xref: /openbsd/gnu/llvm/clang/lib/CodeGen/CGClass.cpp (revision 12c85518)
1 //===--- CGClass.cpp - Emit LLVM Code for C++ classes -----------*- C++ -*-===//
2 //
3 // Part of the LLVM Project, under the Apache License v2.0 with LLVM Exceptions.
4 // See https://llvm.org/LICENSE.txt for license information.
5 // SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception
6 //
7 //===----------------------------------------------------------------------===//
8 //
9 // This contains code dealing with C++ code generation of classes
10 //
11 //===----------------------------------------------------------------------===//
12 
13 #include "CGBlocks.h"
14 #include "CGCXXABI.h"
15 #include "CGDebugInfo.h"
16 #include "CGRecordLayout.h"
17 #include "CodeGenFunction.h"
18 #include "TargetInfo.h"
19 #include "clang/AST/Attr.h"
20 #include "clang/AST/CXXInheritance.h"
21 #include "clang/AST/CharUnits.h"
22 #include "clang/AST/DeclTemplate.h"
23 #include "clang/AST/EvaluatedExprVisitor.h"
24 #include "clang/AST/RecordLayout.h"
25 #include "clang/AST/StmtCXX.h"
26 #include "clang/Basic/CodeGenOptions.h"
27 #include "clang/Basic/TargetBuiltins.h"
28 #include "clang/CodeGen/CGFunctionInfo.h"
29 #include "llvm/IR/Intrinsics.h"
30 #include "llvm/IR/Metadata.h"
31 #include "llvm/Transforms/Utils/SanitizerStats.h"
32 #include <optional>
33 
34 using namespace clang;
35 using namespace CodeGen;
36 
37 /// Return the best known alignment for an unknown pointer to a
38 /// particular class.
getClassPointerAlignment(const CXXRecordDecl * RD)39 CharUnits CodeGenModule::getClassPointerAlignment(const CXXRecordDecl *RD) {
40   if (!RD->hasDefinition())
41     return CharUnits::One(); // Hopefully won't be used anywhere.
42 
43   auto &layout = getContext().getASTRecordLayout(RD);
44 
45   // If the class is final, then we know that the pointer points to an
46   // object of that type and can use the full alignment.
47   if (RD->isEffectivelyFinal())
48     return layout.getAlignment();
49 
50   // Otherwise, we have to assume it could be a subclass.
51   return layout.getNonVirtualAlignment();
52 }
53 
54 /// Return the smallest possible amount of storage that might be allocated
55 /// starting from the beginning of an object of a particular class.
56 ///
57 /// This may be smaller than sizeof(RD) if RD has virtual base classes.
getMinimumClassObjectSize(const CXXRecordDecl * RD)58 CharUnits CodeGenModule::getMinimumClassObjectSize(const CXXRecordDecl *RD) {
59   if (!RD->hasDefinition())
60     return CharUnits::One();
61 
62   auto &layout = getContext().getASTRecordLayout(RD);
63 
64   // If the class is final, then we know that the pointer points to an
65   // object of that type and can use the full alignment.
66   if (RD->isEffectivelyFinal())
67     return layout.getSize();
68 
69   // Otherwise, we have to assume it could be a subclass.
70   return std::max(layout.getNonVirtualSize(), CharUnits::One());
71 }
72 
73 /// Return the best known alignment for a pointer to a virtual base,
74 /// given the alignment of a pointer to the derived class.
getVBaseAlignment(CharUnits actualDerivedAlign,const CXXRecordDecl * derivedClass,const CXXRecordDecl * vbaseClass)75 CharUnits CodeGenModule::getVBaseAlignment(CharUnits actualDerivedAlign,
76                                            const CXXRecordDecl *derivedClass,
77                                            const CXXRecordDecl *vbaseClass) {
78   // The basic idea here is that an underaligned derived pointer might
79   // indicate an underaligned base pointer.
80 
81   assert(vbaseClass->isCompleteDefinition());
82   auto &baseLayout = getContext().getASTRecordLayout(vbaseClass);
83   CharUnits expectedVBaseAlign = baseLayout.getNonVirtualAlignment();
84 
85   return getDynamicOffsetAlignment(actualDerivedAlign, derivedClass,
86                                    expectedVBaseAlign);
87 }
88 
89 CharUnits
getDynamicOffsetAlignment(CharUnits actualBaseAlign,const CXXRecordDecl * baseDecl,CharUnits expectedTargetAlign)90 CodeGenModule::getDynamicOffsetAlignment(CharUnits actualBaseAlign,
91                                          const CXXRecordDecl *baseDecl,
92                                          CharUnits expectedTargetAlign) {
93   // If the base is an incomplete type (which is, alas, possible with
94   // member pointers), be pessimistic.
95   if (!baseDecl->isCompleteDefinition())
96     return std::min(actualBaseAlign, expectedTargetAlign);
97 
98   auto &baseLayout = getContext().getASTRecordLayout(baseDecl);
99   CharUnits expectedBaseAlign = baseLayout.getNonVirtualAlignment();
100 
101   // If the class is properly aligned, assume the target offset is, too.
102   //
103   // This actually isn't necessarily the right thing to do --- if the
104   // class is a complete object, but it's only properly aligned for a
105   // base subobject, then the alignments of things relative to it are
106   // probably off as well.  (Note that this requires the alignment of
107   // the target to be greater than the NV alignment of the derived
108   // class.)
109   //
110   // However, our approach to this kind of under-alignment can only
111   // ever be best effort; after all, we're never going to propagate
112   // alignments through variables or parameters.  Note, in particular,
113   // that constructing a polymorphic type in an address that's less
114   // than pointer-aligned will generally trap in the constructor,
115   // unless we someday add some sort of attribute to change the
116   // assumed alignment of 'this'.  So our goal here is pretty much
117   // just to allow the user to explicitly say that a pointer is
118   // under-aligned and then safely access its fields and vtables.
119   if (actualBaseAlign >= expectedBaseAlign) {
120     return expectedTargetAlign;
121   }
122 
123   // Otherwise, we might be offset by an arbitrary multiple of the
124   // actual alignment.  The correct adjustment is to take the min of
125   // the two alignments.
126   return std::min(actualBaseAlign, expectedTargetAlign);
127 }
128 
LoadCXXThisAddress()129 Address CodeGenFunction::LoadCXXThisAddress() {
130   assert(CurFuncDecl && "loading 'this' without a func declaration?");
131   auto *MD = cast<CXXMethodDecl>(CurFuncDecl);
132 
133   // Lazily compute CXXThisAlignment.
134   if (CXXThisAlignment.isZero()) {
135     // Just use the best known alignment for the parent.
136     // TODO: if we're currently emitting a complete-object ctor/dtor,
137     // we can always use the complete-object alignment.
138     CXXThisAlignment = CGM.getClassPointerAlignment(MD->getParent());
139   }
140 
141   llvm::Type *Ty = ConvertType(MD->getThisType()->getPointeeType());
142   return Address(LoadCXXThis(), Ty, CXXThisAlignment);
143 }
144 
145 /// Emit the address of a field using a member data pointer.
146 ///
147 /// \param E Only used for emergency diagnostics
148 Address
EmitCXXMemberDataPointerAddress(const Expr * E,Address base,llvm::Value * memberPtr,const MemberPointerType * memberPtrType,LValueBaseInfo * BaseInfo,TBAAAccessInfo * TBAAInfo)149 CodeGenFunction::EmitCXXMemberDataPointerAddress(const Expr *E, Address base,
150                                                  llvm::Value *memberPtr,
151                                       const MemberPointerType *memberPtrType,
152                                                  LValueBaseInfo *BaseInfo,
153                                                  TBAAAccessInfo *TBAAInfo) {
154   // Ask the ABI to compute the actual address.
155   llvm::Value *ptr =
156     CGM.getCXXABI().EmitMemberDataPointerAddress(*this, E, base,
157                                                  memberPtr, memberPtrType);
158 
159   QualType memberType = memberPtrType->getPointeeType();
160   CharUnits memberAlign =
161       CGM.getNaturalTypeAlignment(memberType, BaseInfo, TBAAInfo);
162   memberAlign =
163     CGM.getDynamicOffsetAlignment(base.getAlignment(),
164                             memberPtrType->getClass()->getAsCXXRecordDecl(),
165                                   memberAlign);
166   return Address(ptr, ConvertTypeForMem(memberPtrType->getPointeeType()),
167                  memberAlign);
168 }
169 
computeNonVirtualBaseClassOffset(const CXXRecordDecl * DerivedClass,CastExpr::path_const_iterator Start,CastExpr::path_const_iterator End)170 CharUnits CodeGenModule::computeNonVirtualBaseClassOffset(
171     const CXXRecordDecl *DerivedClass, CastExpr::path_const_iterator Start,
172     CastExpr::path_const_iterator End) {
173   CharUnits Offset = CharUnits::Zero();
174 
175   const ASTContext &Context = getContext();
176   const CXXRecordDecl *RD = DerivedClass;
177 
178   for (CastExpr::path_const_iterator I = Start; I != End; ++I) {
179     const CXXBaseSpecifier *Base = *I;
180     assert(!Base->isVirtual() && "Should not see virtual bases here!");
181 
182     // Get the layout.
183     const ASTRecordLayout &Layout = Context.getASTRecordLayout(RD);
184 
185     const auto *BaseDecl =
186         cast<CXXRecordDecl>(Base->getType()->castAs<RecordType>()->getDecl());
187 
188     // Add the offset.
189     Offset += Layout.getBaseClassOffset(BaseDecl);
190 
191     RD = BaseDecl;
192   }
193 
194   return Offset;
195 }
196 
197 llvm::Constant *
GetNonVirtualBaseClassOffset(const CXXRecordDecl * ClassDecl,CastExpr::path_const_iterator PathBegin,CastExpr::path_const_iterator PathEnd)198 CodeGenModule::GetNonVirtualBaseClassOffset(const CXXRecordDecl *ClassDecl,
199                                    CastExpr::path_const_iterator PathBegin,
200                                    CastExpr::path_const_iterator PathEnd) {
201   assert(PathBegin != PathEnd && "Base path should not be empty!");
202 
203   CharUnits Offset =
204       computeNonVirtualBaseClassOffset(ClassDecl, PathBegin, PathEnd);
205   if (Offset.isZero())
206     return nullptr;
207 
208   llvm::Type *PtrDiffTy =
209   Types.ConvertType(getContext().getPointerDiffType());
210 
211   return llvm::ConstantInt::get(PtrDiffTy, Offset.getQuantity());
212 }
213 
214 /// Gets the address of a direct base class within a complete object.
215 /// This should only be used for (1) non-virtual bases or (2) virtual bases
216 /// when the type is known to be complete (e.g. in complete destructors).
217 ///
218 /// The object pointed to by 'This' is assumed to be non-null.
219 Address
GetAddressOfDirectBaseInCompleteClass(Address This,const CXXRecordDecl * Derived,const CXXRecordDecl * Base,bool BaseIsVirtual)220 CodeGenFunction::GetAddressOfDirectBaseInCompleteClass(Address This,
221                                                    const CXXRecordDecl *Derived,
222                                                    const CXXRecordDecl *Base,
223                                                    bool BaseIsVirtual) {
224   // 'this' must be a pointer (in some address space) to Derived.
225   assert(This.getElementType() == ConvertType(Derived));
226 
227   // Compute the offset of the virtual base.
228   CharUnits Offset;
229   const ASTRecordLayout &Layout = getContext().getASTRecordLayout(Derived);
230   if (BaseIsVirtual)
231     Offset = Layout.getVBaseClassOffset(Base);
232   else
233     Offset = Layout.getBaseClassOffset(Base);
234 
235   // Shift and cast down to the base type.
236   // TODO: for complete types, this should be possible with a GEP.
237   Address V = This;
238   if (!Offset.isZero()) {
239     V = Builder.CreateElementBitCast(V, Int8Ty);
240     V = Builder.CreateConstInBoundsByteGEP(V, Offset);
241   }
242   V = Builder.CreateElementBitCast(V, ConvertType(Base));
243 
244   return V;
245 }
246 
247 static Address
ApplyNonVirtualAndVirtualOffset(CodeGenFunction & CGF,Address addr,CharUnits nonVirtualOffset,llvm::Value * virtualOffset,const CXXRecordDecl * derivedClass,const CXXRecordDecl * nearestVBase)248 ApplyNonVirtualAndVirtualOffset(CodeGenFunction &CGF, Address addr,
249                                 CharUnits nonVirtualOffset,
250                                 llvm::Value *virtualOffset,
251                                 const CXXRecordDecl *derivedClass,
252                                 const CXXRecordDecl *nearestVBase) {
253   // Assert that we have something to do.
254   assert(!nonVirtualOffset.isZero() || virtualOffset != nullptr);
255 
256   // Compute the offset from the static and dynamic components.
257   llvm::Value *baseOffset;
258   if (!nonVirtualOffset.isZero()) {
259     llvm::Type *OffsetType =
260         (CGF.CGM.getTarget().getCXXABI().isItaniumFamily() &&
261          CGF.CGM.getItaniumVTableContext().isRelativeLayout())
262             ? CGF.Int32Ty
263             : CGF.PtrDiffTy;
264     baseOffset =
265         llvm::ConstantInt::get(OffsetType, nonVirtualOffset.getQuantity());
266     if (virtualOffset) {
267       baseOffset = CGF.Builder.CreateAdd(virtualOffset, baseOffset);
268     }
269   } else {
270     baseOffset = virtualOffset;
271   }
272 
273   // Apply the base offset.
274   llvm::Value *ptr = addr.getPointer();
275   unsigned AddrSpace = ptr->getType()->getPointerAddressSpace();
276   ptr = CGF.Builder.CreateBitCast(ptr, CGF.Int8Ty->getPointerTo(AddrSpace));
277   ptr = CGF.Builder.CreateInBoundsGEP(CGF.Int8Ty, ptr, baseOffset, "add.ptr");
278 
279   // If we have a virtual component, the alignment of the result will
280   // be relative only to the known alignment of that vbase.
281   CharUnits alignment;
282   if (virtualOffset) {
283     assert(nearestVBase && "virtual offset without vbase?");
284     alignment = CGF.CGM.getVBaseAlignment(addr.getAlignment(),
285                                           derivedClass, nearestVBase);
286   } else {
287     alignment = addr.getAlignment();
288   }
289   alignment = alignment.alignmentAtOffset(nonVirtualOffset);
290 
291   return Address(ptr, CGF.Int8Ty, alignment);
292 }
293 
GetAddressOfBaseClass(Address Value,const CXXRecordDecl * Derived,CastExpr::path_const_iterator PathBegin,CastExpr::path_const_iterator PathEnd,bool NullCheckValue,SourceLocation Loc)294 Address CodeGenFunction::GetAddressOfBaseClass(
295     Address Value, const CXXRecordDecl *Derived,
296     CastExpr::path_const_iterator PathBegin,
297     CastExpr::path_const_iterator PathEnd, bool NullCheckValue,
298     SourceLocation Loc) {
299   assert(PathBegin != PathEnd && "Base path should not be empty!");
300 
301   CastExpr::path_const_iterator Start = PathBegin;
302   const CXXRecordDecl *VBase = nullptr;
303 
304   // Sema has done some convenient canonicalization here: if the
305   // access path involved any virtual steps, the conversion path will
306   // *start* with a step down to the correct virtual base subobject,
307   // and hence will not require any further steps.
308   if ((*Start)->isVirtual()) {
309     VBase = cast<CXXRecordDecl>(
310         (*Start)->getType()->castAs<RecordType>()->getDecl());
311     ++Start;
312   }
313 
314   // Compute the static offset of the ultimate destination within its
315   // allocating subobject (the virtual base, if there is one, or else
316   // the "complete" object that we see).
317   CharUnits NonVirtualOffset = CGM.computeNonVirtualBaseClassOffset(
318       VBase ? VBase : Derived, Start, PathEnd);
319 
320   // If there's a virtual step, we can sometimes "devirtualize" it.
321   // For now, that's limited to when the derived type is final.
322   // TODO: "devirtualize" this for accesses to known-complete objects.
323   if (VBase && Derived->hasAttr<FinalAttr>()) {
324     const ASTRecordLayout &layout = getContext().getASTRecordLayout(Derived);
325     CharUnits vBaseOffset = layout.getVBaseClassOffset(VBase);
326     NonVirtualOffset += vBaseOffset;
327     VBase = nullptr; // we no longer have a virtual step
328   }
329 
330   // Get the base pointer type.
331   llvm::Type *BaseValueTy = ConvertType((PathEnd[-1])->getType());
332   llvm::Type *BasePtrTy =
333       BaseValueTy->getPointerTo(Value.getType()->getPointerAddressSpace());
334 
335   QualType DerivedTy = getContext().getRecordType(Derived);
336   CharUnits DerivedAlign = CGM.getClassPointerAlignment(Derived);
337 
338   // If the static offset is zero and we don't have a virtual step,
339   // just do a bitcast; null checks are unnecessary.
340   if (NonVirtualOffset.isZero() && !VBase) {
341     if (sanitizePerformTypeCheck()) {
342       SanitizerSet SkippedChecks;
343       SkippedChecks.set(SanitizerKind::Null, !NullCheckValue);
344       EmitTypeCheck(TCK_Upcast, Loc, Value.getPointer(),
345                     DerivedTy, DerivedAlign, SkippedChecks);
346     }
347     return Builder.CreateElementBitCast(Value, BaseValueTy);
348   }
349 
350   llvm::BasicBlock *origBB = nullptr;
351   llvm::BasicBlock *endBB = nullptr;
352 
353   // Skip over the offset (and the vtable load) if we're supposed to
354   // null-check the pointer.
355   if (NullCheckValue) {
356     origBB = Builder.GetInsertBlock();
357     llvm::BasicBlock *notNullBB = createBasicBlock("cast.notnull");
358     endBB = createBasicBlock("cast.end");
359 
360     llvm::Value *isNull = Builder.CreateIsNull(Value.getPointer());
361     Builder.CreateCondBr(isNull, endBB, notNullBB);
362     EmitBlock(notNullBB);
363   }
364 
365   if (sanitizePerformTypeCheck()) {
366     SanitizerSet SkippedChecks;
367     SkippedChecks.set(SanitizerKind::Null, true);
368     EmitTypeCheck(VBase ? TCK_UpcastToVirtualBase : TCK_Upcast, Loc,
369                   Value.getPointer(), DerivedTy, DerivedAlign, SkippedChecks);
370   }
371 
372   // Compute the virtual offset.
373   llvm::Value *VirtualOffset = nullptr;
374   if (VBase) {
375     VirtualOffset =
376       CGM.getCXXABI().GetVirtualBaseClassOffset(*this, Value, Derived, VBase);
377   }
378 
379   // Apply both offsets.
380   Value = ApplyNonVirtualAndVirtualOffset(*this, Value, NonVirtualOffset,
381                                           VirtualOffset, Derived, VBase);
382 
383   // Cast to the destination type.
384   Value = Builder.CreateElementBitCast(Value, BaseValueTy);
385 
386   // Build a phi if we needed a null check.
