Home | History | Annotate | Download | only in CodeGenCXX 
      1 // RUN: %clang_cc1 -std=c++11 -fsanitize=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,unreachable,return,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -fsanitize-recover=signed-integer-overflow,integer-divide-by-zero,float-divide-by-zero,shift-base,shift-exponent,vla-bound,alignment,null,vptr,object-size,float-cast-overflow,bool,enum,array-bounds,function -emit-llvm %s -o - -triple x86_64-linux-gnu | opt -instnamer -S | FileCheck %s
      2 // RUN: %clang_cc1 -std=c++11 -fsanitize=vptr,address -fsanitize-recover=vptr,address -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=CHECK-ASAN
      3 // RUN: %clang_cc1 -std=c++11 -fsanitize=vptr -fsanitize-recover=vptr -emit-llvm %s -o - -triple x86_64-linux-gnu | FileCheck %s --check-prefix=DOWNCAST-NULL
      4 // RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple x86_64-linux-gnux32 | FileCheck %s --check-prefix=CHECK-X32
      5 // RUN: %clang_cc1 -std=c++11 -fsanitize=function -emit-llvm %s -o - -triple i386-linux-gnu | FileCheck %s --check-prefix=CHECK-X86
      6 
      7 struct S {
      8   double d;
      9   int a, b;
     10   virtual int f();
     11 };
     12 
     13 // Check that type descriptor global is not modified by ASan.
     14 // CHECK-ASAN: [[TYPE_DESCR:@[0-9]+]] = private unnamed_addr constant { i16, i16, [4 x i8] } { i16 -1, i16 0, [4 x i8] c"'S'\00" }
     15 
     16 // Check that type mismatch handler is not modified by ASan.
     17 // CHECK-ASAN: private unnamed_addr global { { [{{.*}} x i8]*, i32, i32 }, { i16, i16, [4 x i8] }*, i8*, i8 } { {{.*}}, { i16, i16, [4 x i8] }* [[TYPE_DESCR]], {{.*}} }
     18 
     19 struct T : S {};
     20 
     21 // CHECK-LABEL: @_Z17reference_binding
     22 void reference_binding(int *p, S *q) {
     23   // C++ core issue 453: If an lvalue to which a reference is directly bound
     24   // designates neither an existing object or function of an appropriate type,
     25   // nor a region of storage of suitable size and alignment to contain an object
     26   // of the reference's type, the behavior is undefined.
     27 
     28   // CHECK: icmp ne {{.*}}, null
     29 
     30   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
     31   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
     32 
     33   // CHECK: %[[PTRINT:.*]] = ptrtoint
     34   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
     35   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
     36   int &r = *p;
     37 
     38   // A reference is not required to refer to an object within its lifetime.
     39   // CHECK-NOT: __ubsan_handle_dynamic_type_cache_miss
     40   S &r2 = *q;
     41 }
     42 
     43 // CHECK-LABEL: @_Z13member_access
     44 // CHECK-ASAN-LABEL: @_Z13member_access
     45 void member_access(S *p) {
     46   // (1a) Check 'p' is appropriately sized and aligned for member access.
     47 
     48   // CHECK: icmp ne {{.*}}, null
     49 
     50   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
     51   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
     52 
     53   // CHECK: %[[PTRINT:.*]] = ptrtoint
     54   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
     55   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
     56 
     57   // (1b) Check that 'p' actually points to an 'S'.
     58 
     59   // CHECK: %[[VPTRADDR:.*]] = bitcast {{.*}} to i64*
     60   // CHECK-NEXT: %[[VPTR:.*]] = load i64, i64* %[[VPTRADDR]]
     61   //
     62   // hash_16_bytes:
     63   //
     64   // If this number changes, it indicates that either the mangled name of ::S
     65   // has changed, or that LLVM's hashing function has changed. The latter case
     66   // is OK if the hashing function is still stable.
     67   //
     68   // The two hash values are for 64- and 32-bit Clang binaries, respectively.
     69   // FIXME: We should produce a 64-bit value either way.
