Daily bump.
[official-gcc.git] / gcc / vtable-verify.c
blob8e24c924cc20e6938b1a9b549cfa1e3369a1b863
1 /* Copyright (C) 2013-2015 Free Software Foundation, Inc.
3 This file is part of GCC.
5 GCC is free software; you can redistribute it and/or modify it under
6 the terms of the GNU General Public License as published by the Free
7 Software Foundation; either version 3, or (at your option) any later
8 version.
10 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
11 WARRANTY; without even the implied warranty of MERCHANTABILITY or
12 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
13 for more details.
15 You should have received a copy of the GNU General Public License
16 along with GCC; see the file COPYING3. If not see
17 <http://www.gnu.org/licenses/>. */
19 /* Virtual Table Pointer Security Pass - Detect corruption of vtable pointers
20 before using them for virtual method dispatches. */
22 /* This file is part of the vtable security feature implementation.
23 The vtable security feature is designed to detect when a virtual
24 call is about to be made through an invalid vtable pointer
25 (possibly due to data corruption or malicious attacks). The
26 compiler finds every virtual call, and inserts a verification call
27 before the virtual call. The verification call takes the actual
28 vtable pointer value in the object through which the virtual call
29 is being made, and compares the vtable pointer against a set of all
30 valid vtable pointers that the object could contain (this set is
31 based on the declared type of the object). If the pointer is in
32 the valid set, execution is allowed to continue; otherwise the
33 program is halted.
35 There are several pieces needed in order to make this work: 1. For
36 every virtual class in the program (i.e. a class that contains
37 virtual methods), we need to build the set of all possible valid
38 vtables that an object of that class could point to. This includes
39 vtables for any class(es) that inherit from the class under
40 consideration. 2. For every such data set we build up, we need a
41 way to find and reference the data set. This is complicated by the
42 fact that the real vtable addresses are not known until runtime,
43 when the program is loaded into memory, but we need to reference the
44 sets at compile time when we are inserting verification calls into
45 the program. 3. We need to find every virtual call in the program,
46 and insert the verification call (with the appropriate arguments)
47 before the virtual call. 4. We need some runtime library pieces:
48 the code to build up the data sets at runtime; the code to actually
49 perform the verification using the data sets; and some code to set
50 protections on the data sets, so they themselves do not become
51 hacker targets.
53 To find and reference the set of valid vtable pointers for any given
54 virtual class, we create a special global variable for each virtual
55 class. We refer to this as the "vtable map variable" for that
56 class. The vtable map variable has the type "void *", and is
57 initialized by the compiler to NULL. At runtime when the set of
58 valid vtable pointers for a virtual class, e.g. class Foo, is built,
59 the vtable map variable for class Foo is made to point to the set.
60 During compile time, when the compiler is inserting verification
61 calls into the program, it passes the vtable map variable for the
62 appropriate class to the verification call, so that at runtime the
63 verification call can find the appropriate data set.
65 The actual set of valid vtable pointers for a virtual class,
66 e.g. class Foo, cannot be built until runtime, when the vtables get
67 loaded into memory and their addresses are known. But the knowledge
68 about which vtables belong in which class' hierarchy is only known
69 at compile time. Therefore at compile time we collect class
70 hierarchy and vtable information about every virtual class, and we
71 generate calls to build up the data sets at runtime. To build the
72 data sets, we call one of the functions we add to the runtime
73 library, __VLTRegisterPair. __VLTRegisterPair takes two arguments,
74 a vtable map variable and the address of a vtable. If the vtable
75 map variable is currently NULL, it creates a new data set (hash
76 table), makes the vtable map variable point to the new data set, and
77 inserts the vtable address into the data set. If the vtable map
78 variable is not NULL, it just inserts the vtable address into the
79 data set. In order to make sure that our data sets are built before
80 any verification calls happen, we create a special constructor
81 initialization function for each compilation unit, give it a very
82 high initialization priority, and insert all of our calls to
83 __VLTRegisterPair into our special constructor initialization
84 function.