387   if (NullCheckValue) {
388     llvm::BasicBlock *notNullBB = Builder.GetInsertBlock();
389     Builder.CreateBr(endBB);
390     EmitBlock(endBB);
391 
392     llvm::PHINode *PHI = Builder.CreatePHI(BasePtrTy, 2, "cast.result");
393     PHI->addIncoming(Value.getPointer(), notNullBB);
394     PHI->addIncoming(llvm::Constant::getNullValue(BasePtrTy), origBB);
395     Value = Value.withPointer(PHI);
396   }
397 
398   return Value;
399 }
400 
401 Address
GetAddressOfDerivedClass(Address BaseAddr,const CXXRecordDecl * Derived,CastExpr::path_const_iterator PathBegin,CastExpr::path_const_iterator PathEnd,bool NullCheckValue)402 CodeGenFunction::GetAddressOfDerivedClass(Address BaseAddr,
403                                           const CXXRecordDecl *Derived,
404                                         CastExpr::path_const_iterator PathBegin,
405                                           CastExpr::path_const_iterator PathEnd,
406                                           bool NullCheckValue) {
407   assert(PathBegin != PathEnd && "Base path should not be empty!");
408 
409   QualType DerivedTy =
410     getContext().getCanonicalType(getContext().getTagDeclType(Derived));
411   unsigned AddrSpace = BaseAddr.getAddressSpace();
412   llvm::Type *DerivedValueTy = ConvertType(DerivedTy);
413   llvm::Type *DerivedPtrTy = DerivedValueTy->getPointerTo(AddrSpace);
414 
415   llvm::Value *NonVirtualOffset =
416     CGM.GetNonVirtualBaseClassOffset(Derived, PathBegin, PathEnd);
417 
418   if (!NonVirtualOffset) {
419     // No offset, we can just cast back.
420     return Builder.CreateElementBitCast(BaseAddr, DerivedValueTy);
421   }
422 
423   llvm::BasicBlock *CastNull = nullptr;
424   llvm::BasicBlock *CastNotNull = nullptr;
425   llvm::BasicBlock *CastEnd = nullptr;
426 
427   if (NullCheckValue) {
428     CastNull = createBasicBlock("cast.null");
429     CastNotNull = createBasicBlock("cast.notnull");
430     CastEnd = createBasicBlock("cast.end");
431 
432     llvm::Value *IsNull = Builder.CreateIsNull(BaseAddr.getPointer());
433     Builder.CreateCondBr(IsNull, CastNull, CastNotNull);
434     EmitBlock(CastNotNull);
435   }
436 
437   // Apply the offset.
438   llvm::Value *Value = Builder.CreateBitCast(BaseAddr.getPointer(), Int8PtrTy);
439   Value = Builder.CreateInBoundsGEP(
440       Int8Ty, Value, Builder.CreateNeg(NonVirtualOffset), "sub.ptr");
441 
442   // Just cast.
443   Value = Builder.CreateBitCast(Value, DerivedPtrTy);
444 
445   // Produce a PHI if we had a null-check.
446   if (NullCheckValue) {
447     Builder.CreateBr(CastEnd);
448     EmitBlock(CastNull);
449     Builder.CreateBr(CastEnd);
450     EmitBlock(CastEnd);
451 
452     llvm::PHINode *PHI = Builder.CreatePHI(Value->getType(), 2);
453     PHI->addIncoming(Value, CastNotNull);
454     PHI->addIncoming(llvm::Constant::getNullValue(Value->getType()), CastNull);
455     Value = PHI;
456   }
457 
458   return Address(Value, DerivedValueTy, CGM.getClassPointerAlignment(Derived));
459 }
460 
GetVTTParameter(GlobalDecl GD,bool ForVirtualBase,bool Delegating)461 llvm::Value *CodeGenFunction::GetVTTParameter(GlobalDecl GD,
462                                               bool ForVirtualBase,
463                                               bool Delegating) {
464   if (!CGM.getCXXABI().NeedsVTTParameter(GD)) {
465     // This constructor/destructor does not need a VTT parameter.
466     return nullptr;
467   }
468 
469   const CXXRecordDecl *RD = cast<CXXMethodDecl>(CurCodeDecl)->getParent();
470   const CXXRecordDecl *Base = cast<CXXMethodDecl>(GD.getDecl())->getParent();
471 
472   uint64_t SubVTTIndex;
473 
474   if (Delegating) {
475     // If this is a delegating constructor call, just load the VTT.
476     return LoadCXXVTT();
477   } else if (RD == Base) {
478     // If the record matches the base, this is the complete ctor/dtor
479     // variant calling the base variant in a class with virtual bases.
480     assert(!CGM.getCXXABI().NeedsVTTParameter(CurGD) &&
481            "doing no-op VTT offset in base dtor/ctor?");
482     assert(!ForVirtualBase && "Can't have same class as virtual base!");
483     SubVTTIndex = 0;
484   } else {
485     const ASTRecordLayout &Layout = getContext().getASTRecordLayout(RD);
486     CharUnits BaseOffset = ForVirtualBase ?
487       Layout.getVBaseClassOffset(Base) :
488       Layout.getBaseClassOffset(Base);
489 
490     SubVTTIndex =
491       CGM.getVTables().getSubVTTIndex(RD, BaseSubobject(Base, BaseOffset));
492     assert(SubVTTIndex != 0 && "Sub-VTT index must be greater than zero!");
493   }
494 
495   if (CGM.getCXXABI().NeedsVTTParameter(CurGD)) {
496     // A VTT parameter was passed to the constructor, use it.
497     llvm::Value *VTT = LoadCXXVTT();
498     return Builder.CreateConstInBoundsGEP1_64(VoidPtrTy, VTT, SubVTTIndex);
499   } else {
500     // We're the complete constructor, so get the VTT by name.
501     llvm::GlobalValue *VTT = CGM.getVTables().GetAddrOfVTT(RD);
502     return Builder.CreateConstInBoundsGEP2_64(
503         VTT->getValueType(), VTT, 0, SubVTTIndex);
504   }
505 }
506 
507 namespace {
508   /// Call the destructor for a direct base class.
509   struct CallBaseDtor final : EHScopeStack::Cleanup {
510     const CXXRecordDecl *BaseClass;
511     bool BaseIsVirtual;
CallBaseDtor__anonfcad378b0111::CallBaseDtor512     CallBaseDtor(const CXXRecordDecl *Base, bool BaseIsVirtual)
513       : BaseClass(Base), BaseIsVirtual(BaseIsVirtual) {}
514 
Emit__anonfcad378b0111::CallBaseDtor515     void Emit(CodeGenFunction &CGF, Flags flags) override {
516       const CXXRecordDecl *DerivedClass =
517         cast<CXXMethodDecl>(CGF.CurCodeDecl)->getParent();
518 
519       const CXXDestructorDecl *D = BaseClass->getDestructor();
520       // We are already inside a destructor, so presumably the object being
521       // destroyed should have the expected type.
522       QualType ThisTy = D->getThisObjectType();
523       Address Addr =
524         CGF.GetAddressOfDirectBaseInCompleteClass(CGF.LoadCXXThisAddress(),
525                                                   DerivedClass, BaseClass,
526                                                   BaseIsVirtual);
527       CGF.EmitCXXDestructorCall(D, Dtor_Base, BaseIsVirtual,
528                                 /*Delegating=*/false, Addr, ThisTy);
529     }
530   };
531 
532   /// A visitor which checks whether an initializer uses 'this' in a
533   /// way which requires the vtable to be properly set.
534   struct DynamicThisUseChecker : ConstEvaluatedExprVisitor<DynamicThisUseChecker> {
535     typedef ConstEvaluatedExprVisitor<DynamicThisUseChecker> super;
536 
537     bool UsesThis;
538 
DynamicThisUseChecker__anonfcad378b0111::DynamicThisUseChecker539     DynamicThisUseChecker(const ASTContext &C) : super(C), UsesThis(false) {}
540 
541     // Black-list all explicit and implicit references to 'this'.
542     //
543     // Do we need to worry about external references to 'this' derived
544     // from arbitrary code?  If so, then anything which runs arbitrary
545     // external code might potentially access the vtable.
VisitCXXThisExpr__anonfcad378b0111::DynamicThisUseChecker546     void VisitCXXThisExpr(const CXXThisExpr *E) { UsesThis = true; }
547   };
548 } // end anonymous namespace
549 
BaseInitializerUsesThis(ASTContext & C,const Expr * Init)550 static bool BaseInitializerUsesThis(ASTContext &C, const Expr *Init) {
551   DynamicThisUseChecker Checker(C);
552   Checker.Visit(Init);
553   return Checker.UsesThis;
554 }
555 
EmitBaseInitializer(CodeGenFunction & CGF,const CXXRecordDecl * ClassDecl,CXXCtorInitializer * BaseInit)556 static void EmitBaseInitializer(CodeGenFunction &CGF,
557                                 const CXXRecordDecl *ClassDecl,
558                                 CXXCtorInitializer *BaseInit) {
559   assert(BaseInit->isBaseInitializer() &&
560          "Must have base initializer!");
561 
562   Address ThisPtr = CGF.LoadCXXThisAddress();
563 
564   const Type *BaseType = BaseInit->getBaseClass();
565   const auto *BaseClassDecl =
566       cast<CXXRecordDecl>(BaseType->castAs<RecordType>()->getDecl());
567 
568   bool isBaseVirtual = BaseInit->isBaseVirtual();
569 
570   // If the initializer for the base (other than the constructor
571   // itself) accesses 'this' in any way, we need to initialize the
572   // vtables.
573   if (BaseInitializerUsesThis(CGF.getContext(), BaseInit->getInit()))
574     CGF.InitializeVTablePointers(ClassDecl);
575 
576   // We can pretend to be a complete class because it only matters for
577   // virtual bases, and we only do virtual bases for complete ctors.
578   Address V =
579     CGF.GetAddressOfDirectBaseInCompleteClass(ThisPtr, ClassDecl,
580                                               BaseClassDecl,
581                                               isBaseVirtual);
582   AggValueSlot AggSlot =
583       AggValueSlot::forAddr(
584           V, Qualifiers(),
585           AggValueSlot::IsDestructed,
586           AggValueSlot::DoesNotNeedGCBarriers,
587           AggValueSlot::IsNotAliased,
588           CGF.getOverlapForBaseInit(ClassDecl, BaseClassDecl, isBaseVirtual));
589 
590   CGF.EmitAggExpr(BaseInit->getInit(), AggSlot);
591 
592   if (CGF.CGM.getLangOpts().Exceptions &&
593       !BaseClassDecl->hasTrivialDestructor())
594     CGF.EHStack.pushCleanup<CallBaseDtor>(EHCleanup, BaseClassDecl,
595                                           isBaseVirtual);
596 }
597 
isMemcpyEquivalentSpecialMember(const CXXMethodDecl * D)598 static bool isMemcpyEquivalentSpecialMember(const CXXMethodDecl *D) {
599   auto *CD = dyn_cast<CXXConstructorDecl>(D);
600   if (!(CD && CD->isCopyOrMoveConstructor()) &&
601       !D->isCopyAssignmentOperator() && !D->isMoveAssignmentOperator())
602     return false;
603 
604   // We can emit a memcpy for a trivial copy or move constructor/assignment.
605   if (D->isTrivial() && !D->getParent()->mayInsertExtraPadding())
606     return true;
607 
608   // We *must* emit a memcpy for a defaulted union copy or move op.
609   if (D->getParent()->isUnion() && D->isDefaulted())
610     return true;
611 
612   return false;
613 }
614 
EmitLValueForAnyFieldInitialization(CodeGenFunction & CGF,CXXCtorInitializer * MemberInit,LValue & LHS)615 static void EmitLValueForAnyFieldInitialization(CodeGenFunction &CGF,
616                                                 CXXCtorInitializer *MemberInit,
617                                                 LValue &LHS) {
618   FieldDecl *Field = MemberInit->getAnyMember();
619   if (MemberInit->isIndirectMemberInitializer()) {
620     // If we are initializing an anonymous union field, drill down to the field.
621     IndirectFieldDecl *IndirectField = MemberInit->getIndirectMember();
622     for (const auto *I : IndirectField->chain())
623       LHS = CGF.EmitLValueForFieldInitialization(LHS, cast<FieldDecl>(I));
624   } else {
625     LHS = CGF.EmitLValueForFieldInitialization(LHS, Field);
626   }
627 }
628 
EmitMemberInitializer(CodeGenFunction & CGF,const CXXRecordDecl * ClassDecl,CXXCtorInitializer * MemberInit,const CXXConstructorDecl * Constructor,FunctionArgList & Args)629 static void EmitMemberInitializer(CodeGenFunction &CGF,
630                                   const CXXRecordDecl *ClassDecl,
631                                   CXXCtorInitializer *MemberInit,
632                                   const CXXConstructorDecl *Constructor,
633                                   FunctionArgList &Args) {
634   ApplyDebugLocation Loc(CGF, MemberInit->getSourceLocation());
635   assert(MemberInit->isAnyMemberInitializer() &&
636          "Must have member initializer!");
637   assert(MemberInit->getInit() && "Must have initializer!");
638 
639   // non-static data member initializers.
640   FieldDecl *Field = MemberInit->getAnyMember();
641   QualType FieldType = Field->getType();
642 
643   llvm::Value *ThisPtr = CGF.LoadCXXThis();
644   QualType RecordTy = CGF.getContext().getTypeDeclType(ClassDecl);
645   LValue LHS;
646 
647   // If a base constructor is being emitted, create an LValue that has the
648   // non-virtual alignment.
649   if (CGF.CurGD.getCtorType() == Ctor_Base)
650     LHS = CGF.MakeNaturalAlignPointeeAddrLValue(ThisPtr, RecordTy);
651   else
652     LHS = CGF.MakeNaturalAlignAddrLValue(ThisPtr, RecordTy);
653 
654   EmitLValueForAnyFieldInitialization(CGF, MemberInit, LHS);
655 
656   // Special case: if we are in a copy or move constructor, and we are copying
657   // an array of PODs or classes with trivial copy constructors, ignore the
658   // AST and perform the copy we know is equivalent.
659   // FIXME: This is hacky at best... if we had a bit more explicit information
660   // in the AST, we could generalize it more easily.
661   const ConstantArrayType *Array
662     = CGF.getContext().getAsConstantArrayType(FieldType);
663   if (Array && Constructor->isDefaulted() &&
664       Constructor->isCopyOrMoveConstructor()) {
665     QualType BaseElementTy = CGF.getContext().getBaseElementType(Array);
666     CXXConstructExpr *CE = dyn_cast<CXXConstructExpr>(MemberInit->getInit());
667     if (BaseElementTy.isPODType(CGF.getContext()) ||
668         (CE && isMemcpyEquivalentSpecialMember(CE->getConstructor()))) {
669       unsigned SrcArgIndex =
670           CGF.CGM.getCXXABI().getSrcArgforCopyCtor(Constructor, Args);
671       llvm::Value *SrcPtr
672         = CGF.Builder.CreateLoad(CGF.GetAddrOfLocalVar(Args[SrcArgIndex]));
673       LValue ThisRHSLV = CGF.MakeNaturalAlignAddrLValue(SrcPtr, RecordTy);
674       LValue Src = CGF.EmitLValueForFieldInitialization(ThisRHSLV, Field);
675 
676       // Copy the aggregate.
677       CGF.EmitAggregateCopy(LHS, Src, FieldType, CGF.getOverlapForFieldInit(Field),
678                             LHS.isVolatileQualified());
679       // Ensure that we destroy the objects if an exception is thrown later in
680       // the constructor.
681       QualType::DestructionKind dtorKind = FieldType.isDestructedType();
682       if (CGF.needsEHCleanup(dtorKind))
683         CGF.pushEHDestroy(dtorKind, LHS.getAddress(CGF), FieldType);
684       return;
685     }
686   }
687 
688   CGF.EmitInitializerForField(Field, LHS, MemberInit->getInit());
689 }
690 
EmitInitializerForField(FieldDecl * Field,LValue LHS,Expr * Init)691 void CodeGenFunction::EmitInitializerForField(FieldDecl *Field, LValue LHS,
692                                               Expr *Init) {
693   QualType FieldType = Field->getType();
694   switch (getEvaluationKind(FieldType)) {
695   case TEK_Scalar:
696     if (LHS.isSimple()) {
697       EmitExprAsInit(Init, Field, LHS, false);
698     } else {
699       RValue RHS = RValue::get(EmitScalarExpr(Init));
700       EmitStoreThroughLValue(RHS, LHS);
701     }
702     break;
703   case TEK_Complex:
704     EmitComplexExprIntoLValue(Init, LHS, /*isInit*/ true);
705     break;
706   case TEK_Aggregate: {
707     AggValueSlot Slot = AggValueSlot::forLValue(
708         LHS, *this, AggValueSlot::IsDestructed,
709         AggValueSlot::DoesNotNeedGCBarriers, AggValueSlot::IsNotAliased,
710         getOverlapForFieldInit(Field), AggValueSlot::IsNotZeroed,
711         // Checks are made by the code that calls constructor.
712         AggValueSlot::IsSanitizerChecked);
713     EmitAggExpr(Init, Slot);
714     break;
715   }
716   }
717 
718   // Ensure that we destroy this object if an exception is thrown
719   // later in the constructor.
720   QualType::DestructionKind dtorKind = FieldType.isDestructedType();
721   if (needsEHCleanup(dtorKind))
722     pushEHDestroy(dtorKind, LHS.getAddress(*this), FieldType);
723 }
724 
725 /// Checks whether the given constructor is a valid subject for the
726 /// complete-to-base constructor delegation optimization, i.e.
727 /// emitting the complete constructor as a simple call to the base
728 /// constructor.
IsConstructorDelegationValid(const CXXConstructorDecl * Ctor)729 bool CodeGenFunction::IsConstructorDelegationValid(
730     const CXXConstructorDecl *Ctor) {
731 
732   // Currently we disable the optimization for classes with virtual
733   // bases because (1) the addresses of parameter variables need to be
734   // consistent across all initializers but (2) the delegate function
735   // call necessarily creates a second copy of the parameter variable.
736   //
737   // The limiting example (purely theoretical AFAIK):
738   //   struct A { A(int &c) { c++; } };
739   //   struct B : virtual A {
740   //     B(int count) : A(count) { printf("%d\n", count); }
741   //   };
742   // ...although even this example could in principle be emitted as a
743   // delegation since the address of the parameter doesn't escape.
744   if (Ctor->getParent()->getNumVBases()) {
745     // TODO: white-list trivial vbase initializers.  This case wouldn't
746     // be subject to the restrictions below.
747 
748     // TODO: white-list cases where:
749     //  - there are no non-reference parameters to the constructor
750     //  - the initializers don't access any non-reference parameters
751     //  - the initializers don't take the address of non-reference
752     //    parameters
753     //  - etc.
754     // If we ever add any of the above cases, remember that:
755     //  - function-try-blocks will always exclude this optimization
756     //  - we need to perform the constructor prologue and cleanup in
757     //    EmitConstructorBody.
758 
759     return false;
760   }
761 
762   // We also disable the optimization for variadic functions because
763   // it's impossible to "re-pass" varargs.
764   if (Ctor->getType()->castAs<FunctionProtoType>()->isVariadic())
765     return false;
766 
767   // FIXME: Decide if we can do a delegation of a delegating constructor.
768   if (Ctor->isDelegatingConstructor())
769     return false;
770 
771   return true;
772 }
773 
774 // Emit code in ctor (Prologue==true) or dtor (Prologue==false)
775 // to poison the extra field paddings inserted under
776 // -fsanitize-address-field-padding=1|2.
EmitAsanPrologueOrEpilogue(bool Prologue)777 void CodeGenFunction::EmitAsanPrologueOrEpilogue(bool Prologue) {
778   ASTContext &Context = getContext();
779   const CXXRecordDecl *ClassDecl =
780       Prologue ? cast<CXXConstructorDecl>(CurGD.getDecl())->getParent()
781                : cast<CXXDestructorDecl>(CurGD.getDecl())->getParent();
782   if (!ClassDecl->mayInsertExtraPadding()) return;
783 
784   struct SizeAndOffset {
785     uint64_t Size;
786     uint64_t Offset;
787   };
788 
789   unsigned PtrSize = CGM.getDataLayout().getPointerSizeInBits();
790   const ASTRecordLayout &Info = Context.getASTRecordLayout(ClassDecl);
791 
792   // Populate sizes and offsets of fields.
