(<8 x i16> %a, <8 x i16> %b, <8 x i1> %c) nounwind uwtable readnone sanitize_memory {
270 %cond = select <8 x i1> %c, <8 x i16> %a, <8 x i16> %b
274 ; CHECK-ORIGINS: @SelectVector
275 ; CHECK-ORIGINS: bitcast <8 x i1> {{.*}} to i8
276 ; CHECK-ORIGINS: icmp ne i8
277 ; CHECK-ORIGINS: select i1
278 ; CHECK-ORIGINS: ret <8 x i16>
281 define i8* @IntToPtr(i64 %x) nounwind uwtable readnone sanitize_memory {
283 %0 = inttoptr i64 %x to i8*
288 ; CHECK: load i64*{{.*}}__msan_param_tls
289 ; CHECK-NEXT: inttoptr
290 ; CHECK-NEXT: store i64{{.*}}__msan_retval_tls
294 define i8* @IntToPtr_ZExt(i16 %x) nounwind uwtable readnone sanitize_memory {
296 %0 = inttoptr i16 %x to i8*
300 ; CHECK: @IntToPtr_ZExt
302 ; CHECK-NEXT: inttoptr
306 ; Check that we insert exactly one check on udiv
307 ; (2nd arg shadow is checked, 1st arg shadow is propagated)
309 define i32 @Div(i32 %a, i32 %b) nounwind uwtable readnone sanitize_memory {
311 %div = udiv i32 %a, %b
317 ; CHECK: call void @__msan_warning
324 ; Check that we propagate shadow for x<0, x>=0, etc (i.e. sign bit tests)
326 define zeroext i1 @ICmpSLT(i32 %x) nounwind uwtable readnone sanitize_memory {
327 %1 = icmp slt i32 %x, 0
333 ; CHECK-NOT: call void @__msan_warning
335 ; CHECK-NOT: call void @__msan_warning
338 define zeroext i1 @ICmpSGE(i32 %x) nounwind uwtable readnone sanitize_memory {
339 %1 = icmp sge i32 %x, 0
345 ; CHECK-NOT: call void @__msan_warning
347 ; CHECK-NOT: call void @__msan_warning
350 define zeroext i1 @ICmpSGT(i32 %x) nounwind uwtable readnone sanitize_memory {
351 %1 = icmp sgt i32 0, %x
357 ; CHECK-NOT: call void @__msan_warning
359 ; CHECK-NOT: call void @__msan_warning
362 define zeroext i1 @ICmpSLE(i32 %x) nounwind uwtable readnone sanitize_memory {
363 %1 = icmp sle i32 0, %x
369 ; CHECK-NOT: call void @__msan_warning
371 ; CHECK-NOT: call void @__msan_warning
375 ; Check that we propagate shadow for x<0, x>=0, etc (i.e. sign bit tests)
376 ; of the vector arguments.
378 define <2 x i1> @ICmpSLT_vector(<2 x i32*> %x) nounwind uwtable readnone sanitize_memory {
379 %1 = icmp slt <2 x i32*> %x, zeroinitializer
383 ; CHECK: @ICmpSLT_vector
384 ; CHECK: icmp slt <2 x i64>
385 ; CHECK-NOT: call void @__msan_warning
386 ; CHECK: icmp slt <2 x i32*>
387 ; CHECK-NOT: call void @__msan_warning
388 ; CHECK: ret <2 x i1>
391 ; Check that we propagate shadow for unsigned relational comparisons with
394 define zeroext i1 @ICmpUGTConst(i32 %x) nounwind uwtable readnone sanitize_memory {
396 %cmp = icmp ugt i32 %x, 7
400 ; CHECK: @ICmpUGTConst
401 ; CHECK: icmp ugt i32
402 ; CHECK-NOT: call void @__msan_warning
403 ; CHECK: icmp ugt i32
404 ; CHECK-NOT: call void @__msan_warning
405 ; CHECK: icmp ugt i32
406 ; CHECK-NOT: call void @__msan_warning
410 ; Check that loads of shadow have the same aligment as the original loads.
411 ; Check that loads of origin have the aligment of max(4, original alignment).