86 The vtable verification feature is controlled by the flag
87 '-fvtable-verify='. There are three flavors of this:
88 '-fvtable-verify=std', '-fvtable-verify=preinit', and
89 '-fvtable-verify=none'. If the option '-fvtable-verfy=preinit' is
90 used, then our constructor initialization function gets put into the
91 preinit array. This is necessary if there are data sets that need
92 to be built very early in execution. If the constructor
93 initialization function gets put into the preinit array, the we also
94 add calls to __VLTChangePermission at the beginning and end of the
95 function. The call at the beginning sets the permissions on the
96 data sets and vtable map variables to read/write, and the one at the
97 end makes them read-only. If the '-fvtable-verify=std' option is
98 used, the constructor initialization functions are executed at their
99 normal time, and the __VLTChangePermission calls are handled
100 differently (see the comments in libstdc++-v3/libsupc++/vtv_rts.cc).
101 The option '-fvtable-verify=none' turns off vtable verification.
103 This file contains code for the tree pass that goes through all the
104 statements in each basic block, looking for virtual calls, and
105 inserting a call to __VLTVerifyVtablePointer (with appropriate
106 arguments) before each one. It also contains the hash table
107 functions for the data structures used for collecting the class
108 hierarchy data and building/maintaining the vtable map variable data
109 are defined in gcc/vtable-verify.h. These data structures are
110 shared with the code in the C++ front end that collects the class
111 hierarchy & vtable information and generates the vtable map
112 variables (see cp/vtable-class-hierarchy.c). This tree pass should
113 run just before the gimple is converted to RTL.
115 Some implementation details for this pass:
117 To find all of the virtual calls, we iterate through all the
118 gimple statements in each basic block, looking for any call
119 statement with the code "OBJ_TYPE_REF". Once we have found the
120 virtual call, we need to find the vtable pointer through which the
121 call is being made, and the type of the object containing the
122 pointer (to find the appropriate vtable map variable). We then use
123 these to build a call to __VLTVerifyVtablePointer, passing the
124 vtable map variable, and the vtable pointer. We insert the
125 verification call just after the gimple statement that gets the
126 vtable pointer out of the object, and we update the next
127 statement to depend on the result returned from
128 __VLTVerifyVtablePointer (the vtable pointer value), to ensure
129 subsequent compiler phases don't remove or reorder the call (it's no
130 good to have the verification occur after the virtual call, for
131 example). To find the vtable pointer being used (and the type of
132 the object) we search backwards through the def_stmts chain from the
133 virtual call (see verify_bb_vtables for more details). */
135 #include "config.h"
136 #include "system.h"
137 #include "coretypes.h"
138 #include "alias.h"
139 #include "symtab.h"
140 #include "options.h"
141 #include "tree.h"
142 #include "fold-const.h"
143 #include "predict.h"
144 #include "tm.h"
145 #include "hard-reg-set.h"
146 #include "function.h"
147 #include "dominance.h"
148 #include "cfg.h"
149 #include "basic-block.h"
150 #include "tree-ssa-alias.h"
151 #include "internal-fn.h"
152 #include "gimple-expr.h"
153 #include "gimple.h"
154 #include "gimple-iterator.h"
155 #include "gimple-ssa.h"
156 #include "tree-phinodes.h"
157 #include "ssa-iterators.h"
158 #include "stringpool.h"
159 #include "tree-ssanames.h"
160 #include "tree-pass.h"
161 #include "cfgloop.h"
163 #include "vtable-verify.h"
165 unsigned num_vtable_map_nodes = 0;
166 int total_num_virtual_calls = 0;
167 int total_num_verified_vcalls = 0;
169 extern GTY(()) tree verify_vtbl_ptr_fndecl;
170 tree verify_vtbl_ptr_fndecl = NULL_TREE;