793   SmallVector<SizeAndOffset, 16> SSV(Info.getFieldCount());
794   for (unsigned i = 0, e = Info.getFieldCount(); i != e; ++i)
795     SSV[i].Offset =
796         Context.toCharUnitsFromBits(Info.getFieldOffset(i)).getQuantity();
797 
798   size_t NumFields = 0;
799   for (const auto *Field : ClassDecl->fields()) {
800     const FieldDecl *D = Field;
801     auto FieldInfo = Context.getTypeInfoInChars(D->getType());
802     CharUnits FieldSize = FieldInfo.Width;
803     assert(NumFields < SSV.size());
804     SSV[NumFields].Size = D->isBitField() ? 0 : FieldSize.getQuantity();
805     NumFields++;
806   }
807   assert(NumFields == SSV.size());
808   if (SSV.size() <= 1) return;
809 
810   // We will insert calls to __asan_* run-time functions.
811   // LLVM AddressSanitizer pass may decide to inline them later.
812   llvm::Type *Args[2] = {IntPtrTy, IntPtrTy};
813   llvm::FunctionType *FTy =
814       llvm::FunctionType::get(CGM.VoidTy, Args, false);
815   llvm::FunctionCallee F = CGM.CreateRuntimeFunction(
816       FTy, Prologue ? "__asan_poison_intra_object_redzone"
817                     : "__asan_unpoison_intra_object_redzone");
818 
819   llvm::Value *ThisPtr = LoadCXXThis();
820   ThisPtr = Builder.CreatePtrToInt(ThisPtr, IntPtrTy);
821   uint64_t TypeSize = Info.getNonVirtualSize().getQuantity();
822   // For each field check if it has sufficient padding,
823   // if so (un)poison it with a call.
824   for (size_t i = 0; i < SSV.size(); i++) {
825     uint64_t AsanAlignment = 8;
826     uint64_t NextField = i == SSV.size() - 1 ? TypeSize : SSV[i + 1].Offset;
827     uint64_t PoisonSize = NextField - SSV[i].Offset - SSV[i].Size;
828     uint64_t EndOffset = SSV[i].Offset + SSV[i].Size;
829     if (PoisonSize < AsanAlignment || !SSV[i].Size ||
830         (NextField % AsanAlignment) != 0)
831       continue;
832     Builder.CreateCall(
833         F, {Builder.CreateAdd(ThisPtr, Builder.getIntN(PtrSize, EndOffset)),
834             Builder.getIntN(PtrSize, PoisonSize)});
835   }
836 }
837 
838 /// EmitConstructorBody - Emits the body of the current constructor.
EmitConstructorBody(FunctionArgList & Args)839 void CodeGenFunction::EmitConstructorBody(FunctionArgList &Args) {
840   EmitAsanPrologueOrEpilogue(true);
841   const CXXConstructorDecl *Ctor = cast<CXXConstructorDecl>(CurGD.getDecl());
842   CXXCtorType CtorType = CurGD.getCtorType();
843 
844   assert((CGM.getTarget().getCXXABI().hasConstructorVariants() ||
845           CtorType == Ctor_Complete) &&
846          "can only generate complete ctor for this ABI");
847 
848   // Before we go any further, try the complete->base constructor
849   // delegation optimization.
850   if (CtorType == Ctor_Complete && IsConstructorDelegationValid(Ctor) &&
851       CGM.getTarget().getCXXABI().hasConstructorVariants()) {
852     EmitDelegateCXXConstructorCall(Ctor, Ctor_Base, Args, Ctor->getEndLoc());
853     return;
854   }
855 
856   const FunctionDecl *Definition = nullptr;
857   Stmt *Body = Ctor->getBody(Definition);
858   assert(Definition == Ctor && "emitting wrong constructor body");
859 
860   // Enter the function-try-block before the constructor prologue if
861   // applicable.
862   bool IsTryBody = (Body && isa<CXXTryStmt>(Body));
863   if (IsTryBody)
864     EnterCXXTryStmt(*cast<CXXTryStmt>(Body), true);
865 
866   incrementProfileCounter(Body);
867 
868   RunCleanupsScope RunCleanups(*this);
869 
870   // TODO: in restricted cases, we can emit the vbase initializers of
871   // a complete ctor and then delegate to the base ctor.
872 
873   // Emit the constructor prologue, i.e. the base and member
874   // initializers.
875   EmitCtorPrologue(Ctor, CtorType, Args);
876 
877   // Emit the body of the statement.
878   if (IsTryBody)
879     EmitStmt(cast<CXXTryStmt>(Body)->getTryBlock());
880   else if (Body)
881     EmitStmt(Body);
882 
883   // Emit any cleanup blocks associated with the member or base
884   // initializers, which includes (along the exceptional path) the
885   // destructors for those members and bases that were fully
886   // constructed.
887   RunCleanups.ForceCleanup();
888 
889   if (IsTryBody)
890     ExitCXXTryStmt(*cast<CXXTryStmt>(Body), true);
891 }
892 
893 namespace {
894   /// RAII object to indicate that codegen is copying the value representation
895   /// instead of the object representation. Useful when copying a struct or
896   /// class which has uninitialized members and we're only performing
897   /// lvalue-to-rvalue conversion on the object but not its members.
898   class CopyingValueRepresentation {
899   public:
CopyingValueRepresentation(CodeGenFunction & CGF)900     explicit CopyingValueRepresentation(CodeGenFunction &CGF)
901         : CGF(CGF), OldSanOpts(CGF.SanOpts) {
902       CGF.SanOpts.set(SanitizerKind::Bool, false);
903       CGF.SanOpts.set(SanitizerKind::Enum, false);
904     }
~CopyingValueRepresentation()905     ~CopyingValueRepresentation() {
906       CGF.SanOpts = OldSanOpts;
907     }
908   private:
909     CodeGenFunction &CGF;
910     SanitizerSet OldSanOpts;
911   };
912 } // end anonymous namespace
913 
914 namespace {
915   class FieldMemcpyizer {
916   public:
FieldMemcpyizer(CodeGenFunction & CGF,const CXXRecordDecl * ClassDecl,const VarDecl * SrcRec)917     FieldMemcpyizer(CodeGenFunction &CGF, const CXXRecordDecl *ClassDecl,
918                     const VarDecl *SrcRec)
919       : CGF(CGF), ClassDecl(ClassDecl), SrcRec(SrcRec),
920         RecLayout(CGF.getContext().getASTRecordLayout(ClassDecl)),
921         FirstField(nullptr), LastField(nullptr), FirstFieldOffset(0),
922         LastFieldOffset(0), LastAddedFieldIndex(0) {}
923 
isMemcpyableField(FieldDecl * F) const924     bool isMemcpyableField(FieldDecl *F) const {
925       // Never memcpy fields when we are adding poisoned paddings.
926       if (CGF.getContext().getLangOpts().SanitizeAddressFieldPadding)
927         return false;
928       Qualifiers Qual = F->getType().getQualifiers();
929       if (Qual.hasVolatile() || Qual.hasObjCLifetime())
930         return false;
931       return true;
932     }
933 
addMemcpyableField(FieldDecl * F)934     void addMemcpyableField(FieldDecl *F) {
935       if (F->isZeroSize(CGF.getContext()))
936         return;
937       if (!FirstField)
938         addInitialField(F);
939       else
940         addNextField(F);
941     }
942 
getMemcpySize(uint64_t FirstByteOffset) const943     CharUnits getMemcpySize(uint64_t FirstByteOffset) const {
944       ASTContext &Ctx = CGF.getContext();
945       unsigned LastFieldSize =
946           LastField->isBitField()
947               ? LastField->getBitWidthValue(Ctx)
948               : Ctx.toBits(
949                     Ctx.getTypeInfoDataSizeInChars(LastField->getType()).Width);
950       uint64_t MemcpySizeBits = LastFieldOffset + LastFieldSize -
951                                 FirstByteOffset + Ctx.getCharWidth() - 1;
952       CharUnits MemcpySize = Ctx.toCharUnitsFromBits(MemcpySizeBits);
953       return MemcpySize;
954     }
955 
emitMemcpy()956     void emitMemcpy() {
957       // Give the subclass a chance to bail out if it feels the memcpy isn't
958       // worth it (e.g. Hasn't aggregated enough data).
959       if (!FirstField) {
960         return;
961       }
962 
963       uint64_t FirstByteOffset;
964       if (FirstField->isBitField()) {
965         const CGRecordLayout &RL =
966           CGF.getTypes().getCGRecordLayout(FirstField->getParent());
967         const CGBitFieldInfo &BFInfo = RL.getBitFieldInfo(FirstField);
968         // FirstFieldOffset is not appropriate for bitfields,
969         // we need to use the storage offset instead.
970         FirstByteOffset = CGF.getContext().toBits(BFInfo.StorageOffset);
971       } else {
972         FirstByteOffset = FirstFieldOffset;
973       }
974 
975       CharUnits MemcpySize = getMemcpySize(FirstByteOffset);
976       QualType RecordTy = CGF.getContext().getTypeDeclType(ClassDecl);
977       Address ThisPtr = CGF.LoadCXXThisAddress();
978       LValue DestLV = CGF.MakeAddrLValue(ThisPtr, RecordTy);
979       LValue Dest = CGF.EmitLValueForFieldInitialization(DestLV, FirstField);
980       llvm::Value *SrcPtr = CGF.Builder.CreateLoad(CGF.GetAddrOfLocalVar(SrcRec));
981       LValue SrcLV = CGF.MakeNaturalAlignAddrLValue(SrcPtr, RecordTy);
982       LValue Src = CGF.EmitLValueForFieldInitialization(SrcLV, FirstField);
983 
984       emitMemcpyIR(
985           Dest.isBitField() ? Dest.getBitFieldAddress() : Dest.getAddress(CGF),
986           Src.isBitField() ? Src.getBitFieldAddress() : Src.getAddress(CGF),
987           MemcpySize);
988       reset();
989     }
990 
reset()991     void reset() {
992       FirstField = nullptr;
993     }
994 
995   protected:
996     CodeGenFunction &CGF;
997     const CXXRecordDecl *ClassDecl;
998 
999   private:
emitMemcpyIR(Address DestPtr,Address SrcPtr,CharUnits Size)1000     void emitMemcpyIR(Address DestPtr, Address SrcPtr, CharUnits Size) {
1001       DestPtr = CGF.Builder.CreateElementBitCast(DestPtr, CGF.Int8Ty);
1002       SrcPtr = CGF.Builder.CreateElementBitCast(SrcPtr, CGF.Int8Ty);
1003       CGF.Builder.CreateMemCpy(DestPtr, SrcPtr, Size.getQuantity());
1004     }
1005 
addInitialField(FieldDecl * F)1006     void addInitialField(FieldDecl *F) {
1007       FirstField = F;
1008       LastField = F;
1009       FirstFieldOffset = RecLayout.getFieldOffset(F->getFieldIndex());
1010       LastFieldOffset = FirstFieldOffset;
1011       LastAddedFieldIndex = F->getFieldIndex();
1012     }
1013 
addNextField(FieldDecl * F)1014     void addNextField(FieldDecl *F) {
1015       // For the most part, the following invariant will hold:
1016       //   F->getFieldIndex() == LastAddedFieldIndex + 1
1017       // The one exception is that Sema won't add a copy-initializer for an
1018       // unnamed bitfield, which will show up here as a gap in the sequence.
1019       assert(F->getFieldIndex() >= LastAddedFieldIndex + 1 &&
1020              "Cannot aggregate fields out of order.");
1021       LastAddedFieldIndex = F->getFieldIndex();
1022 
1023       // The 'first' and 'last' fields are chosen by offset, rather than field
1024       // index. This allows the code to support bitfields, as well as regular
1025       // fields.
1026       uint64_t FOffset = RecLayout.getFieldOffset(F->getFieldIndex());
1027       if (FOffset < FirstFieldOffset) {
1028         FirstField = F;
1029         FirstFieldOffset = FOffset;
1030       } else if (FOffset >= LastFieldOffset) {
1031         LastField = F;
1032         LastFieldOffset = FOffset;
1033       }
1034     }
1035 
1036     const VarDecl *SrcRec;
1037     const ASTRecordLayout &RecLayout;
1038     FieldDecl *FirstField;
1039     FieldDecl *LastField;
1040     uint64_t FirstFieldOffset, LastFieldOffset;
1041     unsigned LastAddedFieldIndex;
1042   };
1043 
1044   class ConstructorMemcpyizer : public FieldMemcpyizer {
1045   private:
1046     /// Get source argument for copy constructor. Returns null if not a copy
1047     /// constructor.
getTrivialCopySource(CodeGenFunction & CGF,const CXXConstructorDecl * CD,FunctionArgList & Args)1048     static const VarDecl *getTrivialCopySource(CodeGenFunction &CGF,
1049                                                const CXXConstructorDecl *CD,
1050                                                FunctionArgList &Args) {
1051       if (CD->isCopyOrMoveConstructor() && CD->isDefaulted())
1052         return Args[CGF.CGM.getCXXABI().getSrcArgforCopyCtor(CD, Args)];
1053       return nullptr;
1054     }
1055 
1056     // Returns true if a CXXCtorInitializer represents a member initialization
1057     // that can be rolled into a memcpy.
isMemberInitMemcpyable(CXXCtorInitializer * MemberInit) const1058     bool isMemberInitMemcpyable(CXXCtorInitializer *MemberInit) const {
1059       if (!MemcpyableCtor)
1060         return false;
1061       FieldDecl *Field = MemberInit->getMember();
1062       assert(Field && "No field for member init.");
1063       QualType FieldType = Field->getType();
1064       CXXConstructExpr *CE = dyn_cast<CXXConstructExpr>(MemberInit->getInit());
1065 
1066       // Bail out on non-memcpyable, not-trivially-copyable members.
1067       if (!(CE && isMemcpyEquivalentSpecialMember(CE->getConstructor())) &&
1068           !(FieldType.isTriviallyCopyableType(CGF.getContext()) ||
1069             FieldType->isReferenceType()))
1070         return false;
1071 
1072       // Bail out on volatile fields.
1073       if (!isMemcpyableField(Field))
1074         return false;
1075 
1076       // Otherwise we're good.
1077       return true;
1078     }
1079 
1080   public:
ConstructorMemcpyizer(CodeGenFunction & CGF,const CXXConstructorDecl * CD,FunctionArgList & Args)1081     ConstructorMemcpyizer(CodeGenFunction &CGF, const CXXConstructorDecl *CD,
1082                           FunctionArgList &Args)
1083       : FieldMemcpyizer(CGF, CD->getParent(), getTrivialCopySource(CGF, CD, Args)),
1084         ConstructorDecl(CD),
1085         MemcpyableCtor(CD->isDefaulted() &&
1086                        CD->isCopyOrMoveConstructor() &&
1087                        CGF.getLangOpts().getGC() == LangOptions::NonGC),
1088         Args(Args) { }
1089 
addMemberInitializer(CXXCtorInitializer * MemberInit)1090     void addMemberInitializer(CXXCtorInitializer *MemberInit) {
1091       if (isMemberInitMemcpyable(MemberInit)) {
1092         AggregatedInits.push_back(MemberInit);
1093         addMemcpyableField(MemberInit->getMember());
1094       } else {
1095         emitAggregatedInits();
1096         EmitMemberInitializer(CGF, ConstructorDecl->getParent(), MemberInit,
1097                               ConstructorDecl, Args);
1098       }
1099     }
1100 
emitAggregatedInits()1101     void emitAggregatedInits() {
1102       if (AggregatedInits.size() <= 1) {
1103         // This memcpy is too small to be worthwhile. Fall back on default
1104         // codegen.
1105         if (!AggregatedInits.empty()) {
1106           CopyingValueRepresentation CVR(CGF);
1107           EmitMemberInitializer(CGF, ConstructorDecl->getParent(),
1108                                 AggregatedInits[0], ConstructorDecl, Args);
1109           AggregatedInits.clear();
1110         }
1111         reset();
1112         return;
1113       }
1114 
1115       pushEHDestructors();
1116       emitMemcpy();
1117       AggregatedInits.clear();
1118     }
1119 
pushEHDestructors()1120     void pushEHDestructors() {
1121       Address ThisPtr = CGF.LoadCXXThisAddress();
1122       QualType RecordTy = CGF.getContext().getTypeDeclType(ClassDecl);
1123       LValue LHS = CGF.MakeAddrLValue(ThisPtr, RecordTy);
1124 
1125       for (unsigned i = 0; i < AggregatedInits.size(); ++i) {
1126         CXXCtorInitializer *MemberInit = AggregatedInits[i];
1127         QualType FieldType = MemberInit->getAnyMember()->getType();
1128         QualType::DestructionKind dtorKind = FieldType.isDestructedType();
1129         if (!CGF.needsEHCleanup(dtorKind))
1130           continue;
1131         LValue FieldLHS = LHS;
1132         EmitLValueForAnyFieldInitialization(CGF, MemberInit, FieldLHS);
1133         CGF.pushEHDestroy(dtorKind, FieldLHS.getAddress(CGF), FieldType);
1134       }
1135     }
1136 
finish()1137     void finish() {
1138       emitAggregatedInits();
1139     }
1140 
1141   private:
1142     const CXXConstructorDecl *ConstructorDecl;
1143     bool MemcpyableCtor;
1144     FunctionArgList &Args;
1145     SmallVector<CXXCtorInitializer*, 16> AggregatedInits;
1146   };
1147 
1148   class AssignmentMemcpyizer : public FieldMemcpyizer {
1149   private:
1150     // Returns the memcpyable field copied by the given statement, if one
1151     // exists. Otherwise returns null.
getMemcpyableField(Stmt * S)1152     FieldDecl *getMemcpyableField(Stmt *S) {
1153       if (!AssignmentsMemcpyable)
1154         return nullptr;
1155       if (BinaryOperator *BO = dyn_cast<BinaryOperator>(S)) {
1156         // Recognise trivial assignments.
