https://github.com/AdamMagierFOSS created
https://github.com/llvm/llvm-project/pull/223446
Since 052dde9c3a62 ("[SCEV] Do not represent ptrtoint as ptrtoaddr") SCEV
treats the check's ptrtoint as opaque, so IndVarSimplify no longer infers nuw
on the reconstructed address and InstCombine no longer folds the comparison.
Provably safe checks now survive to run time.
ptrtoaddr is correct here: the address is only compared against the recomputed
one and passed to the handler, and is dead otherwise. This is unlike the
pointer subtraction in d7594bf4caa5 (reverted in fcd814ae4357), whose result is
a user-visible value that can be used to reconstruct a pointer, e.g. via
-(nullptr - ptr).
The result type becomes DL.getAddressType(), so the offset arithmetic is done
in the address width rather than the pointer width. They coincide in every
address space the check is emitted in on in-tree targets, and where they do not
the diagnostics are unaffected: EmitCheckValue zero-extends a narrower argument
to IntPtrTy before the handler call.
Assisted-by: Kiro CLI / Claude Opus 5
>From bda987f26879f3b9f2a954f102ac5826c613166b Mon Sep 17 00:00:00 2001
From: Adam Magier <[email protected]>
Date: Fri, 4 Sep 2026 22:06:48 +0200
Subject: [PATCH] [clang][CodeGen] Use ptrtoaddr for the pointer-overflow check
Since 052dde9c3a62 ("[SCEV] Do not represent ptrtoint as ptrtoaddr")
SCEV treats the check's ptrtoint as opaque, so IndVarSimplify no longer
infers nuw on the reconstructed address and InstCombine no longer folds
the comparison. Provably safe checks now survive to run time.
ptrtoaddr is correct here: the address is only compared against the
recomputed one and passed to the handler, and is dead otherwise. This
is unlike the pointer subtraction in d7594bf4caa5 (reverted in
fcd814ae4357), whose result is a user-visible value that can be used
to reconstruct a pointer, e.g. via -(nullptr - ptr).
The result type becomes DL.getAddressType(), so the offset arithmetic
is done in the address width rather than the pointer width. They
coincide in every address space the check is emitted in on in-tree
targets, and where they do not the diagnostics are unaffected:
EmitCheckValue zero-extends a narrower argument to IntPtrTy before
the handler call.
Assisted-by: Kiro CLI / Claude Opus 5
---
clang/lib/CodeGen/CGExprScalar.cpp | 12 +++++-------
...-and-nonzero-offset-when-nullptr-is-defined.c | 2 +-
.../CodeGen/catch-nullptr-and-nonzero-offset.c | 8 ++++----
.../CodeGen/catch-pointer-overflow-volatile.c | 2 +-
clang/test/CodeGen/catch-pointer-overflow.c | 16 ++++++++--------
clang/test/CodeGen/ubsan-pointer-overflow.c | 4 ++--
6 files changed, 21 insertions(+), 23 deletions(-)
diff --git a/clang/lib/CodeGen/CGExprScalar.cpp
b/clang/lib/CodeGen/CGExprScalar.cpp
index d264f4fb28bd6..eaeb2c0d820bc 100644
--- a/clang/lib/CodeGen/CGExprScalar.cpp
+++ b/clang/lib/CodeGen/CGExprScalar.cpp
@@ -6378,10 +6378,8 @@ static GEPOffsetAndOverflow EmitGEPOffsetInBytes(Value
*BasePtr, Value *GEPVal,
if (isa<llvm::Constant>(GEPVal)) {
// Compute the offset by casting both pointers to integers and subtracting:
// GEPVal = BasePtr + ptr(Offset) <--> Offset = int(GEPVal) - int(BasePtr)
- Value *BasePtr_int =
- Builder.CreatePtrToInt(BasePtr, DL.getIntPtrType(BasePtr->getType()));
- Value *GEPVal_int =
- Builder.CreatePtrToInt(GEPVal, DL.getIntPtrType(GEPVal->getType()));
+ Value *BasePtr_int = Builder.CreatePtrToAddr(BasePtr);
+ Value *GEPVal_int = Builder.CreatePtrToAddr(GEPVal);
TotalOffset = Builder.CreateSub(GEPVal_int, BasePtr_int);
return {TotalOffset, /*OffsetOverflows=*/Builder.getFalse()};
}
@@ -6391,7 +6389,7 @@ static GEPOffsetAndOverflow EmitGEPOffsetInBytes(Value
*BasePtr, Value *GEPVal,
"BasePtr must be the base of the GEP.");
assert(GEP->isInBounds() && "Expected inbounds GEP");
- auto *IntPtrTy = DL.getIntPtrType(GEP->getPointerOperandType());
+ auto *IntPtrTy = DL.getAddressType(GEP->getPointerOperandType());
// Grab references to the signed add/mul overflow intrinsics for intptr_t.