     70   //
     71   // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}}, %[[VPTR]]
     72   // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
     73   // CHECK-NEXT: lshr i64 {{.*}}, 47
     74   // CHECK-NEXT: xor i64
     75   // CHECK-NEXT: xor i64 %[[VPTR]]
     76   // CHECK-NEXT: mul i64 {{.*}}, -7070675565921424023
     77   // CHECK-NEXT: lshr i64 {{.*}}, 47
     78   // CHECK-NEXT: xor i64
     79   // CHECK-NEXT: %[[HASH:.*]] = mul i64 {{.*}}, -7070675565921424023
     80   //
     81   // Check the hash against the table:
     82   //
     83   // CHECK-NEXT: %[[IDX:.*]] = and i64 %{{.*}}, 127
     84   // CHECK-NEXT: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %[[IDX]]
     85   // CHECK-NEXT: %[[CACHEVAL:.*]] = load i64, i64*
     86   // CHECK-NEXT: icmp eq i64 %[[CACHEVAL]], %[[HASH]]
     87   // CHECK-NEXT: br i1
     88 
     89   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %[[HASH]])
     90   // CHECK-NOT: unreachable
     91   // CHECK: {{.*}}:
     92 
     93   // (2) Check 'p->b' is appropriately sized and aligned for a load.
     94 
     95   // FIXME: Suppress this in the trivial case of a member access, because we
     96   // know we've just checked the member access expression itself.
     97 
     98   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
     99   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 4
    100 
    101   // CHECK: %[[PTRINT:.*]] = ptrtoint
    102   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 3
    103   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
    104   int k = p->b;
    105 
    106   // (3a) Check 'p' is appropriately sized and aligned for member function call.
    107 
    108   // CHECK: icmp ne {{.*}}, null
    109 
    110   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64
    111   // CHECK-NEXT: icmp uge i64 %[[SIZE]], 24
    112 
    113   // CHECK: %[[PTRINT:.*]] = ptrtoint
    114   // CHECK-NEXT: %[[MISALIGN:.*]] = and i64 %[[PTRINT]], 7
    115   // CHECK-NEXT: icmp eq i64 %[[MISALIGN]], 0
    116 
    117   // (3b) Check that 'p' actually points to an 'S'
    118 
    119   // CHECK: load i64, i64*
    120   // CHECK-NEXT: xor i64 {{-4030275160588942838|2562089159}},
    121   // [...]
    122   // CHECK: getelementptr inbounds [128 x i64], [128 x i64]* @__ubsan_vptr_type_cache, i32 0, i64 %
    123   // CHECK: br i1
    124   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss({{.*}}, i64 %{{.*}}, i64 %{{.*}})
    125   // CHECK-NOT: unreachable
    126   // CHECK: {{.*}}:
    127 
    128   k = p->f();
    129 }
    130 
    131 // CHECK-LABEL: @_Z12lsh_overflow
    132 int lsh_overflow(int a, int b) {
    133   // CHECK: %[[RHS_INBOUNDS:.*]] = icmp ule i32 %[[RHS:.*]], 31
    134   // CHECK-NEXT: br i1 %[[RHS_INBOUNDS]], label %[[CHECK_BB:.*]], label %[[CONT_BB:.*]],
    135 
    136   // CHECK:      [[CHECK_BB]]:
    137   // CHECK-NEXT: %[[SHIFTED_OUT_WIDTH:.*]] = sub nuw nsw i32 31, %[[RHS]]
    138   // CHECK-NEXT: %[[SHIFTED_OUT:.*]] = lshr i32 %[[LHS:.*]], %[[SHIFTED_OUT_WIDTH]]
    139 
    140   // This is present for C++11 but not for C: C++ core issue 1457 allows a '1'
    141   // to be shifted into the sign bit, but not out of it.