1157         if (BO->getOpcode() != BO_Assign)
1158           return nullptr;
1159         MemberExpr *ME = dyn_cast<MemberExpr>(BO->getLHS());
1160         if (!ME)
1161           return nullptr;
1162         FieldDecl *Field = dyn_cast<FieldDecl>(ME->getMemberDecl());
1163         if (!Field || !isMemcpyableField(Field))
1164           return nullptr;
1165         Stmt *RHS = BO->getRHS();
1166         if (ImplicitCastExpr *EC = dyn_cast<ImplicitCastExpr>(RHS))
1167           RHS = EC->getSubExpr();
1168         if (!RHS)
1169           return nullptr;
1170         if (MemberExpr *ME2 = dyn_cast<MemberExpr>(RHS)) {
1171           if (ME2->getMemberDecl() == Field)
1172             return Field;
1173         }
1174         return nullptr;
1175       } else if (CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(S)) {
1176         CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(MCE->getCalleeDecl());
1177         if (!(MD && isMemcpyEquivalentSpecialMember(MD)))
1178           return nullptr;
1179         MemberExpr *IOA = dyn_cast<MemberExpr>(MCE->getImplicitObjectArgument());
1180         if (!IOA)
1181           return nullptr;
1182         FieldDecl *Field = dyn_cast<FieldDecl>(IOA->getMemberDecl());
1183         if (!Field || !isMemcpyableField(Field))
1184           return nullptr;
1185         MemberExpr *Arg0 = dyn_cast<MemberExpr>(MCE->getArg(0));
1186         if (!Arg0 || Field != dyn_cast<FieldDecl>(Arg0->getMemberDecl()))
1187           return nullptr;
1188         return Field;
1189       } else if (CallExpr *CE = dyn_cast<CallExpr>(S)) {
1190         FunctionDecl *FD = dyn_cast<FunctionDecl>(CE->getCalleeDecl());
1191         if (!FD || FD->getBuiltinID() != Builtin::BI__builtin_memcpy)
1192           return nullptr;
1193         Expr *DstPtr = CE->getArg(0);
1194         if (ImplicitCastExpr *DC = dyn_cast<ImplicitCastExpr>(DstPtr))
1195           DstPtr = DC->getSubExpr();
1196         UnaryOperator *DUO = dyn_cast<UnaryOperator>(DstPtr);
1197         if (!DUO || DUO->getOpcode() != UO_AddrOf)
1198           return nullptr;
1199         MemberExpr *ME = dyn_cast<MemberExpr>(DUO->getSubExpr());
1200         if (!ME)
1201           return nullptr;
1202         FieldDecl *Field = dyn_cast<FieldDecl>(ME->getMemberDecl());
1203         if (!Field || !isMemcpyableField(Field))
1204           return nullptr;
1205         Expr *SrcPtr = CE->getArg(1);
1206         if (ImplicitCastExpr *SC = dyn_cast<ImplicitCastExpr>(SrcPtr))
1207           SrcPtr = SC->getSubExpr();
1208         UnaryOperator *SUO = dyn_cast<UnaryOperator>(SrcPtr);
1209         if (!SUO || SUO->getOpcode() != UO_AddrOf)
1210           return nullptr;
1211         MemberExpr *ME2 = dyn_cast<MemberExpr>(SUO->getSubExpr());
1212         if (!ME2 || Field != dyn_cast<FieldDecl>(ME2->getMemberDecl()))
1213           return nullptr;
1214         return Field;
1215       }
1216 
1217       return nullptr;
1218     }
1219 
1220     bool AssignmentsMemcpyable;
1221     SmallVector<Stmt*, 16> AggregatedStmts;
1222 
1223   public:
AssignmentMemcpyizer(CodeGenFunction & CGF,const CXXMethodDecl * AD,FunctionArgList & Args)1224     AssignmentMemcpyizer(CodeGenFunction &CGF, const CXXMethodDecl *AD,
1225                          FunctionArgList &Args)
1226       : FieldMemcpyizer(CGF, AD->getParent(), Args[Args.size() - 1]),
1227         AssignmentsMemcpyable(CGF.getLangOpts().getGC() == LangOptions::NonGC) {
1228       assert(Args.size() == 2);
1229     }
1230 
emitAssignment(Stmt * S)1231     void emitAssignment(Stmt *S) {
1232       FieldDecl *F = getMemcpyableField(S);
1233       if (F) {
1234         addMemcpyableField(F);
1235         AggregatedStmts.push_back(S);
1236       } else {
1237         emitAggregatedStmts();
1238         CGF.EmitStmt(S);
1239       }
1240     }
1241 
emitAggregatedStmts()1242     void emitAggregatedStmts() {
1243       if (AggregatedStmts.size() <= 1) {
1244         if (!AggregatedStmts.empty()) {
1245           CopyingValueRepresentation CVR(CGF);
1246           CGF.EmitStmt(AggregatedStmts[0]);
1247         }
1248         reset();
1249       }
1250 
1251       emitMemcpy();
1252       AggregatedStmts.clear();
1253     }
1254 
finish()1255     void finish() {
1256       emitAggregatedStmts();
1257     }
1258   };
1259 } // end anonymous namespace
1260 
isInitializerOfDynamicClass(const CXXCtorInitializer * BaseInit)1261 static bool isInitializerOfDynamicClass(const CXXCtorInitializer *BaseInit) {
1262   const Type *BaseType = BaseInit->getBaseClass();
1263   const auto *BaseClassDecl =
1264       cast<CXXRecordDecl>(BaseType->castAs<RecordType>()->getDecl());
1265   return BaseClassDecl->isDynamicClass();
1266 }
1267 
1268 /// EmitCtorPrologue - This routine generates necessary code to initialize
1269 /// base classes and non-static data members belonging to this constructor.
EmitCtorPrologue(const CXXConstructorDecl * CD,CXXCtorType CtorType,FunctionArgList & Args)1270 void CodeGenFunction::EmitCtorPrologue(const CXXConstructorDecl *CD,
1271                                        CXXCtorType CtorType,
1272                                        FunctionArgList &Args) {
1273   if (CD->isDelegatingConstructor())
1274     return EmitDelegatingCXXConstructorCall(CD, Args);
1275 
1276   const CXXRecordDecl *ClassDecl = CD->getParent();
1277 
1278   CXXConstructorDecl::init_const_iterator B = CD->init_begin(),
1279                                           E = CD->init_end();
1280 
1281   // Virtual base initializers first, if any. They aren't needed if:
1282   // - This is a base ctor variant
1283   // - There are no vbases
1284   // - The class is abstract, so a complete object of it cannot be constructed
1285   //
1286   // The check for an abstract class is necessary because sema may not have
1287   // marked virtual base destructors referenced.
1288   bool ConstructVBases = CtorType != Ctor_Base &&
1289                          ClassDecl->getNumVBases() != 0 &&
1290                          !ClassDecl->isAbstract();
1291 
1292   // In the Microsoft C++ ABI, there are no constructor variants. Instead, the
1293   // constructor of a class with virtual bases takes an additional parameter to
1294   // conditionally construct the virtual bases. Emit that check here.
1295   llvm::BasicBlock *BaseCtorContinueBB = nullptr;
1296   if (ConstructVBases &&
1297       !CGM.getTarget().getCXXABI().hasConstructorVariants()) {
1298     BaseCtorContinueBB =
1299         CGM.getCXXABI().EmitCtorCompleteObjectHandler(*this, ClassDecl);
1300     assert(BaseCtorContinueBB);
1301   }
1302 
1303   llvm::Value *const OldThis = CXXThisValue;
1304   for (; B != E && (*B)->isBaseInitializer() && (*B)->isBaseVirtual(); B++) {
1305     if (!ConstructVBases)
1306       continue;
1307     if (CGM.getCodeGenOpts().StrictVTablePointers &&
1308         CGM.getCodeGenOpts().OptimizationLevel > 0 &&
1309         isInitializerOfDynamicClass(*B))
1310       CXXThisValue = Builder.CreateLaunderInvariantGroup(LoadCXXThis());
1311     EmitBaseInitializer(*this, ClassDecl, *B);
1312   }
1313 
1314   if (BaseCtorContinueBB) {
1315     // Complete object handler should continue to the remaining initializers.
1316     Builder.CreateBr(BaseCtorContinueBB);
1317     EmitBlock(BaseCtorContinueBB);
1318   }
1319 
1320   // Then, non-virtual base initializers.
1321   for (; B != E && (*B)->isBaseInitializer(); B++) {
1322     assert(!(*B)->isBaseVirtual());
1323 
1324     if (CGM.getCodeGenOpts().StrictVTablePointers &&
1325         CGM.getCodeGenOpts().OptimizationLevel > 0 &&
1326         isInitializerOfDynamicClass(*B))
1327       CXXThisValue = Builder.CreateLaunderInvariantGroup(LoadCXXThis());
1328     EmitBaseInitializer(*this, ClassDecl, *B);
1329   }
1330 
1331   CXXThisValue = OldThis;
1332 
1333   InitializeVTablePointers(ClassDecl);
1334 
1335   // And finally, initialize class members.
1336   FieldConstructionScope FCS(*this, LoadCXXThisAddress());
1337   ConstructorMemcpyizer CM(*this, CD, Args);
1338   for (; B != E; B++) {
1339     CXXCtorInitializer *Member = (*B);
1340     assert(!Member->isBaseInitializer());
1341     assert(Member->isAnyMemberInitializer() &&
1342            "Delegating initializer on non-delegating constructor");
1343     CM.addMemberInitializer(Member);
1344   }
1345   CM.finish();
1346 }
1347 
1348 static bool
1349 FieldHasTrivialDestructorBody(ASTContext &Context, const FieldDecl *Field);
1350 
1351 static bool
HasTrivialDestructorBody(ASTContext & Context,const CXXRecordDecl * BaseClassDecl,const CXXRecordDecl * MostDerivedClassDecl)1352 HasTrivialDestructorBody(ASTContext &Context,
1353                          const CXXRecordDecl *BaseClassDecl,
1354                          const CXXRecordDecl *MostDerivedClassDecl)
1355 {
1356   // If the destructor is trivial we don't have to check anything else.
1357   if (BaseClassDecl->hasTrivialDestructor())
1358     return true;
1359 
1360   if (!BaseClassDecl->getDestructor()->hasTrivialBody())
1361     return false;
1362 
1363   // Check fields.
1364   for (const auto *Field : BaseClassDecl->fields())
1365     if (!FieldHasTrivialDestructorBody(Context, Field))
1366       return false;
1367 
1368   // Check non-virtual bases.
1369   for (const auto &I : BaseClassDecl->bases()) {
1370     if (I.isVirtual())
1371       continue;
1372 
1373     const CXXRecordDecl *NonVirtualBase =
1374       cast<CXXRecordDecl>(I.getType()->castAs<RecordType>()->getDecl());
1375     if (!HasTrivialDestructorBody(Context, NonVirtualBase,
1376                                   MostDerivedClassDecl))
1377       return false;
1378   }
1379 
1380   if (BaseClassDecl == MostDerivedClassDecl) {
1381     // Check virtual bases.
1382     for (const auto &I : BaseClassDecl->vbases()) {
1383       const CXXRecordDecl *VirtualBase =
1384         cast<CXXRecordDecl>(I.getType()->castAs<RecordType>()->getDecl());
1385       if (!HasTrivialDestructorBody(Context, VirtualBase,
1386                                     MostDerivedClassDecl))
1387         return false;
1388     }
1389   }
1390 
1391   return true;
1392 }
1393 
1394 static bool
FieldHasTrivialDestructorBody(ASTContext & Context,const FieldDecl * Field)1395 FieldHasTrivialDestructorBody(ASTContext &Context,
1396                                           const FieldDecl *Field)
1397 {
1398   QualType FieldBaseElementType = Context.getBaseElementType(Field->getType());
1399 
1400   const RecordType *RT = FieldBaseElementType->getAs<RecordType>();
1401   if (!RT)
1402     return true;
1403 
1404   CXXRecordDecl *FieldClassDecl = cast<CXXRecordDecl>(RT->getDecl());
1405 
1406   // The destructor for an implicit anonymous union member is never invoked.
1407   if (FieldClassDecl->isUnion() && FieldClassDecl->isAnonymousStructOrUnion())
1408     return false;
1409 
1410   return HasTrivialDestructorBody(Context, FieldClassDecl, FieldClassDecl);
1411 }
1412 
1413 /// CanSkipVTablePointerInitialization - Check whether we need to initialize
1414 /// any vtable pointers before calling this destructor.
CanSkipVTablePointerInitialization(CodeGenFunction & CGF,const CXXDestructorDecl * Dtor)1415 static bool CanSkipVTablePointerInitialization(CodeGenFunction &CGF,
1416                                                const CXXDestructorDecl *Dtor) {
1417   const CXXRecordDecl *ClassDecl = Dtor->getParent();
1418   if (!ClassDecl->isDynamicClass())
1419     return true;
1420 
1421   // For a final class, the vtable pointer is known to already point to the
1422   // class's vtable.
1423   if (ClassDecl->isEffectivelyFinal())
1424     return true;
1425 
1426   if (!Dtor->hasTrivialBody())
1427     return false;
1428 
1429   // Check the fields.
1430   for (const auto *Field : ClassDecl->fields())
1431     if (!FieldHasTrivialDestructorBody(CGF.getContext(), Field))
1432       return false;
1433 
1434   return true;
1435 }
1436 
1437 /// EmitDestructorBody - Emits the body of the current destructor.
EmitDestructorBody(FunctionArgList & Args)1438 void CodeGenFunction::EmitDestructorBody(FunctionArgList &Args) {
1439   const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CurGD.getDecl());
1440   CXXDtorType DtorType = CurGD.getDtorType();
1441 
1442   // For an abstract class, non-base destructors are never used (and can't
1443   // be emitted in general, because vbase dtors may not have been validated
1444   // by Sema), but the Itanium ABI doesn't make them optional and Clang may
1445   // in fact emit references to them from other compilations, so emit them
1446   // as functions containing a trap instruction.
1447   if (DtorType != Dtor_Base && Dtor->getParent()->isAbstract()) {
1448     llvm::CallInst *TrapCall = EmitTrapCall(llvm::Intrinsic::trap);
1449     TrapCall->setDoesNotReturn();
1450     TrapCall->setDoesNotThrow();
1451     Builder.CreateUnreachable();
1452     Builder.ClearInsertionPoint();
1453     return;
1454   }
1455 
1456   Stmt *Body = Dtor->getBody();
1457   if (Body)
1458     incrementProfileCounter(Body);
1459 
1460   // The call to operator delete in a deleting destructor happens
1461   // outside of the function-try-block, which means it's always
1462   // possible to delegate the destructor body to the complete
1463   // destructor.  Do so.
1464   if (DtorType == Dtor_Deleting) {
1465     RunCleanupsScope DtorEpilogue(*this);
1466     EnterDtorCleanups(Dtor, Dtor_Deleting);
1467     if (HaveInsertPoint()) {
1468       QualType ThisTy = Dtor->getThisObjectType();
1469       EmitCXXDestructorCall(Dtor, Dtor_Complete, /*ForVirtualBase=*/false,
1470                             /*Delegating=*/false, LoadCXXThisAddress(), ThisTy);
1471     }
1472     return;
1473   }
1474 
1475   // If the body is a function-try-block, enter the try before
1476   // anything else.
1477   bool isTryBody = (Body && isa<CXXTryStmt>(Body));
1478   if (isTryBody)
1479     EnterCXXTryStmt(*cast<CXXTryStmt>(Body), true);
1480   EmitAsanPrologueOrEpilogue(false);
1481 
1482   // Enter the epilogue cleanups.
1483   RunCleanupsScope DtorEpilogue(*this);
1484 
1485   // If this is the complete variant, just invoke the base variant;
1486   // the epilogue will destruct the virtual bases.  But we can't do
1487   // this optimization if the body is a function-try-block, because
1488   // we'd introduce *two* handler blocks.  In the Microsoft ABI, we
1489   // always delegate because we might not have a definition in this TU.
1490   switch (DtorType) {
1491   case Dtor_Comdat: llvm_unreachable("not expecting a COMDAT");
1492   case Dtor_Deleting: llvm_unreachable("already handled deleting case");
1493 
1494   case Dtor_Complete:
1495     assert((Body || getTarget().getCXXABI().isMicrosoft()) &&
1496            "can't emit a dtor without a body for non-Microsoft ABIs");
1497 
1498     // Enter the cleanup scopes for virtual bases.
1499     EnterDtorCleanups(Dtor, Dtor_Complete);
1500 
1501     if (!isTryBody) {
1502       QualType ThisTy = Dtor->getThisObjectType();
1503       EmitCXXDestructorCall(Dtor, Dtor_Base, /*ForVirtualBase=*/false,
1504                             /*Delegating=*/false, LoadCXXThisAddress(), ThisTy);
1505       break;
1506     }
1507 
1508     // Fallthrough: act like we're in the base variant.
1509     [[fallthrough]];
1510 
1511   case Dtor_Base:
1512     assert(Body);
1513 
1514     // Enter the cleanup scopes for fields and non-virtual bases.
1515     EnterDtorCleanups(Dtor, Dtor_Base);
1516 
1517     // Initialize the vtable pointers before entering the body.
1518     if (!CanSkipVTablePointerInitialization(*this, Dtor)) {
1519       // Insert the llvm.launder.invariant.group intrinsic before initializing
1520       // the vptrs to cancel any previous assumptions we might have made.
1521       if (CGM.getCodeGenOpts().StrictVTablePointers &&
1522           CGM.getCodeGenOpts().OptimizationLevel > 0)
1523         CXXThisValue = Builder.CreateLaunderInvariantGroup(LoadCXXThis());
1524       InitializeVTablePointers(Dtor->getParent());
1525     }
1526 
1527     if (isTryBody)
1528       EmitStmt(cast<CXXTryStmt>(Body)->getTryBlock());
1529     else if (Body)
1530       EmitStmt(Body);
1531     else {
1532       assert(Dtor->isImplicit() && "bodyless dtor not implicit");
1533       // nothing to do besides what's in the epilogue
1534     }
1535     // -fapple-kext must inline any call to this dtor into
1536     // the caller's body.
1537     if (getLangOpts().AppleKext)
1538       CurFn->addFnAttr(llvm::Attribute::AlwaysInline);
1539 
1540     break;
1541   }
1542 
1543   // Jump out through the epilogue cleanups.
1544   DtorEpilogue.ForceCleanup();
1545 
1546   // Exit the try if applicable.
1547   if (isTryBody)
1548     ExitCXXTryStmt(*cast<CXXTryStmt>(Body), true);
1549 }
1550 
emitImplicitAssignmentOperatorBody(FunctionArgList & Args)1551 void CodeGenFunction::emitImplicitAssignmentOperatorBody(FunctionArgList &Args) {
1552   const CXXMethodDecl *AssignOp = cast<CXXMethodDecl>(CurGD.getDecl());
1553   const Stmt *RootS = AssignOp->getBody();
1554   assert(isa<CompoundStmt>(RootS) &&
1555          "Body of an implicit assignment operator should be compound stmt.");
1556   const CompoundStmt *RootCS = cast<CompoundStmt>(RootS);
1557 
1558   LexicalScope Scope(*this, RootCS->getSourceRange());
1559 
1560   incrementProfileCounter(RootCS);
1561   AssignmentMemcpyizer AM(*this, AssignOp, Args);
1562   for (auto *I : RootCS->body())
1563     AM.emitAssignment(I);
1564   AM.finish();
1565 }
1566 
1567 namespace {
LoadThisForDtorDelete(CodeGenFunction & CGF,const CXXDestructorDecl * DD)1568   llvm::Value *LoadThisForDtorDelete(CodeGenFunction &CGF,
1569                                      const CXXDestructorDecl *DD) {
1570     if (Expr *ThisArg = DD->getOperatorDeleteThisArg())
1571       return CGF.EmitScalarExpr(ThisArg);
1572     return CGF.LoadCXXThis();
1573   }
1574 
1575   /// Call the operator delete associated with the current destructor.