413 define i32 @ShadowLoadAlignmentLarge() nounwind uwtable sanitize_memory {
414 %y = alloca i32, align 64
415 %1 = load volatile i32* %y, align 64
419 ; CHECK: @ShadowLoadAlignmentLarge
420 ; CHECK: load i32* {{.*}} align 64
421 ; CHECK: load volatile i32* {{.*}} align 64
424 define i32 @ShadowLoadAlignmentSmall() nounwind uwtable sanitize_memory {
425 %y = alloca i32, align 2
426 %1 = load volatile i32* %y, align 2
430 ; CHECK: @ShadowLoadAlignmentSmall
431 ; CHECK: load i32* {{.*}} align 2
432 ; CHECK: load volatile i32* {{.*}} align 2
435 ; CHECK-ORIGINS: @ShadowLoadAlignmentSmall
436 ; CHECK-ORIGINS: load i32* {{.*}} align 2
437 ; CHECK-ORIGINS: load i32* {{.*}} align 4
438 ; CHECK-ORIGINS: load volatile i32* {{.*}} align 2
439 ; CHECK-ORIGINS: ret i32
442 ; Test vector manipulation instructions.
443 ; Check that the same bit manipulation is applied to the shadow values.
444 ; Check that there is a zero test of the shadow of %idx argument, where present.
446 define i32 @ExtractElement(<4 x i32> %vec, i32 %idx) sanitize_memory {
447 %x = extractelement <4 x i32> %vec, i32 %idx
451 ; CHECK: @ExtractElement
452 ; CHECK: extractelement
453 ; CHECK: call void @__msan_warning
454 ; CHECK: extractelement
457 define <4 x i32> @InsertElement(<4 x i32> %vec, i32 %idx, i32 %x) sanitize_memory {
458 %vec1 = insertelement <4 x i32> %vec, i32 %x, i32 %idx
462 ; CHECK: @InsertElement
463 ; CHECK: insertelement
464 ; CHECK: call void @__msan_warning
465 ; CHECK: insertelement
466 ; CHECK: ret <4 x i32>
468 define <4 x i32> @ShuffleVector(<4 x i32> %vec, <4 x i32> %vec1) sanitize_memory {
469 %vec2 = shufflevector <4 x i32> %vec, <4 x i32> %vec1,
470 <4 x i32> <i32 0, i32 4, i32 1, i32 5>
474 ; CHECK: @ShuffleVector
475 ; CHECK: shufflevector
476 ; CHECK-NOT: call void @__msan_warning
477 ; CHECK: shufflevector
478 ; CHECK: ret <4 x i32>
481 ; Test bswap intrinsic instrumentation
482 define i32 @BSwap(i32 %x) nounwind uwtable readnone sanitize_memory {
483 %y = tail call i32 @llvm.bswap.i32(i32 %x)
487 declare i32 @llvm.bswap.i32(i32) nounwind readnone
490 ; CHECK-NOT: call void @__msan_warning
491 ; CHECK: @llvm.bswap.i32
492 ; CHECK-NOT: call void @__msan_warning
493 ; CHECK: @llvm.bswap.i32
494 ; CHECK-NOT: call void @__msan_warning
500 define void @StoreIntrinsic(i8* %p, <4 x float> %x) nounwind uwtable sanitize_memory {
501 call void @llvm.x86.sse.storeu.ps(i8* %p, <4 x float> %x)
505 declare void @llvm.x86.sse.storeu.ps(i8*, <4 x float>) nounwind
507 ; CHECK: @StoreIntrinsic
510 ; CHECK: store <4 x i32> {{.*}} align 1
511 ; CHECK: call void @llvm.x86.sse.storeu.ps
517 define <16 x i8> @LoadIntrinsic(i8* %p) nounwind uwtable sanitize_memory {
518 %call = call <16 x i8> @llvm.x86.sse3.ldu.dq(i8* %p)
522 declare <16 x i8> @llvm.x86.sse3.ldu.dq(i8* %p) nounwind
524 ; CHECK: @LoadIntrinsic
525 ; CHECK: load <16 x i8>* {{.*}} align 1
528 ; CHECK: call <16 x i8> @llvm.x86.sse3.ldu.dq
529 ; CHECK: store <16 x i8> {{.*}} @__msan_retval_tls
530 ; CHECK: ret <16 x i8>
532 ; CHECK-ORIGINS: @LoadIntrinsic
533 ; CHECK-ORIGINS: [[ORIGIN:%[01-9a-z]+]] = load i32* {{.*}}
534 ; CHECK-ORIGINS: call <16 x i8> @llvm.x86.sse3.ldu.dq
535 ; CHECK-ORIGINS: store i32 {{.*}}[[ORIGIN]], i32* @__msan_retval_origin_tls
536 ; CHECK-ORIGINS: ret <16 x i8>
539 ; Simple NoMem intrinsic
540 ; Check that shadow is OR'ed, and origin is Select'ed
541 ; And no shadow checks!
