1 /* AddressSanitizer, a fast memory error detector.
2 Copyright (C) 2012-2013 Free Software Foundation, Inc.
3 Contributed by Kostya Serebryany <kcc@google.com>
5 This file is part of GCC.
7 GCC is free software; you can redistribute it and/or modify it under
8 the terms of the GNU General Public License as published by the Free
9 Software Foundation; either version 3, or (at your option) any later
12 GCC is distributed in the hope that it will be useful, but WITHOUT ANY
13 WARRANTY; without even the implied warranty of MERCHANTABILITY or
14 FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
17 You should have received a copy of the GNU General Public License
18 along with GCC; see the file COPYING3. If not see
19 <http://www.gnu.org/licenses/>. */
24 #include "coretypes.h"
26 #include "hash-table.h"
27 #include "basic-block.h"
28 #include "tree-ssa-alias.h"
29 #include "internal-fn.h"
30 #include "gimple-expr.h"
34 #include "gimple-iterator.h"
37 #include "stor-layout.h"
38 #include "tree-iterator.h"
40 #include "stringpool.h"
41 #include "tree-ssanames.h"
42 #include "tree-pass.h"
44 #include "gimple-pretty-print.h"
50 #include "langhooks.h"
51 #include "alloc-pool.h"
53 #include "gimple-builder.h"
56 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
57 with <2x slowdown on average.
59 The tool consists of two parts:
60 instrumentation module (this file) and a run-time library.
61 The instrumentation module adds a run-time check before every memory insn.
62 For a 8- or 16- byte load accessing address X:
63 ShadowAddr = (X >> 3) + Offset
64 ShadowValue = *(char*)ShadowAddr; // *(short*) for 16-byte access.
66 __asan_report_load8(X);
67 For a load of N bytes (N=1, 2 or 4) from address X:
68 ShadowAddr = (X >> 3) + Offset
69 ShadowValue = *(char*)ShadowAddr;
71 if ((X & 7) + N - 1 > ShadowValue)
72 __asan_report_loadN(X);
73 Stores are instrumented similarly, but using __asan_report_storeN functions.
74 A call too __asan_init_vN() is inserted to the list of module CTORs.
75 N is the version number of the AddressSanitizer API. The changes between the
76 API versions are listed in libsanitizer/asan/asan_interface_internal.h.
78 The run-time library redefines malloc (so that redzone are inserted around
79 the allocated memory) and free (so that reuse of free-ed memory is delayed),
80 provides __asan_report* and __asan_init_vN functions.
83 http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerAlgorithm
85 The current implementation supports detection of out-of-bounds and
86 use-after-free in the heap, on the stack and for global variables.
88 [Protection of stack variables]
90 To understand how detection of out-of-bounds and use-after-free works
91 for stack variables, lets look at this example on x86_64 where the
106 For this function, the stack protected by asan will be organized as
107 follows, from the top of the stack to the bottom:
109 Slot 1/ [red zone of 32 bytes called 'RIGHT RedZone']
111 Slot 2/ [8 bytes of red zone, that adds up to the space of 'a' to make
112 the next slot be 32 bytes aligned; this one is called Partial
113 Redzone; this 32 bytes alignment is an asan constraint]
115 Slot 3/ [24 bytes for variable 'a']
117 Slot 4/ [red zone of 32 bytes called 'Middle RedZone']
119 Slot 5/ [24 bytes of Partial Red Zone (similar to slot 2]
121 Slot 6/ [8 bytes for variable 'b']
123 Slot 7/ [32 bytes of Red Zone at the bottom of the stack, called
126 The 32 bytes of LEFT red zone at the bottom of the stack can be
129 1/ The first 8 bytes contain a magical asan number that is always
132 2/ The following 8 bytes contains a pointer to a string (to be
133 parsed at runtime by the runtime asan library), which format is
136 "<function-name> <space> <num-of-variables-on-the-stack>
137 (<32-bytes-aligned-offset-in-bytes-of-variable> <space>
138 <length-of-var-in-bytes> ){n} "
140 where '(...){n}' means the content inside the parenthesis occurs 'n'
141 times, with 'n' being the number of variables on the stack.
143 3/ The following 8 bytes contain the PC of the current function which
144 will be used by the run-time library to print an error message.
146 4/ The following 8 bytes are reserved for internal use by the run-time.
148 The shadow memory for that stack layout is going to look like this:
150 - content of shadow memory 8 bytes for slot 7: 0xF1F1F1F1.
151 The F1 byte pattern is a magic number called
152 ASAN_STACK_MAGIC_LEFT and is a way for the runtime to know that
153 the memory for that shadow byte is part of a the LEFT red zone
154 intended to seat at the bottom of the variables on the stack.
156 - content of shadow memory 8 bytes for slots 6 and 5:
157 0xF4F4F400. The F4 byte pattern is a magic number
158 called ASAN_STACK_MAGIC_PARTIAL. It flags the fact that the
159 memory region for this shadow byte is a PARTIAL red zone
160 intended to pad a variable A, so that the slot following
161 {A,padding} is 32 bytes aligned.
163 Note that the fact that the least significant byte of this
164 shadow memory content is 00 means that 8 bytes of its
165 corresponding memory (which corresponds to the memory of
166 variable 'b') is addressable.
168 - content of shadow memory 8 bytes for slot 4: 0xF2F2F2F2.
169 The F2 byte pattern is a magic number called
170 ASAN_STACK_MAGIC_MIDDLE. It flags the fact that the memory
171 region for this shadow byte is a MIDDLE red zone intended to
172 seat between two 32 aligned slots of {variable,padding}.
174 - content of shadow memory 8 bytes for slot 3 and 2:
175 0xF4000000. This represents is the concatenation of
176 variable 'a' and the partial red zone following it, like what we
177 had for variable 'b'. The least significant 3 bytes being 00
178 means that the 3 bytes of variable 'a' are addressable.
180 - content of shadow memory 8 bytes for slot 1: 0xF3F3F3F3.
181 The F3 byte pattern is a magic number called
182 ASAN_STACK_MAGIC_RIGHT. It flags the fact that the memory
183 region for this shadow byte is a RIGHT red zone intended to seat
184 at the top of the variables of the stack.
186 Note that the real variable layout is done in expand_used_vars in
187 cfgexpand.c. As far as Address Sanitizer is concerned, it lays out
188 stack variables as well as the different red zones, emits some
189 prologue code to populate the shadow memory as to poison (mark as
190 non-accessible) the regions of the red zones and mark the regions of
191 stack variables as accessible, and emit some epilogue code to
192 un-poison (mark as accessible) the regions of red zones right before
195 [Protection of global variables]
197 The basic idea is to insert a red zone between two global variables
198 and install a constructor function that calls the asan runtime to do
199 the populating of the relevant shadow memory regions at load time.
201 So the global variables are laid out as to insert a red zone between
202 them. The size of the red zones is so that each variable starts on a
205 Then a constructor function is installed so that, for each global
206 variable, it calls the runtime asan library function
207 __asan_register_globals_with an instance of this type:
211 // Address of the beginning of the global variable.
214 // Initial size of the global variable.
217 // Size of the global variable + size of the red zone. This
218 // size is 32 bytes aligned.
219 uptr __size_with_redzone;
221 // Name of the global variable.
224 // Name of the module where the global variable is declared.
225 const void *__module_name;
227 // 1 if it has dynamic initialization, 0 otherwise.
228 uptr __has_dynamic_init;
231 A destructor function that calls the runtime asan library function
232 _asan_unregister_globals is also installed. */
234 alias_set_type asan_shadow_set
= -1;
236 /* Pointer types to 1 resp. 2 byte integers in shadow memory. A separate
237 alias set is used for all shadow memory accesses. */
238 static GTY(()) tree shadow_ptr_types
[2];
240 /* Hashtable support for memory references used by gimple
243 /* This type represents a reference to a memory region. */
246 /* The expression of the beginning of the memory region. */
249 /* The size of the access (can be 1, 2, 4, 8, 16 for now). */
253 static alloc_pool asan_mem_ref_alloc_pool
;
255 /* This creates the alloc pool used to store the instances of
256 asan_mem_ref that are stored in the hash table asan_mem_ref_ht. */
259 asan_mem_ref_get_alloc_pool ()
261 if (asan_mem_ref_alloc_pool
== NULL
)
262 asan_mem_ref_alloc_pool
= create_alloc_pool ("asan_mem_ref",
263 sizeof (asan_mem_ref
),
265 return asan_mem_ref_alloc_pool
;
269 /* Initializes an instance of asan_mem_ref. */
272 asan_mem_ref_init (asan_mem_ref
*ref
, tree start
, char access_size
)
275 ref
->access_size
= access_size
;
278 /* Allocates memory for an instance of asan_mem_ref into the memory
279 pool returned by asan_mem_ref_get_alloc_pool and initialize it.
280 START is the address of (or the expression pointing to) the
281 beginning of memory reference. ACCESS_SIZE is the size of the
282 access to the referenced memory. */
285 asan_mem_ref_new (tree start
, char access_size
)
288 (asan_mem_ref
*) pool_alloc (asan_mem_ref_get_alloc_pool ());
290 asan_mem_ref_init (ref
, start
, access_size
);
294 /* This builds and returns a pointer to the end of the memory region
295 that starts at START and of length LEN. */
298 asan_mem_ref_get_end (tree start
, tree len
)
300 if (len
== NULL_TREE
|| integer_zerop (len
))
303 return fold_build2 (POINTER_PLUS_EXPR
, TREE_TYPE (start
), start
, len
);
306 /* Return a tree expression that represents the end of the referenced
307 memory region. Beware that this function can actually build a new
311 asan_mem_ref_get_end (const asan_mem_ref
*ref
, tree len
)
313 return asan_mem_ref_get_end (ref
->start
, len
);
316 struct asan_mem_ref_hasher
317 : typed_noop_remove
<asan_mem_ref
>
319 typedef asan_mem_ref value_type
;
320 typedef asan_mem_ref compare_type
;
322 static inline hashval_t
hash (const value_type
*);
323 static inline bool equal (const value_type
*, const compare_type
*);
326 /* Hash a memory reference. */
329 asan_mem_ref_hasher::hash (const asan_mem_ref
*mem_ref
)
331 hashval_t h
= iterative_hash_expr (mem_ref
->start
, 0);
332 h
= iterative_hash_hashval_t (h
, mem_ref
->access_size
);
336 /* Compare two memory references. We accept the length of either
337 memory references to be NULL_TREE. */
340 asan_mem_ref_hasher::equal (const asan_mem_ref
*m1
,
341 const asan_mem_ref
*m2
)
343 return (m1
->access_size
== m2
->access_size
344 && operand_equal_p (m1
->start
, m2
->start
, 0));
347 static hash_table
<asan_mem_ref_hasher
> asan_mem_ref_ht
;
349 /* Returns a reference to the hash table containing memory references.