1576   struct CallDtorDelete final : EHScopeStack::Cleanup {
CallDtorDelete__anonfcad378b0411::CallDtorDelete1577     CallDtorDelete() {}
1578 
Emit__anonfcad378b0411::CallDtorDelete1579     void Emit(CodeGenFunction &CGF, Flags flags) override {
1580       const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CGF.CurCodeDecl);
1581       const CXXRecordDecl *ClassDecl = Dtor->getParent();
1582       CGF.EmitDeleteCall(Dtor->getOperatorDelete(),
1583                          LoadThisForDtorDelete(CGF, Dtor),
1584                          CGF.getContext().getTagDeclType(ClassDecl));
1585     }
1586   };
1587 
EmitConditionalDtorDeleteCall(CodeGenFunction & CGF,llvm::Value * ShouldDeleteCondition,bool ReturnAfterDelete)1588   void EmitConditionalDtorDeleteCall(CodeGenFunction &CGF,
1589                                      llvm::Value *ShouldDeleteCondition,
1590                                      bool ReturnAfterDelete) {
1591     llvm::BasicBlock *callDeleteBB = CGF.createBasicBlock("dtor.call_delete");
1592     llvm::BasicBlock *continueBB = CGF.createBasicBlock("dtor.continue");
1593     llvm::Value *ShouldCallDelete
1594       = CGF.Builder.CreateIsNull(ShouldDeleteCondition);
1595     CGF.Builder.CreateCondBr(ShouldCallDelete, continueBB, callDeleteBB);
1596 
1597     CGF.EmitBlock(callDeleteBB);
1598     const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CGF.CurCodeDecl);
1599     const CXXRecordDecl *ClassDecl = Dtor->getParent();
1600     CGF.EmitDeleteCall(Dtor->getOperatorDelete(),
1601                        LoadThisForDtorDelete(CGF, Dtor),
1602                        CGF.getContext().getTagDeclType(ClassDecl));
1603     assert(Dtor->getOperatorDelete()->isDestroyingOperatorDelete() ==
1604                ReturnAfterDelete &&
1605            "unexpected value for ReturnAfterDelete");
1606     if (ReturnAfterDelete)
1607       CGF.EmitBranchThroughCleanup(CGF.ReturnBlock);
1608     else
1609       CGF.Builder.CreateBr(continueBB);
1610 
1611     CGF.EmitBlock(continueBB);
1612   }
1613 
1614   struct CallDtorDeleteConditional final : EHScopeStack::Cleanup {
1615     llvm::Value *ShouldDeleteCondition;
1616 
1617   public:
CallDtorDeleteConditional__anonfcad378b0411::CallDtorDeleteConditional1618     CallDtorDeleteConditional(llvm::Value *ShouldDeleteCondition)
1619         : ShouldDeleteCondition(ShouldDeleteCondition) {
1620       assert(ShouldDeleteCondition != nullptr);
1621     }
1622 
Emit__anonfcad378b0411::CallDtorDeleteConditional1623     void Emit(CodeGenFunction &CGF, Flags flags) override {
1624       EmitConditionalDtorDeleteCall(CGF, ShouldDeleteCondition,
1625                                     /*ReturnAfterDelete*/false);
1626     }
1627   };
1628 
1629   class DestroyField  final : public EHScopeStack::Cleanup {
1630     const FieldDecl *field;
1631     CodeGenFunction::Destroyer *destroyer;
1632     bool useEHCleanupForArray;
1633 
1634   public:
DestroyField(const FieldDecl * field,CodeGenFunction::Destroyer * destroyer,bool useEHCleanupForArray)1635     DestroyField(const FieldDecl *field, CodeGenFunction::Destroyer *destroyer,
1636                  bool useEHCleanupForArray)
1637         : field(field), destroyer(destroyer),
1638           useEHCleanupForArray(useEHCleanupForArray) {}
1639 
Emit(CodeGenFunction & CGF,Flags flags)1640     void Emit(CodeGenFunction &CGF, Flags flags) override {
1641       // Find the address of the field.
1642       Address thisValue = CGF.LoadCXXThisAddress();
1643       QualType RecordTy = CGF.getContext().getTagDeclType(field->getParent());
1644       LValue ThisLV = CGF.MakeAddrLValue(thisValue, RecordTy);
1645       LValue LV = CGF.EmitLValueForField(ThisLV, field);
1646       assert(LV.isSimple());
1647 
1648       CGF.emitDestroy(LV.getAddress(CGF), field->getType(), destroyer,
1649                       flags.isForNormalCleanup() && useEHCleanupForArray);
1650     }
1651   };
1652 
1653   class DeclAsInlineDebugLocation {
1654     CGDebugInfo *DI;
1655     llvm::MDNode *InlinedAt;
1656     std::optional<ApplyDebugLocation> Location;
1657 
1658   public:
DeclAsInlineDebugLocation(CodeGenFunction & CGF,const NamedDecl & Decl)1659     DeclAsInlineDebugLocation(CodeGenFunction &CGF, const NamedDecl &Decl)
1660         : DI(CGF.getDebugInfo()) {
1661       if (!DI)
1662         return;
1663       InlinedAt = DI->getInlinedAt();
1664       DI->setInlinedAt(CGF.Builder.getCurrentDebugLocation());
1665       Location.emplace(CGF, Decl.getLocation());
1666     }
1667 
~DeclAsInlineDebugLocation()1668     ~DeclAsInlineDebugLocation() {
1669       if (!DI)
1670         return;
1671       Location.reset();
1672       DI->setInlinedAt(InlinedAt);
1673     }
1674   };
1675 
EmitSanitizerDtorCallback(CodeGenFunction & CGF,StringRef Name,llvm::Value * Ptr,std::optional<CharUnits::QuantityType> PoisonSize={})1676   static void EmitSanitizerDtorCallback(
1677       CodeGenFunction &CGF, StringRef Name, llvm::Value *Ptr,
1678       std::optional<CharUnits::QuantityType> PoisonSize = {}) {
1679     CodeGenFunction::SanitizerScope SanScope(&CGF);
1680     // Pass in void pointer and size of region as arguments to runtime
1681     // function
1682     SmallVector<llvm::Value *, 2> Args = {
1683         CGF.Builder.CreateBitCast(Ptr, CGF.VoidPtrTy)};
1684     SmallVector<llvm::Type *, 2> ArgTypes = {CGF.VoidPtrTy};
1685 
1686     if (PoisonSize.has_value()) {
1687       Args.emplace_back(llvm::ConstantInt::get(CGF.SizeTy, *PoisonSize));
1688       ArgTypes.emplace_back(CGF.SizeTy);
1689     }
1690 
1691     llvm::FunctionType *FnType =
1692         llvm::FunctionType::get(CGF.VoidTy, ArgTypes, false);
1693     llvm::FunctionCallee Fn = CGF.CGM.CreateRuntimeFunction(FnType, Name);
1694 
1695     CGF.EmitNounwindRuntimeCall(Fn, Args);
1696   }
1697 
1698   static void
EmitSanitizerDtorFieldsCallback(CodeGenFunction & CGF,llvm::Value * Ptr,CharUnits::QuantityType PoisonSize)1699   EmitSanitizerDtorFieldsCallback(CodeGenFunction &CGF, llvm::Value *Ptr,
1700                                   CharUnits::QuantityType PoisonSize) {
1701     EmitSanitizerDtorCallback(CGF, "__sanitizer_dtor_callback_fields", Ptr,
1702                               PoisonSize);
1703   }
1704 
1705   /// Poison base class with a trivial destructor.
1706   struct SanitizeDtorTrivialBase final : EHScopeStack::Cleanup {
1707     const CXXRecordDecl *BaseClass;
1708     bool BaseIsVirtual;
SanitizeDtorTrivialBase__anonfcad378b0411::SanitizeDtorTrivialBase1709     SanitizeDtorTrivialBase(const CXXRecordDecl *Base, bool BaseIsVirtual)
1710         : BaseClass(Base), BaseIsVirtual(BaseIsVirtual) {}
1711 
Emit__anonfcad378b0411::SanitizeDtorTrivialBase1712     void Emit(CodeGenFunction &CGF, Flags flags) override {
1713       const CXXRecordDecl *DerivedClass =
1714           cast<CXXMethodDecl>(CGF.CurCodeDecl)->getParent();
1715 
1716       Address Addr = CGF.GetAddressOfDirectBaseInCompleteClass(
1717           CGF.LoadCXXThisAddress(), DerivedClass, BaseClass, BaseIsVirtual);
1718 
1719       const ASTRecordLayout &BaseLayout =
1720           CGF.getContext().getASTRecordLayout(BaseClass);
1721       CharUnits BaseSize = BaseLayout.getSize();
1722 
1723       if (!BaseSize.isPositive())
1724         return;
1725 
1726       // Use the base class declaration location as inline DebugLocation. All
1727       // fields of the class are destroyed.
1728       DeclAsInlineDebugLocation InlineHere(CGF, *BaseClass);
1729       EmitSanitizerDtorFieldsCallback(CGF, Addr.getPointer(),
1730                                       BaseSize.getQuantity());
1731 
1732       // Prevent the current stack frame from disappearing from the stack trace.
1733       CGF.CurFn->addFnAttr("disable-tail-calls", "true");
1734     }
1735   };
1736 
1737   class SanitizeDtorFieldRange final : public EHScopeStack::Cleanup {
1738     const CXXDestructorDecl *Dtor;
1739     unsigned StartIndex;
1740     unsigned EndIndex;
1741 
1742   public:
SanitizeDtorFieldRange(const CXXDestructorDecl * Dtor,unsigned StartIndex,unsigned EndIndex)1743     SanitizeDtorFieldRange(const CXXDestructorDecl *Dtor, unsigned StartIndex,
1744                            unsigned EndIndex)
1745         : Dtor(Dtor), StartIndex(StartIndex), EndIndex(EndIndex) {}
1746 
1747     // Generate function call for handling object poisoning.
1748     // Disables tail call elimination, to prevent the current stack frame
1749     // from disappearing from the stack trace.
Emit(CodeGenFunction & CGF,Flags flags)1750     void Emit(CodeGenFunction &CGF, Flags flags) override {
1751       const ASTContext &Context = CGF.getContext();
1752       const ASTRecordLayout &Layout =
1753           Context.getASTRecordLayout(Dtor->getParent());
1754 
1755       // It's a first trivial field so it should be at the begining of a char,
1756       // still round up start offset just in case.
1757       CharUnits PoisonStart = Context.toCharUnitsFromBits(
1758           Layout.getFieldOffset(StartIndex) + Context.getCharWidth() - 1);
1759       llvm::ConstantInt *OffsetSizePtr =
1760           llvm::ConstantInt::get(CGF.SizeTy, PoisonStart.getQuantity());
1761 
1762       llvm::Value *OffsetPtr = CGF.Builder.CreateGEP(
1763           CGF.Int8Ty,
1764           CGF.Builder.CreateBitCast(CGF.LoadCXXThis(), CGF.Int8PtrTy),
1765           OffsetSizePtr);
1766 
1767       CharUnits PoisonEnd;
1768       if (EndIndex >= Layout.getFieldCount()) {
1769         PoisonEnd = Layout.getNonVirtualSize();
1770       } else {
1771         PoisonEnd =
1772             Context.toCharUnitsFromBits(Layout.getFieldOffset(EndIndex));
1773       }
1774       CharUnits PoisonSize = PoisonEnd - PoisonStart;
1775       if (!PoisonSize.isPositive())
1776         return;
1777 
1778       // Use the top field declaration location as inline DebugLocation.
1779       DeclAsInlineDebugLocation InlineHere(
1780           CGF, **std::next(Dtor->getParent()->field_begin(), StartIndex));
1781       EmitSanitizerDtorFieldsCallback(CGF, OffsetPtr, PoisonSize.getQuantity());
1782 
1783       // Prevent the current stack frame from disappearing from the stack trace.
1784       CGF.CurFn->addFnAttr("disable-tail-calls", "true");
1785     }
1786   };
1787 
1788  class SanitizeDtorVTable final : public EHScopeStack::Cleanup {
1789     const CXXDestructorDecl *Dtor;
1790 
1791   public:
SanitizeDtorVTable(const CXXDestructorDecl * Dtor)1792     SanitizeDtorVTable(const CXXDestructorDecl *Dtor) : Dtor(Dtor) {}
1793 
1794     // Generate function call for handling vtable pointer poisoning.
Emit(CodeGenFunction & CGF,Flags flags)1795     void Emit(CodeGenFunction &CGF, Flags flags) override {
1796       assert(Dtor->getParent()->isDynamicClass());
1797       (void)Dtor;
1798       // Poison vtable and vtable ptr if they exist for this class.
1799       llvm::Value *VTablePtr = CGF.LoadCXXThis();
1800 
1801       // Pass in void pointer and size of region as arguments to runtime
1802       // function
1803       EmitSanitizerDtorCallback(CGF, "__sanitizer_dtor_callback_vptr",
1804                                 VTablePtr);
1805     }
1806  };
1807 
1808  class SanitizeDtorCleanupBuilder {
1809    ASTContext &Context;
1810    EHScopeStack &EHStack;
1811    const CXXDestructorDecl *DD;
1812    std::optional<unsigned> StartIndex;
1813 
1814  public:
SanitizeDtorCleanupBuilder(ASTContext & Context,EHScopeStack & EHStack,const CXXDestructorDecl * DD)1815    SanitizeDtorCleanupBuilder(ASTContext &Context, EHScopeStack &EHStack,
1816                               const CXXDestructorDecl *DD)
1817        : Context(Context), EHStack(EHStack), DD(DD), StartIndex(std::nullopt) {}
PushCleanupForField(const FieldDecl * Field)1818    void PushCleanupForField(const FieldDecl *Field) {
1819      if (Field->isZeroSize(Context))
1820        return;
1821      unsigned FieldIndex = Field->getFieldIndex();
1822      if (FieldHasTrivialDestructorBody(Context, Field)) {
1823        if (!StartIndex)
1824          StartIndex = FieldIndex;
1825      } else if (StartIndex) {
1826        EHStack.pushCleanup<SanitizeDtorFieldRange>(NormalAndEHCleanup, DD,
1827                                                    *StartIndex, FieldIndex);
1828        StartIndex = std::nullopt;
1829      }
1830    }
End()1831    void End() {
1832      if (StartIndex)
1833        EHStack.pushCleanup<SanitizeDtorFieldRange>(NormalAndEHCleanup, DD,
1834                                                    *StartIndex, -1);
1835    }
1836  };
1837 } // end anonymous namespace
1838 
1839 /// Emit all code that comes at the end of class's
1840 /// destructor. This is to call destructors on members and base classes
1841 /// in reverse order of their construction.
1842 ///
1843 /// For a deleting destructor, this also handles the case where a destroying
1844 /// operator delete completely overrides the definition.
EnterDtorCleanups(const CXXDestructorDecl * DD,CXXDtorType DtorType)1845 void CodeGenFunction::EnterDtorCleanups(const CXXDestructorDecl *DD,
1846                                         CXXDtorType DtorType) {
1847   assert((!DD->isTrivial() || DD->hasAttr<DLLExportAttr>()) &&
1848          "Should not emit dtor epilogue for non-exported trivial dtor!");
1849 
1850   // The deleting-destructor phase just needs to call the appropriate
1851   // operator delete that Sema picked up.
1852   if (DtorType == Dtor_Deleting) {
1853     assert(DD->getOperatorDelete() &&
1854            "operator delete missing - EnterDtorCleanups");
1855     if (CXXStructorImplicitParamValue) {
1856       // If there is an implicit param to the deleting dtor, it's a boolean
1857       // telling whether this is a deleting destructor.
1858       if (DD->getOperatorDelete()->isDestroyingOperatorDelete())
1859         EmitConditionalDtorDeleteCall(*this, CXXStructorImplicitParamValue,
1860                                       /*ReturnAfterDelete*/true);
1861       else
1862         EHStack.pushCleanup<CallDtorDeleteConditional>(
1863             NormalAndEHCleanup, CXXStructorImplicitParamValue);
1864     } else {
1865       if (DD->getOperatorDelete()->isDestroyingOperatorDelete()) {
1866         const CXXRecordDecl *ClassDecl = DD->getParent();
1867         EmitDeleteCall(DD->getOperatorDelete(),
1868                        LoadThisForDtorDelete(*this, DD),
1869                        getContext().getTagDeclType(ClassDecl));
1870         EmitBranchThroughCleanup(ReturnBlock);
1871       } else {
1872         EHStack.pushCleanup<CallDtorDelete>(NormalAndEHCleanup);
1873       }
1874     }
1875     return;
1876   }
1877 
1878   const CXXRecordDecl *ClassDecl = DD->getParent();
1879 
1880   // Unions have no bases and do not call field destructors.
1881   if (ClassDecl->isUnion())
1882     return;
1883 
1884   // The complete-destructor phase just destructs all the virtual bases.
1885   if (DtorType == Dtor_Complete) {
1886     // Poison the vtable pointer such that access after the base
1887     // and member destructors are invoked is invalid.
1888     if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor &&
1889         SanOpts.has(SanitizerKind::Memory) && ClassDecl->getNumVBases() &&
1890         ClassDecl->isPolymorphic())
1891       EHStack.pushCleanup<SanitizeDtorVTable>(NormalAndEHCleanup, DD);
1892 
1893     // We push them in the forward order so that they'll be popped in
1894     // the reverse order.
1895     for (const auto &Base : ClassDecl->vbases()) {
1896       auto *BaseClassDecl =
1897           cast<CXXRecordDecl>(Base.getType()->castAs<RecordType>()->getDecl());
1898 
1899       if (BaseClassDecl->hasTrivialDestructor()) {
1900         // Under SanitizeMemoryUseAfterDtor, poison the trivial base class
1901         // memory. For non-trival base classes the same is done in the class
1902         // destructor.
1903         if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor &&
1904             SanOpts.has(SanitizerKind::Memory) && !BaseClassDecl->isEmpty())
1905           EHStack.pushCleanup<SanitizeDtorTrivialBase>(NormalAndEHCleanup,
1906                                                        BaseClassDecl,
1907                                                        /*BaseIsVirtual*/ true);
1908       } else {
1909         EHStack.pushCleanup<CallBaseDtor>(NormalAndEHCleanup, BaseClassDecl,
1910                                           /*BaseIsVirtual*/ true);
1911       }
1912     }
1913 
1914     return;
1915   }
1916 
1917   assert(DtorType == Dtor_Base);
1918   // Poison the vtable pointer if it has no virtual bases, but inherits
1919   // virtual functions.
1920   if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor &&
1921       SanOpts.has(SanitizerKind::Memory) && !ClassDecl->getNumVBases() &&
1922       ClassDecl->isPolymorphic())
1923     EHStack.pushCleanup<SanitizeDtorVTable>(NormalAndEHCleanup, DD);
1924 
1925   // Destroy non-virtual bases.
1926   for (const auto &Base : ClassDecl->bases()) {
1927     // Ignore virtual bases.
1928     if (Base.isVirtual())
1929       continue;
1930 
1931     CXXRecordDecl *BaseClassDecl = Base.getType()->getAsCXXRecordDecl();
1932 
1933     if (BaseClassDecl->hasTrivialDestructor()) {
1934       if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor &&
1935           SanOpts.has(SanitizerKind::Memory) && !BaseClassDecl->isEmpty())
1936         EHStack.pushCleanup<SanitizeDtorTrivialBase>(NormalAndEHCleanup,
1937                                                      BaseClassDecl,
1938                                                      /*BaseIsVirtual*/ false);
1939     } else {
1940       EHStack.pushCleanup<CallBaseDtor>(NormalAndEHCleanup, BaseClassDecl,
1941                                         /*BaseIsVirtual*/ false);
1942     }
1943   }
1944 
1945   // Poison fields such that access after their destructors are
1946   // invoked, and before the base class destructor runs, is invalid.
1947   bool SanitizeFields = CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor &&
1948                         SanOpts.has(SanitizerKind::Memory);
1949   SanitizeDtorCleanupBuilder SanitizeBuilder(getContext(), EHStack, DD);
1950 
1951   // Destroy direct fields.
1952   for (const auto *Field : ClassDecl->fields()) {
1953     if (SanitizeFields)
1954       SanitizeBuilder.PushCleanupForField(Field);
1955 
1956     QualType type = Field->getType();
1957     QualType::DestructionKind dtorKind = type.isDestructedType();
1958     if (!dtorKind)
1959       continue;
1960 
1961     // Anonymous union members do not have their destructors called.
1962     const RecordType *RT = type->getAsUnionType();
1963     if (RT && RT->getDecl()->isAnonymousStructOrUnion())
1964       continue;
1965 
1966     CleanupKind cleanupKind = getCleanupKind(dtorKind);
1967     EHStack.pushCleanup<DestroyField>(
1968         cleanupKind, Field, getDestroyer(dtorKind), cleanupKind & EHCleanup);
1969   }
1970 
1971   if (SanitizeFields)
1972     SanitizeBuilder.End();
1973 }
1974 
1975 /// EmitCXXAggrConstructorCall - Emit a loop to call a particular
1976 /// constructor for each of several members of an array.