auto *Zero = llvm::ConstantInt::getNullValue(IntPtrTy);
@@ -6493,7 +6491,7 @@ CodeGenFunction::EmitCheckedInBoundsGEP(llvm::Type
*ElemTy, Value *Ptr,
auto CheckOrdinal = SanitizerKind::SO_PointerOverflow;
auto CheckHandler = SanitizerHandler::PointerOverflow;
SanitizerDebugLocation SanScope(this, {CheckOrdinal}, CheckHandler);
- llvm::Type *IntPtrTy = DL.getIntPtrType(PtrTy);
+ llvm::Type *IntPtrTy = DL.getAddressType(PtrTy);
GEPOffsetAndOverflow EvaluatedGEP =
EmitGEPOffsetInBytes(Ptr, GEPVal, getLLVMContext(), CGM, Builder);
@@ -6508,7 +6506,7 @@ CodeGenFunction::EmitCheckedInBoundsGEP(llvm::Type
*ElemTy, Value *Ptr,
// Now that we've computed the total offset, add it to the base pointer (with
// wrapping semantics).
- auto *IntPtr = Builder.CreatePtrToInt(Ptr, IntPtrTy);
+ auto *IntPtr = Builder.CreatePtrToAddr(Ptr);
auto *ComputedGEP = Builder.CreateAdd(IntPtr, EvaluatedGEP.TotalOffset);
llvm::SmallVector<std::pair<llvm::Value *, SanitizerKind::SanitizerOrdinal>,
diff --git
a/clang/test/CodeGen/catch-nullptr-and-nonzero-offset-when-nullptr-is-defined.c
b/clang/test/CodeGen/catch-nullptr-and-nonzero-offset-when-nullptr-is-defined.c
index 00198b4faf8bc..86c0629932289 100644
---
a/clang/test/CodeGen/catch-nullptr-and-nonzero-offset-when-nullptr-is-defined.c
+++
b/clang/test/CodeGen/catch-nullptr-and-nonzero-offset-when-nullptr-is-defined.c
@@ -38,7 +38,7 @@ char *add_unsigned(char *base, unsigned long offset) {
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET_OVERFLOWED:.*]] =
extractvalue { i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[OR_OV:.+]] = or i1
%[[COMPUTED_OFFSET_OVERFLOWED]], false, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET:.*]] = extractvalue
{ i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 0, !nosanitize
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], %[[COMPUTED_OFFSET]], !nosanitize
// CHECK-SANITIZE-NULLNOTOK-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NULLNOTOK-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
diff --git a/clang/test/CodeGen/catch-nullptr-and-nonzero-offset.c
b/clang/test/CodeGen/catch-nullptr-and-nonzero-offset.c
index fcde72badffd5..7a9f55f1153b8 100644
--- a/clang/test/CodeGen/catch-nullptr-and-nonzero-offset.c
+++ b/clang/test/CodeGen/catch-nullptr-and-nonzero-offset.c
@@ -46,7 +46,7 @@ char *var_var(char *base, unsigned long offset) {
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET_OVERFLOWED:.*]] =
extractvalue { i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[OR_OV:.+]] = or i1
%[[COMPUTED_OFFSET_OVERFLOWED]], false, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET:.*]] = extractvalue
{ i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 0, !nosanitize
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], %[[COMPUTED_OFFSET]], !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -87,7 +87,7 @@ char *var_one(char *base) {
// CHECK-NEXT: store ptr %[[BASE]], ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[BASE_RELOADED:.*]] = load ptr, ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[ADD_PTR:.*]] = getelementptr
inbounds nuw i8, ptr %[[BASE_RELOADED]], i64 1
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -115,7 +115,7 @@ char *var_allones(char *base) {
// CHECK-NEXT: store ptr %[[BASE]], ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[BASE_RELOADED:.*]] = load ptr, ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[ADD_PTR:.*]] = getelementptr
inbounds nuw i8, ptr %[[BASE_RELOADED]], i64 -1
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], -1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -235,7 +235,7 @@ char *void_ptr(void *base, unsigned long offset) {