543 define <8 x i16> @Paddsw128(<8 x i16> %a, <8 x i16> %b) nounwind uwtable sanitize_memory {
544 %call = call <8 x i16> @llvm.x86.sse2.padds.w(<8 x i16> %a, <8 x i16> %b)
548 declare <8 x i16> @llvm.x86.sse2.padds.w(<8 x i16> %a, <8 x i16> %b) nounwind
551 ; CHECK-NEXT: load <8 x i16>* {{.*}} @__msan_param_tls
552 ; CHECK-NEXT: load <8 x i16>* {{.*}} @__msan_param_tls
553 ; CHECK-NEXT: = or <8 x i16>
554 ; CHECK-NEXT: call <8 x i16> @llvm.x86.sse2.padds.w
555 ; CHECK-NEXT: store <8 x i16> {{.*}} @__msan_retval_tls
556 ; CHECK-NEXT: ret <8 x i16>
558 ; CHECK-ORIGINS: @Paddsw128
559 ; CHECK-ORIGINS: load i32* {{.*}} @__msan_param_origin_tls
560 ; CHECK-ORIGINS: load i32* {{.*}} @__msan_param_origin_tls
561 ; CHECK-ORIGINS: = bitcast <8 x i16> {{.*}} to i128
562 ; CHECK-ORIGINS-NEXT: = icmp ne i128 {{.*}}, 0
563 ; CHECK-ORIGINS-NEXT: = select i1 {{.*}}, i32 {{.*}}, i32
564 ; CHECK-ORIGINS: call <8 x i16> @llvm.x86.sse2.padds.w
565 ; CHECK-ORIGINS: store i32 {{.*}} @__msan_retval_origin_tls
566 ; CHECK-ORIGINS: ret <8 x i16>
569 ; Test handling of vectors of pointers.
570 ; Check that shadow of such vector is a vector of integers.
572 define <8 x i8*> @VectorOfPointers(<8 x i8*>* %p) nounwind uwtable sanitize_memory {
573 %x = load <8 x i8*>* %p
577 ; CHECK: @VectorOfPointers
578 ; CHECK: load <8 x i64>*
579 ; CHECK: load <8 x i8*>*
580 ; CHECK: store <8 x i64> {{.*}} @__msan_retval_tls
581 ; CHECK: ret <8 x i8*>
583 ; Test handling of va_copy.
585 declare void @llvm.va_copy(i8*, i8*) nounwind
587 define void @VACopy(i8* %p1, i8* %p2) nounwind uwtable sanitize_memory {
588 call void @llvm.va_copy(i8* %p1, i8* %p2) nounwind
593 ; CHECK: call void @llvm.memset.p0i8.i64({{.*}}, i8 0, i64 24, i32 8, i1 false)
597 ; Test handling of volatile stores.
598 ; Check that MemorySanitizer does not add a check of the value being stored.
600 define void @VolatileStore(i32* nocapture %p, i32 %x) nounwind uwtable sanitize_memory {
602 store volatile i32 %x, i32* %p, align 4
606 ; CHECK: @VolatileStore
607 ; CHECK-NOT: @__msan_warning
611 ; Test that checks are omitted but shadow propagation is kept if
612 ; sanitize_memory attribute is missing.
614 define i32 @NoSanitizeMemory(i32 %x) uwtable {
616 %tobool = icmp eq i32 %x, 0
617 br i1 %tobool, label %if.end, label %if.then
619 if.then: ; preds = %entry
620 tail call void @bar()
623 if.end: ; preds = %entry, %if.then
629 ; CHECK: @NoSanitizeMemory
630 ; CHECK-NOT: @__msan_warning
631 ; CHECK: load i32* {{.*}} @__msan_param_tls
632 ; CHECK-NOT: @__msan_warning
633 ; CHECK: store {{.*}} @__msan_retval_tls
634 ; CHECK-NOT: @__msan_warning