https://github.com/henrimarconni updated https://github.com/llvm/llvm-project/pull/232570
>From bbd741c9ffb70d535a6269e5d78aa9dc47a684fa Mon Sep 17 00:00:00 2001 From: henrimarconni <[email protected]> Date: Fri, 16 Oct 2026 07:32:35 +0530 Subject: [PATCH] [clang][CodeGen] Fix assertion for new T[SIZE_MAX] with array cookie [clang][CodeGen] Add test for new[] size overflow with array cookie --- clang/lib/CodeGen/CGExprCXX.cpp | 8 ++++++-- .../test/CodeGenCXX/new-array-cookie-overflow.cpp | 15 +++++++++++++++ 2 files changed, 21 insertions(+), 2 deletions(-) create mode 100644 clang/test/CodeGenCXX/new-array-cookie-overflow.cpp diff --git a/clang/lib/CodeGen/CGExprCXX.cpp b/clang/lib/CodeGen/CGExprCXX.cpp index 8279611accba3..b55bb578d4fdd 100644 --- a/clang/lib/CodeGen/CGExprCXX.cpp +++ b/clang/lib/CodeGen/CGExprCXX.cpp @@ -1789,8 +1789,12 @@ llvm::Value *CodeGenFunction::EmitCXXNewExpr(const CXXNewExpr *E) { cleanupDominator = Builder.CreateUnreachable(); } - assert((allocSize == allocSizeWithoutCookie) == - CalculateCookiePadding(*this, E).isZero()); + // Without a cookie the two sizes must match. With a cookie they usually + // differ, but on overflow the allocation size is all-ones, which can + // coincide with the size without the cookie. + assert(allocSize == llvm::Constant::getAllOnesValue(SizeTy) || + ((allocSize == allocSizeWithoutCookie) == + CalculateCookiePadding(*this, E).isZero())); if (allocSize != allocSizeWithoutCookie) { assert(E->isArray()); allocation = CGM.getCXXABI().InitializeArrayCookie( diff --git a/clang/test/CodeGenCXX/new-array-cookie-overflow.cpp b/clang/test/CodeGenCXX/new-array-cookie-overflow.cpp new file mode 100644 index 0000000000000..690e2d046ceee --- /dev/null +++ b/clang/test/CodeGenCXX/new-array-cookie-overflow.cpp @@ -0,0 +1,15 @@ +// RUN: %clang_cc1 -triple i386-unknown-linux-gnu -emit-llvm %s -o - | FileCheck %s + +// Regression test for https://github.com/llvm/llvm-project/issues/232250. +// With a 32-bit size_t, 'new S[0xFFFFFFFF]' has no multiplication overflow +// (sizeof(S) == 1), but adding the array cookie overflows. The allocation +// size becomes all-ones, which can coincide with the size without the cookie. +// This used to hit an assertion in EmitCXXNewExpr. + +struct S { + ~S(); +}; + +// CHECK-LABEL: define {{.*}} @_Z1fv( +// CHECK: call {{.*}} @_Znaj(i32 {{.*}}-1) +void f() { new S[0xFFFFFFFFu]; } _______________________________________________ cfe-commits mailing list [email protected] https://lists.llvm.org/cgi-bin/mailman/listinfo/cfe-commits
