Skip to content

🍒 [BoundsSafety][CodeGen] don't create invalid conditional branches #13588

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
hnrklssn merged 1 commit into from
Jul 31, 2026
+133 −5
Merged

🍒 [BoundsSafety][CodeGen] don't create invalid conditional branches #13588

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions clang/lib/CodeGen/CGExprAgg.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -516,7 +516,7 @@ VisitBoundsSafetyPointerPromotionExpr(BoundsSafetyPointerPromotionExpr *E) {
Ptr = CGF.GetWidePointerElement(PtrRV.getAggregateAddress(), WPIndex::Pointer);
}

llvm::BranchInst *NullCheckBranch = nullptr;
llvm::BasicBlock *NullBlock = nullptr;
if (E->getNullCheck()) {
// Test that the pointer is not NULL before testing that it's in bounds,
// if AcceptNullPtr is specified.
Expand All @@ -525,7 +525,8 @@ VisitBoundsSafetyPointerPromotionExpr(BoundsSafetyPointerPromotionExpr *E) {

llvm::Value *Null = llvm::Constant::getNullValue(Ptr->getType());
llvm::Value *PtrIsNull = Builder.CreateICmpNE(Ptr, Null);
NullCheckBranch = Builder.CreateCondBr(PtrIsNull, NotNull, nullptr);
NullBlock = CGF.createBasicBlock("boundscheck.null");
Builder.CreateCondBr(PtrIsNull, NotNull, NullBlock);
CGF.EmitBlock(NotNull);
}

Expand Down Expand Up @@ -573,12 +574,10 @@ VisitBoundsSafetyPointerPromotionExpr(BoundsSafetyPointerPromotionExpr *E) {
// fill result with null
// br cont
// cont:
if (NullCheckBranch) {
if (NullBlock) {
llvm::BasicBlock *ContBlock = CGF.createBasicBlock("boundscheck.cont");
Builder.CreateBr(ContBlock);

llvm::BasicBlock *NullBlock = CGF.createBasicBlock("boundscheck.null");
NullCheckBranch->setSuccessor(1, NullBlock);
CGF.EmitBlock(NullBlock);
llvm::Value *Zero = llvm::Constant::getNullValue(Ptr->getType());
EmitWidePointerToDest(E->getType(), Zero, Zero, Zero, Callback);
Expand Down
74 changes: 74 additions & 0 deletions clang/test/BoundsSafety/CodeGen/loop-counted_by_or_null-O0.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,74 @@
// NOTE: Assertions have been autogenerated by utils/update_cc_test_checks.py UTC_ARGS: --version 6
// REQUIRES: system-darwin

// RUN: %clang_cc1 -O0 -triple arm64-apple-iphoneos -emit-llvm -fbounds-safety -o - %s | FileCheck %s

// Exercise the null check path inside a loop. This used to crash the compiler.

#include <ptrcheck.h>

void use(int *__bidi_indexable q);