350 This function ensures that the hash table is created. Note that
351 this hash table is updated by the function
352 update_mem_ref_hash_table. */
354 static hash_table
<asan_mem_ref_hasher
> &
355 get_mem_ref_hash_table ()
357 if (!asan_mem_ref_ht
.is_created ())
358 asan_mem_ref_ht
.create (10);
360 return asan_mem_ref_ht
;
363 /* Clear all entries from the memory references hash table. */
366 empty_mem_ref_hash_table ()
368 if (asan_mem_ref_ht
.is_created ())
369 asan_mem_ref_ht
.empty ();
372 /* Free the memory references hash table. */
375 free_mem_ref_resources ()
377 if (asan_mem_ref_ht
.is_created ())
378 asan_mem_ref_ht
.dispose ();
380 if (asan_mem_ref_alloc_pool
)
382 free_alloc_pool (asan_mem_ref_alloc_pool
);
383 asan_mem_ref_alloc_pool
= NULL
;
387 /* Return true iff the memory reference REF has been instrumented. */
390 has_mem_ref_been_instrumented (tree ref
, char access_size
)
393 asan_mem_ref_init (&r
, ref
, access_size
);
395 return (get_mem_ref_hash_table ().find (&r
) != NULL
);
398 /* Return true iff the memory reference REF has been instrumented. */
401 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
)
403 return has_mem_ref_been_instrumented (ref
->start
, ref
->access_size
);
406 /* Return true iff access to memory region starting at REF and of
407 length LEN has been instrumented. */
410 has_mem_ref_been_instrumented (const asan_mem_ref
*ref
, tree len
)
412 /* First let's see if the address of the beginning of REF has been
414 if (!has_mem_ref_been_instrumented (ref
))
419 /* Let's see if the end of the region has been instrumented. */
420 if (!has_mem_ref_been_instrumented (asan_mem_ref_get_end (ref
, len
),
427 /* Set REF to the memory reference present in a gimple assignment
428 ASSIGNMENT. Return true upon successful completion, false
432 get_mem_ref_of_assignment (const gimple assignment
,
436 gcc_assert (gimple_assign_single_p (assignment
));
438 if (gimple_store_p (assignment
)
439 && !gimple_clobber_p (assignment
))
441 ref
->start
= gimple_assign_lhs (assignment
);
442 *ref_is_store
= true;
444 else if (gimple_assign_load_p (assignment
))
446 ref
->start
= gimple_assign_rhs1 (assignment
);
447 *ref_is_store
= false;
452 ref
->access_size
= int_size_in_bytes (TREE_TYPE (ref
->start
));
456 /* Return the memory references contained in a gimple statement
457 representing a builtin call that has to do with memory access. */
460 get_mem_refs_of_builtin_call (const gimple call
,
472 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
474 tree callee
= gimple_call_fndecl (call
);
475 tree source0
= NULL_TREE
, source1
= NULL_TREE
,
476 dest
= NULL_TREE
, len
= NULL_TREE
;
477 bool is_store
= true, got_reference_p
= false;
478 char access_size
= 1;
480 switch (DECL_FUNCTION_CODE (callee
))
482 /* (s, s, n) style memops. */
484 case BUILT_IN_MEMCMP
:
485 source0
= gimple_call_arg (call
, 0);
486 source1
= gimple_call_arg (call
, 1);
487 len
= gimple_call_arg (call
, 2);
490 /* (src, dest, n) style memops. */
492 source0
= gimple_call_arg (call
, 0);
493 dest
= gimple_call_arg (call
, 1);
494 len
= gimple_call_arg (call
, 2);
497 /* (dest, src, n) style memops. */
498 case BUILT_IN_MEMCPY
:
499 case BUILT_IN_MEMCPY_CHK
:
500 case BUILT_IN_MEMMOVE
:
501 case BUILT_IN_MEMMOVE_CHK
:
502 case BUILT_IN_MEMPCPY
:
503 case BUILT_IN_MEMPCPY_CHK
:
504 dest
= gimple_call_arg (call
, 0);
505 source0
= gimple_call_arg (call
, 1);
506 len
= gimple_call_arg (call
, 2);
509 /* (dest, n) style memops. */
511 dest
= gimple_call_arg (call
, 0);
512 len
= gimple_call_arg (call
, 1);
515 /* (dest, x, n) style memops*/
516 case BUILT_IN_MEMSET
:
517 case BUILT_IN_MEMSET_CHK
:
518 dest
= gimple_call_arg (call
, 0);
519 len
= gimple_call_arg (call
, 2);
522 case BUILT_IN_STRLEN
:
523 source0
= gimple_call_arg (call
, 0);
524 len
= gimple_call_lhs (call
);
527 /* And now the __atomic* and __sync builtins.
528 These are handled differently from the classical memory memory
529 access builtins above. */
531 case BUILT_IN_ATOMIC_LOAD_1
:
532 case BUILT_IN_ATOMIC_LOAD_2
:
533 case BUILT_IN_ATOMIC_LOAD_4
:
534 case BUILT_IN_ATOMIC_LOAD_8
:
535 case BUILT_IN_ATOMIC_LOAD_16
:
539 case BUILT_IN_SYNC_FETCH_AND_ADD_1
:
540 case BUILT_IN_SYNC_FETCH_AND_ADD_2
:
541 case BUILT_IN_SYNC_FETCH_AND_ADD_4
:
542 case BUILT_IN_SYNC_FETCH_AND_ADD_8
:
543 case BUILT_IN_SYNC_FETCH_AND_ADD_16
:
545 case BUILT_IN_SYNC_FETCH_AND_SUB_1
:
546 case BUILT_IN_SYNC_FETCH_AND_SUB_2
:
547 case BUILT_IN_SYNC_FETCH_AND_SUB_4
:
548 case BUILT_IN_SYNC_FETCH_AND_SUB_8
:
549 case BUILT_IN_SYNC_FETCH_AND_SUB_16
:
551 case BUILT_IN_SYNC_FETCH_AND_OR_1
:
552 case BUILT_IN_SYNC_FETCH_AND_OR_2
:
553 case BUILT_IN_SYNC_FETCH_AND_OR_4
:
554 case BUILT_IN_SYNC_FETCH_AND_OR_8
:
555 case BUILT_IN_SYNC_FETCH_AND_OR_16
:
557 case BUILT_IN_SYNC_FETCH_AND_AND_1
:
558 case BUILT_IN_SYNC_FETCH_AND_AND_2
:
559 case BUILT_IN_SYNC_FETCH_AND_AND_4
:
560 case BUILT_IN_SYNC_FETCH_AND_AND_8
:
561 case BUILT_IN_SYNC_FETCH_AND_AND_16
:
563 case BUILT_IN_SYNC_FETCH_AND_XOR_1
:
564 case BUILT_IN_SYNC_FETCH_AND_XOR_2
:
565 case BUILT_IN_SYNC_FETCH_AND_XOR_4
:
566 case BUILT_IN_SYNC_FETCH_AND_XOR_8
:
567 case BUILT_IN_SYNC_FETCH_AND_XOR_16
:
569 case BUILT_IN_SYNC_FETCH_AND_NAND_1
:
570 case BUILT_IN_SYNC_FETCH_AND_NAND_2
:
571 case BUILT_IN_SYNC_FETCH_AND_NAND_4
:
572 case BUILT_IN_SYNC_FETCH_AND_NAND_8
:
574 case BUILT_IN_SYNC_ADD_AND_FETCH_1
:
575 case BUILT_IN_SYNC_ADD_AND_FETCH_2
:
576 case BUILT_IN_SYNC_ADD_AND_FETCH_4
:
577 case BUILT_IN_SYNC_ADD_AND_FETCH_8
:
578 case BUILT_IN_SYNC_ADD_AND_FETCH_16
:
580 case BUILT_IN_SYNC_SUB_AND_FETCH_1
:
581 case BUILT_IN_SYNC_SUB_AND_FETCH_2
:
582 case BUILT_IN_SYNC_SUB_AND_FETCH_4
:
583 case BUILT_IN_SYNC_SUB_AND_FETCH_8
:
584 case BUILT_IN_SYNC_SUB_AND_FETCH_16
:
586 case BUILT_IN_SYNC_OR_AND_FETCH_1
:
587 case BUILT_IN_SYNC_OR_AND_FETCH_2
:
588 case BUILT_IN_SYNC_OR_AND_FETCH_4
:
589 case BUILT_IN_SYNC_OR_AND_FETCH_8
:
590 case BUILT_IN_SYNC_OR_AND_FETCH_16
:
592 case BUILT_IN_SYNC_AND_AND_FETCH_1
:
593 case BUILT_IN_SYNC_AND_AND_FETCH_2
:
594 case BUILT_IN_SYNC_AND_AND_FETCH_4
:
595 case BUILT_IN_SYNC_AND_AND_FETCH_8
:
596 case BUILT_IN_SYNC_AND_AND_FETCH_16
:
598 case BUILT_IN_SYNC_XOR_AND_FETCH_1
:
599 case BUILT_IN_SYNC_XOR_AND_FETCH_2
:
600 case BUILT_IN_SYNC_XOR_AND_FETCH_4
:
601 case BUILT_IN_SYNC_XOR_AND_FETCH_8
:
602 case BUILT_IN_SYNC_XOR_AND_FETCH_16
:
604 case BUILT_IN_SYNC_NAND_AND_FETCH_1
:
605 case BUILT_IN_SYNC_NAND_AND_FETCH_2
:
606 case BUILT_IN_SYNC_NAND_AND_FETCH_4
:
607 case BUILT_IN_SYNC_NAND_AND_FETCH_8
:
609 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_1
:
610 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_2
:
611 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_4
:
612 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_8
:
613 case BUILT_IN_SYNC_BOOL_COMPARE_AND_SWAP_16
:
615 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_1
:
616 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_2
:
617 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_4
:
618 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_8
:
619 case BUILT_IN_SYNC_VAL_COMPARE_AND_SWAP_16
:
621 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_1
:
622 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_2
:
623 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_4
:
624 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_8
:
625 case BUILT_IN_SYNC_LOCK_TEST_AND_SET_16
:
627 case BUILT_IN_SYNC_LOCK_RELEASE_1
:
628 case BUILT_IN_SYNC_LOCK_RELEASE_2
:
629 case BUILT_IN_SYNC_LOCK_RELEASE_4
:
630 case BUILT_IN_SYNC_LOCK_RELEASE_8
:
631 case BUILT_IN_SYNC_LOCK_RELEASE_16
:
633 case BUILT_IN_ATOMIC_EXCHANGE_1
:
634 case BUILT_IN_ATOMIC_EXCHANGE_2
:
635 case BUILT_IN_ATOMIC_EXCHANGE_4
:
636 case BUILT_IN_ATOMIC_EXCHANGE_8
:
637 case BUILT_IN_ATOMIC_EXCHANGE_16
:
639 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_1
:
640 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_2
:
641 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_4
:
642 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_8
:
643 case BUILT_IN_ATOMIC_COMPARE_EXCHANGE_16
:
645 case BUILT_IN_ATOMIC_STORE_1
:
646 case BUILT_IN_ATOMIC_STORE_2
:
647 case BUILT_IN_ATOMIC_STORE_4
:
648 case BUILT_IN_ATOMIC_STORE_8
:
649 case BUILT_IN_ATOMIC_STORE_16
:
651 case BUILT_IN_ATOMIC_ADD_FETCH_1
:
652 case BUILT_IN_ATOMIC_ADD_FETCH_2
:
653 case BUILT_IN_ATOMIC_ADD_FETCH_4
:
654 case BUILT_IN_ATOMIC_ADD_FETCH_8
:
655 case BUILT_IN_ATOMIC_ADD_FETCH_16
:
657 case BUILT_IN_ATOMIC_SUB_FETCH_1
:
658 case BUILT_IN_ATOMIC_SUB_FETCH_2
:
659 case BUILT_IN_ATOMIC_SUB_FETCH_4
:
660 case BUILT_IN_ATOMIC_SUB_FETCH_8
:
661 case BUILT_IN_ATOMIC_SUB_FETCH_16
:
663 case BUILT_IN_ATOMIC_AND_FETCH_1
:
664 case BUILT_IN_ATOMIC_AND_FETCH_2
:
665 case BUILT_IN_ATOMIC_AND_FETCH_4
:
666 case BUILT_IN_ATOMIC_AND_FETCH_8
:
667 case BUILT_IN_ATOMIC_AND_FETCH_16
:
669 case BUILT_IN_ATOMIC_NAND_FETCH_1
:
670 case BUILT_IN_ATOMIC_NAND_FETCH_2
:
671 case BUILT_IN_ATOMIC_NAND_FETCH_4
:
672 case BUILT_IN_ATOMIC_NAND_FETCH_8
:
673 case BUILT_IN_ATOMIC_NAND_FETCH_16
:
675 case BUILT_IN_ATOMIC_XOR_FETCH_1
:
676 case BUILT_IN_ATOMIC_XOR_FETCH_2
:
677 case BUILT_IN_ATOMIC_XOR_FETCH_4
:
678 case BUILT_IN_ATOMIC_XOR_FETCH_8
:
679 case BUILT_IN_ATOMIC_XOR_FETCH_16
:
681 case BUILT_IN_ATOMIC_OR_FETCH_1
:
682 case BUILT_IN_ATOMIC_OR_FETCH_2
:
683 case BUILT_IN_ATOMIC_OR_FETCH_4
:
684 case BUILT_IN_ATOMIC_OR_FETCH_8
:
685 case BUILT_IN_ATOMIC_OR_FETCH_16
:
687 case BUILT_IN_ATOMIC_FETCH_ADD_1
:
688 case BUILT_IN_ATOMIC_FETCH_ADD_2
:
689 case BUILT_IN_ATOMIC_FETCH_ADD_4
:
690 case BUILT_IN_ATOMIC_FETCH_ADD_8
:
691 case BUILT_IN_ATOMIC_FETCH_ADD_16
:
693 case BUILT_IN_ATOMIC_FETCH_SUB_1
:
694 case BUILT_IN_ATOMIC_FETCH_SUB_2
:
695 case BUILT_IN_ATOMIC_FETCH_SUB_4
:
696 case BUILT_IN_ATOMIC_FETCH_SUB_8
:
697 case BUILT_IN_ATOMIC_FETCH_SUB_16
:
699 case BUILT_IN_ATOMIC_FETCH_AND_1
:
700 case BUILT_IN_ATOMIC_FETCH_AND_2
:
701 case BUILT_IN_ATOMIC_FETCH_AND_4
:
702 case BUILT_IN_ATOMIC_FETCH_AND_8
:
703 case BUILT_IN_ATOMIC_FETCH_AND_16
:
705 case BUILT_IN_ATOMIC_FETCH_NAND_1
:
706 case BUILT_IN_ATOMIC_FETCH_NAND_2
:
707 case BUILT_IN_ATOMIC_FETCH_NAND_4
:
708 case BUILT_IN_ATOMIC_FETCH_NAND_8
:
709 case BUILT_IN_ATOMIC_FETCH_NAND_16
:
711 case BUILT_IN_ATOMIC_FETCH_XOR_1
:
712 case BUILT_IN_ATOMIC_FETCH_XOR_2
:
713 case BUILT_IN_ATOMIC_FETCH_XOR_4
:
714 case BUILT_IN_ATOMIC_FETCH_XOR_8
:
715 case BUILT_IN_ATOMIC_FETCH_XOR_16
:
717 case BUILT_IN_ATOMIC_FETCH_OR_1
:
718 case BUILT_IN_ATOMIC_FETCH_OR_2
:
719 case BUILT_IN_ATOMIC_FETCH_OR_4
:
720 case BUILT_IN_ATOMIC_FETCH_OR_8
:
721 case BUILT_IN_ATOMIC_FETCH_OR_16
:
723 dest
= gimple_call_arg (call
, 0);
724 /* DEST represents the address of a memory location.
