1 //===--- CGClass.cpp - Emit LLVM Code for C++ classes -----------*- C++ -*-===//
2 //
3 // The LLVM Compiler Infrastructure
4 //
5 // This file is distributed under the University of Illinois Open Source
6 // License. See LICENSE.TXT for details.
7 //
8 //===----------------------------------------------------------------------===//
9 //
10 // This contains code dealing with C++ code generation of classes
11 //
12 //===----------------------------------------------------------------------===//
13
14 #include "CGBlocks.h"
15 #include "CGCXXABI.h"
16 #include "CGDebugInfo.h"
17 #include "CGRecordLayout.h"
18 #include "CodeGenFunction.h"
19 #include "clang/AST/CXXInheritance.h"
20 #include "clang/AST/DeclTemplate.h"
21 #include "clang/AST/EvaluatedExprVisitor.h"
22 #include "clang/AST/RecordLayout.h"
23 #include "clang/AST/StmtCXX.h"
24 #include "clang/Basic/TargetBuiltins.h"
25 #include "clang/CodeGen/CGFunctionInfo.h"
26 #include "clang/Frontend/CodeGenOptions.h"
27 #include "llvm/IR/Intrinsics.h"
28 #include "llvm/IR/Metadata.h"
29
30 using namespace clang;
31 using namespace CodeGen;
32
33 /// Return the best known alignment for an unknown pointer to a
34 /// particular class.
getClassPointerAlignment(const CXXRecordDecl * RD)35 CharUnits CodeGenModule::getClassPointerAlignment(const CXXRecordDecl *RD) {
36 if (!RD->isCompleteDefinition())
37 return CharUnits::One(); // Hopefully won't be used anywhere.
38
39 auto &layout = getContext().getASTRecordLayout(RD);
40
41 // If the class is final, then we know that the pointer points to an
42 // object of that type and can use the full alignment.
43 if (RD->hasAttr<FinalAttr>()) {
44 return layout.getAlignment();
45
46 // Otherwise, we have to assume it could be a subclass.
47 } else {
48 return layout.getNonVirtualAlignment();
49 }
50 }
51
52 /// Return the best known alignment for a pointer to a virtual base,
53 /// given the alignment of a pointer to the derived class.
getVBaseAlignment(CharUnits actualDerivedAlign,const CXXRecordDecl * derivedClass,const CXXRecordDecl * vbaseClass)54 CharUnits CodeGenModule::getVBaseAlignment(CharUnits actualDerivedAlign,
55 const CXXRecordDecl *derivedClass,
56 const CXXRecordDecl *vbaseClass) {
57 // The basic idea here is that an underaligned derived pointer might
58 // indicate an underaligned base pointer.
59
60 assert(vbaseClass->isCompleteDefinition());
61 auto &baseLayout = getContext().getASTRecordLayout(vbaseClass);
62 CharUnits expectedVBaseAlign = baseLayout.getNonVirtualAlignment();
63
64 return getDynamicOffsetAlignment(actualDerivedAlign, derivedClass,
65 expectedVBaseAlign);
66 }
67
68 CharUnits
getDynamicOffsetAlignment(CharUnits actualBaseAlign,const CXXRecordDecl * baseDecl,CharUnits expectedTargetAlign)69 CodeGenModule::getDynamicOffsetAlignment(CharUnits actualBaseAlign,
70 const CXXRecordDecl *baseDecl,
71 CharUnits expectedTargetAlign) {
72 // If the base is an incomplete type (which is, alas, possible with
73 // member pointers), be pessimistic.
74 if (!baseDecl->isCompleteDefinition())
75 return std::min(actualBaseAlign, expectedTargetAlign);
76
77 auto &baseLayout = getContext().getASTRecordLayout(baseDecl);
78 CharUnits expectedBaseAlign = baseLayout.getNonVirtualAlignment();
79
80 // If the class is properly aligned, assume the target offset is, too.
81 //
82 // This actually isn't necessarily the right thing to do --- if the
83 // class is a complete object, but it's only properly aligned for a
84 // base subobject, then the alignments of things relative to it are
85 // probably off as well. (Note that this requires the alignment of
86 // the target to be greater than the NV alignment of the derived
87 // class.)
88 //
89 // However, our approach to this kind of under-alignment can only
90 // ever be best effort; after all, we're never going to propagate
91 // alignments through variables or parameters. Note, in particular,
92 // that constructing a polymorphic type in an address that's less
93 // than pointer-aligned will generally trap in the constructor,
94 // unless we someday add some sort of attribute to change the
95 // assumed alignment of 'this'. So our goal here is pretty much
96 // just to allow the user to explicitly say that a pointer is
97 // under-aligned and then safely access its fields and v-tables.
98 if (actualBaseAlign >= expectedBaseAlign) {
99 return expectedTargetAlign;
100 }
101
102 // Otherwise, we might be offset by an arbitrary multiple of the
103 // actual alignment. The correct adjustment is to take the min of
104 // the two alignments.
105 return std::min(actualBaseAlign, expectedTargetAlign);
106 }
107
LoadCXXThisAddress()108 Address CodeGenFunction::LoadCXXThisAddress() {
109 assert(CurFuncDecl && "loading 'this' without a func declaration?");
110 assert(isa<CXXMethodDecl>(CurFuncDecl));
111
112 // Lazily compute CXXThisAlignment.
113 if (CXXThisAlignment.isZero()) {
114 // Just use the best known alignment for the parent.
115 // TODO: if we're currently emitting a complete-object ctor/dtor,
116 // we can always use the complete-object alignment.