172 /* Keep track of whether or not any virtual call were verified. */
173 static bool any_verification_calls_generated = false;
175 unsigned int vtable_verify_main (void);
178 /* The following few functions are for the vtbl pointer hash table
179 in the 'registered' field of the struct vtable_map_node. The hash
180 table keeps track of which vtable pointers have been used in
181 calls to __VLTRegisterPair with that particular vtable map variable. */
183 /* This function checks to see if a particular VTABLE_DECL and OFFSET are
184 already in the 'registered' hash table for NODE. */
186 bool
187 vtbl_map_node_registration_find (struct vtbl_map_node *node,
188 tree vtable_decl,
189 unsigned offset)
191 struct vtable_registration key;
192 struct vtable_registration **slot;
194 gcc_assert (node && node->registered);
196 key.vtable_decl = vtable_decl;
197 slot = node->registered->find_slot (&key, NO_INSERT);
199 if (slot && (*slot))
201 unsigned i;
202 for (i = 0; i < ((*slot)->offsets).length (); ++i)
203 if ((*slot)->offsets[i] == offset)
204 return true;
207 return false;
210 /* This function inserts VTABLE_DECL and OFFSET into the 'registered'
211 hash table for NODE. It returns a boolean indicating whether or not
212 it actually inserted anything. */
214 bool
215 vtbl_map_node_registration_insert (struct vtbl_map_node *node,
216 tree vtable_decl,
217 unsigned offset)
219 struct vtable_registration key;
220 struct vtable_registration **slot;
221 bool inserted_something = false;
223 if (!node || !node->registered)
224 return false;
226 key.vtable_decl = vtable_decl;
227 slot = node->registered->find_slot (&key, INSERT);
229 if (! *slot)
231 struct vtable_registration *node;
232 node = XNEW (struct vtable_registration);
233 node->vtable_decl = vtable_decl;
235 (node->offsets).create (10);
236 (node->offsets).safe_push (offset);
237 *slot = node;
238 inserted_something = true;
240 else
242 /* We found the vtable_decl slot; we need to see if it already
243 contains the offset. If not, we need to add the offset. */
244 unsigned i;
245 bool found = false;
246 for (i = 0; i < ((*slot)->offsets).length () && !found; ++i)
247 if ((*slot)->offsets[i] == offset)
248 found = true;
250 if (!found)
252 ((*slot)->offsets).safe_push (offset);
253 inserted_something = true;
256 return inserted_something;
259 /* Hashtable functions for vtable_registration hashtables. */
261 inline hashval_t
262 registration_hasher::hash (const vtable_registration *p)
264 const struct vtable_registration *n = (const struct vtable_registration *) p;
265 return (hashval_t) (DECL_UID (n->vtable_decl));
268 inline bool
269 registration_hasher::equal (const vtable_registration *p1,
270 const vtable_registration *p2)
272 const struct vtable_registration *n1 =
273 (const struct vtable_registration *) p1;
274 const struct vtable_registration *n2 =
275 (const struct vtable_registration *) p2;
276 return (DECL_UID (n1->vtable_decl) == DECL_UID (n2->vtable_decl));
279 /* End of hashtable functions for "registered" hashtables. */
283 /* Hashtable definition and functions for vtbl_map_hash. */
285 struct vtbl_map_hasher : nofree_ptr_hash <struct vtbl_map_node>
287 static inline hashval_t hash (const vtbl_map_node *);
288 static inline bool equal (const vtbl_map_node *, const vtbl_map_node *);
291 /* Returns a hash code for P. */
293 inline hashval_t
294 vtbl_map_hasher::hash (const vtbl_map_node *p)
296 const struct vtbl_map_node n = *((const struct vtbl_map_node *) p);
297 return (hashval_t) IDENTIFIER_HASH_VALUE (n.class_name);
300 /* Returns nonzero if P1 and P2 are equal. */
302 inline bool
303 vtbl_map_hasher::equal (const vtbl_map_node *p1, const vtbl_map_node *p2)
305 const struct vtbl_map_node n1 = *((const struct vtbl_map_node *) p1);
306 const struct vtbl_map_node n2 = *((const struct vtbl_map_node *) p2);
307 return (IDENTIFIER_HASH_VALUE (n1.class_name) ==
308 IDENTIFIER_HASH_VALUE (n2.class_name));
311 /* Here are the two structures into which we insert vtable map nodes.