725 instrument_derefs wants the memory location, so lets
726 dereference the address DEST before handing it to
727 instrument_derefs. */
728 if (TREE_CODE (dest
) == ADDR_EXPR
)
729 dest
= TREE_OPERAND (dest
, 0);
730 else if (TREE_CODE (dest
) == SSA_NAME
|| TREE_CODE (dest
) == INTEGER_CST
)
731 dest
= build2 (MEM_REF
, TREE_TYPE (TREE_TYPE (dest
)),
732 dest
, build_int_cst (TREE_TYPE (dest
), 0));
736 access_size
= int_size_in_bytes (TREE_TYPE (dest
));
740 /* The other builtins memory access are not instrumented in this
741 function because they either don't have any length parameter,
742 or their length parameter is just a limit. */
746 if (len
!= NULL_TREE
)
748 if (source0
!= NULL_TREE
)
750 src0
->start
= source0
;
751 src0
->access_size
= access_size
;
753 *src0_is_store
= false;
756 if (source1
!= NULL_TREE
)
758 src1
->start
= source1
;
759 src1
->access_size
= access_size
;
761 *src1_is_store
= false;
764 if (dest
!= NULL_TREE
)
767 dst
->access_size
= access_size
;
769 *dst_is_store
= true;
772 got_reference_p
= true;
777 dst
->access_size
= access_size
;
778 *dst_len
= NULL_TREE
;
779 *dst_is_store
= is_store
;
780 *dest_is_deref
= true;
781 got_reference_p
= true;
784 return got_reference_p
;
787 /* Return true iff a given gimple statement has been instrumented.
788 Note that the statement is "defined" by the memory references it
792 has_stmt_been_instrumented_p (gimple stmt
)
794 if (gimple_assign_single_p (stmt
))
798 asan_mem_ref_init (&r
, NULL
, 1);
800 if (get_mem_ref_of_assignment (stmt
, &r
, &r_is_store
))
801 return has_mem_ref_been_instrumented (&r
);
803 else if (gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
))
805 asan_mem_ref src0
, src1
, dest
;
806 asan_mem_ref_init (&src0
, NULL
, 1);
807 asan_mem_ref_init (&src1
, NULL
, 1);
808 asan_mem_ref_init (&dest
, NULL
, 1);
810 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
811 bool src0_is_store
= false, src1_is_store
= false,
812 dest_is_store
= false, dest_is_deref
= false;
813 if (get_mem_refs_of_builtin_call (stmt
,
814 &src0
, &src0_len
, &src0_is_store
,
815 &src1
, &src1_len
, &src1_is_store
,
816 &dest
, &dest_len
, &dest_is_store
,
819 if (src0
.start
!= NULL_TREE
820 && !has_mem_ref_been_instrumented (&src0
, src0_len
))
823 if (src1
.start
!= NULL_TREE
824 && !has_mem_ref_been_instrumented (&src1
, src1_len
))
827 if (dest
.start
!= NULL_TREE
828 && !has_mem_ref_been_instrumented (&dest
, dest_len
))
837 /* Insert a memory reference into the hash table. */
840 update_mem_ref_hash_table (tree ref
, char access_size
)
842 hash_table
<asan_mem_ref_hasher
> ht
= get_mem_ref_hash_table ();
845 asan_mem_ref_init (&r
, ref
, access_size
);
847 asan_mem_ref
**slot
= ht
.find_slot (&r
, INSERT
);
849 *slot
= asan_mem_ref_new (ref
, access_size
);
852 /* Initialize shadow_ptr_types array. */
855 asan_init_shadow_ptr_types (void)
857 asan_shadow_set
= new_alias_set ();
858 shadow_ptr_types
[0] = build_distinct_type_copy (signed_char_type_node
);
859 TYPE_ALIAS_SET (shadow_ptr_types
[0]) = asan_shadow_set
;
860 shadow_ptr_types
[0] = build_pointer_type (shadow_ptr_types
[0]);
861 shadow_ptr_types
[1] = build_distinct_type_copy (short_integer_type_node
);
862 TYPE_ALIAS_SET (shadow_ptr_types
[1]) = asan_shadow_set
;
863 shadow_ptr_types
[1] = build_pointer_type (shadow_ptr_types
[1]);
864 initialize_sanitizer_builtins ();
867 /* Create ADDR_EXPR of STRING_CST with the PP pretty printer text. */
870 asan_pp_string (pretty_printer
*pp
)
872 const char *buf
= pp_formatted_text (pp
);
873 size_t len
= strlen (buf
);
874 tree ret
= build_string (len
+ 1, buf
);
876 = build_array_type (TREE_TYPE (shadow_ptr_types
[0]),
877 build_index_type (size_int (len
)));
878 TREE_READONLY (ret
) = 1;
879 TREE_STATIC (ret
) = 1;
880 return build1 (ADDR_EXPR
, shadow_ptr_types
[0], ret
);
883 /* Return a CONST_INT representing 4 subsequent shadow memory bytes. */
886 asan_shadow_cst (unsigned char shadow_bytes
[4])
889 unsigned HOST_WIDE_INT val
= 0;
890 gcc_assert (WORDS_BIG_ENDIAN
== BYTES_BIG_ENDIAN
);
891 for (i
= 0; i
< 4; i
++)
892 val
|= (unsigned HOST_WIDE_INT
) shadow_bytes
[BYTES_BIG_ENDIAN
? 3 - i
: i
]
893 << (BITS_PER_UNIT
* i
);
894 return gen_int_mode (val
, SImode
);
897 /* Clear shadow memory at SHADOW_MEM, LEN bytes. Can't call a library call here
901 asan_clear_shadow (rtx shadow_mem
, HOST_WIDE_INT len
)
903 rtx insn
, insns
, top_label
, end
, addr
, tmp
, jump
;
906 clear_storage (shadow_mem
, GEN_INT (len
), BLOCK_OP_NORMAL
);
907 insns
= get_insns ();
909 for (insn
= insns
; insn
; insn
= NEXT_INSN (insn
))
912 if (insn
== NULL_RTX
)
918 gcc_assert ((len
& 3) == 0);
919 top_label
= gen_label_rtx ();
920 addr
= copy_to_mode_reg (Pmode
, XEXP (shadow_mem
, 0));
921 shadow_mem
= adjust_automodify_address (shadow_mem
, SImode
, addr
, 0);
922 end
= force_reg (Pmode
, plus_constant (Pmode
, addr
, len
));
923 emit_label (top_label
);
925 emit_move_insn (shadow_mem
, const0_rtx
);
926 tmp
= expand_simple_binop (Pmode
, PLUS
, addr
, gen_int_mode (4, Pmode
), addr
,
927 true, OPTAB_LIB_WIDEN
);
929 emit_move_insn (addr
, tmp
);
930 emit_cmp_and_jump_insns (addr
, end
, LT
, NULL_RTX
, Pmode
, true, top_label
);
931 jump
= get_last_insn ();
932 gcc_assert (JUMP_P (jump
));
933 add_int_reg_note (jump
, REG_BR_PROB
, REG_BR_PROB_BASE
* 80 / 100);
937 asan_function_start (void)
939 section
*fnsec
= function_section (current_function_decl
);
940 switch_to_section (fnsec
);
941 ASM_OUTPUT_DEBUG_LABEL (asm_out_file
, "LASANPC",
942 current_function_funcdef_no
);
945 /* Insert code to protect stack vars. The prologue sequence should be emitted
946 directly, epilogue sequence returned. BASE is the register holding the
947 stack base, against which OFFSETS array offsets are relative to, OFFSETS
948 array contains pairs of offsets in reverse order, always the end offset
949 of some gap that needs protection followed by starting offset,
950 and DECLS is an array of representative decls for each var partition.