117 auto RD = cast<CXXMethodDecl>(CurFuncDecl)->getParent();
118 CXXThisAlignment = CGM.getClassPointerAlignment(RD);
119 }
120
121 return Address(LoadCXXThis(), CXXThisAlignment);
122 }
123
124 /// Emit the address of a field using a member data pointer.
125 ///
126 /// \param E Only used for emergency diagnostics
127 Address
EmitCXXMemberDataPointerAddress(const Expr * E,Address base,llvm::Value * memberPtr,const MemberPointerType * memberPtrType,AlignmentSource * alignSource)128 CodeGenFunction::EmitCXXMemberDataPointerAddress(const Expr *E, Address base,
129 llvm::Value *memberPtr,
130 const MemberPointerType *memberPtrType,
131 AlignmentSource *alignSource) {
132 // Ask the ABI to compute the actual address.
133 llvm::Value *ptr =
134 CGM.getCXXABI().EmitMemberDataPointerAddress(*this, E, base,
135 memberPtr, memberPtrType);
136
137 QualType memberType = memberPtrType->getPointeeType();
138 CharUnits memberAlign = getNaturalTypeAlignment(memberType, alignSource);
139 memberAlign =
140 CGM.getDynamicOffsetAlignment(base.getAlignment(),
141 memberPtrType->getClass()->getAsCXXRecordDecl(),
142 memberAlign);
143 return Address(ptr, memberAlign);
144 }
145
computeNonVirtualBaseClassOffset(const CXXRecordDecl * DerivedClass,CastExpr::path_const_iterator Start,CastExpr::path_const_iterator End)146 CharUnits CodeGenModule::computeNonVirtualBaseClassOffset(
147 const CXXRecordDecl *DerivedClass, CastExpr::path_const_iterator Start,
148 CastExpr::path_const_iterator End) {
149 CharUnits Offset = CharUnits::Zero();
150
151 const ASTContext &Context = getContext();
152 const CXXRecordDecl *RD = DerivedClass;
153
154 for (CastExpr::path_const_iterator I = Start; I != End; ++I) {
155 const CXXBaseSpecifier *Base = *I;
156 assert(!Base->isVirtual() && "Should not see virtual bases here!");
157
158 // Get the layout.
159 const ASTRecordLayout &Layout = Context.getASTRecordLayout(RD);
160
161 const CXXRecordDecl *BaseDecl =
162 cast<CXXRecordDecl>(Base->getType()->getAs<RecordType>()->getDecl());
163
164 // Add the offset.
165 Offset += Layout.getBaseClassOffset(BaseDecl);
166
167 RD = BaseDecl;
168 }
169
170 return Offset;
171 }
172
173 llvm::Constant *
GetNonVirtualBaseClassOffset(const CXXRecordDecl * ClassDecl,CastExpr::path_const_iterator PathBegin,CastExpr::path_const_iterator PathEnd)174 CodeGenModule::GetNonVirtualBaseClassOffset(const CXXRecordDecl *ClassDecl,
175 CastExpr::path_const_iterator PathBegin,
176 CastExpr::path_const_iterator PathEnd) {
177 assert(PathBegin != PathEnd && "Base path should not be empty!");
178
179 CharUnits Offset =
180 computeNonVirtualBaseClassOffset(ClassDecl, PathBegin, PathEnd);
181 if (Offset.isZero())
182 return nullptr;
183
184 llvm::Type *PtrDiffTy =
185 Types.ConvertType(getContext().getPointerDiffType());
186
187 return llvm::ConstantInt::get(PtrDiffTy, Offset.getQuantity());
188 }
189
190 /// Gets the address of a direct base class within a complete object.
191 /// This should only be used for (1) non-virtual bases or (2) virtual bases
192 /// when the type is known to be complete (e.g. in complete destructors).
193 ///
194 /// The object pointed to by 'This' is assumed to be non-null.
195 Address
GetAddressOfDirectBaseInCompleteClass(Address This,const CXXRecordDecl * Derived,const CXXRecordDecl * Base,bool BaseIsVirtual)196 CodeGenFunction::GetAddressOfDirectBaseInCompleteClass(Address This,
197 const CXXRecordDecl *Derived,
198 const CXXRecordDecl *Base,
199 bool BaseIsVirtual) {
200 // 'this' must be a pointer (in some address space) to Derived.
201 assert(This.getElementType() == ConvertType(Derived));
202
203 // Compute the offset of the virtual base.
204 CharUnits Offset;
205 const ASTRecordLayout &Layout = getContext().getASTRecordLayout(Derived);
206 if (BaseIsVirtual)
207 Offset = Layout.getVBaseClassOffset(Base);
208 else
209 Offset = Layout.getBaseClassOffset(Base);
210
211 // Shift and cast down to the base type.
212 // TODO: for complete types, this should be possible with a GEP.
213 Address V = This;
214 if (!Offset.isZero()) {
215 V = Builder.CreateElementBitCast(V, Int8Ty);
216 V = Builder.CreateConstInBoundsByteGEP(V, Offset);
217 }
218 V = Builder.CreateElementBitCast(V, ConvertType(Base));
219
220 return V;
221 }
222
223 static Address
ApplyNonVirtualAndVirtualOffset(CodeGenFunction & CGF,Address addr,CharUnits nonVirtualOffset,llvm::Value * virtualOffset,const CXXRecordDecl * derivedClass,const CXXRecordDecl * nearestVBase)224 ApplyNonVirtualAndVirtualOffset(CodeGenFunction &CGF, Address addr,
225 CharUnits nonVirtualOffset,
226 llvm::Value *virtualOffset,
227 const CXXRecordDecl *derivedClass,
228 const CXXRecordDecl *nearestVBase) {
229 // Assert that we have something to do.