312 We use two data structures because of the vastly different ways we need
313 to find the nodes for various tasks (see comments in vtable-verify.h
314 for more details. */
316 typedef hash_table<vtbl_map_hasher> vtbl_map_table_type;
317 typedef vtbl_map_table_type::iterator vtbl_map_iterator_type;
319 /* Vtable map variable nodes stored in a hash table. */
320 static vtbl_map_table_type *vtbl_map_hash;
322 /* Vtable map variable nodes stored in a vector. */
323 vec<struct vtbl_map_node *> vtbl_map_nodes_vec;
325 /* Return vtbl_map node for CLASS_NAME without creating a new one. */
327 struct vtbl_map_node *
328 vtbl_map_get_node (tree class_type)
330 struct vtbl_map_node key;
331 struct vtbl_map_node **slot;
333 tree class_type_decl;
334 tree class_name;
335 unsigned int type_quals;
337 if (!vtbl_map_hash)
338 return NULL;
340 gcc_assert (TREE_CODE (class_type) == RECORD_TYPE);
343 /* Find the TYPE_DECL for the class. */
344 class_type_decl = TYPE_NAME (class_type);
346 /* Verify that there aren't any qualifiers on the type. */
347 type_quals = TYPE_QUALS (TREE_TYPE (class_type_decl));
348 gcc_assert (type_quals == TYPE_UNQUALIFIED);
350 /* Get the mangled name for the unqualified type. */
351 gcc_assert (HAS_DECL_ASSEMBLER_NAME_P (class_type_decl));
352 class_name = DECL_ASSEMBLER_NAME (class_type_decl);
354 key.class_name = class_name;
355 slot = (struct vtbl_map_node **) vtbl_map_hash->find_slot (&key, NO_INSERT);
356 if (!slot)
357 return NULL;
358 return *slot;
361 /* Return vtbl_map node assigned to BASE_CLASS_TYPE. Create new one
362 when needed. */
364 struct vtbl_map_node *
365 find_or_create_vtbl_map_node (tree base_class_type)
367 struct vtbl_map_node key;
368 struct vtbl_map_node *node;
369 struct vtbl_map_node **slot;
370 tree class_type_decl;
371 unsigned int type_quals;
373 if (!vtbl_map_hash)
374 vtbl_map_hash = new vtbl_map_table_type (10);
376 /* Find the TYPE_DECL for the class. */
377 class_type_decl = TYPE_NAME (base_class_type);
379 /* Verify that there aren't any type qualifiers on type. */
380 type_quals = TYPE_QUALS (TREE_TYPE (class_type_decl));
381 gcc_assert (type_quals == TYPE_UNQUALIFIED);
383 gcc_assert (HAS_DECL_ASSEMBLER_NAME_P (class_type_decl));
384 key.class_name = DECL_ASSEMBLER_NAME (class_type_decl);
385 slot = (struct vtbl_map_node **) vtbl_map_hash->find_slot (&key, INSERT);
387 if (*slot)
388 return *slot;
390 node = XNEW (struct vtbl_map_node);
391 node->vtbl_map_decl = NULL_TREE;
392 node->class_name = key.class_name;
393 node->uid = num_vtable_map_nodes++;
395 node->class_info = XNEW (struct vtv_graph_node);
396 node->class_info->class_type = base_class_type;
397 node->class_info->class_uid = node->uid;
398 node->class_info->num_processed_children = 0;
400 (node->class_info->parents).create (4);
401 (node->class_info->children).create (4);
403 node->registered = new register_table_type (16);
405 node->is_used = false;
407 vtbl_map_nodes_vec.safe_push (node);
408 gcc_assert (vtbl_map_nodes_vec[node->uid] == node);
410 *slot = node;
411 return node;
414 /* End of hashtable functions for vtable_map variables hash table. */
416 /* Given a gimple STMT, this function checks to see if the statement
417 is an assignment, the rhs of which is getting the vtable pointer