    142   // CHECK-NEXT: %[[SHIFTED_OUT_NOT_SIGN:.*]] = lshr i32 %[[SHIFTED_OUT]], 1
    143 
    144   // CHECK-NEXT: %[[NO_OVERFLOW:.*]] = icmp eq i32 %[[SHIFTED_OUT_NOT_SIGN]], 0
    145   // CHECK-NEXT: br label %[[CONT_BB]]
    146 
    147   // CHECK:      [[CONT_BB]]:
    148   // CHECK-NEXT: %[[VALID_BASE:.*]] = phi i1 [ true, {{.*}} ], [ %[[NO_OVERFLOW]], %[[CHECK_BB]] ]
    149   // CHECK-NEXT: %[[VALID:.*]] = and i1 %[[RHS_INBOUNDS]], %[[VALID_BASE]]
    150   // CHECK-NEXT: br i1 %[[VALID]]
    151 
    152   // CHECK: call void @__ubsan_handle_shift_out_of_bounds
    153   // CHECK-NOT: call void @__ubsan_handle_shift_out_of_bounds
    154 
    155   // CHECK: %[[RET:.*]] = shl i32 %[[LHS]], %[[RHS]]
    156   // CHECK-NEXT: ret i32 %[[RET]]
    157   return a << b;
    158 }
    159 
    160 // CHECK-LABEL: @_Z9no_return
    161 int no_return() {
    162   // CHECK:      call void @__ubsan_handle_missing_return(i8* bitcast ({{.*}}* @{{.*}} to i8*)) [[NR_NUW:#[0-9]+]]
    163   // CHECK-NEXT: unreachable
    164 }
    165 
    166 // CHECK-LABEL: @_Z9sour_bool
    167 bool sour_bool(bool *p) {
    168   // CHECK: %[[OK:.*]] = icmp ule i8 {{.*}}, 1
    169   // CHECK: br i1 %[[OK]]
    170   // CHECK: call void @__ubsan_handle_load_invalid_value(i8* bitcast ({{.*}}), i64 {{.*}})
    171   return *p;
    172 }
    173 
    174 enum E1 { e1a = 0, e1b = 127 } e1;
    175 enum E2 { e2a = -1, e2b = 64 } e2;
    176 enum E3 { e3a = (1u << 31) - 1 } e3;
    177 
    178 // CHECK-LABEL: @_Z14bad_enum_value
    179 int bad_enum_value() {
    180   // CHECK: %[[E1:.*]] = icmp ule i32 {{.*}}, 127
    181   // CHECK: br i1 %[[E1]]
    182   // CHECK: call void @__ubsan_handle_load_invalid_value(
    183   int a = e1;
    184 
    185   // CHECK: %[[E2HI:.*]] = icmp sle i32 {{.*}}, 127
    186   // CHECK: %[[E2LO:.*]] = icmp sge i32 {{.*}}, -128
    187   // CHECK: %[[E2:.*]] = and i1 %[[E2HI]], %[[E2LO]]
    188   // CHECK: br i1 %[[E2]]
    189   // CHECK: call void @__ubsan_handle_load_invalid_value(
    190   int b = e2;
    191 
    192   // CHECK: %[[E3:.*]] = icmp ule i32 {{.*}}, 2147483647
    193   // CHECK: br i1 %[[E3]]
    194   // CHECK: call void @__ubsan_handle_load_invalid_value(
    195   int c = e3;
    196   return a + b + c;
    197 }
    198 
    199 // CHECK-LABEL: @_Z20bad_downcast_pointer
    200 // DOWNCAST-NULL-LABEL: @_Z20bad_downcast_pointer
    201 void bad_downcast_pointer(S *p) {
    202   // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
    203   // CHECK: br i1 %[[NONNULL]],
    204 
    205   // A null poiner access is guarded without -fsanitize=null.
    206   // DOWNCAST-NULL: %[[NONNULL:.*]] = icmp ne {{.*}}, null
    207   // DOWNCAST-NULL: br i1 %[[NONNULL]],
    208 
    209   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
    210   // CHECK: %[[E1:.*]] = icmp uge i64 %[[SIZE]], 24
    211   // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
    212   // CHECK: %[[E2:.*]] = icmp eq i64 %[[MISALIGN]], 0
    213   // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
    214   // CHECK: br i1 %[[E12]],
    215 
    216   // CHECK: call void @__ubsan_handle_type_mismatch
    217   // CHECK: br label
    218 
    219   // CHECK: br i1 %{{.*}},
    220 
    221   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
    222   // CHECK: br label
    223   (void) static_cast<T*>(p);
    224 }
    225 
    226 // CHECK-LABEL: @_Z22bad_downcast_reference
    227 void bad_downcast_reference(S &p) {
    228   // CHECK: %[[E1:.*]] = icmp ne {{.*}}, null
    229   // CHECK-NOT: br i1
    230 
    231   // CHECK: %[[SIZE:.*]] = call i64 @llvm.objectsize.i64.p0i8(
    232   // CHECK: %[[E2:.*]] = icmp uge i64 %[[SIZE]], 24
    233 
    234   // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
    235   // CHECK: %[[E3:.*]] = icmp eq i64 %[[MISALIGN]], 0
    236 
    237   // CHECK: %[[E12:.*]] = and i1 %[[E1]], %[[E2]]
    238   // CHECK: %[[E123:.*]] = and i1 %[[E12]], %[[E3]]
    239   // CHECK: br i1 %[[E123]],
    240 
    241   // CHECK: call void @__ubsan_handle_type_mismatch
    242   // CHECK: br label
    243 