230 assert(!nonVirtualOffset.isZero() || virtualOffset != nullptr);
231
232 // Compute the offset from the static and dynamic components.
233 llvm::Value *baseOffset;
234 if (!nonVirtualOffset.isZero()) {
235 baseOffset = llvm::ConstantInt::get(CGF.PtrDiffTy,
236 nonVirtualOffset.getQuantity());
237 if (virtualOffset) {
238 baseOffset = CGF.Builder.CreateAdd(virtualOffset, baseOffset);
239 }
240 } else {
241 baseOffset = virtualOffset;
242 }
243
244 // Apply the base offset.
245 llvm::Value *ptr = addr.getPointer();
246 ptr = CGF.Builder.CreateBitCast(ptr, CGF.Int8PtrTy);
247 ptr = CGF.Builder.CreateInBoundsGEP(ptr, baseOffset, "add.ptr");
248
249 // If we have a virtual component, the alignment of the result will
250 // be relative only to the known alignment of that vbase.
251 CharUnits alignment;
252 if (virtualOffset) {
253 assert(nearestVBase && "virtual offset without vbase?");
254 alignment = CGF.CGM.getVBaseAlignment(addr.getAlignment(),
255 derivedClass, nearestVBase);
256 } else {
257 alignment = addr.getAlignment();
258 }
259 alignment = alignment.alignmentAtOffset(nonVirtualOffset);
260
261 return Address(ptr, alignment);
262 }
263
GetAddressOfBaseClass(Address Value,const CXXRecordDecl * Derived,CastExpr::path_const_iterator PathBegin,CastExpr::path_const_iterator PathEnd,bool NullCheckValue,SourceLocation Loc)264 Address CodeGenFunction::GetAddressOfBaseClass(
265 Address Value, const CXXRecordDecl *Derived,
266 CastExpr::path_const_iterator PathBegin,
267 CastExpr::path_const_iterator PathEnd, bool NullCheckValue,
268 SourceLocation Loc) {
269 assert(PathBegin != PathEnd && "Base path should not be empty!");
270
271 CastExpr::path_const_iterator Start = PathBegin;
272 const CXXRecordDecl *VBase = nullptr;
273
274 // Sema has done some convenient canonicalization here: if the
275 // access path involved any virtual steps, the conversion path will
276 // *start* with a step down to the correct virtual base subobject,
277 // and hence will not require any further steps.
278 if ((*Start)->isVirtual()) {
279 VBase =
280 cast<CXXRecordDecl>((*Start)->getType()->getAs<RecordType>()->getDecl());
281 ++Start;
282 }
283
284 // Compute the static offset of the ultimate destination within its
285 // allocating subobject (the virtual base, if there is one, or else
286 // the "complete" object that we see).
287 CharUnits NonVirtualOffset = CGM.computeNonVirtualBaseClassOffset(
288 VBase ? VBase : Derived, Start, PathEnd);
289
290 // If there's a virtual step, we can sometimes "devirtualize" it.
291 // For now, that's limited to when the derived type is final.
292 // TODO: "devirtualize" this for accesses to known-complete objects.
293 if (VBase && Derived->hasAttr<FinalAttr>()) {
294 const ASTRecordLayout &layout = getContext().getASTRecordLayout(Derived);
295 CharUnits vBaseOffset = layout.getVBaseClassOffset(VBase);
296 NonVirtualOffset += vBaseOffset;
297 VBase = nullptr; // we no longer have a virtual step
298 }
299
300 // Get the base pointer type.
301 llvm::Type *BasePtrTy =
302 ConvertType((PathEnd[-1])->getType())->getPointerTo();
303
304 QualType DerivedTy = getContext().getRecordType(Derived);
305 CharUnits DerivedAlign = CGM.getClassPointerAlignment(Derived);
306
307 // If the static offset is zero and we don't have a virtual step,
308 // just do a bitcast; null checks are unnecessary.
309 if (NonVirtualOffset.isZero() && !VBase) {
310 if (sanitizePerformTypeCheck()) {
311 EmitTypeCheck(TCK_Upcast, Loc, Value.getPointer(),
312 DerivedTy, DerivedAlign, !NullCheckValue);
313 }
314 return Builder.CreateBitCast(Value, BasePtrTy);
315 }
316
317 llvm::BasicBlock *origBB = nullptr;
318 llvm::BasicBlock *endBB = nullptr;
319
320 // Skip over the offset (and the vtable load) if we're supposed to
321 // null-check the pointer.
322 if (NullCheckValue) {
323 origBB = Builder.GetInsertBlock();
324 llvm::BasicBlock *notNullBB = createBasicBlock("cast.notnull");
325 endBB = createBasicBlock("cast.end");
326
327 llvm::Value *isNull = Builder.CreateIsNull(Value.getPointer());
328 Builder.CreateCondBr(isNull, endBB, notNullBB);
329 EmitBlock(notNullBB);
330 }
331
332 if (sanitizePerformTypeCheck()) {
333 EmitTypeCheck(VBase ? TCK_UpcastToVirtualBase : TCK_Upcast, Loc,
334 Value.getPointer(), DerivedTy, DerivedAlign, true);
335 }
336
337 // Compute the virtual offset.