951 LENGTH is the length of the OFFSETS array, DECLS array is LENGTH / 2 - 1
952 elements long (OFFSETS include gap before the first variable as well
953 as gaps after each stack variable). */
956 asan_emit_stack_protection (rtx base
, HOST_WIDE_INT
*offsets
, tree
*decls
,
959 rtx shadow_base
, shadow_mem
, ret
, mem
;
961 unsigned char shadow_bytes
[4];
962 HOST_WIDE_INT base_offset
= offsets
[length
- 1], offset
, prev_offset
;
963 HOST_WIDE_INT last_offset
, last_size
;
965 unsigned char cur_shadow_byte
= ASAN_STACK_MAGIC_LEFT
;
966 tree str_cst
, decl
, id
;
968 if (shadow_ptr_types
[0] == NULL_TREE
)
969 asan_init_shadow_ptr_types ();
971 /* First of all, prepare the description string. */
972 pretty_printer asan_pp
;
974 pp_decimal_int (&asan_pp
, length
/ 2 - 1);
976 for (l
= length
- 2; l
; l
-= 2)
978 tree decl
= decls
[l
/ 2 - 1];
979 pp_wide_integer (&asan_pp
, offsets
[l
] - base_offset
);
981 pp_wide_integer (&asan_pp
, offsets
[l
- 1] - offsets
[l
]);
983 if (DECL_P (decl
) && DECL_NAME (decl
))
985 pp_decimal_int (&asan_pp
, IDENTIFIER_LENGTH (DECL_NAME (decl
)));
987 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
990 pp_string (&asan_pp
, "9 <unknown>");
993 str_cst
= asan_pp_string (&asan_pp
);
995 /* Emit the prologue sequence. */
996 base
= expand_binop (Pmode
, add_optab
, base
,
997 gen_int_mode (base_offset
, Pmode
),
998 NULL_RTX
, 1, OPTAB_DIRECT
);
999 mem
= gen_rtx_MEM (ptr_mode
, base
);
1000 emit_move_insn (mem
, gen_int_mode (ASAN_STACK_FRAME_MAGIC
, ptr_mode
));
1001 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1002 emit_move_insn (mem
, expand_normal (str_cst
));
1003 mem
= adjust_address (mem
, VOIDmode
, GET_MODE_SIZE (ptr_mode
));
1004 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASANPC", current_function_funcdef_no
);
1005 id
= get_identifier (buf
);
1006 decl
= build_decl (DECL_SOURCE_LOCATION (current_function_decl
),
1007 VAR_DECL
, id
, char_type_node
);
1008 SET_DECL_ASSEMBLER_NAME (decl
, id
);
1009 TREE_ADDRESSABLE (decl
) = 1;
1010 TREE_READONLY (decl
) = 1;
1011 DECL_ARTIFICIAL (decl
) = 1;
1012 DECL_IGNORED_P (decl
) = 1;
1013 TREE_STATIC (decl
) = 1;
1014 TREE_PUBLIC (decl
) = 0;
1015 TREE_USED (decl
) = 1;
1016 DECL_INITIAL (decl
) = decl
;
1017 TREE_ASM_WRITTEN (decl
) = 1;
1018 TREE_ASM_WRITTEN (id
) = 1;
1019 emit_move_insn (mem
, expand_normal (build_fold_addr_expr (decl
)));
1020 shadow_base
= expand_binop (Pmode
, lshr_optab
, base
,
1021 GEN_INT (ASAN_SHADOW_SHIFT
),
1022 NULL_RTX
, 1, OPTAB_DIRECT
);
1023 shadow_base
= expand_binop (Pmode
, add_optab
, shadow_base
,
1024 gen_int_mode (targetm
.asan_shadow_offset (),
1026 NULL_RTX
, 1, OPTAB_DIRECT
);
1027 gcc_assert (asan_shadow_set
!= -1
1028 && (ASAN_RED_ZONE_SIZE
>> ASAN_SHADOW_SHIFT
) == 4);
1029 shadow_mem
= gen_rtx_MEM (SImode
, shadow_base
);
1030 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1031 prev_offset
= base_offset
;
1032 for (l
= length
; l
; l
-= 2)
1035 cur_shadow_byte
= ASAN_STACK_MAGIC_RIGHT
;
1036 offset
= offsets
[l
- 1];
1037 if ((offset
- base_offset
) & (ASAN_RED_ZONE_SIZE
- 1))
1041 = base_offset
+ ((offset
- base_offset
)
1042 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1043 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1044 (aoff
- prev_offset
)
1045 >> ASAN_SHADOW_SHIFT
);
1047 for (i
= 0; i
< 4; i
++, aoff
+= (1 << ASAN_SHADOW_SHIFT
))
1050 if (aoff
< offset
- (1 << ASAN_SHADOW_SHIFT
) + 1)
1051 shadow_bytes
[i
] = 0;
1053 shadow_bytes
[i
] = offset
- aoff
;
1056 shadow_bytes
[i
] = ASAN_STACK_MAGIC_PARTIAL
;
1057 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1060 while (offset
<= offsets
[l
- 2] - ASAN_RED_ZONE_SIZE
)
1062 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1063 (offset
- prev_offset
)
1064 >> ASAN_SHADOW_SHIFT
);
1065 prev_offset
= offset
;
1066 memset (shadow_bytes
, cur_shadow_byte
, 4);
1067 emit_move_insn (shadow_mem
, asan_shadow_cst (shadow_bytes
));
1068 offset
+= ASAN_RED_ZONE_SIZE
;
1070 cur_shadow_byte
= ASAN_STACK_MAGIC_MIDDLE
;
1072 do_pending_stack_adjust ();
1074 /* Construct epilogue sequence. */
1077 shadow_mem
= gen_rtx_MEM (BLKmode
, shadow_base
);
1078 set_mem_alias_set (shadow_mem
, asan_shadow_set
);
1079 prev_offset
= base_offset
;
1080 last_offset
= base_offset
;
1082 for (l
= length
; l
; l
-= 2)
1084 offset
= base_offset
+ ((offsets
[l
- 1] - base_offset
)
1085 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
));
1086 if (last_offset
+ last_size
!= offset
)
1088 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1089 (last_offset
- prev_offset
)
1090 >> ASAN_SHADOW_SHIFT
);
1091 prev_offset
= last_offset
;
1092 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1093 last_offset
= offset
;
1096 last_size
+= base_offset
+ ((offsets
[l
- 2] - base_offset
)
1097 & ~(ASAN_RED_ZONE_SIZE
- HOST_WIDE_INT_1
))
1102 shadow_mem
= adjust_address (shadow_mem
, VOIDmode
,
1103 (last_offset
- prev_offset
)
1104 >> ASAN_SHADOW_SHIFT
);
1105 asan_clear_shadow (shadow_mem
, last_size
>> ASAN_SHADOW_SHIFT
);
1108 do_pending_stack_adjust ();
1115 /* Return true if DECL, a global var, might be overridden and needs
1116 therefore a local alias. */
1119 asan_needs_local_alias (tree decl
)
1121 return DECL_WEAK (decl
) || !targetm
.binds_local_p (decl
);
1124 /* Return true if DECL is a VAR_DECL that should be protected
1125 by Address Sanitizer, by appending a red zone with protected
1126 shadow memory after it and aligning it to at least
1127 ASAN_RED_ZONE_SIZE bytes. */
1130 asan_protect_global (tree decl
)
1134 if (TREE_CODE (decl
) == STRING_CST
)
1136 /* Instrument all STRING_CSTs except those created
1137 by asan_pp_string here. */
1138 if (shadow_ptr_types
[0] != NULL_TREE
1139 && TREE_CODE (TREE_TYPE (decl
)) == ARRAY_TYPE
1140 && TREE_TYPE (TREE_TYPE (decl
)) == TREE_TYPE (shadow_ptr_types
[0]))
1144 if (TREE_CODE (decl
) != VAR_DECL
1145 /* TLS vars aren't statically protectable. */
1146 || DECL_THREAD_LOCAL_P (decl
)
1147 /* Externs will be protected elsewhere. */
1148 || DECL_EXTERNAL (decl
)
1149 || !DECL_RTL_SET_P (decl
)
1150 /* Comdat vars pose an ABI problem, we can't know if
1151 the var that is selected by the linker will have
1153 || DECL_ONE_ONLY (decl
)
1154 /* Similarly for common vars. People can use -fno-common. */
1155 || (DECL_COMMON (decl
) && TREE_PUBLIC (decl
))
1156 /* Don't protect if using user section, often vars placed
1157 into user section from multiple TUs are then assumed
1158 to be an array of such vars, putting padding in there
1159 breaks this assumption. */
1160 || (DECL_SECTION_NAME (decl
) != NULL_TREE
1161 && !DECL_HAS_IMPLICIT_SECTION_NAME_P (decl
))
1162 || DECL_SIZE (decl
) == 0
1163 || ASAN_RED_ZONE_SIZE
* BITS_PER_UNIT
> MAX_OFILE_ALIGNMENT
1164 || !valid_constant_size_p (DECL_SIZE_UNIT (decl
))
1165 || DECL_ALIGN_UNIT (decl
) > 2 * ASAN_RED_ZONE_SIZE
)
1168 rtl
= DECL_RTL (decl
);
1169 if (!MEM_P (rtl
) || GET_CODE (XEXP (rtl
, 0)) != SYMBOL_REF
)
1171 symbol
= XEXP (rtl
, 0);
1173 if (CONSTANT_POOL_ADDRESS_P (symbol
)
1174 || TREE_CONSTANT_POOL_ADDRESS_P (symbol
))
1177 if (lookup_attribute ("weakref", DECL_ATTRIBUTES (decl
)))
1180 #ifndef ASM_OUTPUT_DEF
1181 if (asan_needs_local_alias (decl
))
1188 /* Construct a function tree for __asan_report_{load,store}{1,2,4,8,16}.
1189 IS_STORE is either 1 (for a store) or 0 (for a load).
1190 SIZE_IN_BYTES is one of 1, 2, 4, 8, 16. */
1193 report_error_func (bool is_store
, int size_in_bytes
)
1195 static enum built_in_function report
[2][5]
1196 = { { BUILT_IN_ASAN_REPORT_LOAD1
, BUILT_IN_ASAN_REPORT_LOAD2
,
1197 BUILT_IN_ASAN_REPORT_LOAD4
, BUILT_IN_ASAN_REPORT_LOAD8
,
1198 BUILT_IN_ASAN_REPORT_LOAD16
},
1199 { BUILT_IN_ASAN_REPORT_STORE1
, BUILT_IN_ASAN_REPORT_STORE2
,
1200 BUILT_IN_ASAN_REPORT_STORE4
, BUILT_IN_ASAN_REPORT_STORE8
,
1201 BUILT_IN_ASAN_REPORT_STORE16
} };
1202 return builtin_decl_implicit (report
[is_store
][exact_log2 (size_in_bytes
)]);
1205 #define PROB_VERY_UNLIKELY (REG_BR_PROB_BASE / 2000 - 1)
1206 #define PROB_ALWAYS (REG_BR_PROB_BASE)
1208 /* Split the current basic block and create a condition statement
1209 insertion point right before or after the statement pointed to by
1210 ITER. Return an iterator to the point at which the caller might
1211 safely insert the condition statement.
1213 THEN_BLOCK must be set to the address of an uninitialized instance
1214 of basic_block. The function will then set *THEN_BLOCK to the
1215 'then block' of the condition statement to be inserted by the
1218 If CREATE_THEN_FALLTHRU_EDGE is false, no edge will be created from
1219 *THEN_BLOCK to *FALLTHROUGH_BLOCK.
1221 Similarly, the function will set *FALLTRHOUGH_BLOCK to the 'else
1222 block' of the condition statement to be inserted by the caller.
1224 Note that *FALLTHROUGH_BLOCK is a new block that contains the
1225 statements starting from *ITER, and *THEN_BLOCK is a new empty
1228 *ITER is adjusted to point to always point to the first statement
1229 of the basic block * FALLTHROUGH_BLOCK. That statement is the
1230 same as what ITER was pointing to prior to calling this function,
1231 if BEFORE_P is true; otherwise, it is its following statement. */
1233 static gimple_stmt_iterator
1234 create_cond_insert_point (gimple_stmt_iterator
*iter
,
1236 bool then_more_likely_p
,
1237 bool create_then_fallthru_edge
,
1238 basic_block
*then_block
,
1239 basic_block
*fallthrough_block
)
1241 gimple_stmt_iterator gsi
= *iter
;
1243 if (!gsi_end_p (gsi
) && before_p
)
1246 basic_block cur_bb
= gsi_bb (*iter
);
1248 edge e
= split_block (cur_bb
, gsi_stmt (gsi
));
1250 /* Get a hold on the 'condition block', the 'then block' and the
1252 basic_block cond_bb
= e
->src
;
1253 basic_block fallthru_bb
= e
->dest
;
1254 basic_block then_bb
= create_empty_bb (cond_bb
);
1257 add_bb_to_loop (then_bb
, cond_bb
->loop_father
);
1258 loops_state_set (LOOPS_NEED_FIXUP
);
1261 /* Set up the newly created 'then block'. */
1262 e
= make_edge (cond_bb
, then_bb
, EDGE_TRUE_VALUE
);
1263 int fallthrough_probability
1264 = then_more_likely_p
1265 ? PROB_VERY_UNLIKELY
1266 : PROB_ALWAYS
- PROB_VERY_UNLIKELY
;
1267 e
->probability
= PROB_ALWAYS
- fallthrough_probability
;
1268 if (create_then_fallthru_edge
)
1269 make_single_succ_edge (then_bb
, fallthru_bb
, EDGE_FALLTHRU
);
1271 /* Set up the fallthrough basic block. */
1272 e
= find_edge (cond_bb
, fallthru_bb
);
1273 e
->flags
= EDGE_FALSE_VALUE
;
1274 e
->count
= cond_bb
->count
;
1275 e
->probability
= fallthrough_probability
;
1277 /* Update dominance info for the newly created then_bb; note that
1278 fallthru_bb's dominance info has already been updated by
1280 if (dom_info_available_p (CDI_DOMINATORS
))
1281 set_immediate_dominator (CDI_DOMINATORS
, then_bb
, cond_bb
);
1283 *then_block
= then_bb
;
1284 *fallthrough_block
= fallthru_bb
;
1285 *iter
= gsi_start_bb (fallthru_bb
);
1287 return gsi_last_bb (cond_bb
);