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET_OVERFLOWED:.*]] =
extractvalue { i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[OR_OV:.+]] = or i1
%[[COMPUTED_OFFSET_OVERFLOWED]], false, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET:.*]] = extractvalue
{ i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 0, !nosanitize
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], %[[COMPUTED_OFFSET]], !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
diff --git a/clang/test/CodeGen/catch-pointer-overflow-volatile.c
b/clang/test/CodeGen/catch-pointer-overflow-volatile.c
index 48a2ba360a4d3..b9817794bd3e5 100644
--- a/clang/test/CodeGen/catch-pointer-overflow-volatile.c
+++ b/clang/test/CodeGen/catch-pointer-overflow-volatile.c
@@ -28,7 +28,7 @@ char *volatile_ptr(char *volatile base, unsigned long offset)
{
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET_OVERFLOWED:.*]] =
extractvalue { i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[OR_OV:.+]] = or i1
%[[COMPUTED_OFFSET_OVERFLOWED]], false, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET:.*]] = extractvalue
{ i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 0, !nosanitize
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], %[[COMPUTED_OFFSET]], !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
diff --git a/clang/test/CodeGen/catch-pointer-overflow.c
b/clang/test/CodeGen/catch-pointer-overflow.c
index 4442994bfaae6..1994fee45e54d 100644
--- a/clang/test/CodeGen/catch-pointer-overflow.c
+++ b/clang/test/CodeGen/catch-pointer-overflow.c
@@ -35,7 +35,7 @@ char *add_unsigned(char *base, unsigned long offset) {
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET_OVERFLOWED:.*]] =
extractvalue { i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[OR_OV:.+]] = or i1
%[[COMPUTED_OFFSET_OVERFLOWED]], false, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET:.*]] = extractvalue
{ i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 0, !nosanitize
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], %[[COMPUTED_OFFSET]], !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -71,7 +71,7 @@ char *sub_unsigned(char *base, unsigned long offset) {
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET_OVERFLOWED:.*]] =
extractvalue { i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[OR_OV:.+]] = or i1
%[[COMPUTED_OFFSET_OVERFLOWED]], false, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET:.*]] = extractvalue
{ i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 0, !nosanitize
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], %[[COMPUTED_OFFSET]], !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -106,7 +106,7 @@ char *add_signed(char *base, signed long offset) {
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET_OVERFLOWED:.*]] =
extractvalue { i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[OR_OV:.+]] = or i1
%[[COMPUTED_OFFSET_OVERFLOWED]], false, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET:.*]] = extractvalue
{ i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 0, !nosanitize
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], %[[COMPUTED_OFFSET]], !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -145,7 +145,7 @@ char *sub_signed(char *base, signed long offset) {
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET_OVERFLOWED:.*]] =
extractvalue { i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[OR_OV:.+]] = or i1
%[[COMPUTED_OFFSET_OVERFLOWED]], false, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_OFFSET:.*]] = extractvalue