338 llvm::Value *VirtualOffset = nullptr;
339 if (VBase) {
340 VirtualOffset =
341 CGM.getCXXABI().GetVirtualBaseClassOffset(*this, Value, Derived, VBase);
342 }
343
344 // Apply both offsets.
345 Value = ApplyNonVirtualAndVirtualOffset(*this, Value, NonVirtualOffset,
346 VirtualOffset, Derived, VBase);
347
348 // Cast to the destination type.
349 Value = Builder.CreateBitCast(Value, BasePtrTy);
350
351 // Build a phi if we needed a null check.
352 if (NullCheckValue) {
353 llvm::BasicBlock *notNullBB = Builder.GetInsertBlock();
354 Builder.CreateBr(endBB);
355 EmitBlock(endBB);
356
357 llvm::PHINode *PHI = Builder.CreatePHI(BasePtrTy, 2, "cast.result");
358 PHI->addIncoming(Value.getPointer(), notNullBB);
359 PHI->addIncoming(llvm::Constant::getNullValue(BasePtrTy), origBB);
360 Value = Address(PHI, Value.getAlignment());
361 }
362
363 return Value;
364 }
365
366 Address
GetAddressOfDerivedClass(Address BaseAddr,const CXXRecordDecl * Derived,CastExpr::path_const_iterator PathBegin,CastExpr::path_const_iterator PathEnd,bool NullCheckValue)367 CodeGenFunction::GetAddressOfDerivedClass(Address BaseAddr,
368 const CXXRecordDecl *Derived,
369 CastExpr::path_const_iterator PathBegin,
370 CastExpr::path_const_iterator PathEnd,
371 bool NullCheckValue) {
372 assert(PathBegin != PathEnd && "Base path should not be empty!");
373
374 QualType DerivedTy =
375 getContext().getCanonicalType(getContext().getTagDeclType(Derived));
376 llvm::Type *DerivedPtrTy = ConvertType(DerivedTy)->getPointerTo();
377
378 llvm::Value *NonVirtualOffset =
379 CGM.GetNonVirtualBaseClassOffset(Derived, PathBegin, PathEnd);
380
381 if (!NonVirtualOffset) {
382 // No offset, we can just cast back.
383 return Builder.CreateBitCast(BaseAddr, DerivedPtrTy);
384 }
385
386 llvm::BasicBlock *CastNull = nullptr;
387 llvm::BasicBlock *CastNotNull = nullptr;
388 llvm::BasicBlock *CastEnd = nullptr;
389
390 if (NullCheckValue) {
391 CastNull = createBasicBlock("cast.null");
392 CastNotNull = createBasicBlock("cast.notnull");
393 CastEnd = createBasicBlock("cast.end");
394
395 llvm::Value *IsNull = Builder.CreateIsNull(BaseAddr.getPointer());
396 Builder.CreateCondBr(IsNull, CastNull, CastNotNull);
397 EmitBlock(CastNotNull);
398 }
399
400 // Apply the offset.
401 llvm::Value *Value = Builder.CreateBitCast(BaseAddr.getPointer(), Int8PtrTy);
402 Value = Builder.CreateGEP(Value, Builder.CreateNeg(NonVirtualOffset),
403 "sub.ptr");
404
405 // Just cast.
406 Value = Builder.CreateBitCast(Value, DerivedPtrTy);
407
408 // Produce a PHI if we had a null-check.
409 if (NullCheckValue) {
410 Builder.CreateBr(CastEnd);
411 EmitBlock(CastNull);
412 Builder.CreateBr(CastEnd);
413 EmitBlock(CastEnd);
414
415 llvm::PHINode *PHI = Builder.CreatePHI(Value->getType(), 2);
416 PHI->addIncoming(Value, CastNotNull);
417 PHI->addIncoming(llvm::Constant::getNullValue(Value->getType()), CastNull);
418 Value = PHI;
419 }
420
421 return Address(Value, CGM.getClassPointerAlignment(Derived));
422 }
423
GetVTTParameter(GlobalDecl GD,bool ForVirtualBase,bool Delegating)424 llvm::Value *CodeGenFunction::GetVTTParameter(GlobalDecl GD,
425 bool ForVirtualBase,
426 bool Delegating) {
427 if (!CGM.getCXXABI().NeedsVTTParameter(GD)) {
428 // This constructor/destructor does not need a VTT parameter.
429 return nullptr;
430 }
431
432 const CXXRecordDecl *RD = cast<CXXMethodDecl>(CurCodeDecl)->getParent();
433 const CXXRecordDecl *Base = cast<CXXMethodDecl>(GD.getDecl())->getParent();
434
435 llvm::Value *VTT;
436
437 uint64_t SubVTTIndex;
438
439 if (Delegating) {
440 // If this is a delegating constructor call, just load the VTT.
441 return LoadCXXVTT();
442 } else if (RD == Base) {
443 // If the record matches the base, this is the complete ctor/dtor
444 // variant calling the base variant in a class with virtual bases.
445 assert(!CGM.getCXXABI().NeedsVTTParameter(CurGD) &&
446 "doing no-op VTT offset in base dtor/ctor?");
447 assert(!ForVirtualBase && "Can't have same class as virtual base!");
448 SubVTTIndex = 0;
449 } else {
450 const ASTRecordLayout &Layout = getContext().getASTRecordLayout(RD);
451 CharUnits BaseOffset = ForVirtualBase ?
452 Layout.getVBaseClassOffset(Base) :
453 Layout.getBaseClassOffset(Base);
454
455 SubVTTIndex =
456 CGM.getVTables().getSubVTTIndex(RD, BaseSubobject(Base, BaseOffset));
457 assert(SubVTTIndex != 0 && "Sub-VTT index must be greater than zero!");
458 }
459
460 if (CGM.getCXXABI().NeedsVTTParameter(CurGD)) {
461 // A VTT parameter was passed to the constructor, use it.