1290 /* Insert an if condition followed by a 'then block' right before the
1291 statement pointed to by ITER. The fallthrough block -- which is the
1292 else block of the condition as well as the destination of the
1293 outcoming edge of the 'then block' -- starts with the statement
1296 COND is the condition of the if.
1298 If THEN_MORE_LIKELY_P is true, the probability of the edge to the
1299 'then block' is higher than the probability of the edge to the
1302 Upon completion of the function, *THEN_BB is set to the newly
1303 inserted 'then block' and similarly, *FALLTHROUGH_BB is set to the
1306 *ITER is adjusted to still point to the same statement it was
1307 pointing to initially. */
1310 insert_if_then_before_iter (gimple cond
,
1311 gimple_stmt_iterator
*iter
,
1312 bool then_more_likely_p
,
1313 basic_block
*then_bb
,
1314 basic_block
*fallthrough_bb
)
1316 gimple_stmt_iterator cond_insert_point
=
1317 create_cond_insert_point (iter
,
1320 /*create_then_fallthru_edge=*/true,
1323 gsi_insert_after (&cond_insert_point
, cond
, GSI_NEW_STMT
);
1326 /* Instrument the memory access instruction BASE. Insert new
1327 statements before or after ITER.
1329 Note that the memory access represented by BASE can be either an
1330 SSA_NAME, or a non-SSA expression. LOCATION is the source code
1331 location. IS_STORE is TRUE for a store, FALSE for a load.
1332 BEFORE_P is TRUE for inserting the instrumentation code before
1333 ITER, FALSE for inserting it after ITER. SIZE_IN_BYTES is one of
1336 If BEFORE_P is TRUE, *ITER is arranged to still point to the
1337 statement it was pointing to prior to calling this function,
1338 otherwise, it points to the statement logically following it. */
1341 build_check_stmt (location_t location
, tree base
, gimple_stmt_iterator
*iter
,
1342 bool before_p
, bool is_store
, int size_in_bytes
)
1344 gimple_stmt_iterator gsi
;
1345 basic_block then_bb
, else_bb
;
1346 tree t
, base_addr
, shadow
;
1348 tree shadow_ptr_type
= shadow_ptr_types
[size_in_bytes
== 16 ? 1 : 0];
1349 tree shadow_type
= TREE_TYPE (shadow_ptr_type
);
1351 = build_nonstandard_integer_type (TYPE_PRECISION (TREE_TYPE (base
)), 1);
1352 tree base_ssa
= base
;
1354 /* Get an iterator on the point where we can add the condition
1355 statement for the instrumentation. */
1356 gsi
= create_cond_insert_point (iter
, before_p
,
1357 /*then_more_likely_p=*/false,
1358 /*create_then_fallthru_edge=*/false,
1362 base
= unshare_expr (base
);
1364 /* BASE can already be an SSA_NAME; in that case, do not create a
1365 new SSA_NAME for it. */
1366 if (TREE_CODE (base
) != SSA_NAME
)
1368 g
= gimple_build_assign_with_ops (TREE_CODE (base
),
1369 make_ssa_name (TREE_TYPE (base
), NULL
),
1371 gimple_set_location (g
, location
);
1372 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1373 base_ssa
= gimple_assign_lhs (g
);
1376 g
= gimple_build_assign_with_ops (NOP_EXPR
,
1377 make_ssa_name (uintptr_type
, NULL
),
1378 base_ssa
, NULL_TREE
);
1379 gimple_set_location (g
, location
);
1380 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1381 base_addr
= gimple_assign_lhs (g
);
1384 (base_addr >> ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset (). */
1386 t
= build_int_cst (uintptr_type
, ASAN_SHADOW_SHIFT
);
1387 g
= gimple_build_assign_with_ops (RSHIFT_EXPR
,
1388 make_ssa_name (uintptr_type
, NULL
),
1390 gimple_set_location (g
, location
);
1391 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1393 t
= build_int_cst (uintptr_type
, targetm
.asan_shadow_offset ());
1394 g
= gimple_build_assign_with_ops (PLUS_EXPR
,
1395 make_ssa_name (uintptr_type
, NULL
),
1396 gimple_assign_lhs (g
), t
);
1397 gimple_set_location (g
, location
);
1398 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1400 g
= gimple_build_assign_with_ops (NOP_EXPR
,
1401 make_ssa_name (shadow_ptr_type
, NULL
),
1402 gimple_assign_lhs (g
), NULL_TREE
);
1403 gimple_set_location (g
, location
);
1404 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1406 t
= build2 (MEM_REF
, shadow_type
, gimple_assign_lhs (g
),
1407 build_int_cst (shadow_ptr_type
, 0));
1408 g
= gimple_build_assign_with_ops (MEM_REF
,
1409 make_ssa_name (shadow_type
, NULL
),
1411 gimple_set_location (g
, location
);
1412 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1413 shadow
= gimple_assign_lhs (g
);
1415 if (size_in_bytes
< 8)
1417 /* Slow path for 1, 2 and 4 byte accesses.
1419 & ((base_addr & 7) + (size_in_bytes - 1)) >= shadow). */
1420 gimple_seq seq
= NULL
;
1421 gimple shadow_test
= build_assign (NE_EXPR
, shadow
, 0);
1422 gimple_seq_add_stmt (&seq
, shadow_test
);
1423 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, base_addr
, 7));
1424 gimple_seq_add_stmt (&seq
, build_type_cast (shadow_type
,
1425 gimple_seq_last (seq
)));
1426 if (size_in_bytes
> 1)
1427 gimple_seq_add_stmt (&seq
,
1428 build_assign (PLUS_EXPR
, gimple_seq_last (seq
),
1429 size_in_bytes
- 1));
1430 gimple_seq_add_stmt (&seq
, build_assign (GE_EXPR
, gimple_seq_last (seq
),
1432 gimple_seq_add_stmt (&seq
, build_assign (BIT_AND_EXPR
, shadow_test
,
1433 gimple_seq_last (seq
)));
1434 t
= gimple_assign_lhs (gimple_seq_last (seq
));
1435 gimple_seq_set_location (seq
, location
);
1436 gsi_insert_seq_after (&gsi
, seq
, GSI_CONTINUE_LINKING
);
1441 g
= gimple_build_cond (NE_EXPR
, t
, build_int_cst (TREE_TYPE (t
), 0),
1442 NULL_TREE
, NULL_TREE
);
1443 gimple_set_location (g
, location
);
1444 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1446 /* Generate call to the run-time library (e.g. __asan_report_load8). */
1447 gsi
= gsi_start_bb (then_bb
);
1448 g
= gimple_build_call (report_error_func (is_store
, size_in_bytes
),
1450 gimple_set_location (g
, location
);
1451 gsi_insert_after (&gsi
, g
, GSI_NEW_STMT
);
1453 *iter
= gsi_start_bb (else_bb
);
1456 /* If T represents a memory access, add instrumentation code before ITER.
1457 LOCATION is source code location.
1458 IS_STORE is either TRUE (for a store) or FALSE (for a load). */
1461 instrument_derefs (gimple_stmt_iterator
*iter
, tree t
,
1462 location_t location
, bool is_store
)
1465 HOST_WIDE_INT size_in_bytes
;
1467 type
= TREE_TYPE (t
);
1468 switch (TREE_CODE (t
))
1481 size_in_bytes
= int_size_in_bytes (type
);
1482 if ((size_in_bytes
& (size_in_bytes
- 1)) != 0
1483 || (unsigned HOST_WIDE_INT
) size_in_bytes
- 1 >= 16)
1486 HOST_WIDE_INT bitsize
, bitpos
;
1488 enum machine_mode mode
;
1489 int volatilep
= 0, unsignedp
= 0;
1490 tree inner
= get_inner_reference (t
, &bitsize
, &bitpos
, &offset
,
1491 &mode
, &unsignedp
, &volatilep
);
1492 if (bitpos
% (size_in_bytes
* BITS_PER_UNIT
)
1493 || bitsize
!= size_in_bytes
* BITS_PER_UNIT
)
1495 if (TREE_CODE (t
) == COMPONENT_REF
1496 && DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1)) != NULL_TREE
)
1498 tree repr
= DECL_BIT_FIELD_REPRESENTATIVE (TREE_OPERAND (t
, 1));
1499 instrument_derefs (iter
, build3 (COMPONENT_REF
, TREE_TYPE (repr
),
1500 TREE_OPERAND (t
, 0), repr
,
1501 NULL_TREE
), location
, is_store
);
1506 if (TREE_CODE (inner
) == VAR_DECL
1507 && offset
== NULL_TREE
1509 && DECL_SIZE (inner
)
1510 && tree_fits_shwi_p (DECL_SIZE (inner
))
1511 && bitpos
+ bitsize
<= tree_to_shwi (DECL_SIZE (inner
)))
1513 if (DECL_THREAD_LOCAL_P (inner
))
1515 if (!TREE_STATIC (inner
))
1517 /* Automatic vars in the current function will be always
1519 if (decl_function_context (inner
) == current_function_decl
)
1522 /* Always instrument external vars, they might be dynamically
1524 else if (!DECL_EXTERNAL (inner
))
1526 /* For static vars if they are known not to be dynamically
1527 initialized, they will be always accessible. */
1528 struct varpool_node
*vnode
= varpool_get_node (inner
);
1529 if (vnode
&& !vnode
->dynamically_initialized
)
1534 base
= build_fold_addr_expr (t
);
1535 if (!has_mem_ref_been_instrumented (base
, size_in_bytes
))
1537 build_check_stmt (location
, base
, iter
, /*before_p=*/true,
1538 is_store
, size_in_bytes
);
1539 update_mem_ref_hash_table (base
, size_in_bytes
);
1540 update_mem_ref_hash_table (t
, size_in_bytes
);
1545 /* Instrument an access to a contiguous memory region that starts at
1546 the address pointed to by BASE, over a length of LEN (expressed in
1547 the sizeof (*BASE) bytes). ITER points to the instruction before
1548 which the instrumentation instructions must be inserted. LOCATION
1549 is the source location that the instrumentation instructions must
1550 have. If IS_STORE is true, then the memory access is a store;
1551 otherwise, it's a load. */
1554 instrument_mem_region_access (tree base
, tree len
,
1555 gimple_stmt_iterator
*iter
,
1556 location_t location
, bool is_store
)
1558 if (!POINTER_TYPE_P (TREE_TYPE (base
))
1559 || !INTEGRAL_TYPE_P (TREE_TYPE (len
))
1560 || integer_zerop (len
))
1563 gimple_stmt_iterator gsi
= *iter
;
1565 basic_block fallthrough_bb
= NULL
, then_bb
= NULL
;
1567 /* If the beginning of the memory region has already been
1568 instrumented, do not instrument it. */
1569 bool start_instrumented
= has_mem_ref_been_instrumented (base
, 1);
1571 /* If the end of the memory region has already been instrumented, do
1572 not instrument it. */
1573 tree end
= asan_mem_ref_get_end (base
, len
);
1574 bool end_instrumented
= has_mem_ref_been_instrumented (end
, 1);
1576 if (start_instrumented
&& end_instrumented
)
1579 if (!is_gimple_constant (len
))
1581 /* So, the length of the memory area to asan-protect is
1582 non-constant. Let's guard the generated instrumentation code
1587 //asan instrumentation code goes here.