418 value out of an object. (i.e. it's the value we need to verify
419 because its the vtable pointer that will be used for a virtual
420 call). */
422 static bool
423 is_vtable_assignment_stmt (gimple stmt)
426 if (gimple_code (stmt) != GIMPLE_ASSIGN)
427 return false;
428 else
430 tree lhs = gimple_assign_lhs (stmt);
431 tree rhs = gimple_assign_rhs1 (stmt);
433 if (TREE_CODE (lhs) != SSA_NAME)
434 return false;
436 if (TREE_CODE (rhs) != COMPONENT_REF)
437 return false;
439 if (! (TREE_OPERAND (rhs, 1))
440 || (TREE_CODE (TREE_OPERAND (rhs, 1)) != FIELD_DECL))
441 return false;
443 if (! DECL_VIRTUAL_P (TREE_OPERAND (rhs, 1)))
444 return false;
447 return true;
450 /* This function attempts to recover the declared class of an object
451 that is used in making a virtual call. We try to get the type from
452 the type cast in the gimple assignment statement that extracts the
453 vtable pointer from the object (DEF_STMT). The gimple statement
454 usually looks something like this:
456 D.2201_4 = MEM[(struct Event *)this_1(D)]._vptr.Event */
458 static tree
459 extract_object_class_type (tree rhs)
461 tree result = NULL_TREE;
463 /* Try to find and extract the type cast from that stmt. */
464 if (TREE_CODE (rhs) == COMPONENT_REF)
466 tree op0 = TREE_OPERAND (rhs, 0);
467 tree op1 = TREE_OPERAND (rhs, 1);
469 if (TREE_CODE (op1) == FIELD_DECL
470 && DECL_VIRTUAL_P (op1))
472 if (TREE_CODE (op0) == COMPONENT_REF
473 && TREE_CODE (TREE_OPERAND (op0, 0)) == MEM_REF
474 && TREE_CODE (TREE_TYPE (TREE_OPERAND (op0, 0)))== RECORD_TYPE)
475 result = TREE_TYPE (TREE_OPERAND (op0, 0));
476 else
477 result = TREE_TYPE (op0);
479 else if (TREE_CODE (op0) == COMPONENT_REF)
481 result = extract_object_class_type (op0);
482 if (result == NULL_TREE
483 && TREE_CODE (op1) == COMPONENT_REF)
484 result = extract_object_class_type (op1);
488 return result;
491 /* This function traces forward through the def-use chain of an SSA
492 variable to see if it ever gets used in a virtual function call. It
493 returns a boolean indicating whether or not it found a virtual call in
494 the use chain. */
496 static bool
497 var_is_used_for_virtual_call_p (tree lhs, int *mem_ref_depth)
499 imm_use_iterator imm_iter;
500 bool found_vcall = false;
501 use_operand_p use_p;
503 if (TREE_CODE (lhs) != SSA_NAME)
504 return false;
506 if (*mem_ref_depth > 2)
507 return false;
509 /* Iterate through the immediate uses of the current variable. If
510 it's a virtual function call, we're done. Otherwise, if there's
511 an LHS for the use stmt, add the ssa var to the work list
512 (assuming it's not already in the list and is not a variable
513 we've already examined. */
515 FOR_EACH_IMM_USE_FAST (use_p, imm_iter, lhs)
517 gimple stmt2 = USE_STMT (use_p);
519 if (is_gimple_call (stmt2))
521 tree fncall = gimple_call_fn (stmt2);
522 if (fncall && TREE_CODE (fncall) == OBJ_TYPE_REF)
523 found_vcall = true;
524 else
525 return false;
527 else if (gimple_code (stmt2) == GIMPLE_PHI)
529 found_vcall = var_is_used_for_virtual_call_p
530 (gimple_phi_result (stmt2),
531 mem_ref_depth);
533 else if (is_gimple_assign (stmt2))
535 tree rhs = gimple_assign_rhs1 (stmt2);
536 if (TREE_CODE (rhs) == ADDR_EXPR
537 || TREE_CODE (rhs) == MEM_REF)
538 *mem_ref_depth = *mem_ref_depth + 1;
540 if (TREE_CODE (rhs) == COMPONENT_REF)