462 VTT = LoadCXXVTT();
463 VTT = Builder.CreateConstInBoundsGEP1_64(VTT, SubVTTIndex);
464 } else {
465 // We're the complete constructor, so get the VTT by name.
466 VTT = CGM.getVTables().GetAddrOfVTT(RD);
467 VTT = Builder.CreateConstInBoundsGEP2_64(VTT, 0, SubVTTIndex);
468 }
469
470 return VTT;
471 }
472
473 namespace {
474 /// Call the destructor for a direct base class.
475 struct CallBaseDtor final : EHScopeStack::Cleanup {
476 const CXXRecordDecl *BaseClass;
477 bool BaseIsVirtual;
CallBaseDtor__anonba83d5a10111::CallBaseDtor478 CallBaseDtor(const CXXRecordDecl *Base, bool BaseIsVirtual)
479 : BaseClass(Base), BaseIsVirtual(BaseIsVirtual) {}
480
Emit__anonba83d5a10111::CallBaseDtor481 void Emit(CodeGenFunction &CGF, Flags flags) override {
482 const CXXRecordDecl *DerivedClass =
483 cast<CXXMethodDecl>(CGF.CurCodeDecl)->getParent();
484
485 const CXXDestructorDecl *D = BaseClass->getDestructor();
486 Address Addr =
487 CGF.GetAddressOfDirectBaseInCompleteClass(CGF.LoadCXXThisAddress(),
488 DerivedClass, BaseClass,
489 BaseIsVirtual);
490 CGF.EmitCXXDestructorCall(D, Dtor_Base, BaseIsVirtual,
491 /*Delegating=*/false, Addr);
492 }
493 };
494
495 /// A visitor which checks whether an initializer uses 'this' in a
496 /// way which requires the vtable to be properly set.
497 struct DynamicThisUseChecker : ConstEvaluatedExprVisitor<DynamicThisUseChecker> {
498 typedef ConstEvaluatedExprVisitor<DynamicThisUseChecker> super;
499
500 bool UsesThis;
501
DynamicThisUseChecker__anonba83d5a10111::DynamicThisUseChecker502 DynamicThisUseChecker(const ASTContext &C) : super(C), UsesThis(false) {}
503
504 // Black-list all explicit and implicit references to 'this'.
505 //
506 // Do we need to worry about external references to 'this' derived
507 // from arbitrary code? If so, then anything which runs arbitrary
508 // external code might potentially access the vtable.
VisitCXXThisExpr__anonba83d5a10111::DynamicThisUseChecker509 void VisitCXXThisExpr(const CXXThisExpr *E) { UsesThis = true; }
510 };
511 } // end anonymous namespace
512
BaseInitializerUsesThis(ASTContext & C,const Expr * Init)513 static bool BaseInitializerUsesThis(ASTContext &C, const Expr *Init) {
514 DynamicThisUseChecker Checker(C);
515 Checker.Visit(Init);
516 return Checker.UsesThis;
517 }
518
EmitBaseInitializer(CodeGenFunction & CGF,const CXXRecordDecl * ClassDecl,CXXCtorInitializer * BaseInit,CXXCtorType CtorType)519 static void EmitBaseInitializer(CodeGenFunction &CGF,
520 const CXXRecordDecl *ClassDecl,
521 CXXCtorInitializer *BaseInit,
522 CXXCtorType CtorType) {
523 assert(BaseInit->isBaseInitializer() &&
524 "Must have base initializer!");
525
526 Address ThisPtr = CGF.LoadCXXThisAddress();
527
528 const Type *BaseType = BaseInit->getBaseClass();
529 CXXRecordDecl *BaseClassDecl =
530 cast<CXXRecordDecl>(BaseType->getAs<RecordType>()->getDecl());
531
532 bool isBaseVirtual = BaseInit->isBaseVirtual();
533
534 // The base constructor doesn't construct virtual bases.
535 if (CtorType == Ctor_Base && isBaseVirtual)
536 return;
537
538 // If the initializer for the base (other than the constructor
539 // itself) accesses 'this' in any way, we need to initialize the
540 // vtables.
541 if (BaseInitializerUsesThis(CGF.getContext(), BaseInit->getInit()))
542 CGF.InitializeVTablePointers(ClassDecl);
543
544 // We can pretend to be a complete class because it only matters for
545 // virtual bases, and we only do virtual bases for complete ctors.