1589 // falltrough instructions, starting with *ITER. */
1591 gimple g
= gimple_build_cond (NE_EXPR
,
1593 build_int_cst (TREE_TYPE (len
), 0),
1594 NULL_TREE
, NULL_TREE
);
1595 gimple_set_location (g
, location
);
1596 insert_if_then_before_iter (g
, iter
, /*then_more_likely_p=*/true,
1597 &then_bb
, &fallthrough_bb
);
1598 /* Note that fallthrough_bb starts with the statement that was
1599 pointed to by ITER. */
1601 /* The 'then block' of the 'if (len != 0) condition is where
1602 we'll generate the asan instrumentation code now. */
1603 gsi
= gsi_last_bb (then_bb
);
1606 if (!start_instrumented
)
1608 /* Instrument the beginning of the memory region to be accessed,
1609 and arrange for the rest of the intrumentation code to be
1610 inserted in the then block *after* the current gsi. */
1611 build_check_stmt (location
, base
, &gsi
, /*before_p=*/true, is_store
, 1);
1614 /* We are in the case where the length of the region is not
1615 constant; so instrumentation code is being generated in the
1616 'then block' of the 'if (len != 0) condition. Let's arrange
1617 for the subsequent instrumentation statements to go in the
1619 gsi
= gsi_last_bb (then_bb
);
1623 /* Don't remember this access as instrumented, if length
1624 is unknown. It might be zero and not being actually
1625 instrumented, so we can't rely on it being instrumented. */
1626 update_mem_ref_hash_table (base
, 1);
1630 if (end_instrumented
)
1633 /* We want to instrument the access at the end of the memory region,
1634 which is at (base + len - 1). */
1636 /* offset = len - 1; */
1637 len
= unshare_expr (len
);
1639 gimple_seq seq
= NULL
;
1640 if (TREE_CODE (len
) == INTEGER_CST
)
1641 offset
= fold_build2 (MINUS_EXPR
, size_type_node
,
1642 fold_convert (size_type_node
, len
),
1643 build_int_cst (size_type_node
, 1));
1649 if (TREE_CODE (len
) != SSA_NAME
)
1651 t
= make_ssa_name (TREE_TYPE (len
), NULL
);
1652 g
= gimple_build_assign_with_ops (TREE_CODE (len
), t
, len
, NULL
);
1653 gimple_set_location (g
, location
);
1654 gimple_seq_add_stmt_without_update (&seq
, g
);
1657 if (!useless_type_conversion_p (size_type_node
, TREE_TYPE (len
)))
1659 t
= make_ssa_name (size_type_node
, NULL
);
1660 g
= gimple_build_assign_with_ops (NOP_EXPR
, t
, len
, NULL
);
1661 gimple_set_location (g
, location
);
1662 gimple_seq_add_stmt_without_update (&seq
, g
);
1666 t
= make_ssa_name (size_type_node
, NULL
);
1667 g
= gimple_build_assign_with_ops (MINUS_EXPR
, t
, len
,
1668 build_int_cst (size_type_node
, 1));
1669 gimple_set_location (g
, location
);
1670 gimple_seq_add_stmt_without_update (&seq
, g
);
1671 offset
= gimple_assign_lhs (g
);
1675 base
= unshare_expr (base
);
1677 gimple_build_assign_with_ops (TREE_CODE (base
),
1678 make_ssa_name (TREE_TYPE (base
), NULL
),
1680 gimple_set_location (region_end
, location
);
1681 gimple_seq_add_stmt_without_update (&seq
, region_end
);
1683 /* _2 = _1 + offset; */
1685 gimple_build_assign_with_ops (POINTER_PLUS_EXPR
,
1686 make_ssa_name (TREE_TYPE (base
), NULL
),
1687 gimple_assign_lhs (region_end
),
1689 gimple_set_location (region_end
, location
);
1690 gimple_seq_add_stmt_without_update (&seq
, region_end
);
1691 gsi_insert_seq_before (&gsi
, seq
, GSI_SAME_STMT
);
1693 /* instrument access at _2; */
1694 gsi
= gsi_for_stmt (region_end
);
1695 build_check_stmt (location
, gimple_assign_lhs (region_end
),
1696 &gsi
, /*before_p=*/false, is_store
, 1);
1698 if (then_bb
== NULL
)
1699 update_mem_ref_hash_table (end
, 1);
1701 *iter
= gsi_for_stmt (gsi_stmt (*iter
));
1704 /* Instrument the call (to the builtin strlen function) pointed to by
1707 This function instruments the access to the first byte of the
1708 argument, right before the call. After the call it instruments the
1709 access to the last byte of the argument; it uses the result of the
1710 call to deduce the offset of that last byte.
1712 Upon completion, iff the call has actually been instrumented, this
1713 function returns TRUE and *ITER points to the statement logically
1714 following the built-in strlen function call *ITER was initially
1715 pointing to. Otherwise, the function returns FALSE and *ITER
1716 remains unchanged. */
1719 instrument_strlen_call (gimple_stmt_iterator
*iter
)
1721 gimple call
= gsi_stmt (*iter
);
1722 gcc_assert (is_gimple_call (call
));
1724 tree callee
= gimple_call_fndecl (call
);
1725 gcc_assert (is_builtin_fn (callee
)
1726 && DECL_BUILT_IN_CLASS (callee
) == BUILT_IN_NORMAL
1727 && DECL_FUNCTION_CODE (callee
) == BUILT_IN_STRLEN
);
1729 tree len
= gimple_call_lhs (call
);
1731 /* Some passes might clear the return value of the strlen call;
1732 bail out in that case. Return FALSE as we are not advancing
1735 gcc_assert (INTEGRAL_TYPE_P (TREE_TYPE (len
)));
1737 location_t loc
= gimple_location (call
);
1738 tree str_arg
= gimple_call_arg (call
, 0);
1740 /* Instrument the access to the first byte of str_arg. i.e:
1742 _1 = str_arg; instrument (_1); */
1743 tree cptr_type
= build_pointer_type (char_type_node
);
1744 gimple str_arg_ssa
=
1745 gimple_build_assign_with_ops (NOP_EXPR
,
1746 make_ssa_name (cptr_type
, NULL
),
1748 gimple_set_location (str_arg_ssa
, loc
);
1749 gimple_stmt_iterator gsi
= *iter
;
1750 gsi_insert_before (&gsi
, str_arg_ssa
, GSI_NEW_STMT
);
1751 build_check_stmt (loc
, gimple_assign_lhs (str_arg_ssa
), &gsi
,
1752 /*before_p=*/false, /*is_store=*/false, 1);
1754 /* If we initially had an instruction like:
1756 int n = strlen (str)
1758 we now want to instrument the access to str[n], after the
1759 instruction above.*/
1761 /* So let's build the access to str[n] that is, access through the
1762 pointer_plus expr: (_1 + len). */
1764 gimple_build_assign_with_ops (POINTER_PLUS_EXPR
,
1765 make_ssa_name (cptr_type
, NULL
),
1766 gimple_assign_lhs (str_arg_ssa
),
1768 gimple_set_location (stmt
, loc
);
1769 gsi_insert_after (&gsi
, stmt
, GSI_NEW_STMT
);
1771 build_check_stmt (loc
, gimple_assign_lhs (stmt
), &gsi
,
1772 /*before_p=*/false, /*is_store=*/false, 1);
1774 /* Ensure that iter points to the statement logically following the
1775 one it was initially pointing to. */
1777 /* As *ITER has been advanced to point to the next statement, let's
1778 return true to inform transform_statements that it shouldn't
1779 advance *ITER anymore; otherwises it will skip that next
1780 statement, which wouldn't be instrumented. */
1784 /* Instrument the call to a built-in memory access function that is
1785 pointed to by the iterator ITER.
1787 Upon completion, return TRUE iff *ITER has been advanced to the
1788 statement following the one it was originally pointing to. */
1791 instrument_builtin_call (gimple_stmt_iterator
*iter
)
1793 bool iter_advanced_p
= false;
1794 gimple call
= gsi_stmt (*iter
);
1796 gcc_checking_assert (gimple_call_builtin_p (call
, BUILT_IN_NORMAL
));
1798 tree callee
= gimple_call_fndecl (call
);
1799 location_t loc
= gimple_location (call
);
1801 if (DECL_FUNCTION_CODE (callee
) == BUILT_IN_STRLEN
)
1802 iter_advanced_p
= instrument_strlen_call (iter
);
1805 asan_mem_ref src0
, src1
, dest
;
1806 asan_mem_ref_init (&src0
, NULL
, 1);
1807 asan_mem_ref_init (&src1
, NULL
, 1);
1808 asan_mem_ref_init (&dest
, NULL
, 1);
1810 tree src0_len
= NULL_TREE
, src1_len
= NULL_TREE
, dest_len
= NULL_TREE
;
1811 bool src0_is_store
= false, src1_is_store
= false,
1812 dest_is_store
= false, dest_is_deref
= false;
1814 if (get_mem_refs_of_builtin_call (call
,
1815 &src0
, &src0_len
, &src0_is_store
,
1816 &src1
, &src1_len
, &src1_is_store
,
1817 &dest
, &dest_len
, &dest_is_store
,
1822 instrument_derefs (iter
, dest
.start
, loc
, dest_is_store
);
1824 iter_advanced_p
= true;
1826 else if (src0_len
|| src1_len
|| dest_len
)
1828 if (src0
.start
!= NULL_TREE
)
1829 instrument_mem_region_access (src0
.start
, src0_len
,
1830 iter
, loc
, /*is_store=*/false);
1831 if (src1
.start
!= NULL_TREE
)
1832 instrument_mem_region_access (src1
.start
, src1_len
,
1833 iter
, loc
, /*is_store=*/false);
1834 if (dest
.start
!= NULL_TREE
)
1835 instrument_mem_region_access (dest
.start
, dest_len
,
1836 iter
, loc
, /*is_store=*/true);
1837 *iter
= gsi_for_stmt (call
);
1839 iter_advanced_p
= true;
1843 return iter_advanced_p
;
1846 /* Instrument the assignment statement ITER if it is subject to
1847 instrumentation. Return TRUE iff instrumentation actually
1848 happened. In that case, the iterator ITER is advanced to the next
1849 logical expression following the one initially pointed to by ITER,
1850 and the relevant memory reference that which access has been
1851 instrumented is added to the memory references hash table. */
1854 maybe_instrument_assignment (gimple_stmt_iterator
*iter
)
1856 gimple s
= gsi_stmt (*iter
);
1858 gcc_assert (gimple_assign_single_p (s
));
1860 tree ref_expr
= NULL_TREE
;
1861 bool is_store
, is_instrumented
= false;
1863 if (gimple_store_p (s
))
1865 ref_expr
= gimple_assign_lhs (s
);
1867 instrument_derefs (iter
, ref_expr
,
1868 gimple_location (s
),
1870 is_instrumented
= true;
1873 if (gimple_assign_load_p (s
))
1875 ref_expr
= gimple_assign_rhs1 (s
);
1877 instrument_derefs (iter
, ref_expr
,
1878 gimple_location (s
),
1880 is_instrumented
= true;
1883 if (is_instrumented
)
1886 return is_instrumented
;
1889 /* Instrument the function call pointed to by the iterator ITER, if it
1890 is subject to instrumentation. At the moment, the only function
1891 calls that are instrumented are some built-in functions that access
1892 memory. Look at instrument_builtin_call to learn more.