// CHECK-LABEL: define dso_local void @f(
// CHECK-SAME: ptr noundef [[P:%.*]], i32 noundef [[LEN:%.*]]) #[[ATTR0:[0-9]+]] {
// CHECK-NEXT: [[ENTRY:.*:]]
// CHECK-NEXT: [[P_ADDR:%.*]] = alloca ptr, align 8
// CHECK-NEXT: [[LEN_ADDR:%.*]] = alloca i32, align 4
// CHECK-NEXT: [[I:%.*]] = alloca i32, align 4
// CHECK-NEXT: [[Q:%.*]] = alloca %"__bounds_safety::wide_ptr.bidi_indexable", align 8
// CHECK-NEXT: [[BYVAL_TEMP:%.*]] = alloca %"__bounds_safety::wide_ptr.bidi_indexable", align 8
// CHECK-NEXT: store ptr [[P]], ptr [[P_ADDR]], align 8
// CHECK-NEXT: store i32 [[LEN]], ptr [[LEN_ADDR]], align 4
// CHECK-NEXT: store i32 0, ptr [[I]], align 4
// CHECK-NEXT: br label %[[FOR_COND:.*]]
// CHECK: [[FOR_COND]]:
// CHECK-NEXT: [[TMP0:%.*]] = load i32, ptr [[I]], align 4
// CHECK-NEXT: [[TMP1:%.*]] = load i32, ptr [[LEN_ADDR]], align 4
// CHECK-NEXT: [[CMP:%.*]] = icmp slt i32 [[TMP0]], [[TMP1]]
// CHECK-NEXT: br i1 [[CMP]], label %[[FOR_BODY:.*]], label %[[FOR_END:.*]]
// CHECK: [[FOR_BODY]]:
// CHECK-NEXT: [[TMP2:%.*]] = load ptr, ptr [[P_ADDR]], align 8
// CHECK-NEXT: [[TMP3:%.*]] = load i32, ptr [[LEN_ADDR]], align 4
// CHECK-NEXT: [[TMP4:%.*]] = icmp ne ptr [[TMP2]], null, !annotation [[META4:![0-9]+]]
// CHECK-NEXT: br i1 [[TMP4]], label %[[BOUNDSCHECK_NOTNULL:.*]], label %[[BOUNDSCHECK_NULL:.*]], !annotation [[META4]]
// CHECK: [[BOUNDSCHECK_NOTNULL]]:
// CHECK-NEXT: [[IDX_EXT:%.*]] = sext i32 [[TMP3]] to i64
// CHECK-NEXT: [[ADD_PTR:%.*]] = getelementptr inbounds i32, ptr [[TMP2]], i64 [[IDX_EXT]]
// CHECK-NEXT: [[TMP5:%.*]] = getelementptr inbounds nuw %"__bounds_safety::wide_ptr.bidi_indexable", ptr [[Q]], i32 0, i32 0
// CHECK-NEXT: store ptr [[TMP2]], ptr [[TMP5]], align 8
// CHECK-NEXT: [[TMP6:%.*]] = getelementptr inbounds nuw %"__bounds_safety::wide_ptr.bidi_indexable", ptr [[Q]], i32 0, i32 1
// CHECK-NEXT: store ptr [[ADD_PTR]], ptr [[TMP6]], align 8
// CHECK-NEXT: [[TMP7:%.*]] = getelementptr inbounds nuw %"__bounds_safety::wide_ptr.bidi_indexable", ptr [[Q]], i32 0, i32 2
// CHECK-NEXT: store ptr [[TMP2]], ptr [[TMP7]], align 8
// CHECK-NEXT: br label %[[BOUNDSCHECK_CONT:.*]]
// CHECK: [[BOUNDSCHECK_NULL]]:
// CHECK-NEXT: [[TMP8:%.*]] = getelementptr inbounds nuw %"__bounds_safety::wide_ptr.bidi_indexable", ptr [[Q]], i32 0, i32 0
// CHECK-NEXT: store ptr null, ptr [[TMP8]], align 8
// CHECK-NEXT: [[TMP9:%.*]] = getelementptr inbounds nuw %"__bounds_safety::wide_ptr.bidi_indexable", ptr [[Q]], i32 0, i32 1
// CHECK-NEXT: store ptr null, ptr [[TMP9]], align 8
// CHECK-NEXT: [[TMP10:%.*]] = getelementptr inbounds nuw %"__bounds_safety::wide_ptr.bidi_indexable", ptr [[Q]], i32 0, i32 2
// CHECK-NEXT: store ptr null, ptr [[TMP10]], align 8
// CHECK-NEXT: br label %[[BOUNDSCHECK_CONT]]
// CHECK: [[BOUNDSCHECK_CONT]]:
// CHECK-NEXT: call void @llvm.memcpy.p0.p0.i64(ptr align 8 [[BYVAL_TEMP]], ptr align 8 [[Q]], i64 24, i1 false)
// CHECK-NEXT: call void @use(ptr noundef align 8 dead_on_return [[BYVAL_TEMP]])
// CHECK-NEXT: br label %[[FOR_INC:.*]]
// CHECK: [[FOR_INC]]:
// CHECK-NEXT: [[TMP11:%.*]] = load i32, ptr [[I]], align 4
// CHECK-NEXT: [[INC:%.*]] = add nsw i32 [[TMP11]], 1
// CHECK-NEXT: store i32 [[INC]], ptr [[I]], align 4
// CHECK-NEXT: br label %[[FOR_COND]], !llvm.loop [[LOOP5:![0-9]+]]
// CHECK: [[FOR_END]]:
// CHECK-NEXT: ret void
//
void f(int *__counted_by_or_null(len) p, int len) {
for (int i = 0; i < len; ++i) {
int *__bidi_indexable q = p;
use(q);
}
}
//.
// CHECK: [[META4]] = !{!"bounds-safety-check-ptr-neq-null"}
// CHECK: [[LOOP5]] = distinct !{[[LOOP5]], [[META6:![0-9]+]]}
// CHECK: [[META6]] = !{!"llvm.loop.mustprogress"}
//.
55 changes: 55 additions & 0 deletions clang/test/BoundsSafety/CodeGen/loop-counted_by_or_null-O2.c
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,55 @@
// NOTE: Assertions have been autogenerated by utils/update_cc_test_checks.py UTC_ARGS: --version 6
// REQUIRES: system-darwin

// RUN: %clang_cc1 -O2 -triple arm64-apple-iphoneos -emit-llvm -fbounds-safety -o - %s | FileCheck %s

// Exercise the null check path inside a loop. This used to crash the compiler.