546 Address V =
547 CGF.GetAddressOfDirectBaseInCompleteClass(ThisPtr, ClassDecl,
548 BaseClassDecl,
549 isBaseVirtual);
550 AggValueSlot AggSlot =
551 AggValueSlot::forAddr(V, Qualifiers(),
552 AggValueSlot::IsDestructed,
553 AggValueSlot::DoesNotNeedGCBarriers,
554 AggValueSlot::IsNotAliased);
555
556 CGF.EmitAggExpr(BaseInit->getInit(), AggSlot);
557
558 if (CGF.CGM.getLangOpts().Exceptions &&
559 !BaseClassDecl->hasTrivialDestructor())
560 CGF.EHStack.pushCleanup<CallBaseDtor>(EHCleanup, BaseClassDecl,
561 isBaseVirtual);
562 }
563
EmitAggMemberInitializer(CodeGenFunction & CGF,LValue LHS,Expr * Init,Address ArrayIndexVar,QualType T,ArrayRef<VarDecl * > ArrayIndexes,unsigned Index)564 static void EmitAggMemberInitializer(CodeGenFunction &CGF,
565 LValue LHS,
566 Expr *Init,
567 Address ArrayIndexVar,
568 QualType T,
569 ArrayRef<VarDecl *> ArrayIndexes,
570 unsigned Index) {
571 if (Index == ArrayIndexes.size()) {
572 LValue LV = LHS;
573
574 if (ArrayIndexVar.isValid()) {
575 // If we have an array index variable, load it and use it as an offset.
576 // Then, increment the value.
577 llvm::Value *Dest = LHS.getPointer();
578 llvm::Value *ArrayIndex = CGF.Builder.CreateLoad(ArrayIndexVar);
579 Dest = CGF.Builder.CreateInBoundsGEP(Dest, ArrayIndex, "destaddress");
580 llvm::Value *Next = llvm::ConstantInt::get(ArrayIndex->getType(), 1);
581 Next = CGF.Builder.CreateAdd(ArrayIndex, Next, "inc");
582 CGF.Builder.CreateStore(Next, ArrayIndexVar);
583
584 // Update the LValue.
585 CharUnits EltSize = CGF.getContext().getTypeSizeInChars(T);
586 CharUnits Align = LV.getAlignment().alignmentOfArrayElement(EltSize);
587 LV.setAddress(Address(Dest, Align));
588 }
589
590 switch (CGF.getEvaluationKind(T)) {
591 case TEK_Scalar:
592 CGF.EmitScalarInit(Init, /*decl*/ nullptr, LV, false);
593 break;
594 case TEK_Complex:
595 CGF.EmitComplexExprIntoLValue(Init, LV, /*isInit*/ true);
596 break;
597 case TEK_Aggregate: {
598 AggValueSlot Slot =
599 AggValueSlot::forLValue(LV,
600 AggValueSlot::IsDestructed,
601 AggValueSlot::DoesNotNeedGCBarriers,
602 AggValueSlot::IsNotAliased);
603
604 CGF.EmitAggExpr(Init, Slot);
605 break;
606 }
607 }
608
609 return;
610 }
611
612 const ConstantArrayType *Array = CGF.getContext().getAsConstantArrayType(T);
613 assert(Array && "Array initialization without the array type?");
614 Address IndexVar = CGF.GetAddrOfLocalVar(ArrayIndexes[Index]);
615
616 // Initialize this index variable to zero.
617 llvm::Value* Zero
618 = llvm::Constant::getNullValue(IndexVar.getElementType());
619 CGF.Builder.CreateStore(Zero, IndexVar);
620
621 // Start the loop with a block that tests the condition.
622 llvm::BasicBlock *CondBlock = CGF.createBasicBlock("for.cond");
623 llvm::BasicBlock *AfterFor = CGF.createBasicBlock("for.end");
624
625 CGF.EmitBlock(CondBlock);
626
627 llvm::BasicBlock *ForBody = CGF.createBasicBlock("for.body");
628 // Generate: if (loop-index < number-of-elements) fall to the loop body,
629 // otherwise, go to the block after the for-loop.
630 uint64_t NumElements = Array->getSize().getZExtValue();
631 llvm::Value *Counter = CGF.Builder.CreateLoad(IndexVar);
632 llvm::Value *NumElementsPtr =
633 llvm::ConstantInt::get(Counter->getType(), NumElements);
634 llvm::Value *IsLess = CGF.Builder.CreateICmpULT(Counter, NumElementsPtr,
635 "isless");
636
637 // If the condition is true, execute the body.
638 CGF.Builder.CreateCondBr(IsLess, ForBody, AfterFor);
639
640 CGF.EmitBlock(ForBody);
641 llvm::BasicBlock *ContinueBlock = CGF.createBasicBlock("for.inc");
642
643 // Inside the loop body recurse to emit the inner loop or, eventually, the
644 // constructor call.
645 EmitAggMemberInitializer(CGF, LHS, Init, ArrayIndexVar,
646 Array->getElementType(), ArrayIndexes, Index + 1);
647
648 CGF.EmitBlock(ContinueBlock);
649
650 // Emit the increment of the loop counter.
651 llvm::Value *NextVal = llvm::ConstantInt::get(Counter->getType(), 1);
652 Counter = CGF.Builder.CreateLoad(IndexVar);
653 NextVal = CGF.Builder.CreateAdd(Counter, NextVal, "inc");
654 CGF.Builder.CreateStore(NextVal, IndexVar);
655
656 // Finally, branch back up to the condition for the next iteration.
657 CGF.EmitBranch(CondBlock);
658
659 // Emit the fall-through block.
660 CGF.EmitBlock(AfterFor, true);
661 }
662
isMemcpyEquivalentSpecialMember(const CXXMethodDecl * D)663 static bool isMemcpyEquivalentSpecialMember(const CXXMethodDecl *D) {
664 auto *CD = dyn_cast<CXXConstructorDecl>(D);
665 if (!(CD && CD->isCopyOrMoveConstructor()) &&
666 !D->isCopyAssignmentOperator() && !D->isMoveAssignmentOperator())
667 return false;
668
669 // We can emit a memcpy for a trivial copy or move constructor/assignment.