1977 ///
1978 /// \param ctor the constructor to call for each element
1979 /// \param arrayType the type of the array to initialize
1980 /// \param arrayBegin an arrayType*
1981 /// \param zeroInitialize true if each element should be
1982 ///   zero-initialized before it is constructed
EmitCXXAggrConstructorCall(const CXXConstructorDecl * ctor,const ArrayType * arrayType,Address arrayBegin,const CXXConstructExpr * E,bool NewPointerIsChecked,bool zeroInitialize)1983 void CodeGenFunction::EmitCXXAggrConstructorCall(
1984     const CXXConstructorDecl *ctor, const ArrayType *arrayType,
1985     Address arrayBegin, const CXXConstructExpr *E, bool NewPointerIsChecked,
1986     bool zeroInitialize) {
1987   QualType elementType;
1988   llvm::Value *numElements =
1989     emitArrayLength(arrayType, elementType, arrayBegin);
1990 
1991   EmitCXXAggrConstructorCall(ctor, numElements, arrayBegin, E,
1992                              NewPointerIsChecked, zeroInitialize);
1993 }
1994 
1995 /// EmitCXXAggrConstructorCall - Emit a loop to call a particular
1996 /// constructor for each of several members of an array.
1997 ///
1998 /// \param ctor the constructor to call for each element
1999 /// \param numElements the number of elements in the array;
2000 ///   may be zero
2001 /// \param arrayBase a T*, where T is the type constructed by ctor
2002 /// \param zeroInitialize true if each element should be
2003 ///   zero-initialized before it is constructed
EmitCXXAggrConstructorCall(const CXXConstructorDecl * ctor,llvm::Value * numElements,Address arrayBase,const CXXConstructExpr * E,bool NewPointerIsChecked,bool zeroInitialize)2004 void CodeGenFunction::EmitCXXAggrConstructorCall(const CXXConstructorDecl *ctor,
2005                                                  llvm::Value *numElements,
2006                                                  Address arrayBase,
2007                                                  const CXXConstructExpr *E,
2008                                                  bool NewPointerIsChecked,
2009                                                  bool zeroInitialize) {
2010   // It's legal for numElements to be zero.  This can happen both
2011   // dynamically, because x can be zero in 'new A[x]', and statically,
2012   // because of GCC extensions that permit zero-length arrays.  There
2013   // are probably legitimate places where we could assume that this
2014   // doesn't happen, but it's not clear that it's worth it.
2015   llvm::BranchInst *zeroCheckBranch = nullptr;
2016 
2017   // Optimize for a constant count.
2018   llvm::ConstantInt *constantCount
2019     = dyn_cast<llvm::ConstantInt>(numElements);
2020   if (constantCount) {
2021     // Just skip out if the constant count is zero.
2022     if (constantCount->isZero()) return;
2023 
2024   // Otherwise, emit the check.
2025   } else {
2026     llvm::BasicBlock *loopBB = createBasicBlock("new.ctorloop");
2027     llvm::Value *iszero = Builder.CreateIsNull(numElements, "isempty");
2028     zeroCheckBranch = Builder.CreateCondBr(iszero, loopBB, loopBB);
2029     EmitBlock(loopBB);
2030   }
2031 
2032   // Find the end of the array.
2033   llvm::Type *elementType = arrayBase.getElementType();
2034   llvm::Value *arrayBegin = arrayBase.getPointer();
2035   llvm::Value *arrayEnd = Builder.CreateInBoundsGEP(
2036       elementType, arrayBegin, numElements, "arrayctor.end");
2037 
2038   // Enter the loop, setting up a phi for the current location to initialize.
2039   llvm::BasicBlock *entryBB = Builder.GetInsertBlock();
2040   llvm::BasicBlock *loopBB = createBasicBlock("arrayctor.loop");
2041   EmitBlock(loopBB);
2042   llvm::PHINode *cur = Builder.CreatePHI(arrayBegin->getType(), 2,
2043                                          "arrayctor.cur");
2044   cur->addIncoming(arrayBegin, entryBB);
2045 
2046   // Inside the loop body, emit the constructor call on the array element.
2047 
2048   // The alignment of the base, adjusted by the size of a single element,
2049   // provides a conservative estimate of the alignment of every element.
2050   // (This assumes we never start tracking offsetted alignments.)
2051   //
2052   // Note that these are complete objects and so we don't need to
2053   // use the non-virtual size or alignment.
2054   QualType type = getContext().getTypeDeclType(ctor->getParent());
2055   CharUnits eltAlignment =
2056     arrayBase.getAlignment()
2057              .alignmentOfArrayElement(getContext().getTypeSizeInChars(type));
2058   Address curAddr = Address(cur, elementType, eltAlignment);
2059 
2060   // Zero initialize the storage, if requested.
2061   if (zeroInitialize)
2062     EmitNullInitialization(curAddr, type);
2063 
2064   // C++ [class.temporary]p4:
2065   // There are two contexts in which temporaries are destroyed at a different
2066   // point than the end of the full-expression. The first context is when a
2067   // default constructor is called to initialize an element of an array.
2068   // If the constructor has one or more default arguments, the destruction of
2069   // every temporary created in a default argument expression is sequenced
2070   // before the construction of the next array element, if any.
2071 
2072   {
2073     RunCleanupsScope Scope(*this);
2074 
2075     // Evaluate the constructor and its arguments in a regular
2076     // partial-destroy cleanup.
2077     if (getLangOpts().Exceptions &&
2078         !ctor->getParent()->hasTrivialDestructor()) {
2079       Destroyer *destroyer = destroyCXXObject;
2080       pushRegularPartialArrayCleanup(arrayBegin, cur, type, eltAlignment,
2081                                      *destroyer);
2082     }
2083     auto currAVS = AggValueSlot::forAddr(
2084         curAddr, type.getQualifiers(), AggValueSlot::IsDestructed,
2085         AggValueSlot::DoesNotNeedGCBarriers, AggValueSlot::IsNotAliased,
2086         AggValueSlot::DoesNotOverlap, AggValueSlot::IsNotZeroed,
2087         NewPointerIsChecked ? AggValueSlot::IsSanitizerChecked
2088                             : AggValueSlot::IsNotSanitizerChecked);
2089     EmitCXXConstructorCall(ctor, Ctor_Complete, /*ForVirtualBase=*/false,
2090                            /*Delegating=*/false, currAVS, E);
2091   }
2092 
2093   // Go to the next element.
2094   llvm::Value *next = Builder.CreateInBoundsGEP(
2095       elementType, cur, llvm::ConstantInt::get(SizeTy, 1), "arrayctor.next");
2096   cur->addIncoming(next, Builder.GetInsertBlock());
2097 
2098   // Check whether that's the end of the loop.
2099   llvm::Value *done = Builder.CreateICmpEQ(next, arrayEnd, "arrayctor.done");
2100   llvm::BasicBlock *contBB = createBasicBlock("arrayctor.cont");
2101   Builder.CreateCondBr(done, contBB, loopBB);
2102 
2103   // Patch the earlier check to skip over the loop.
2104   if (zeroCheckBranch) zeroCheckBranch->setSuccessor(0, contBB);
2105 
2106   EmitBlock(contBB);
2107 }
2108 
destroyCXXObject(CodeGenFunction & CGF,Address addr,QualType type)2109 void CodeGenFunction::destroyCXXObject(CodeGenFunction &CGF,
2110                                        Address addr,
2111                                        QualType type) {
2112   const RecordType *rtype = type->castAs<RecordType>();
2113   const CXXRecordDecl *record = cast<CXXRecordDecl>(rtype->getDecl());
2114   const CXXDestructorDecl *dtor = record->getDestructor();
2115   assert(!dtor->isTrivial());
2116   CGF.EmitCXXDestructorCall(dtor, Dtor_Complete, /*for vbase*/ false,
2117                             /*Delegating=*/false, addr, type);
2118 }
2119 
EmitCXXConstructorCall(const CXXConstructorDecl * D,CXXCtorType Type,bool ForVirtualBase,bool Delegating,AggValueSlot ThisAVS,const CXXConstructExpr * E)2120 void CodeGenFunction::EmitCXXConstructorCall(const CXXConstructorDecl *D,
2121                                              CXXCtorType Type,
2122                                              bool ForVirtualBase,
2123                                              bool Delegating,
2124                                              AggValueSlot ThisAVS,
2125                                              const CXXConstructExpr *E) {
2126   CallArgList Args;
2127   Address This = ThisAVS.getAddress();
2128   LangAS SlotAS = ThisAVS.getQualifiers().getAddressSpace();
2129   QualType ThisType = D->getThisType();
2130   LangAS ThisAS = ThisType.getTypePtr()->getPointeeType().getAddressSpace();
2131   llvm::Value *ThisPtr = This.getPointer();
2132 
2133   if (SlotAS != ThisAS) {
2134     unsigned TargetThisAS = getContext().getTargetAddressSpace(ThisAS);
2135     llvm::Type *NewType = llvm::PointerType::getWithSamePointeeType(
2136         This.getType(), TargetThisAS);
2137     ThisPtr = getTargetHooks().performAddrSpaceCast(*this, This.getPointer(),
2138                                                     ThisAS, SlotAS, NewType);
2139   }
2140 
2141   // Push the this ptr.
2142   Args.add(RValue::get(ThisPtr), D->getThisType());
2143 
2144   // If this is a trivial constructor, emit a memcpy now before we lose
2145   // the alignment information on the argument.
2146   // FIXME: It would be better to preserve alignment information into CallArg.
2147   if (isMemcpyEquivalentSpecialMember(D)) {
2148     assert(E->getNumArgs() == 1 && "unexpected argcount for trivial ctor");
2149 
2150     const Expr *Arg = E->getArg(0);
2151     LValue Src = EmitLValue(Arg);
2152     QualType DestTy = getContext().getTypeDeclType(D->getParent());
2153     LValue Dest = MakeAddrLValue(This, DestTy);
2154     EmitAggregateCopyCtor(Dest, Src, ThisAVS.mayOverlap());
2155     return;
2156   }
2157 
2158   // Add the rest of the user-supplied arguments.
2159   const FunctionProtoType *FPT = D->getType()->castAs<FunctionProtoType>();
2160   EvaluationOrder Order = E->isListInitialization()
2161                               ? EvaluationOrder::ForceLeftToRight
2162                               : EvaluationOrder::Default;
2163   EmitCallArgs(Args, FPT, E->arguments(), E->getConstructor(),
2164                /*ParamsToSkip*/ 0, Order);
2165 
2166   EmitCXXConstructorCall(D, Type, ForVirtualBase, Delegating, This, Args,
2167                          ThisAVS.mayOverlap(), E->getExprLoc(),
2168                          ThisAVS.isSanitizerChecked());
2169 }
2170 
canEmitDelegateCallArgs(CodeGenFunction & CGF,const CXXConstructorDecl * Ctor,CXXCtorType Type,CallArgList & Args)2171 static bool canEmitDelegateCallArgs(CodeGenFunction &CGF,
2172                                     const CXXConstructorDecl *Ctor,
2173                                     CXXCtorType Type, CallArgList &Args) {
2174   // We can't forward a variadic call.
2175   if (Ctor->isVariadic())
2176     return false;
2177 
2178   if (CGF.getTarget().getCXXABI().areArgsDestroyedLeftToRightInCallee()) {
2179     // If the parameters are callee-cleanup, it's not safe to forward.
2180     for (auto *P : Ctor->parameters())
2181       if (P->needsDestruction(CGF.getContext()))
2182         return false;
2183 
2184     // Likewise if they're inalloca.
2185     const CGFunctionInfo &Info =
2186         CGF.CGM.getTypes().arrangeCXXConstructorCall(Args, Ctor, Type, 0, 0);
2187     if (Info.usesInAlloca())
2188       return false;
2189   }
2190 
2191   // Anything else should be OK.
2192   return true;
2193 }
2194 
EmitCXXConstructorCall(const CXXConstructorDecl * D,CXXCtorType Type,bool ForVirtualBase,bool Delegating,Address This,CallArgList & Args,AggValueSlot::Overlap_t Overlap,SourceLocation Loc,bool NewPointerIsChecked)2195 void CodeGenFunction::EmitCXXConstructorCall(const CXXConstructorDecl *D,
2196                                              CXXCtorType Type,
2197                                              bool ForVirtualBase,
2198                                              bool Delegating,
2199                                              Address This,
2200                                              CallArgList &Args,
2201                                              AggValueSlot::Overlap_t Overlap,
2202                                              SourceLocation Loc,
2203                                              bool NewPointerIsChecked) {
2204   const CXXRecordDecl *ClassDecl = D->getParent();
2205 
2206   if (!NewPointerIsChecked)
2207     EmitTypeCheck(CodeGenFunction::TCK_ConstructorCall, Loc, This.getPointer(),
2208                   getContext().getRecordType(ClassDecl), CharUnits::Zero());
2209 
2210   if (D->isTrivial() && D->isDefaultConstructor()) {
2211     assert(Args.size() == 1 && "trivial default ctor with args");
2212     return;
2213   }
2214 
2215   // If this is a trivial constructor, just emit what's needed. If this is a
2216   // union copy constructor, we must emit a memcpy, because the AST does not
2217   // model that copy.
2218   if (isMemcpyEquivalentSpecialMember(D)) {
2219     assert(Args.size() == 2 && "unexpected argcount for trivial ctor");
2220 
2221     QualType SrcTy = D->getParamDecl(0)->getType().getNonReferenceType();
2222     Address Src = Address(Args[1].getRValue(*this).getScalarVal(), ConvertTypeForMem(SrcTy),
2223                                       CGM.getNaturalTypeAlignment(SrcTy));
2224     LValue SrcLVal = MakeAddrLValue(Src, SrcTy);
2225     QualType DestTy = getContext().getTypeDeclType(ClassDecl);
2226     LValue DestLVal = MakeAddrLValue(This, DestTy);
2227     EmitAggregateCopyCtor(DestLVal, SrcLVal, Overlap);
2228     return;
2229   }
2230 
2231   bool PassPrototypeArgs = true;
2232   // Check whether we can actually emit the constructor before trying to do so.
2233   if (auto Inherited = D->getInheritedConstructor()) {
2234     PassPrototypeArgs = getTypes().inheritingCtorHasParams(Inherited, Type);
2235     if (PassPrototypeArgs && !canEmitDelegateCallArgs(*this, D, Type, Args)) {
2236       EmitInlinedInheritingCXXConstructorCall(D, Type, ForVirtualBase,
2237                                               Delegating, Args);
2238       return;
2239     }
2240   }
2241 
2242   // Insert any ABI-specific implicit constructor arguments.
2243   CGCXXABI::AddedStructorArgCounts ExtraArgs =
2244       CGM.getCXXABI().addImplicitConstructorArgs(*this, D, Type, ForVirtualBase,
2245                                                  Delegating, Args);
2246 
2247   // Emit the call.
2248   llvm::Constant *CalleePtr = CGM.getAddrOfCXXStructor(GlobalDecl(D, Type));
2249   const CGFunctionInfo &Info = CGM.getTypes().arrangeCXXConstructorCall(
2250       Args, D, Type, ExtraArgs.Prefix, ExtraArgs.Suffix, PassPrototypeArgs);
2251   CGCallee Callee = CGCallee::forDirect(CalleePtr, GlobalDecl(D, Type));
2252   EmitCall(Info, Callee, ReturnValueSlot(), Args, nullptr, false, Loc);
2253 
2254   // Generate vtable assumptions if we're constructing a complete object
2255   // with a vtable.  We don't do this for base subobjects for two reasons:
2256   // first, it's incorrect for classes with virtual bases, and second, we're
2257   // about to overwrite the vptrs anyway.
2258   // We also have to make sure if we can refer to vtable:
2259   // - Otherwise we can refer to vtable if it's safe to speculatively emit.
2260   // FIXME: If vtable is used by ctor/dtor, or if vtable is external and we are
2261   // sure that definition of vtable is not hidden,
2262   // then we are always safe to refer to it.
2263   // FIXME: It looks like InstCombine is very inefficient on dealing with
2264   // assumes. Make assumption loads require -fstrict-vtable-pointers temporarily.
2265   if (CGM.getCodeGenOpts().OptimizationLevel > 0 &&
2266       ClassDecl->isDynamicClass() && Type != Ctor_Base &&
2267       CGM.getCXXABI().canSpeculativelyEmitVTable(ClassDecl) &&
2268       CGM.getCodeGenOpts().StrictVTablePointers)
2269     EmitVTableAssumptionLoads(ClassDecl, This);
2270 }
2271 
EmitInheritedCXXConstructorCall(const CXXConstructorDecl * D,bool ForVirtualBase,Address This,bool InheritedFromVBase,const CXXInheritedCtorInitExpr * E)2272 void CodeGenFunction::EmitInheritedCXXConstructorCall(
2273     const CXXConstructorDecl *D, bool ForVirtualBase, Address This,
2274     bool InheritedFromVBase, const CXXInheritedCtorInitExpr *E) {
2275   CallArgList Args;
2276   CallArg ThisArg(RValue::get(This.getPointer()), D->getThisType());
2277 
2278   // Forward the parameters.
2279   if (InheritedFromVBase &&
2280       CGM.getTarget().getCXXABI().hasConstructorVariants()) {
2281     // Nothing to do; this construction is not responsible for constructing
2282     // the base class containing the inherited constructor.
2283     // FIXME: Can we just pass undef's for the remaining arguments if we don't
2284     // have constructor variants?
2285     Args.push_back(ThisArg);
2286   } else if (!CXXInheritedCtorInitExprArgs.empty()) {
2287     // The inheriting constructor was inlined; just inject its arguments.
2288     assert(CXXInheritedCtorInitExprArgs.size() >= D->getNumParams() &&
2289            "wrong number of parameters for inherited constructor call");
2290     Args = CXXInheritedCtorInitExprArgs;
2291     Args[0] = ThisArg;
2292   } else {
2293     // The inheriting constructor was not inlined. Emit delegating arguments.
2294     Args.push_back(ThisArg);
2295     const auto *OuterCtor = cast<CXXConstructorDecl>(CurCodeDecl);
2296     assert(OuterCtor->getNumParams() == D->getNumParams());
2297     assert(!OuterCtor->isVariadic() && "should have been inlined");
2298 
2299     for (const auto *Param : OuterCtor->parameters()) {
2300       assert(getContext().hasSameUnqualifiedType(
2301           OuterCtor->getParamDecl(Param->getFunctionScopeIndex())->getType(),
2302           Param->getType()));
2303       EmitDelegateCallArg(Args, Param, E->getLocation());
2304 
2305       // Forward __attribute__(pass_object_size).
2306       if (Param->hasAttr<PassObjectSizeAttr>()) {
2307         auto *POSParam = SizeArguments[Param];
2308         assert(POSParam && "missing pass_object_size value for forwarding");
2309         EmitDelegateCallArg(Args, POSParam, E->getLocation());
2310       }
2311     }
2312   }
2313 
2314   EmitCXXConstructorCall(D, Ctor_Base, ForVirtualBase, /*Delegating*/false,
2315                          This, Args, AggValueSlot::MayOverlap,
2316                          E->getLocation(), /*NewPointerIsChecked*/true);
2317 }
2318 
EmitInlinedInheritingCXXConstructorCall(const CXXConstructorDecl * Ctor,CXXCtorType CtorType,bool ForVirtualBase,bool Delegating,CallArgList & Args)2319 void CodeGenFunction::EmitInlinedInheritingCXXConstructorCall(
2320     const CXXConstructorDecl *Ctor, CXXCtorType CtorType, bool ForVirtualBase,
2321     bool Delegating, CallArgList &Args) {
2322   GlobalDecl GD(Ctor, CtorType);
2323   InlinedInheritingConstructorScope Scope(*this, GD);
2324   ApplyInlineDebugLocation DebugScope(*this, GD);
2325   RunCleanupsScope RunCleanups(*this);
2326 
2327   // Save the arguments to be passed to the inherited constructor.