{ i64, i1 } %[[COMPUTED_OFFSET_AGGREGATE]], 0, !nosanitize
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], %[[COMPUTED_OFFSET]], !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -176,7 +176,7 @@ char *postinc(char *base) {
// CHECK-NEXT: store ptr %[[BASE]], ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[BASE_RELOADED:.*]] = load ptr, ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[ADD_PTR:.*]] = getelementptr
inbounds nuw i8, ptr %[[BASE_RELOADED]], i32 1
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -206,7 +206,7 @@ char *postdec(char *base) {
// CHECK-NEXT: store ptr %[[BASE]], ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[BASE_RELOADED:.*]] = load ptr, ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[ADD_PTR:.*]] = getelementptr
inbounds i8, ptr %[[BASE_RELOADED]], i32 -1
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], -1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -236,7 +236,7 @@ char *preinc(char *base) {
// CHECK-NEXT: store ptr %[[BASE]], ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[BASE_RELOADED:.*]] = load ptr, ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[ADD_PTR:.*]] = getelementptr
inbounds nuw i8, ptr %[[BASE_RELOADED]], i32 1
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], 1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
@@ -266,7 +266,7 @@ char *predec(char *base) {
// CHECK-NEXT: store ptr %[[BASE]], ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[BASE_RELOADED:.*]] = load ptr, ptr
%[[BASE_ADDR]], align 8
// CHECK-NEXT: %[[ADD_PTR:.*]] = getelementptr
inbounds i8, ptr %[[BASE_RELOADED]], i32 -1
- // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoint
ptr %[[BASE_RELOADED]] to i64, !nosanitize
+ // CHECK-SANITIZE-NEXT: %[[BASE_RELOADED_INT:.*]] = ptrtoaddr
ptr %[[BASE_RELOADED]] to i64, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP:.*]] = add i64
%[[BASE_RELOADED_INT]], -1, !nosanitize
// CHECK-SANITIZE-NEXT: %[[BASE_IS_NOT_NULLPTR:.*]] = icmp ne
ptr %[[BASE_RELOADED]], null, !nosanitize
// CHECK-SANITIZE-NEXT: %[[COMPUTED_GEP_IS_NOT_NULL:.*]] =
icmp ne i64 %[[COMPUTED_GEP]], 0, !nosanitize
diff --git a/clang/test/CodeGen/ubsan-pointer-overflow.c
b/clang/test/CodeGen/ubsan-pointer-overflow.c
index fd5b236504b16..b5a02703f9764 100644
--- a/clang/test/CodeGen/ubsan-pointer-overflow.c
+++ b/clang/test/CodeGen/ubsan-pointer-overflow.c
@@ -12,7 +12,7 @@ void fixed_len_array(int k) {
// CHECK-NEXT: [[SMULOFLOW:%.*]] = extractvalue { i64, i1 } [[SMUL]], 1,
!nosanitize
// CHECK-NEXT: [[OR:%.+]] = or i1 [[SMULOFLOW]], false, !nosanitize
// CHECK-NEXT: [[SMULVAL:%.*]] = extractvalue { i64, i1 } [[SMUL]], 0,
!nosanitize
- // CHECK-NEXT: [[BASE:%.*]] = ptrtoint ptr [[ARR]] to i64, !nosanitize
+ // CHECK-NEXT: [[BASE:%.*]] = ptrtoaddr ptr [[ARR]] to i64, !nosanitize
// CHECK-NEXT: [[COMPGEP:%.*]] = add i64 [[BASE]], [[SMULVAL]], !nosanitize
// CHECK: call void @__ubsan_handle_pointer_overflow{{.*}}, i64 [[BASE]],
i64 [[COMPGEP]]){{.*}}, !nosanitize
@@ -84,7 +84,7 @@ struct S1 {
// CHECK-LABEL: define{{.*}} void @struct_index
void struct_index(struct S1 *p) {
// CHECK: getelementptr inbounds %struct.S1, ptr [[P:%.*]], i64 10
- // CHECK-NEXT: [[BASE:%.*]] = ptrtoint ptr [[P]] to i64, !nosanitize
+ // CHECK-NEXT: [[BASE:%.*]] = ptrtoaddr ptr [[P]] to i64, !nosanitize
// CHECK-NEXT: [[COMPGEP:%.*]] = add i64 [[BASE]], 240, !nosanitize
// CHECK: select
// CHECK: @__ubsan_handle_pointer_overflow{{.*}} i64 [[BASE]], i64
[[COMPGEP]]) {{.*}}, !nosanitize
_______________________________________________
cfe-commits mailing list
[email protected]
https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