670 if (D->isTrivial() && !D->getParent()->mayInsertExtraPadding())
671 return true;
672
673 // We *must* emit a memcpy for a defaulted union copy or move op.
674 if (D->getParent()->isUnion() && D->isDefaulted())
675 return true;
676
677 return false;
678 }
679
EmitLValueForAnyFieldInitialization(CodeGenFunction & CGF,CXXCtorInitializer * MemberInit,LValue & LHS)680 static void EmitLValueForAnyFieldInitialization(CodeGenFunction &CGF,
681 CXXCtorInitializer *MemberInit,
682 LValue &LHS) {
683 FieldDecl *Field = MemberInit->getAnyMember();
684 if (MemberInit->isIndirectMemberInitializer()) {
685 // If we are initializing an anonymous union field, drill down to the field.
686 IndirectFieldDecl *IndirectField = MemberInit->getIndirectMember();
687 for (const auto *I : IndirectField->chain())
688 LHS = CGF.EmitLValueForFieldInitialization(LHS, cast<FieldDecl>(I));
689 } else {
690 LHS = CGF.EmitLValueForFieldInitialization(LHS, Field);
691 }
692 }
693
EmitMemberInitializer(CodeGenFunction & CGF,const CXXRecordDecl * ClassDecl,CXXCtorInitializer * MemberInit,const CXXConstructorDecl * Constructor,FunctionArgList & Args)694 static void EmitMemberInitializer(CodeGenFunction &CGF,
695 const CXXRecordDecl *ClassDecl,
696 CXXCtorInitializer *MemberInit,
697 const CXXConstructorDecl *Constructor,
698 FunctionArgList &Args) {
699 ApplyDebugLocation Loc(CGF, MemberInit->getSourceLocation());
700 assert(MemberInit->isAnyMemberInitializer() &&
701 "Must have member initializer!");
702 assert(MemberInit->getInit() && "Must have initializer!");
703
704 // non-static data member initializers.
705 FieldDecl *Field = MemberInit->getAnyMember();
706 QualType FieldType = Field->getType();
707
708 llvm::Value *ThisPtr = CGF.LoadCXXThis();
709 QualType RecordTy = CGF.getContext().getTypeDeclType(ClassDecl);
710 LValue LHS = CGF.MakeNaturalAlignAddrLValue(ThisPtr, RecordTy);
711
712 EmitLValueForAnyFieldInitialization(CGF, MemberInit, LHS);
713
714 // Special case: if we are in a copy or move constructor, and we are copying
715 // an array of PODs or classes with trivial copy constructors, ignore the
716 // AST and perform the copy we know is equivalent.
717 // FIXME: This is hacky at best... if we had a bit more explicit information
718 // in the AST, we could generalize it more easily.
719 const ConstantArrayType *Array
720 = CGF.getContext().getAsConstantArrayType(FieldType);
721 if (Array && Constructor->isDefaulted() &&
722 Constructor->isCopyOrMoveConstructor()) {
723 QualType BaseElementTy = CGF.getContext().getBaseElementType(Array);
724 CXXConstructExpr *CE = dyn_cast<CXXConstructExpr>(MemberInit->getInit());
725 if (BaseElementTy.isPODType(CGF.getContext()) ||
726 (CE && isMemcpyEquivalentSpecialMember(CE->getConstructor()))) {
727 unsigned SrcArgIndex =
728 CGF.CGM.getCXXABI().getSrcArgforCopyCtor(Constructor, Args);
729 llvm::Value *SrcPtr
730 = CGF.Builder.CreateLoad(CGF.GetAddrOfLocalVar(Args[SrcArgIndex]));
731 LValue ThisRHSLV = CGF.MakeNaturalAlignAddrLValue(SrcPtr, RecordTy);
732 LValue Src = CGF.EmitLValueForFieldInitialization(ThisRHSLV, Field);
733
734 // Copy the aggregate.
735 CGF.EmitAggregateCopy(LHS.getAddress(), Src.getAddress(), FieldType,
736 LHS.isVolatileQualified());
737 // Ensure that we destroy the objects if an exception is thrown later in
738 // the constructor.
739 QualType::DestructionKind dtorKind = FieldType.isDestructedType();
740 if (CGF.needsEHCleanup(dtorKind))
741 CGF.pushEHDestroy(dtorKind, LHS.getAddress(), FieldType);
742 return;
743 }
744 }
745
746 ArrayRef<VarDecl *> ArrayIndexes;
747 if (MemberInit->getNumArrayIndices())
748 ArrayIndexes = MemberInit->getArrayIndexes();
749 CGF.EmitInitializerForField(Field, LHS, MemberInit->getInit(), ArrayIndexes);
750 }
751
EmitInitializerForField(FieldDecl * Field,LValue LHS,Expr * Init,ArrayRef<VarDecl * > ArrayIndexes)752 void CodeGenFunction::EmitInitializerForField(FieldDecl *Field, LValue LHS,
753 Expr *Init, ArrayRef<VarDecl *> ArrayIndexes) {
754 QualType FieldType = Field->getType();
755 switch (getEvaluationKind(FieldType)) {
756 case TEK_Scalar:
757 if (LHS.isSimple()) {
758 EmitExprAsInit(Init, Field, LHS, false);
759 } else {
760 RValue RHS = RValue::get(EmitScalarExpr(Init));
761 EmitStoreThroughLValue(RHS, LHS);
762 }
763 break;
764 case TEK_Complex:
765 EmitComplexExprIntoLValue(Init, LHS, /*isInit*/ true);
766 break;
767 case TEK_Aggregate: {
768 Address ArrayIndexVar = Address::invalid();
769 if (ArrayIndexes.size()) {
770 // The LHS is a pointer to the first object we'll be constructing, as
771 // a flat array.