542 while (TREE_CODE (TREE_OPERAND (rhs, 0)) == COMPONENT_REF)
543 rhs = TREE_OPERAND (rhs, 0);
545 if (TREE_CODE (TREE_OPERAND (rhs, 0)) == ADDR_EXPR
546 || TREE_CODE (TREE_OPERAND (rhs, 0)) == MEM_REF)
547 *mem_ref_depth = *mem_ref_depth + 1;
550 if (*mem_ref_depth < 3)
551 found_vcall = var_is_used_for_virtual_call_p
552 (gimple_assign_lhs (stmt2),
553 mem_ref_depth);
556 else
557 break;
559 if (found_vcall)
560 return true;
563 return false;
566 /* Search through all the statements in a basic block (BB), searching
567 for virtual method calls. For each virtual method dispatch, find
568 the vptr value used, and the statically declared type of the
569 object; retrieve the vtable map variable for the type of the
570 object; generate a call to __VLTVerifyVtablePointer; and insert the
571 generated call into the basic block, after the point where the vptr
572 value is gotten out of the object and before the virtual method
573 dispatch. Make the virtual method dispatch depend on the return
574 value from the verification call, so that subsequent optimizations
575 cannot reorder the two calls. */
577 static void
578 verify_bb_vtables (basic_block bb)
580 gimple_seq stmts;
581 gimple stmt = NULL;
582 gimple_stmt_iterator gsi_vtbl_assign;
583 gimple_stmt_iterator gsi_virtual_call;
585 stmts = bb_seq (bb);
586 gsi_virtual_call = gsi_start (stmts);
587 for (; !gsi_end_p (gsi_virtual_call); gsi_next (&gsi_virtual_call))
589 stmt = gsi_stmt (gsi_virtual_call);
591 /* Count virtual calls. */
592 if (is_gimple_call (stmt))
594 tree fncall = gimple_call_fn (stmt);
595 if (fncall && TREE_CODE (fncall) == OBJ_TYPE_REF)
596 total_num_virtual_calls++;
599 if (is_vtable_assignment_stmt (stmt))
601 tree lhs = gimple_assign_lhs (stmt);
602 tree vtbl_var_decl = NULL_TREE;
603 struct vtbl_map_node *vtable_map_node;
604 tree vtbl_decl = NULL_TREE;
605 gcall *call_stmt;
606 const char *vtable_name = "<unknown>";
607 tree tmp0;
608 bool found;
609 int mem_ref_depth = 0;
611 /* Make sure this vptr field access is for a virtual call. */
612 if (!var_is_used_for_virtual_call_p (lhs, &mem_ref_depth))
613 continue;
615 /* Now we have found the virtual method dispatch and
616 the preceding access of the _vptr.* field... Next
617 we need to find the statically declared type of
618 the object, so we can find and use the right
619 vtable map variable in the verification call. */
620 tree class_type = extract_object_class_type
621 (gimple_assign_rhs1 (stmt));
623 gsi_vtbl_assign = gsi_for_stmt (stmt);
625 if (class_type
626 && (TREE_CODE (class_type) == RECORD_TYPE)
627 && TYPE_BINFO (class_type))
629 /* Get the vtable VAR_DECL for the type. */
630 vtbl_var_decl = BINFO_VTABLE (TYPE_BINFO (class_type));
632 if (TREE_CODE (vtbl_var_decl) == POINTER_PLUS_EXPR)
633 vtbl_var_decl = TREE_OPERAND (TREE_OPERAND (vtbl_var_decl, 0),
636 gcc_assert (vtbl_var_decl);
638 vtbl_decl = vtbl_var_decl;
639 vtable_map_node = vtbl_map_get_node
640 (TYPE_MAIN_VARIANT (class_type));
642 gcc_assert (verify_vtbl_ptr_fndecl);
644 /* Given the vtable pointer for the base class of the
645 object, build the call to __VLTVerifyVtablePointer to
646 verify that the object's vtable pointer (contained in
647 lhs) is in the set of valid vtable pointers for the
648 base class. */