#include <ptrcheck.h>

void use(int *__bidi_indexable q);

// CHECK-LABEL: define dso_local void @f(
// CHECK-SAME: ptr noundef [[P:%.*]], i32 noundef [[LEN:%.*]]) local_unnamed_addr #[[ATTR0:[0-9]+]] {
// CHECK-NEXT: [[ENTRY:.*:]]
// CHECK-NEXT: [[BYVAL_TEMP:%.*]] = alloca %"__bounds_safety::wide_ptr.bidi_indexable", align 8
// CHECK-NEXT: [[CMP3:%.*]] = icmp sgt i32 [[LEN]], 0
// CHECK-NEXT: br i1 [[CMP3]], label %[[FOR_BODY_LR_PH:.*]], label %[[FOR_COND_CLEANUP:.*]]
// CHECK: [[FOR_BODY_LR_PH]]:
// CHECK-NEXT: [[DOTNOT:%.*]] = icmp eq ptr [[P]], null, !annotation [[META9:![0-9]+]]
// CHECK-NEXT: [[IDX_EXT:%.*]] = zext nneg i32 [[LEN]] to i64
// CHECK-NEXT: [[ADD_PTR:%.*]] = getelementptr inbounds nuw [4 x i8], ptr [[P]], i64 [[IDX_EXT]]
// CHECK-NEXT: [[Q_SROA_5_0:%.*]] = select i1 [[DOTNOT]], ptr null, ptr [[ADD_PTR]]
// CHECK-NEXT: [[Q_SROA_5_0_BYVAL_TEMP_SROA_IDX:%.*]] = getelementptr inbounds nuw i8, ptr [[BYVAL_TEMP]], i64 8
// CHECK-NEXT: [[Q_SROA_7_0_BYVAL_TEMP_SROA_IDX:%.*]] = getelementptr inbounds nuw i8, ptr [[BYVAL_TEMP]], i64 16
// CHECK-NEXT: br label %[[FOR_BODY:.*]]
// CHECK: [[FOR_COND_CLEANUP]]:
// CHECK-NEXT: ret void
// CHECK: [[FOR_BODY]]:
// CHECK-NEXT: [[I_04:%.*]] = phi i32 [ 0, %[[FOR_BODY_LR_PH]] ], [ [[INC:%.*]], %[[FOR_BODY]] ]
// CHECK-NEXT: call void @llvm.lifetime.start.p0(ptr nonnull [[BYVAL_TEMP]]) #[[ATTR3:[0-9]+]]
// CHECK-NEXT: store ptr [[P]], ptr [[BYVAL_TEMP]], align 8
// CHECK-NEXT: store ptr [[Q_SROA_5_0]], ptr [[Q_SROA_5_0_BYVAL_TEMP_SROA_IDX]], align 8
// CHECK-NEXT: store ptr [[P]], ptr [[Q_SROA_7_0_BYVAL_TEMP_SROA_IDX]], align 8, !tbaa [[INTPTR_TBAA10:![0-9]+]]
// CHECK-NEXT: call void @use(ptr noundef nonnull align 8 dead_on_return [[BYVAL_TEMP]]) #[[ATTR3]]
// CHECK-NEXT: call void @llvm.lifetime.end.p0(ptr nonnull [[BYVAL_TEMP]]) #[[ATTR3]]
// CHECK-NEXT: [[INC]] = add nuw nsw i32 [[I_04]], 1
// CHECK-NEXT: [[EXITCOND_NOT:%.*]] = icmp eq i32 [[INC]], [[LEN]]
// CHECK-NEXT: br i1 [[EXITCOND_NOT]], label %[[FOR_COND_CLEANUP]], label %[[FOR_BODY]], !llvm.loop [[LOOP13:![0-9]+]]
//
void f(int *__counted_by_or_null(len) p, int len) {
for (int i = 0; i < len; ++i) {
int *__bidi_indexable q = p;
use(q);
}
}
//.
// CHECK: [[META7:![0-9]+]] = !{!"omnipotent char", [[META8:![0-9]+]], i64 0}
// CHECK: [[META8]] = !{!"Simple C/C++ TBAA"}
// CHECK: [[META9]] = !{!"bounds-safety-check-ptr-neq-null"}
// CHECK: [[INTPTR_TBAA10]] = !{[[META11:![0-9]+]], [[META11]], i64 0}
// CHECK: [[META11]] = !{!"p1 int", [[META12:![0-9]+]], i64 0}
// CHECK: [[META12]] = !{!"any pointer", [[META7]], i64 0}
// CHECK: [[LOOP13]] = distinct !{[[LOOP13]], [[META14:![0-9]+]]}
// CHECK: [[META14]] = !{!"llvm.loop.mustprogress"}
//.