    244   // CHECK: br i1 %{{.*}},
    245 
    246   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
    247   // CHECK: br label
    248   (void) static_cast<T&>(p);
    249 }
    250 
    251 // CHECK-LABEL: @_Z11array_index
    252 int array_index(const int (&a)[4], int n) {
    253   // CHECK: %[[K1_OK:.*]] = icmp ult i64 %{{.*}}, 4
    254   // CHECK: br i1 %[[K1_OK]]
    255   // CHECK: call void @__ubsan_handle_out_of_bounds(
    256   int k1 = a[n];
    257 
    258   // CHECK: %[[R1_OK:.*]] = icmp ule i64 %{{.*}}, 4
    259   // CHECK: br i1 %[[R1_OK]]
    260   // CHECK: call void @__ubsan_handle_out_of_bounds(
    261   const int *r1 = &a[n];
    262 
    263   // CHECK: %[[K2_OK:.*]] = icmp ult i64 %{{.*}}, 8
    264   // CHECK: br i1 %[[K2_OK]]
    265   // CHECK: call void @__ubsan_handle_out_of_bounds(
    266   int k2 = ((const int(&)[8])a)[n];
    267 
    268   // CHECK: %[[K3_OK:.*]] = icmp ult i64 %{{.*}}, 4
    269   // CHECK: br i1 %[[K3_OK]]
    270   // CHECK: call void @__ubsan_handle_out_of_bounds(
    271   int k3 = n[a];
    272 
    273   return k1 + *r1 + k2;
    274 }
    275 
    276 // CHECK-LABEL: @_Z17multi_array_index
    277 int multi_array_index(int n, int m) {
    278   int arr[4][6];
    279 
    280   // CHECK: %[[IDX2_OK:.*]] = icmp ult i64 %{{.*}}, 6
    281   // CHECK: br i1 %[[IDX2_OK]]
    282   // CHECK: call void @__ubsan_handle_out_of_bounds(
    283 
    284   // CHECK: %[[IDX1_OK:.*]] = icmp ult i64 %{{.*}}, 4
    285   // CHECK: br i1 %[[IDX1_OK]]
    286   // CHECK: call void @__ubsan_handle_out_of_bounds(
    287   return arr[n][m];
    288 }
    289 
    290 // CHECK-LABEL: @_Z11array_arith
    291 int array_arith(const int (&a)[4], int n) {
    292   // CHECK: %[[K1_OK:.*]] = icmp ule i64 %{{.*}}, 4
    293   // CHECK: br i1 %[[K1_OK]]
    294   // CHECK: call void @__ubsan_handle_out_of_bounds(
    295   const int *k1 = a + n;
    296 
    297   // CHECK: %[[K2_OK:.*]] = icmp ule i64 %{{.*}}, 8
    298   // CHECK: br i1 %[[K2_OK]]
    299   // CHECK: call void @__ubsan_handle_out_of_bounds(
    300   const int *k2 = (const int(&)[8])a + n;
    301 
    302   return *k1 + *k2;
    303 }
    304 
    305 struct ArrayMembers {
    306   int a1[5];
    307   int a2[1];
    308 };
    309 // CHECK-LABEL: @_Z18struct_array_index
    310 int struct_array_index(ArrayMembers *p, int n) {
    311   // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 5
    312   // CHECK: br i1 %[[IDX_OK]]
    313   // CHECK: call void @__ubsan_handle_out_of_bounds(
    314   return p->a1[n];
    315 }
    316 
    317 // CHECK-LABEL: @_Z16flex_array_index
    318 int flex_array_index(ArrayMembers *p, int n) {
    319   // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
    320   return p->a2[n];
    321 }
    322 
    323 extern int incomplete[];
    324 // CHECK-LABEL: @_Z22incomplete_array_index
    325 int incomplete_array_index(int n) {
    326   // CHECK-NOT: call void @__ubsan_handle_out_of_bounds(
    327   return incomplete[n];
    328 }
    329 
    330 typedef __attribute__((ext_vector_type(4))) int V4I;
    331 // CHECK-LABEL: @_Z12vector_index
    332 int vector_index(V4I v, int n) {
    333   // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 4
    334   // CHECK: br i1 %[[IDX_OK]]
    335   // CHECK: call void @__ubsan_handle_out_of_bounds(
    336   return v[n];
    337 }
    338 
    339 // CHECK-LABEL: @_Z12string_index
    340 char string_index(int n) {
    341   // CHECK: %[[IDX_OK:.*]] = icmp ult i64 %{{.*}}, 6
    342   // CHECK: br i1 %[[IDX_OK]]
    343   // CHECK: call void @__ubsan_handle_out_of_bounds(
    344   return "Hello"[n];
    345 }
    346 
    347 class A // align=4
    348 {
    349   int a1, a2, a3;
    350 };
    351 
    352 class B // align=8
    353 {
    354   long b1, b2;
    355 };
    356 
    357 class C : public A, public B // align=16
    358 {
    359   alignas(16) int c1;
    360 };
    361 
    362 // Make sure we check the alignment of the pointer after subtracting any
    363 // offset. The pointer before subtraction doesn't need to be aligned for
    364 // the destination type.