2328   CXXInheritedCtorInitExprArgs = Args;
2329 
2330   FunctionArgList Params;
2331   QualType RetType = BuildFunctionArgList(CurGD, Params);
2332   FnRetTy = RetType;
2333 
2334   // Insert any ABI-specific implicit constructor arguments.
2335   CGM.getCXXABI().addImplicitConstructorArgs(*this, Ctor, CtorType,
2336                                              ForVirtualBase, Delegating, Args);
2337 
2338   // Emit a simplified prolog. We only need to emit the implicit params.
2339   assert(Args.size() >= Params.size() && "too few arguments for call");
2340   for (unsigned I = 0, N = Args.size(); I != N; ++I) {
2341     if (I < Params.size() && isa<ImplicitParamDecl>(Params[I])) {
2342       const RValue &RV = Args[I].getRValue(*this);
2343       assert(!RV.isComplex() && "complex indirect params not supported");
2344       ParamValue Val = RV.isScalar()
2345                            ? ParamValue::forDirect(RV.getScalarVal())
2346                            : ParamValue::forIndirect(RV.getAggregateAddress());
2347       EmitParmDecl(*Params[I], Val, I + 1);
2348     }
2349   }
2350 
2351   // Create a return value slot if the ABI implementation wants one.
2352   // FIXME: This is dumb, we should ask the ABI not to try to set the return
2353   // value instead.
2354   if (!RetType->isVoidType())
2355     ReturnValue = CreateIRTemp(RetType, "retval.inhctor");
2356 
2357   CGM.getCXXABI().EmitInstanceFunctionProlog(*this);
2358   CXXThisValue = CXXABIThisValue;
2359 
2360   // Directly emit the constructor initializers.
2361   EmitCtorPrologue(Ctor, CtorType, Params);
2362 }
2363 
EmitVTableAssumptionLoad(const VPtr & Vptr,Address This)2364 void CodeGenFunction::EmitVTableAssumptionLoad(const VPtr &Vptr, Address This) {
2365   llvm::Value *VTableGlobal =
2366       CGM.getCXXABI().getVTableAddressPoint(Vptr.Base, Vptr.VTableClass);
2367   if (!VTableGlobal)
2368     return;
2369 
2370   // We can just use the base offset in the complete class.
2371   CharUnits NonVirtualOffset = Vptr.Base.getBaseOffset();
2372 
2373   if (!NonVirtualOffset.isZero())
2374     This =
2375         ApplyNonVirtualAndVirtualOffset(*this, This, NonVirtualOffset, nullptr,
2376                                         Vptr.VTableClass, Vptr.NearestVBase);
2377 
2378   llvm::Value *VPtrValue =
2379       GetVTablePtr(This, VTableGlobal->getType(), Vptr.VTableClass);
2380   llvm::Value *Cmp =
2381       Builder.CreateICmpEQ(VPtrValue, VTableGlobal, "cmp.vtables");
2382   Builder.CreateAssumption(Cmp);
2383 }
2384 
EmitVTableAssumptionLoads(const CXXRecordDecl * ClassDecl,Address This)2385 void CodeGenFunction::EmitVTableAssumptionLoads(const CXXRecordDecl *ClassDecl,
2386                                                 Address This) {
2387   if (CGM.getCXXABI().doStructorsInitializeVPtrs(ClassDecl))
2388     for (const VPtr &Vptr : getVTablePointers(ClassDecl))
2389       EmitVTableAssumptionLoad(Vptr, This);
2390 }
2391 
2392 void
EmitSynthesizedCXXCopyCtorCall(const CXXConstructorDecl * D,Address This,Address Src,const CXXConstructExpr * E)2393 CodeGenFunction::EmitSynthesizedCXXCopyCtorCall(const CXXConstructorDecl *D,
2394                                                 Address This, Address Src,
2395                                                 const CXXConstructExpr *E) {
2396   const FunctionProtoType *FPT = D->getType()->castAs<FunctionProtoType>();
2397 
2398   CallArgList Args;
2399 
2400   // Push the this ptr.
2401   Args.add(RValue::get(This.getPointer()), D->getThisType());
2402 
2403   // Push the src ptr.
2404   QualType QT = *(FPT->param_type_begin());
2405   llvm::Type *t = CGM.getTypes().ConvertType(QT);
2406   llvm::Value *SrcVal = Builder.CreateBitCast(Src.getPointer(), t);
2407   Args.add(RValue::get(SrcVal), QT);
2408 
2409   // Skip over first argument (Src).
2410   EmitCallArgs(Args, FPT, drop_begin(E->arguments(), 1), E->getConstructor(),
2411                /*ParamsToSkip*/ 1);
2412 
2413   EmitCXXConstructorCall(D, Ctor_Complete, /*ForVirtualBase*/false,
2414                          /*Delegating*/false, This, Args,
2415                          AggValueSlot::MayOverlap, E->getExprLoc(),
2416                          /*NewPointerIsChecked*/false);
2417 }
2418 
2419 void
EmitDelegateCXXConstructorCall(const CXXConstructorDecl * Ctor,CXXCtorType CtorType,const FunctionArgList & Args,SourceLocation Loc)2420 CodeGenFunction::EmitDelegateCXXConstructorCall(const CXXConstructorDecl *Ctor,
2421                                                 CXXCtorType CtorType,
2422                                                 const FunctionArgList &Args,
2423                                                 SourceLocation Loc) {
2424   CallArgList DelegateArgs;
2425 
2426   FunctionArgList::const_iterator I = Args.begin(), E = Args.end();
2427   assert(I != E && "no parameters to constructor");
2428 
2429   // this
2430   Address This = LoadCXXThisAddress();
2431   DelegateArgs.add(RValue::get(This.getPointer()), (*I)->getType());
2432   ++I;
2433 
2434   // FIXME: The location of the VTT parameter in the parameter list is
2435   // specific to the Itanium ABI and shouldn't be hardcoded here.
2436   if (CGM.getCXXABI().NeedsVTTParameter(CurGD)) {
2437     assert(I != E && "cannot skip vtt parameter, already done with args");
2438     assert((*I)->getType()->isPointerType() &&
2439            "skipping parameter not of vtt type");
2440     ++I;
2441   }
2442 
2443   // Explicit arguments.
2444   for (; I != E; ++I) {
2445     const VarDecl *param = *I;
2446     // FIXME: per-argument source location
2447     EmitDelegateCallArg(DelegateArgs, param, Loc);
2448   }
2449 
2450   EmitCXXConstructorCall(Ctor, CtorType, /*ForVirtualBase=*/false,
2451                          /*Delegating=*/true, This, DelegateArgs,
2452                          AggValueSlot::MayOverlap, Loc,
2453                          /*NewPointerIsChecked=*/true);
2454 }
2455 
2456 namespace {
2457   struct CallDelegatingCtorDtor final : EHScopeStack::Cleanup {
2458     const CXXDestructorDecl *Dtor;
2459     Address Addr;
2460     CXXDtorType Type;
2461 
CallDelegatingCtorDtor__anonfcad378b0511::CallDelegatingCtorDtor2462     CallDelegatingCtorDtor(const CXXDestructorDecl *D, Address Addr,
2463                            CXXDtorType Type)
2464       : Dtor(D), Addr(Addr), Type(Type) {}
2465 
Emit__anonfcad378b0511::CallDelegatingCtorDtor2466     void Emit(CodeGenFunction &CGF, Flags flags) override {
2467       // We are calling the destructor from within the constructor.
2468       // Therefore, "this" should have the expected type.
2469       QualType ThisTy = Dtor->getThisObjectType();
2470       CGF.EmitCXXDestructorCall(Dtor, Type, /*ForVirtualBase=*/false,
2471                                 /*Delegating=*/true, Addr, ThisTy);
2472     }
2473   };
2474 } // end anonymous namespace
2475 
2476 void
EmitDelegatingCXXConstructorCall(const CXXConstructorDecl * Ctor,const FunctionArgList & Args)2477 CodeGenFunction::EmitDelegatingCXXConstructorCall(const CXXConstructorDecl *Ctor,
2478                                                   const FunctionArgList &Args) {
2479   assert(Ctor->isDelegatingConstructor());
2480 
2481   Address ThisPtr = LoadCXXThisAddress();
2482 
2483   AggValueSlot AggSlot =
2484     AggValueSlot::forAddr(ThisPtr, Qualifiers(),
2485                           AggValueSlot::IsDestructed,
2486                           AggValueSlot::DoesNotNeedGCBarriers,
2487                           AggValueSlot::IsNotAliased,
2488                           AggValueSlot::MayOverlap,
2489                           AggValueSlot::IsNotZeroed,
2490                           // Checks are made by the code that calls constructor.
2491                           AggValueSlot::IsSanitizerChecked);
2492 
2493   EmitAggExpr(Ctor->init_begin()[0]->getInit(), AggSlot);
2494 
2495   const CXXRecordDecl *ClassDecl = Ctor->getParent();
2496   if (CGM.getLangOpts().Exceptions && !ClassDecl->hasTrivialDestructor()) {
2497     CXXDtorType Type =
2498       CurGD.getCtorType() == Ctor_Complete ? Dtor_Complete : Dtor_Base;
2499 
2500     EHStack.pushCleanup<CallDelegatingCtorDtor>(EHCleanup,
2501                                                 ClassDecl->getDestructor(),
2502                                                 ThisPtr, Type);
2503   }
2504 }
2505 
EmitCXXDestructorCall(const CXXDestructorDecl * DD,CXXDtorType Type,bool ForVirtualBase,bool Delegating,Address This,QualType ThisTy)2506 void CodeGenFunction::EmitCXXDestructorCall(const CXXDestructorDecl *DD,
2507                                             CXXDtorType Type,
2508                                             bool ForVirtualBase,
2509                                             bool Delegating, Address This,
2510                                             QualType ThisTy) {
2511   CGM.getCXXABI().EmitDestructorCall(*this, DD, Type, ForVirtualBase,
2512                                      Delegating, This, ThisTy);
2513 }
2514 
2515 namespace {
2516   struct CallLocalDtor final : EHScopeStack::Cleanup {
2517     const CXXDestructorDecl *Dtor;
2518     Address Addr;
2519     QualType Ty;
2520 
CallLocalDtor__anonfcad378b0611::CallLocalDtor2521     CallLocalDtor(const CXXDestructorDecl *D, Address Addr, QualType Ty)
2522         : Dtor(D), Addr(Addr), Ty(Ty) {}
2523 
Emit__anonfcad378b0611::CallLocalDtor2524     void Emit(CodeGenFunction &CGF, Flags flags) override {
2525       CGF.EmitCXXDestructorCall(Dtor, Dtor_Complete,
2526                                 /*ForVirtualBase=*/false,
2527                                 /*Delegating=*/false, Addr, Ty);
2528     }
2529   };
2530 } // end anonymous namespace
2531 
PushDestructorCleanup(const CXXDestructorDecl * D,QualType T,Address Addr)2532 void CodeGenFunction::PushDestructorCleanup(const CXXDestructorDecl *D,
2533                                             QualType T, Address Addr) {
2534   EHStack.pushCleanup<CallLocalDtor>(NormalAndEHCleanup, D, Addr, T);
2535 }
2536 
PushDestructorCleanup(QualType T,Address Addr)2537 void CodeGenFunction::PushDestructorCleanup(QualType T, Address Addr) {
2538   CXXRecordDecl *ClassDecl = T->getAsCXXRecordDecl();
2539   if (!ClassDecl) return;
2540   if (ClassDecl->hasTrivialDestructor()) return;
2541 
2542   const CXXDestructorDecl *D = ClassDecl->getDestructor();
2543   assert(D && D->isUsed() && "destructor not marked as used!");
2544   PushDestructorCleanup(D, T, Addr);
2545 }
2546 
InitializeVTablePointer(const VPtr & Vptr)2547 void CodeGenFunction::InitializeVTablePointer(const VPtr &Vptr) {
2548   // Compute the address point.
2549   llvm::Value *VTableAddressPoint =
2550       CGM.getCXXABI().getVTableAddressPointInStructor(
2551           *this, Vptr.VTableClass, Vptr.Base, Vptr.NearestVBase);
2552 
2553   if (!VTableAddressPoint)
2554     return;
2555 
2556   // Compute where to store the address point.
2557   llvm::Value *VirtualOffset = nullptr;
2558   CharUnits NonVirtualOffset = CharUnits::Zero();
2559 
2560   if (CGM.getCXXABI().isVirtualOffsetNeededForVTableField(*this, Vptr)) {
2561     // We need to use the virtual base offset offset because the virtual base
2562     // might have a different offset in the most derived class.
2563 
2564     VirtualOffset = CGM.getCXXABI().GetVirtualBaseClassOffset(
2565         *this, LoadCXXThisAddress(), Vptr.VTableClass, Vptr.NearestVBase);
2566     NonVirtualOffset = Vptr.OffsetFromNearestVBase;
2567   } else {
2568     // We can just use the base offset in the complete class.
2569     NonVirtualOffset = Vptr.Base.getBaseOffset();
2570   }
2571 
2572   // Apply the offsets.
2573   Address VTableField = LoadCXXThisAddress();
2574   if (!NonVirtualOffset.isZero() || VirtualOffset)
2575     VTableField = ApplyNonVirtualAndVirtualOffset(
2576         *this, VTableField, NonVirtualOffset, VirtualOffset, Vptr.VTableClass,
2577         Vptr.NearestVBase);
2578 
2579   // Finally, store the address point. Use the same LLVM types as the field to
2580   // support optimization.
2581   unsigned GlobalsAS = CGM.getDataLayout().getDefaultGlobalsAddressSpace();
2582   unsigned ProgAS = CGM.getDataLayout().getProgramAddressSpace();
2583   llvm::Type *VTablePtrTy =
2584       llvm::FunctionType::get(CGM.Int32Ty, /*isVarArg=*/true)
2585           ->getPointerTo(ProgAS)
2586           ->getPointerTo(GlobalsAS);
2587   // vtable field is derived from `this` pointer, therefore they should be in
2588   // the same addr space. Note that this might not be LLVM address space 0.
2589   VTableField = Builder.CreateElementBitCast(VTableField, VTablePtrTy);
2590   VTableAddressPoint = Builder.CreateBitCast(VTableAddressPoint, VTablePtrTy);
2591 
2592   llvm::StoreInst *Store = Builder.CreateStore(VTableAddressPoint, VTableField);
2593   TBAAAccessInfo TBAAInfo = CGM.getTBAAVTablePtrAccessInfo(VTablePtrTy);
2594   CGM.DecorateInstructionWithTBAA(Store, TBAAInfo);
2595   if (CGM.getCodeGenOpts().OptimizationLevel > 0 &&
2596       CGM.getCodeGenOpts().StrictVTablePointers)
2597     CGM.DecorateInstructionWithInvariantGroup(Store, Vptr.VTableClass);
2598 }
2599 
2600 CodeGenFunction::VPtrsVector
getVTablePointers(const CXXRecordDecl * VTableClass)2601 CodeGenFunction::getVTablePointers(const CXXRecordDecl *VTableClass) {
2602   CodeGenFunction::VPtrsVector VPtrsResult;
2603   VisitedVirtualBasesSetTy VBases;
2604   getVTablePointers(BaseSubobject(VTableClass, CharUnits::Zero()),
2605                     /*NearestVBase=*/nullptr,
2606                     /*OffsetFromNearestVBase=*/CharUnits::Zero(),
2607                     /*BaseIsNonVirtualPrimaryBase=*/false, VTableClass, VBases,
2608                     VPtrsResult);
2609   return VPtrsResult;
2610 }
2611 
getVTablePointers(BaseSubobject Base,const CXXRecordDecl * NearestVBase,CharUnits OffsetFromNearestVBase,bool BaseIsNonVirtualPrimaryBase,const CXXRecordDecl * VTableClass,VisitedVirtualBasesSetTy & VBases,VPtrsVector & Vptrs)2612 void CodeGenFunction::getVTablePointers(BaseSubobject Base,
2613                                         const CXXRecordDecl *NearestVBase,
2614                                         CharUnits OffsetFromNearestVBase,
2615                                         bool BaseIsNonVirtualPrimaryBase,
2616                                         const CXXRecordDecl *VTableClass,
2617                                         VisitedVirtualBasesSetTy &VBases,
2618                                         VPtrsVector &Vptrs) {
2619   // If this base is a non-virtual primary base the address point has already
2620   // been set.
2621   if (!BaseIsNonVirtualPrimaryBase) {
2622     // Initialize the vtable pointer for this base.
2623     VPtr Vptr = {Base, NearestVBase, OffsetFromNearestVBase, VTableClass};
2624     Vptrs.push_back(Vptr);
2625   }
2626 
2627   const CXXRecordDecl *RD = Base.getBase();
2628 
2629   // Traverse bases.
2630   for (const auto &I : RD->bases()) {
2631     auto *BaseDecl =
2632         cast<CXXRecordDecl>(I.getType()->castAs<RecordType>()->getDecl());
2633 
2634     // Ignore classes without a vtable.
2635     if (!BaseDecl->isDynamicClass())
2636       continue;
2637 
2638     CharUnits BaseOffset;
2639     CharUnits BaseOffsetFromNearestVBase;
2640     bool BaseDeclIsNonVirtualPrimaryBase;
2641 
2642     if (I.isVirtual()) {
2643       // Check if we've visited this virtual base before.
2644       if (!VBases.insert(BaseDecl).second)
2645         continue;
2646 
2647       const ASTRecordLayout &Layout =
2648         getContext().getASTRecordLayout(VTableClass);
2649 
2650       BaseOffset = Layout.getVBaseClassOffset(BaseDecl);
2651       BaseOffsetFromNearestVBase = CharUnits::Zero();
2652       BaseDeclIsNonVirtualPrimaryBase = false;
2653     } else {
2654       const ASTRecordLayout &Layout = getContext().getASTRecordLayout(RD);
2655 
2656       BaseOffset = Base.getBaseOffset() + Layout.getBaseClassOffset(BaseDecl);
2657       BaseOffsetFromNearestVBase =
2658         OffsetFromNearestVBase + Layout.getBaseClassOffset(BaseDecl);
2659       BaseDeclIsNonVirtualPrimaryBase = Layout.getPrimaryBase() == BaseDecl;
2660     }
2661 
2662     getVTablePointers(
2663         BaseSubobject(BaseDecl, BaseOffset),
2664         I.isVirtual() ? BaseDecl : NearestVBase, BaseOffsetFromNearestVBase,
2665         BaseDeclIsNonVirtualPrimaryBase, VTableClass, VBases, Vptrs);
2666   }
2667 }
2668 
InitializeVTablePointers(const CXXRecordDecl * RD)2669 void CodeGenFunction::InitializeVTablePointers(const CXXRecordDecl *RD) {
2670   // Ignore classes without a vtable.
2671   if (!RD->isDynamicClass())
2672     return;
2673 
2674   // Initialize the vtable pointers for this class and all of its bases.