1894 Upon completion return TRUE iff *ITER was advanced to the statement
1895 following the one it was originally pointing to. */
1898 maybe_instrument_call (gimple_stmt_iterator
*iter
)
1900 gimple stmt
= gsi_stmt (*iter
);
1901 bool is_builtin
= gimple_call_builtin_p (stmt
, BUILT_IN_NORMAL
);
1903 if (is_builtin
&& instrument_builtin_call (iter
))
1906 if (gimple_call_noreturn_p (stmt
))
1910 tree callee
= gimple_call_fndecl (stmt
);
1911 switch (DECL_FUNCTION_CODE (callee
))
1913 case BUILT_IN_UNREACHABLE
:
1915 /* Don't instrument these. */
1919 tree decl
= builtin_decl_implicit (BUILT_IN_ASAN_HANDLE_NO_RETURN
);
1920 gimple g
= gimple_build_call (decl
, 0);
1921 gimple_set_location (g
, gimple_location (stmt
));
1922 gsi_insert_before (iter
, g
, GSI_SAME_STMT
);
1927 /* Walk each instruction of all basic block and instrument those that
1928 represent memory references: loads, stores, or function calls.
1929 In a given basic block, this function avoids instrumenting memory
1930 references that have already been instrumented. */
1933 transform_statements (void)
1935 basic_block bb
, last_bb
= NULL
;
1936 gimple_stmt_iterator i
;
1937 int saved_last_basic_block
= last_basic_block
;
1941 basic_block prev_bb
= bb
;
1943 if (bb
->index
>= saved_last_basic_block
) continue;
1945 /* Flush the mem ref hash table, if current bb doesn't have
1946 exactly one predecessor, or if that predecessor (skipping
1947 over asan created basic blocks) isn't the last processed
1948 basic block. Thus we effectively flush on extended basic
1949 block boundaries. */
1950 while (single_pred_p (prev_bb
))
1952 prev_bb
= single_pred (prev_bb
);
1953 if (prev_bb
->index
< saved_last_basic_block
)
1956 if (prev_bb
!= last_bb
)
1957 empty_mem_ref_hash_table ();
1960 for (i
= gsi_start_bb (bb
); !gsi_end_p (i
);)
1962 gimple s
= gsi_stmt (i
);
1964 if (has_stmt_been_instrumented_p (s
))
1966 else if (gimple_assign_single_p (s
)
1967 && maybe_instrument_assignment (&i
))
1968 /* Nothing to do as maybe_instrument_assignment advanced
1970 else if (is_gimple_call (s
) && maybe_instrument_call (&i
))
1971 /* Nothing to do as maybe_instrument_call
1972 advanced the iterator I. */;
1975 /* No instrumentation happened.
1977 If the current instruction is a function call that
1978 might free something, let's forget about the memory
1979 references that got instrumented. Otherwise we might
1980 miss some instrumentation opportunities. */
1981 if (is_gimple_call (s
) && !nonfreeing_call_p (s
))
1982 empty_mem_ref_hash_table ();
1988 free_mem_ref_resources ();
1992 __asan_before_dynamic_init (module_name)
1994 __asan_after_dynamic_init ()
1998 asan_dynamic_init_call (bool after_p
)
2000 tree fn
= builtin_decl_implicit (after_p
2001 ? BUILT_IN_ASAN_AFTER_DYNAMIC_INIT
2002 : BUILT_IN_ASAN_BEFORE_DYNAMIC_INIT
);
2003 tree module_name_cst
= NULL_TREE
;
2006 pretty_printer module_name_pp
;
2007 pp_string (&module_name_pp
, main_input_filename
);
2009 if (shadow_ptr_types
[0] == NULL_TREE
)
2010 asan_init_shadow_ptr_types ();
2011 module_name_cst
= asan_pp_string (&module_name_pp
);
2012 module_name_cst
= fold_convert (const_ptr_type_node
,
2016 return build_call_expr (fn
, after_p
? 0 : 1, module_name_cst
);
2020 struct __asan_global
2024 uptr __size_with_redzone;
2026 const void *__module_name;
2027 uptr __has_dynamic_init;
2031 asan_global_struct (void)
2033 static const char *field_names
[6]
2034 = { "__beg", "__size", "__size_with_redzone",
2035 "__name", "__module_name", "__has_dynamic_init" };
2036 tree fields
[6], ret
;
2039 ret
= make_node (RECORD_TYPE
);
2040 for (i
= 0; i
< 6; i
++)
2043 = build_decl (UNKNOWN_LOCATION
, FIELD_DECL
,
2044 get_identifier (field_names
[i
]),
2045 (i
== 0 || i
== 3) ? const_ptr_type_node
2046 : pointer_sized_int_node
);
2047 DECL_CONTEXT (fields
[i
]) = ret
;
2049 DECL_CHAIN (fields
[i
- 1]) = fields
[i
];
2051 TYPE_FIELDS (ret
) = fields
[0];
2052 TYPE_NAME (ret
) = get_identifier ("__asan_global");
2057 /* Append description of a single global DECL into vector V.
2058 TYPE is __asan_global struct type as returned by asan_global_struct. */
2061 asan_add_global (tree decl
, tree type
, vec
<constructor_elt
, va_gc
> *v
)
2063 tree init
, uptr
= TREE_TYPE (DECL_CHAIN (TYPE_FIELDS (type
)));
2064 unsigned HOST_WIDE_INT size
;
2065 tree str_cst
, module_name_cst
, refdecl
= decl
;
2066 vec
<constructor_elt
, va_gc
> *vinner
= NULL
;
2068 pretty_printer asan_pp
, module_name_pp
;
2070 if (DECL_NAME (decl
))
2071 pp_tree_identifier (&asan_pp
, DECL_NAME (decl
));
2073 pp_string (&asan_pp
, "<unknown>");
2074 str_cst
= asan_pp_string (&asan_pp
);
2076 pp_string (&module_name_pp
, main_input_filename
);
2077 module_name_cst
= asan_pp_string (&module_name_pp
);
2079 if (asan_needs_local_alias (decl
))
2082 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", vec_safe_length (v
) + 1);
2083 refdecl
= build_decl (DECL_SOURCE_LOCATION (decl
),
2084 VAR_DECL
, get_identifier (buf
), TREE_TYPE (decl
));
2085 TREE_ADDRESSABLE (refdecl
) = TREE_ADDRESSABLE (decl
);
2086 TREE_READONLY (refdecl
) = TREE_READONLY (decl
);
2087 TREE_THIS_VOLATILE (refdecl
) = TREE_THIS_VOLATILE (decl
);
2088 DECL_GIMPLE_REG_P (refdecl
) = DECL_GIMPLE_REG_P (decl
);
2089 DECL_ARTIFICIAL (refdecl
) = DECL_ARTIFICIAL (decl
);
2090 DECL_IGNORED_P (refdecl
) = DECL_IGNORED_P (decl
);
2091 TREE_STATIC (refdecl
) = 1;
2092 TREE_PUBLIC (refdecl
) = 0;
2093 TREE_USED (refdecl
) = 1;
2094 assemble_alias (refdecl
, DECL_ASSEMBLER_NAME (decl
));
2097 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2098 fold_convert (const_ptr_type_node
,
2099 build_fold_addr_expr (refdecl
)));
2100 size
= tree_to_uhwi (DECL_SIZE_UNIT (decl
));
2101 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2102 size
+= asan_red_zone_size (size
);
2103 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
, build_int_cst (uptr
, size
));
2104 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2105 fold_convert (const_ptr_type_node
, str_cst
));
2106 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2107 fold_convert (const_ptr_type_node
, module_name_cst
));
2108 struct varpool_node
*vnode
= varpool_get_node (decl
);
2109 int has_dynamic_init
= vnode
? vnode
->dynamically_initialized
: 0;
2110 CONSTRUCTOR_APPEND_ELT (vinner
, NULL_TREE
,
2111 build_int_cst (uptr
, has_dynamic_init
));
2112 init
= build_constructor (type
, vinner
);
2113 CONSTRUCTOR_APPEND_ELT (v
, NULL_TREE
, init
);
2116 /* Initialize sanitizer.def builtins if the FE hasn't initialized them. */
2118 initialize_sanitizer_builtins (void)
2122 if (builtin_decl_implicit_p (BUILT_IN_ASAN_INIT
))
2125 tree BT_FN_VOID
= build_function_type_list (void_type_node
, NULL_TREE
);
2127 = build_function_type_list (void_type_node
, ptr_type_node
, NULL_TREE
);
2128 tree BT_FN_VOID_CONST_PTR
2129 = build_function_type_list (void_type_node
, const_ptr_type_node
, NULL_TREE
);
2130 tree BT_FN_VOID_PTR_PTR
2131 = build_function_type_list (void_type_node
, ptr_type_node
,
2132 ptr_type_node
, NULL_TREE
);
2133 tree BT_FN_VOID_PTR_PTR_PTR
2134 = build_function_type_list (void_type_node
, ptr_type_node
,
2135 ptr_type_node
, ptr_type_node
, NULL_TREE
);
2136 tree BT_FN_VOID_PTR_PTRMODE
2137 = build_function_type_list (void_type_node
, ptr_type_node
,
2138 pointer_sized_int_node
, NULL_TREE
);
2140 = build_function_type_list (void_type_node
, integer_type_node
, NULL_TREE
);
2141 tree BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[5];
2142 tree BT_FN_IX_CONST_VPTR_INT
[5];
2143 tree BT_FN_IX_VPTR_IX_INT
[5];
2144 tree BT_FN_VOID_VPTR_IX_INT
[5];
2146 = build_pointer_type (build_qualified_type (void_type_node
,
2147 TYPE_QUAL_VOLATILE
));
2149 = build_pointer_type (build_qualified_type (void_type_node
,
2153 = lang_hooks
.types
.type_for_size (BOOL_TYPE_SIZE
, 1);
2155 for (i
= 0; i
< 5; i
++)
2157 tree ix
= build_nonstandard_integer_type (BITS_PER_UNIT
* (1 << i
), 1);
2158 BT_FN_BOOL_VPTR_PTR_IX_INT_INT
[i
]
2159 = build_function_type_list (boolt
, vptr
, ptr_type_node
, ix
,
2160 integer_type_node
, integer_type_node
,
2162 BT_FN_IX_CONST_VPTR_INT
[i
]
2163 = build_function_type_list (ix
, cvptr
, integer_type_node
, NULL_TREE
);
2164 BT_FN_IX_VPTR_IX_INT
[i
]
2165 = build_function_type_list (ix
, vptr
, ix
, integer_type_node
,
2167 BT_FN_VOID_VPTR_IX_INT
[i
]
2168 = build_function_type_list (void_type_node
, vptr
, ix
,
2169 integer_type_node
, NULL_TREE
);
2171 #define BT_FN_BOOL_VPTR_PTR_I1_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[0]
2172 #define BT_FN_I1_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[0]
2173 #define BT_FN_I1_VPTR_I1_INT BT_FN_IX_VPTR_IX_INT[0]
2174 #define BT_FN_VOID_VPTR_I1_INT BT_FN_VOID_VPTR_IX_INT[0]
2175 #define BT_FN_BOOL_VPTR_PTR_I2_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[1]
2176 #define BT_FN_I2_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[1]
2177 #define BT_FN_I2_VPTR_I2_INT BT_FN_IX_VPTR_IX_INT[1]
2178 #define BT_FN_VOID_VPTR_I2_INT BT_FN_VOID_VPTR_IX_INT[1]
2179 #define BT_FN_BOOL_VPTR_PTR_I4_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[2]
2180 #define BT_FN_I4_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[2]
2181 #define BT_FN_I4_VPTR_I4_INT BT_FN_IX_VPTR_IX_INT[2]