    365 
    366 // CHECK-LABEL: define void @_Z16downcast_pointerP1B(%class.B* %b)
    367 void downcast_pointer(B *b) {
    368   (void) static_cast<C*>(b);
    369   // Alignment check from EmitTypeCheck(TCK_DowncastPointer, ...)
    370   // CHECK: [[SUB:%[.a-z0-9]*]] = getelementptr i8, i8* {{.*}}, i64 -16
    371   // CHECK-NEXT: [[C:%.+]] = bitcast i8* [[SUB]] to %class.C*
    372   // null check goes here
    373   // CHECK: [[FROM_PHI:%.+]] = phi %class.C* [ [[C]], {{.*}} ], {{.*}}
    374   // Objectsize check goes here
    375   // CHECK: [[C_INT:%.+]] = ptrtoint %class.C* [[FROM_PHI]] to i64
    376   // CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
    377   // CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
    378   // AND the alignment test with the objectsize test.
    379   // CHECK-NEXT: [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
    380   // CHECK-NEXT: br i1 [[AND]]
    381 }
    382 
    383 // CHECK-LABEL: define void @_Z18downcast_referenceR1B(%class.B* dereferenceable({{[0-9]+}}) %b)
    384 void downcast_reference(B &b) {
    385   (void) static_cast<C&>(b);
    386   // Alignment check from EmitTypeCheck(TCK_DowncastReference, ...)
    387   // CHECK:      [[SUB:%[.a-z0-9]*]] = getelementptr i8, i8* {{.*}}, i64 -16
    388   // CHECK-NEXT: [[C:%.+]] = bitcast i8* [[SUB]] to %class.C*
    389   // Objectsize check goes here
    390   // CHECK:      [[C_INT:%.+]] = ptrtoint %class.C* [[C]] to i64
    391   // CHECK-NEXT: [[MASKED:%.+]] = and i64 [[C_INT]], 15
    392   // CHECK-NEXT: [[TEST:%.+]] = icmp eq i64 [[MASKED]], 0
    393   // AND the alignment test with the objectsize test.
    394   // CHECK:      [[AND:%.+]] = and i1 {{.*}}, [[TEST]]
    395   // CHECK-NEXT: br i1 [[AND]]
    396 }
    397 
    398 // CHECK-LABEL: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413876459, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
    399 // CHECK-X32: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413875435, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
    400 // CHECK-X86: @_Z22indirect_function_callPFviE({{.*}} prologue <{ i32, i8* }> <{ i32 1413875435, i8* bitcast ({ i8*, i8* }* @_ZTIFvPFviEE to i8*) }>
    401 void indirect_function_call(void (*p)(int)) {
    402   // CHECK: [[PTR:%.+]] = bitcast void (i32)* {{.*}} to <{ i32, i8* }>*
    403 
    404   // Signature check
    405   // CHECK-NEXT: [[SIGPTR:%.+]] = getelementptr <{ i32, i8* }>, <{ i32, i8* }>* [[PTR]], i32 0, i32 0
    406   // CHECK-NEXT: [[SIG:%.+]] = load i32, i32* [[SIGPTR]]
    407   // CHECK-NEXT: [[SIGCMP:%.+]] = icmp eq i32 [[SIG]], 1413876459
    408   // CHECK-NEXT: br i1 [[SIGCMP]]
    409 
    410   // RTTI pointer check
    411   // CHECK: [[RTTIPTR:%.+]] = getelementptr <{ i32, i8* }>, <{ i32, i8* }>* [[PTR]], i32 0, i32 1
    412   // CHECK-NEXT: [[RTTI:%.+]] = load i8*, i8** [[RTTIPTR]]
    413   // CHECK-NEXT: [[RTTICMP:%.+]] = icmp eq i8* [[RTTI]], bitcast ({ i8*, i8* }* @_ZTIFviE to i8*)
    414   // CHECK-NEXT: br i1 [[RTTICMP]]
    415   p(42);
    416 }
    417 
    418 namespace UpcastPointerTest {
    419 struct S {};
    420 struct T : S { double d; };
    421 struct V : virtual S {};
    422 
    423 // CHECK-LABEL: upcast_pointer
    424 S* upcast_pointer(T* t) {
    425   // Check for null pointer