650 if (vtable_map_node && vtable_map_node->vtbl_map_decl)
652 vtable_map_node->is_used = true;
653 vtbl_var_decl = vtable_map_node->vtbl_map_decl;
655 if (TREE_CODE (vtbl_decl) == VAR_DECL)
656 vtable_name = IDENTIFIER_POINTER (DECL_NAME (vtbl_decl));
658 /* Call different routines if we are interested in
659 trace information to debug problems. */
660 if (flag_vtv_debug)
662 int len1 = IDENTIFIER_LENGTH
663 (DECL_NAME (vtbl_var_decl));
664 int len2 = strlen (vtable_name);
666 call_stmt = gimple_build_call
667 (verify_vtbl_ptr_fndecl, 4,
668 build1 (ADDR_EXPR,
669 TYPE_POINTER_TO
670 (TREE_TYPE (vtbl_var_decl)),
671 vtbl_var_decl),
672 lhs,
673 build_string_literal
674 (len1 + 1,
675 IDENTIFIER_POINTER
676 (DECL_NAME
677 (vtbl_var_decl))),
678 build_string_literal (len2 + 1,
679 vtable_name));
681 else
682 call_stmt = gimple_build_call
683 (verify_vtbl_ptr_fndecl, 2,
684 build1 (ADDR_EXPR,
685 TYPE_POINTER_TO
686 (TREE_TYPE (vtbl_var_decl)),
687 vtbl_var_decl),
688 lhs);
691 /* Create a new SSA_NAME var to hold the call's
692 return value, and make the call_stmt use the
693 variable for that purpose. */
694 tmp0 = make_temp_ssa_name (TREE_TYPE (lhs), NULL, "VTV");
695 gimple_call_set_lhs (call_stmt, tmp0);
696 update_stmt (call_stmt);
698 /* Replace all uses of lhs with tmp0. */
699 found = false;
700 imm_use_iterator iterator;
701 gimple use_stmt;
702 FOR_EACH_IMM_USE_STMT (use_stmt, iterator, lhs)
704 use_operand_p use_p;
705 if (use_stmt == call_stmt)
706 continue;
707 FOR_EACH_IMM_USE_ON_STMT (use_p, iterator)
708 SET_USE (use_p, tmp0);
709 update_stmt (use_stmt);
710 found = true;
713 gcc_assert (found);
715 /* Insert the new verification call just after the
716 statement that gets the vtable pointer out of the
717 object. */
718 gcc_assert (gsi_stmt (gsi_vtbl_assign) == stmt);
719 gsi_insert_after (&gsi_vtbl_assign, call_stmt,
720 GSI_NEW_STMT);
722 any_verification_calls_generated = true;
723 total_num_verified_vcalls++;
730 /* Definition of this optimization pass. */
732 namespace {
734 const pass_data pass_data_vtable_verify =
736 GIMPLE_PASS, /* type */
737 "vtable-verify", /* name */
738 OPTGROUP_NONE, /* optinfo_flags */
739 TV_VTABLE_VERIFICATION, /* tv_id */
740 ( PROP_cfg | PROP_ssa ), /* properties_required */
741 0, /* properties_provided */
742 0, /* properties_destroyed */
743 0, /* todo_flags_start */
744 TODO_update_ssa, /* todo_flags_finish */
747 class pass_vtable_verify : public gimple_opt_pass
749 public:
750 pass_vtable_verify (gcc::context *ctxt)
751 : gimple_opt_pass (pass_data_vtable_verify, ctxt)
754 /* opt_pass methods: */
755 virtual bool gate (function *) { return (flag_vtable_verify); }
756 virtual unsigned int execute (function *);
758 }; // class pass_vtable_verify
760 /* Loop through all the basic blocks in the current function, passing them to
761 verify_bb_vtables, which searches for virtual calls, and inserts
762 calls to __VLTVerifyVtablePointer. */
764 unsigned int
765 pass_vtable_verify::execute (function *fun)
767 unsigned int ret = 1;
768 basic_block bb;
770 FOR_ALL_BB_FN (bb, fun)
771 verify_bb_vtables (bb);
773 return ret;
776 } // anon namespace
778 gimple_opt_pass *
779 make_pass_vtable_verify (gcc::context *ctxt)
781 return new pass_vtable_verify (ctxt);
784 #include "gt-vtable-verify.h"