2675   if (CGM.getCXXABI().doStructorsInitializeVPtrs(RD))
2676     for (const VPtr &Vptr : getVTablePointers(RD))
2677       InitializeVTablePointer(Vptr);
2678 
2679   if (RD->getNumVBases())
2680     CGM.getCXXABI().initializeHiddenVirtualInheritanceMembers(*this, RD);
2681 }
2682 
GetVTablePtr(Address This,llvm::Type * VTableTy,const CXXRecordDecl * RD)2683 llvm::Value *CodeGenFunction::GetVTablePtr(Address This,
2684                                            llvm::Type *VTableTy,
2685                                            const CXXRecordDecl *RD) {
2686   Address VTablePtrSrc = Builder.CreateElementBitCast(This, VTableTy);
2687   llvm::Instruction *VTable = Builder.CreateLoad(VTablePtrSrc, "vtable");
2688   TBAAAccessInfo TBAAInfo = CGM.getTBAAVTablePtrAccessInfo(VTableTy);
2689   CGM.DecorateInstructionWithTBAA(VTable, TBAAInfo);
2690 
2691   if (CGM.getCodeGenOpts().OptimizationLevel > 0 &&
2692       CGM.getCodeGenOpts().StrictVTablePointers)
2693     CGM.DecorateInstructionWithInvariantGroup(VTable, RD);
2694 
2695   return VTable;
2696 }
2697 
2698 // If a class has a single non-virtual base and does not introduce or override
2699 // virtual member functions or fields, it will have the same layout as its base.
2700 // This function returns the least derived such class.
2701 //
2702 // Casting an instance of a base class to such a derived class is technically
2703 // undefined behavior, but it is a relatively common hack for introducing member
2704 // functions on class instances with specific properties (e.g. llvm::Operator)
2705 // that works under most compilers and should not have security implications, so
2706 // we allow it by default. It can be disabled with -fsanitize=cfi-cast-strict.
2707 static const CXXRecordDecl *
LeastDerivedClassWithSameLayout(const CXXRecordDecl * RD)2708 LeastDerivedClassWithSameLayout(const CXXRecordDecl *RD) {
2709   if (!RD->field_empty())
2710     return RD;
2711 
2712   if (RD->getNumVBases() != 0)
2713     return RD;
2714 
2715   if (RD->getNumBases() != 1)
2716     return RD;
2717 
2718   for (const CXXMethodDecl *MD : RD->methods()) {
2719     if (MD->isVirtual()) {
2720       // Virtual member functions are only ok if they are implicit destructors
2721       // because the implicit destructor will have the same semantics as the
2722       // base class's destructor if no fields are added.
2723       if (isa<CXXDestructorDecl>(MD) && MD->isImplicit())
2724         continue;
2725       return RD;
2726     }
2727   }
2728 
2729   return LeastDerivedClassWithSameLayout(
2730       RD->bases_begin()->getType()->getAsCXXRecordDecl());
2731 }
2732 
EmitTypeMetadataCodeForVCall(const CXXRecordDecl * RD,llvm::Value * VTable,SourceLocation Loc)2733 void CodeGenFunction::EmitTypeMetadataCodeForVCall(const CXXRecordDecl *RD,
2734                                                    llvm::Value *VTable,
2735                                                    SourceLocation Loc) {
2736   if (SanOpts.has(SanitizerKind::CFIVCall))
2737     EmitVTablePtrCheckForCall(RD, VTable, CodeGenFunction::CFITCK_VCall, Loc);
2738   else if (CGM.getCodeGenOpts().WholeProgramVTables &&
2739            // Don't insert type test assumes if we are forcing public
2740            // visibility.
2741            !CGM.AlwaysHasLTOVisibilityPublic(RD)) {
2742     QualType Ty = QualType(RD->getTypeForDecl(), 0);
2743     llvm::Metadata *MD = CGM.CreateMetadataIdentifierForType(Ty);
2744     llvm::Value *TypeId =
2745         llvm::MetadataAsValue::get(CGM.getLLVMContext(), MD);
2746 
2747     llvm::Value *CastedVTable = Builder.CreateBitCast(VTable, Int8PtrTy);
2748     // If we already know that the call has hidden LTO visibility, emit
2749     // @llvm.type.test(). Otherwise emit @llvm.public.type.test(), which WPD
2750     // will convert to @llvm.type.test() if we assert at link time that we have
2751     // whole program visibility.
2752     llvm::Intrinsic::ID IID = CGM.HasHiddenLTOVisibility(RD)
2753                                   ? llvm::Intrinsic::type_test
2754                                   : llvm::Intrinsic::public_type_test;
2755     llvm::Value *TypeTest =
2756         Builder.CreateCall(CGM.getIntrinsic(IID), {CastedVTable, TypeId});
2757     Builder.CreateCall(CGM.getIntrinsic(llvm::Intrinsic::assume), TypeTest);
2758   }
2759 }
2760 
EmitVTablePtrCheckForCall(const CXXRecordDecl * RD,llvm::Value * VTable,CFITypeCheckKind TCK,SourceLocation Loc)2761 void CodeGenFunction::EmitVTablePtrCheckForCall(const CXXRecordDecl *RD,
2762                                                 llvm::Value *VTable,
2763                                                 CFITypeCheckKind TCK,
2764                                                 SourceLocation Loc) {
2765   if (!SanOpts.has(SanitizerKind::CFICastStrict))
2766     RD = LeastDerivedClassWithSameLayout(RD);
2767 
2768   EmitVTablePtrCheck(RD, VTable, TCK, Loc);
2769 }
2770 
EmitVTablePtrCheckForCast(QualType T,Address Derived,bool MayBeNull,CFITypeCheckKind TCK,SourceLocation Loc)2771 void CodeGenFunction::EmitVTablePtrCheckForCast(QualType T, Address Derived,
2772                                                 bool MayBeNull,
2773                                                 CFITypeCheckKind TCK,
2774                                                 SourceLocation Loc) {
2775   if (!getLangOpts().CPlusPlus)
2776     return;
2777 
2778   auto *ClassTy = T->getAs<RecordType>();
2779   if (!ClassTy)
2780     return;
2781 
2782   const CXXRecordDecl *ClassDecl = cast<CXXRecordDecl>(ClassTy->getDecl());
2783 
2784   if (!ClassDecl->isCompleteDefinition() || !ClassDecl->isDynamicClass())
2785     return;
2786 
2787   if (!SanOpts.has(SanitizerKind::CFICastStrict))
2788     ClassDecl = LeastDerivedClassWithSameLayout(ClassDecl);
2789 
2790   llvm::BasicBlock *ContBlock = nullptr;
2791 
2792   if (MayBeNull) {
2793     llvm::Value *DerivedNotNull =
2794         Builder.CreateIsNotNull(Derived.getPointer(), "cast.nonnull");
2795 
2796     llvm::BasicBlock *CheckBlock = createBasicBlock("cast.check");
2797     ContBlock = createBasicBlock("cast.cont");
2798 
2799     Builder.CreateCondBr(DerivedNotNull, CheckBlock, ContBlock);
2800 
2801     EmitBlock(CheckBlock);
2802   }
2803 
2804   llvm::Value *VTable;
2805   std::tie(VTable, ClassDecl) =
2806       CGM.getCXXABI().LoadVTablePtr(*this, Derived, ClassDecl);
2807 
2808   EmitVTablePtrCheck(ClassDecl, VTable, TCK, Loc);
2809 
2810   if (MayBeNull) {
2811     Builder.CreateBr(ContBlock);
2812     EmitBlock(ContBlock);
2813   }
2814 }
2815 
EmitVTablePtrCheck(const CXXRecordDecl * RD,llvm::Value * VTable,CFITypeCheckKind TCK,SourceLocation Loc)2816 void CodeGenFunction::EmitVTablePtrCheck(const CXXRecordDecl *RD,
2817                                          llvm::Value *VTable,
2818                                          CFITypeCheckKind TCK,
2819                                          SourceLocation Loc) {
2820   if (!CGM.getCodeGenOpts().SanitizeCfiCrossDso &&
2821       !CGM.HasHiddenLTOVisibility(RD))
2822     return;
2823 
2824   SanitizerMask M;
2825   llvm::SanitizerStatKind SSK;
2826   switch (TCK) {
2827   case CFITCK_VCall:
2828     M = SanitizerKind::CFIVCall;
2829     SSK = llvm::SanStat_CFI_VCall;
2830     break;
2831   case CFITCK_NVCall:
2832     M = SanitizerKind::CFINVCall;
2833     SSK = llvm::SanStat_CFI_NVCall;
2834     break;
2835   case CFITCK_DerivedCast:
2836     M = SanitizerKind::CFIDerivedCast;
2837     SSK = llvm::SanStat_CFI_DerivedCast;
2838     break;
2839   case CFITCK_UnrelatedCast:
2840     M = SanitizerKind::CFIUnrelatedCast;
2841     SSK = llvm::SanStat_CFI_UnrelatedCast;
2842     break;
2843   case CFITCK_ICall:
2844   case CFITCK_NVMFCall:
2845   case CFITCK_VMFCall:
2846     llvm_unreachable("unexpected sanitizer kind");
2847   }
2848 
2849   std::string TypeName = RD->getQualifiedNameAsString();
2850   if (getContext().getNoSanitizeList().containsType(M, TypeName))
2851     return;
2852 
2853   SanitizerScope SanScope(this);
2854   EmitSanitizerStatReport(SSK);
2855 
2856   llvm::Metadata *MD =
2857       CGM.CreateMetadataIdentifierForType(QualType(RD->getTypeForDecl(), 0));
2858   llvm::Value *TypeId = llvm::MetadataAsValue::get(getLLVMContext(), MD);
2859 
2860   llvm::Value *CastedVTable = Builder.CreateBitCast(VTable, Int8PtrTy);
2861   llvm::Value *TypeTest = Builder.CreateCall(
2862       CGM.getIntrinsic(llvm::Intrinsic::type_test), {CastedVTable, TypeId});
2863 
2864   llvm::Constant *StaticData[] = {
2865       llvm::ConstantInt::get(Int8Ty, TCK),
2866       EmitCheckSourceLocation(Loc),
2867       EmitCheckTypeDescriptor(QualType(RD->getTypeForDecl(), 0)),
2868   };
2869 
2870   auto CrossDsoTypeId = CGM.CreateCrossDsoCfiTypeId(MD);
2871   if (CGM.getCodeGenOpts().SanitizeCfiCrossDso && CrossDsoTypeId) {
2872     EmitCfiSlowPathCheck(M, TypeTest, CrossDsoTypeId, CastedVTable, StaticData);
2873     return;
2874   }
2875 
2876   if (CGM.getCodeGenOpts().SanitizeTrap.has(M)) {
2877     EmitTrapCheck(TypeTest, SanitizerHandler::CFICheckFail);
2878     return;
2879   }
2880 
2881   llvm::Value *AllVtables = llvm::MetadataAsValue::get(
2882       CGM.getLLVMContext(),
2883       llvm::MDString::get(CGM.getLLVMContext(), "all-vtables"));
2884   llvm::Value *ValidVtable = Builder.CreateCall(
2885       CGM.getIntrinsic(llvm::Intrinsic::type_test), {CastedVTable, AllVtables});
2886   EmitCheck(std::make_pair(TypeTest, M), SanitizerHandler::CFICheckFail,
2887             StaticData, {CastedVTable, ValidVtable});
2888 }
2889 
ShouldEmitVTableTypeCheckedLoad(const CXXRecordDecl * RD)2890 bool CodeGenFunction::ShouldEmitVTableTypeCheckedLoad(const CXXRecordDecl *RD) {
2891   if (!CGM.getCodeGenOpts().WholeProgramVTables ||
2892       !CGM.HasHiddenLTOVisibility(RD))
2893     return false;
2894 
2895   if (CGM.getCodeGenOpts().VirtualFunctionElimination)
2896     return true;
2897 
2898   if (!SanOpts.has(SanitizerKind::CFIVCall) ||
2899       !CGM.getCodeGenOpts().SanitizeTrap.has(SanitizerKind::CFIVCall))
2900     return false;
2901 
2902   std::string TypeName = RD->getQualifiedNameAsString();
2903   return !getContext().getNoSanitizeList().containsType(SanitizerKind::CFIVCall,
2904                                                         TypeName);
2905 }
2906 
EmitVTableTypeCheckedLoad(const CXXRecordDecl * RD,llvm::Value * VTable,llvm::Type * VTableTy,uint64_t VTableByteOffset)2907 llvm::Value *CodeGenFunction::EmitVTableTypeCheckedLoad(
2908     const CXXRecordDecl *RD, llvm::Value *VTable, llvm::Type *VTableTy,
2909     uint64_t VTableByteOffset) {
2910   SanitizerScope SanScope(this);
2911 
2912   EmitSanitizerStatReport(llvm::SanStat_CFI_VCall);
2913 
2914   llvm::Metadata *MD =
2915       CGM.CreateMetadataIdentifierForType(QualType(RD->getTypeForDecl(), 0));
2916   llvm::Value *TypeId = llvm::MetadataAsValue::get(CGM.getLLVMContext(), MD);
2917 
2918   llvm::Value *CastedVTable = Builder.CreateBitCast(VTable, Int8PtrTy);
2919   llvm::Value *CheckedLoad = Builder.CreateCall(
2920       CGM.getIntrinsic(llvm::Intrinsic::type_checked_load),
2921       {CastedVTable, llvm::ConstantInt::get(Int32Ty, VTableByteOffset),
2922        TypeId});
2923   llvm::Value *CheckResult = Builder.CreateExtractValue(CheckedLoad, 1);
2924 
2925   std::string TypeName = RD->getQualifiedNameAsString();
2926   if (SanOpts.has(SanitizerKind::CFIVCall) &&
2927       !getContext().getNoSanitizeList().containsType(SanitizerKind::CFIVCall,
2928                                                      TypeName)) {
2929     EmitCheck(std::make_pair(CheckResult, SanitizerKind::CFIVCall),
2930               SanitizerHandler::CFICheckFail, {}, {});
2931   }
2932 
2933   return Builder.CreateBitCast(Builder.CreateExtractValue(CheckedLoad, 0),
2934                                VTableTy);
2935 }
2936 
EmitForwardingCallToLambda(const CXXMethodDecl * callOperator,CallArgList & callArgs)2937 void CodeGenFunction::EmitForwardingCallToLambda(
2938                                       const CXXMethodDecl *callOperator,
2939                                       CallArgList &callArgs) {
2940   // Get the address of the call operator.
2941   const CGFunctionInfo &calleeFnInfo =
2942     CGM.getTypes().arrangeCXXMethodDeclaration(callOperator);
2943   llvm::Constant *calleePtr =
2944     CGM.GetAddrOfFunction(GlobalDecl(callOperator),
2945                           CGM.getTypes().GetFunctionType(calleeFnInfo));
2946 
2947   // Prepare the return slot.
2948   const FunctionProtoType *FPT =
2949     callOperator->getType()->castAs<FunctionProtoType>();
2950   QualType resultType = FPT->getReturnType();
2951   ReturnValueSlot returnSlot;
2952   if (!resultType->isVoidType() &&
2953       calleeFnInfo.getReturnInfo().getKind() == ABIArgInfo::Indirect &&
2954       !hasScalarEvaluationKind(calleeFnInfo.getReturnType()))
2955     returnSlot =
2956         ReturnValueSlot(ReturnValue, resultType.isVolatileQualified(),
2957                         /*IsUnused=*/false, /*IsExternallyDestructed=*/true);
2958 
2959   // We don't need to separately arrange the call arguments because
2960   // the call can't be variadic anyway --- it's impossible to forward
2961   // variadic arguments.
2962 
2963   // Now emit our call.
2964   auto callee = CGCallee::forDirect(calleePtr, GlobalDecl(callOperator));
2965   RValue RV = EmitCall(calleeFnInfo, callee, returnSlot, callArgs);
2966 
2967   // If necessary, copy the returned value into the slot.
2968   if (!resultType->isVoidType() && returnSlot.isNull()) {
2969     if (getLangOpts().ObjCAutoRefCount && resultType->isObjCRetainableType()) {
2970       RV = RValue::get(EmitARCRetainAutoreleasedReturnValue(RV.getScalarVal()));
2971     }
2972     EmitReturnOfRValue(RV, resultType);
2973   } else
2974     EmitBranchThroughCleanup(ReturnBlock);
2975 }
2976 
EmitLambdaBlockInvokeBody()2977 void CodeGenFunction::EmitLambdaBlockInvokeBody() {
2978   const BlockDecl *BD = BlockInfo->getBlockDecl();
2979   const VarDecl *variable = BD->capture_begin()->getVariable();
2980   const CXXRecordDecl *Lambda = variable->getType()->getAsCXXRecordDecl();
2981   const CXXMethodDecl *CallOp = Lambda->getLambdaCallOperator();
2982 
2983   if (CallOp->isVariadic()) {
2984     // FIXME: Making this work correctly is nasty because it requires either
2985     // cloning the body of the call operator or making the call operator
2986     // forward.
2987     CGM.ErrorUnsupported(CurCodeDecl, "lambda conversion to variadic function");
2988     return;
2989   }
2990 
2991   // Start building arguments for forwarding call
2992   CallArgList CallArgs;
2993 
2994   QualType ThisType = getContext().getPointerType(getContext().getRecordType(Lambda));
2995   Address ThisPtr = GetAddrOfBlockDecl(variable);
2996   CallArgs.add(RValue::get(ThisPtr.getPointer()), ThisType);
2997 
2998   // Add the rest of the parameters.
2999   for (auto *param : BD->parameters())
3000     EmitDelegateCallArg(CallArgs, param, param->getBeginLoc());
3001 
3002   assert(!Lambda->isGenericLambda() &&
3003             "generic lambda interconversion to block not implemented");
3004   EmitForwardingCallToLambda(CallOp, CallArgs);
3005 }
3006 
EmitLambdaDelegatingInvokeBody(const CXXMethodDecl * MD)3007 void CodeGenFunction::EmitLambdaDelegatingInvokeBody(const CXXMethodDecl *MD) {
3008   const CXXRecordDecl *Lambda = MD->getParent();
3009 
3010   // Start building arguments for forwarding call
3011   CallArgList CallArgs;
3012 
3013   QualType LambdaType = getContext().getRecordType(Lambda);
3014   QualType ThisType = getContext().getPointerType(LambdaType);
3015   Address ThisPtr = CreateMemTemp(LambdaType, "unused.capture");
3016   CallArgs.add(RValue::get(ThisPtr.getPointer()), ThisType);
3017 
3018   // Add the rest of the parameters.
3019   for (auto *Param : MD->parameters())
3020     EmitDelegateCallArg(CallArgs, Param, Param->getBeginLoc());
3021 
3022   const CXXMethodDecl *CallOp = Lambda->getLambdaCallOperator();
3023   // For a generic lambda, find the corresponding call operator specialization
3024   // to which the call to the static-invoker shall be forwarded.
3025   if (Lambda->isGenericLambda()) {
3026     assert(MD->isFunctionTemplateSpecialization());
3027     const TemplateArgumentList *TAL = MD->getTemplateSpecializationArgs();
3028     FunctionTemplateDecl *CallOpTemplate = CallOp->getDescribedFunctionTemplate();
3029     void *InsertPos = nullptr;
3030     FunctionDecl *CorrespondingCallOpSpecialization =
3031         CallOpTemplate->findSpecialization(TAL->asArray(), InsertPos);
3032     assert(CorrespondingCallOpSpecialization);
3033     CallOp = cast<CXXMethodDecl>(CorrespondingCallOpSpecialization);
3034   }
3035   EmitForwardingCallToLambda(CallOp, CallArgs);
3036 }
3037 
EmitLambdaStaticInvokeBody(const CXXMethodDecl * MD)3038 void CodeGenFunction::EmitLambdaStaticInvokeBody(const CXXMethodDecl *MD) {
3039   if (MD->isVariadic()) {
3040     // FIXME: Making this work correctly is nasty because it requires either
3041     // cloning the body of the call operator or making the call operator forward.
3042     CGM.ErrorUnsupported(MD, "lambda conversion to variadic function");
3043     return;
3044   }
3045 
3046   EmitLambdaDelegatingInvokeBody(MD);
3047 }
3048