    426   // CHECK: %[[NONNULL:.*]] = icmp ne {{.*}}, null
    427   // CHECK: br i1 %[[NONNULL]]
    428 
    429   // Check alignment
    430   // CHECK: %[[MISALIGN:.*]] = and i64 %{{.*}}, 7
    431   // CHECK: icmp eq i64 %[[MISALIGN]], 0
    432 
    433   // CHECK: call void @__ubsan_handle_type_mismatch
    434   return t;
    435 }
    436 
    437 V getV();
    438 
    439 // CHECK-LABEL: upcast_to_vbase
    440 void upcast_to_vbase() {
    441   // No need to check for null here, as we have a temporary here.
    442 
    443   // CHECK-NOT: br i1
    444 
    445   // CHECK: call i64 @llvm.objectsize
    446   // CHECK: call void @__ubsan_handle_type_mismatch
    447   // CHECK: call void @__ubsan_handle_dynamic_type_cache_miss
    448   const S& s = getV();
    449 }
    450 }
    451 
    452 namespace CopyValueRepresentation {
    453   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S3aSERKS0_
    454   // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
    455   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S4aSEOS0_
    456   // CHECK-NOT: call {{.*}} @__ubsan_handle_load_invalid_value
    457   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S1C2ERKS0_
    458   // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
    459   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S2C2ERKS0_
    460   // CHECK: __ubsan_handle_load_invalid_value
    461   // CHECK-LABEL: define {{.*}} @_ZN23CopyValueRepresentation2S5C2ERKS0_
    462   // CHECK-NOT: call {{.*}} __ubsan_handle_load_invalid_value
    463 
    464   struct CustomCopy { CustomCopy(); CustomCopy(const CustomCopy&); };
    465   struct S1 {
    466     CustomCopy CC;
    467     bool b;
    468   };
    469   void callee1(S1);
    470   void test1() {
    471     S1 s11;
    472     callee1(s11);
    473     S1 s12;
    474     s12 = s11;
    475   }
    476 
    477   static bool some_global_bool;
    478   struct ExprCopy {
    479     ExprCopy();
    480     ExprCopy(const ExprCopy&, bool b = some_global_bool);
    481   };
    482   struct S2 {
    483     ExprCopy EC;
    484     bool b;
    485   };
    486   void callee2(S2);
    487   void test2(void) {
    488     S2 s21;
    489     callee2(s21);
    490     S2 s22;
    491     s22 = s21;
    492   }
    493 
    494   struct CustomAssign { CustomAssign &operator=(const CustomAssign&); };
    495   struct S3 {
    496     CustomAssign CA;
    497     bool b;
    498   };
    499   void test3() {
    500     S3 x, y;
    501     x = y;
    502   }
    503 
    504   struct CustomMove {
    505     CustomMove();
    506     CustomMove(const CustomMove&&);
    507     CustomMove &operator=(const CustomMove&&);
    508   };
    509   struct S4 {
    510     CustomMove CM;
    511     bool b;
    512   };
    513   void test4() {
    514     S4 x, y;
    515     x = static_cast<S4&&>(y);
    516   }
    517 
    518   struct EnumCustomCopy {
    519     EnumCustomCopy();
    520     EnumCustomCopy(const EnumCustomCopy&);
    521   };
    522   struct S5 {
    523     EnumCustomCopy ECC;
    524     bool b;
    525   };
    526   void callee5(S5);
    527   void test5() {
    528     S5 s51;
    529     callee5(s51);
    530     S5 s52;
    531     s52 = s51;
    532   }
    533 }
    534 
    535 // CHECK: attributes [[NR_NUW]] = { noreturn nounwind }
    536