Re: [PATCH] -fsanitize=vptr instrumentation (take 2)

[Jakub Jelinek <jakub@redhat.com>]

On Wed, Nov 26, 2014 at 11:18:11AM -0500, Jason Merrill wrote:
> On 10/28/2014 08:44 AM, Jakub Jelinek wrote:
> >+cp_ubsan_check_member_access_r (tree *stmt_p, int *walk_subtrees, void *data)
> 
> This function needs a longer comment about exactly what forms it's trying to
> instrument.

Ok, will do.

> >+  /* T t; t.foo (); doesn't need instrumentation, if the type is known.  */
> >+  if (is_addr
> >+      && TREE_CODE (op) == ADDR_EXPR
> >+      && DECL_P (TREE_OPERAND (op, 0))
> >+      && same_type_p (type,
> >+		      TYPE_MAIN_VARIANT (TREE_TYPE (TREE_OPERAND (op, 0)))))
> >+    return NULL_TREE;
> 
> How do we know the decl's vptr hasn't been clobbered?  This seems like one
> of the optimizations we decided to drop.

Yeah, will try to remove this hunk and see what it changes.

> >+  if (TREE_CODE (base) == COMPONENT_REF
> >+      && DECL_ARTIFICIAL (TREE_OPERAND (base, 1)))
> >+    {
> >+      tree base2 = TREE_OPERAND (base, 0);
> >+      while (TREE_CODE (base2) == COMPONENT_REF
> >+	     || TREE_CODE (base2) == ARRAY_REF
> >+	     || TREE_CODE (base2) == ARRAY_RANGE_REF)
> >+	base2 = TREE_OPERAND (base2, 0);
> >+      if (TREE_CODE (base2) != INDIRECT_REF
> >+	  && TREE_CODE (base2) != MEM_REF)
> >+	return;
> >+    }
> >+  else if (TREE_CODE (base) != INDIRECT_REF
> >+	   && TREE_CODE (base) != MEM_REF)
> >+    return;
> 
> Why do you look through ARRAY_REF here?  An element of an array is its own
> complete object.

That had to do with only instrumenting dereferences surrounded by handled
components, but not accesses to decls (so p->x gets instrumented but
q.x for VAR_DECL q is not).  If we want to instrument that, then I'll need
to tweak the member access instrumentation some more.

Today I found that the C++14 constexpr changes unfortunately mean I have to
make bigger changes, so I'm rewriting it to use UBSAN_VPTR internal calls
and only lower that during sanopt (and will try to optimize clearly
unnecessary checks at that point to offset from the FE instrumenting more
- if the optimizers can prove virtual table of the object has not been
changed since dominating UBSAN_VPTR, we don't need to instrument it again.

	Jakub