2182 #define BT_FN_VOID_VPTR_I4_INT BT_FN_VOID_VPTR_IX_INT[2]
2183 #define BT_FN_BOOL_VPTR_PTR_I8_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[3]
2184 #define BT_FN_I8_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[3]
2185 #define BT_FN_I8_VPTR_I8_INT BT_FN_IX_VPTR_IX_INT[3]
2186 #define BT_FN_VOID_VPTR_I8_INT BT_FN_VOID_VPTR_IX_INT[3]
2187 #define BT_FN_BOOL_VPTR_PTR_I16_INT_INT BT_FN_BOOL_VPTR_PTR_IX_INT_INT[4]
2188 #define BT_FN_I16_CONST_VPTR_INT BT_FN_IX_CONST_VPTR_INT[4]
2189 #define BT_FN_I16_VPTR_I16_INT BT_FN_IX_VPTR_IX_INT[4]
2190 #define BT_FN_VOID_VPTR_I16_INT BT_FN_VOID_VPTR_IX_INT[4]
2191 #undef ATTR_NOTHROW_LEAF_LIST
2192 #define ATTR_NOTHROW_LEAF_LIST ECF_NOTHROW | ECF_LEAF
2193 #undef ATTR_TMPURE_NOTHROW_LEAF_LIST
2194 #define ATTR_TMPURE_NOTHROW_LEAF_LIST ECF_TM_PURE | ATTR_NOTHROW_LEAF_LIST
2195 #undef ATTR_NORETURN_NOTHROW_LEAF_LIST
2196 #define ATTR_NORETURN_NOTHROW_LEAF_LIST ECF_NORETURN | ATTR_NOTHROW_LEAF_LIST
2197 #undef ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST
2198 #define ATTR_TMPURE_NORETURN_NOTHROW_LEAF_LIST \
2199 ECF_TM_PURE | ATTR_NORETURN_NOTHROW_LEAF_LIST
2200 #undef ATTR_COLD_NOTHROW_LEAF_LIST
2201 #define ATTR_COLD_NOTHROW_LEAF_LIST \
2202 /* ECF_COLD missing */ ATTR_NOTHROW_LEAF_LIST
2203 #undef ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST
2204 #define ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST \
2205 /* ECF_COLD missing */ ATTR_NORETURN_NOTHROW_LEAF_LIST
2206 #undef DEF_SANITIZER_BUILTIN
2207 #define DEF_SANITIZER_BUILTIN(ENUM, NAME, TYPE, ATTRS) \
2208 decl = add_builtin_function ("__builtin_" NAME, TYPE, ENUM, \
2209 BUILT_IN_NORMAL, NAME, NULL_TREE); \
2210 set_call_expr_flags (decl, ATTRS); \
2211 set_builtin_decl (ENUM, decl, true);
2213 #include "sanitizer.def"
2215 #undef DEF_SANITIZER_BUILTIN
2218 /* Called via htab_traverse. Count number of emitted
2219 STRING_CSTs in the constant hash table. */
2222 count_string_csts (void **slot
, void *data
)
2224 struct constant_descriptor_tree
*desc
2225 = (struct constant_descriptor_tree
*) *slot
;
2226 if (TREE_CODE (desc
->value
) == STRING_CST
2227 && TREE_ASM_WRITTEN (desc
->value
)
2228 && asan_protect_global (desc
->value
))
2229 ++*((unsigned HOST_WIDE_INT
*) data
);
2233 /* Helper structure to pass two parameters to
2236 struct asan_add_string_csts_data
2239 vec
<constructor_elt
, va_gc
> *v
;
2242 /* Called via htab_traverse. Call asan_add_global
2243 on emitted STRING_CSTs from the constant hash table. */
2246 add_string_csts (void **slot
, void *data
)
2248 struct constant_descriptor_tree
*desc
2249 = (struct constant_descriptor_tree
*) *slot
;
2250 if (TREE_CODE (desc
->value
) == STRING_CST
2251 && TREE_ASM_WRITTEN (desc
->value
)
2252 && asan_protect_global (desc
->value
))
2254 struct asan_add_string_csts_data
*aascd
2255 = (struct asan_add_string_csts_data
*) data
;
2256 asan_add_global (SYMBOL_REF_DECL (XEXP (desc
->rtl
, 0)),
2257 aascd
->type
, aascd
->v
);
2262 /* Needs to be GTY(()), because cgraph_build_static_cdtor may
2263 invoke ggc_collect. */
2264 static GTY(()) tree asan_ctor_statements
;
2266 /* Module-level instrumentation.
2267 - Insert __asan_init_vN() into the list of CTORs.
2268 - TODO: insert redzones around globals.
2272 asan_finish_file (void)
2274 struct varpool_node
*vnode
;
2275 unsigned HOST_WIDE_INT gcount
= 0;
2277 if (shadow_ptr_types
[0] == NULL_TREE
)
2278 asan_init_shadow_ptr_types ();
2279 /* Avoid instrumenting code in the asan ctors/dtors.
2280 We don't need to insert padding after the description strings,
2281 nor after .LASAN* array. */
2282 flag_sanitize
&= ~SANITIZE_ADDRESS
;
2284 tree fn
= builtin_decl_implicit (BUILT_IN_ASAN_INIT
);
2285 append_to_statement_list (build_call_expr (fn
, 0), &asan_ctor_statements
);
2286 FOR_EACH_DEFINED_VARIABLE (vnode
)
2287 if (TREE_ASM_WRITTEN (vnode
->decl
)
2288 && asan_protect_global (vnode
->decl
))
2290 htab_t const_desc_htab
= constant_pool_htab ();
2291 htab_traverse (const_desc_htab
, count_string_csts
, &gcount
);
2294 tree type
= asan_global_struct (), var
, ctor
;
2295 tree dtor_statements
= NULL_TREE
;
2296 vec
<constructor_elt
, va_gc
> *v
;
2299 type
= build_array_type_nelts (type
, gcount
);
2300 ASM_GENERATE_INTERNAL_LABEL (buf
, "LASAN", 0);
2301 var
= build_decl (UNKNOWN_LOCATION
, VAR_DECL
, get_identifier (buf
),
2303 TREE_STATIC (var
) = 1;
2304 TREE_PUBLIC (var
) = 0;
2305 DECL_ARTIFICIAL (var
) = 1;
2306 DECL_IGNORED_P (var
) = 1;
2307 vec_alloc (v
, gcount
);
2308 FOR_EACH_DEFINED_VARIABLE (vnode
)
2309 if (TREE_ASM_WRITTEN (vnode
->decl
)
2310 && asan_protect_global (vnode
->decl
))
2311 asan_add_global (vnode
->decl
, TREE_TYPE (type
), v
);
2312 struct asan_add_string_csts_data aascd
;
2313 aascd
.type
= TREE_TYPE (type
);
2315 htab_traverse (const_desc_htab
, add_string_csts
, &aascd
);
2316 ctor
= build_constructor (type
, v
);
2317 TREE_CONSTANT (ctor
) = 1;
2318 TREE_STATIC (ctor
) = 1;
2319 DECL_INITIAL (var
) = ctor
;
2320 varpool_assemble_decl (varpool_node_for_decl (var
));
2322 fn
= builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS
);
2323 tree gcount_tree
= build_int_cst (pointer_sized_int_node
, gcount
);
2324 append_to_statement_list (build_call_expr (fn
, 2,
2325 build_fold_addr_expr (var
),
2327 &asan_ctor_statements
);
2329 fn
= builtin_decl_implicit (BUILT_IN_ASAN_UNREGISTER_GLOBALS
);
2330 append_to_statement_list (build_call_expr (fn
, 2,
2331 build_fold_addr_expr (var
),
2334 cgraph_build_static_cdtor ('D', dtor_statements
,
2335 MAX_RESERVED_INIT_PRIORITY
- 1);
2337 cgraph_build_static_cdtor ('I', asan_ctor_statements
,
2338 MAX_RESERVED_INIT_PRIORITY
- 1);
2339 flag_sanitize
|= SANITIZE_ADDRESS
;
2342 /* Instrument the current function. */
2345 asan_instrument (void)
2347 if (shadow_ptr_types
[0] == NULL_TREE
)
2348 asan_init_shadow_ptr_types ();
2349 transform_statements ();
2356 return (flag_sanitize
& SANITIZE_ADDRESS
) != 0
2357 && !lookup_attribute ("no_sanitize_address",
2358 DECL_ATTRIBUTES (current_function_decl
));
2363 const pass_data pass_data_asan
=
2365 GIMPLE_PASS
, /* type */
2367 OPTGROUP_NONE
, /* optinfo_flags */
2368 true, /* has_gate */
2369 true, /* has_execute */
2370 TV_NONE
, /* tv_id */
2371 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2372 0, /* properties_provided */
2373 0, /* properties_destroyed */
2374 0, /* todo_flags_start */
2375 ( TODO_verify_flow
| TODO_verify_stmts
2376 | TODO_update_ssa
), /* todo_flags_finish */
2379 class pass_asan
: public gimple_opt_pass
2382 pass_asan (gcc::context
*ctxt
)
2383 : gimple_opt_pass (pass_data_asan
, ctxt
)
2386 /* opt_pass methods: */
2387 opt_pass
* clone () { return new pass_asan (m_ctxt
); }
2388 bool gate () { return gate_asan (); }
2389 unsigned int execute () { return asan_instrument (); }
2391 }; // class pass_asan
2396 make_pass_asan (gcc::context
*ctxt
)
2398 return new pass_asan (ctxt
);
2404 return !optimize
&& gate_asan ();
2409 const pass_data pass_data_asan_O0
=
2411 GIMPLE_PASS
, /* type */
2413 OPTGROUP_NONE
, /* optinfo_flags */
2414 true, /* has_gate */
2415 true, /* has_execute */
2416 TV_NONE
, /* tv_id */
2417 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2418 0, /* properties_provided */
2419 0, /* properties_destroyed */
2420 0, /* todo_flags_start */
2421 ( TODO_verify_flow
| TODO_verify_stmts
2422 | TODO_update_ssa
), /* todo_flags_finish */
2425 class pass_asan_O0
: public gimple_opt_pass
2428 pass_asan_O0 (gcc::context
*ctxt
)
2429 : gimple_opt_pass (pass_data_asan_O0
, ctxt
)
2432 /* opt_pass methods: */
2433 bool gate () { return gate_asan_O0 (); }
2434 unsigned int execute () { return asan_instrument (); }
2436 }; // class pass_asan_O0
2441 make_pass_asan_O0 (gcc::context
*ctxt
)
2443 return new pass_asan_O0 (ctxt
);
2446 /* Perform optimization of sanitize functions. */
2449 execute_sanopt (void)
2455 gimple_stmt_iterator gsi
;
2456 for (gsi
= gsi_start_bb (bb
); !gsi_end_p (gsi
); gsi_next (&gsi
))
2458 gimple stmt
= gsi_stmt (gsi
);
2460 if (!is_gimple_call (stmt
))
2463 if (gimple_call_internal_p (stmt
))
2464 switch (gimple_call_internal_fn (stmt
))
2466 case IFN_UBSAN_NULL
:
2467 ubsan_expand_null_ifn (gsi
);
2473 if (dump_file
&& (dump_flags
& TDF_DETAILS
))
2475 fprintf (dump_file
, "Optimized\n ");
2476 print_gimple_stmt (dump_file
, stmt
, 0, dump_flags
);
2477 fprintf (dump_file
, "\n");
2487 return flag_sanitize
;
2492 const pass_data pass_data_sanopt
=
2494 GIMPLE_PASS
, /* type */
2495 "sanopt", /* name */
2496 OPTGROUP_NONE
, /* optinfo_flags */
2497 true, /* has_gate */
2498 true, /* has_execute */
2499 TV_NONE
, /* tv_id */
2500 ( PROP_ssa
| PROP_cfg
| PROP_gimple_leh
), /* properties_required */
2501 0, /* properties_provided */
2502 0, /* properties_destroyed */
2503 0, /* todo_flags_start */
2504 ( TODO_verify_flow
| TODO_verify_stmts
2505 | TODO_update_ssa
), /* todo_flags_finish */
2508 class pass_sanopt
: public gimple_opt_pass
2511 pass_sanopt (gcc::context
*ctxt
)
2512 : gimple_opt_pass (pass_data_sanopt
, ctxt
)
2515 /* opt_pass methods: */
2516 bool gate () { return gate_sanopt (); }
2517 unsigned int execute () { return execute_sanopt (); }
2519 }; // class pass_sanopt
2524 make_pass_sanopt (gcc::context
*ctxt
)
2526 return new pass_sanopt (ctxt
);
2529 #include "gt-asan.h"