772 QualType BaseElementTy = getContext().getBaseElementType(FieldType);
773 llvm::Type *BasePtr = ConvertType(BaseElementTy);
774 BasePtr = llvm::PointerType::getUnqual(BasePtr);
775 Address BaseAddrPtr = Builder.CreateBitCast(LHS.getAddress(), BasePtr);
776 LHS = MakeAddrLValue(BaseAddrPtr, BaseElementTy);
777
778 // Create an array index that will be used to walk over all of the
779 // objects we're constructing.
780 ArrayIndexVar = CreateMemTemp(getContext().getSizeType(), "object.index");
781 llvm::Value *Zero =
782 llvm::Constant::getNullValue(ArrayIndexVar.getElementType());
783 Builder.CreateStore(Zero, ArrayIndexVar);
784
785 // Emit the block variables for the array indices, if any.
786 for (unsigned I = 0, N = ArrayIndexes.size(); I != N; ++I)
787 EmitAutoVarDecl(*ArrayIndexes[I]);
788 }
789
790 EmitAggMemberInitializer(*this, LHS, Init, ArrayIndexVar, FieldType,
791 ArrayIndexes, 0);
792 }
793 }
794
795 // Ensure that we destroy this object if an exception is thrown
796 // later in the constructor.
797 QualType::DestructionKind dtorKind = FieldType.isDestructedType();
798 if (needsEHCleanup(dtorKind))
799 pushEHDestroy(dtorKind, LHS.getAddress(), FieldType);
800 }
801
802 /// Checks whether the given constructor is a valid subject for the
803 /// complete-to-base constructor delegation optimization, i.e.
804 /// emitting the complete constructor as a simple call to the base
805 /// constructor.
IsConstructorDelegationValid(const CXXConstructorDecl * Ctor)806 static bool IsConstructorDelegationValid(const CXXConstructorDecl *Ctor) {
807
808 // Currently we disable the optimization for classes with virtual
809 // bases because (1) the addresses of parameter variables need to be
810 // consistent across all initializers but (2) the delegate function
811 // call necessarily creates a second copy of the parameter variable.
812 //
813 // The limiting example (purely theoretical AFAIK):
814 // struct A { A(int &c) { c++; } };
815 // struct B : virtual A {
816 // B(int count) : A(count) { printf("%d\n", count); }
817 // };
818 // ...although even this example could in principle be emitted as a
819 // delegation since the address of the parameter doesn't escape.
820 if (Ctor->getParent()->getNumVBases()) {
821 // TODO: white-list trivial vbase initializers. This case wouldn't
822 // be subject to the restrictions below.
823
824 // TODO: white-list cases where:
825 // - there are no non-reference parameters to the constructor
826 // - the initializers don't access any non-reference parameters
827 // - the initializers don't take the address of non-reference
828 // parameters
829 // - etc.
830 // If we ever add any of the above cases, remember that:
831 // - function-try-blocks will always blacklist this optimization
832 // - we need to perform the constructor prologue and cleanup in
833 // EmitConstructorBody.
834
835 return false;
836 }
837
838 // We also disable the optimization for variadic functions because
839 // it's impossible to "re-pass" varargs.
840 if (Ctor->getType()->getAs<FunctionProtoType>()->isVariadic())
841 return false;
842
843 // FIXME: Decide if we can do a delegation of a delegating constructor.
844 if (Ctor->isDelegatingConstructor())
845 return false;
846
847 return true;
848 }
849
850 // Emit code in ctor (Prologue==true) or dtor (Prologue==false)
851 // to poison the extra field paddings inserted under
852 // -fsanitize-address-field-padding=1|2.
EmitAsanPrologueOrEpilogue(bool Prologue)853 void CodeGenFunction::EmitAsanPrologueOrEpilogue(bool Prologue) {
854 ASTContext &Context = getContext();
855 const CXXRecordDecl *ClassDecl =
856 Prologue ? cast<CXXConstructorDecl>(CurGD.getDecl())->getParent()
857 : cast<CXXDestructorDecl>(CurGD.getDecl())->getParent();
858 if (!ClassDecl->mayInsertExtraPadding()) return;
859
860 struct SizeAndOffset {
861 uint64_t Size;
862 uint64_t Offset;
863 };
864
865 unsigned PtrSize = CGM.getDataLayout().getPointerSizeInBits();
866 const ASTRecordLayout &Info = Context.getASTRecordLayout(ClassDecl);
867
868 // Populate sizes and offsets of fields.
869 SmallVector<SizeAndOffset, 16> SSV(Info.getFieldCount());
870 for (unsigned i = 0, e = Info.getFieldCount(); i != e; ++i)
871 SSV[i].Offset =
872 Context.toCharUnitsFromBits(Info.getFieldOffset(i)).getQuantity();
873
874 size_t NumFields = 0;
875 for (const auto *Field : ClassDecl->fields()) {
876 const FieldDecl *D = Field;
877 std::pair<CharUnits, CharUnits> FieldInfo =
878 Context.getTypeInfoInChars(D->getType());
879 CharUnits FieldSize = FieldInfo.first;
880 assert(NumFields < SSV.size());
881 SSV[NumFields].Size = D->isBitField() ? 0 : FieldSize.getQuantity();
882 NumFields++;
883 }
884 assert(NumFields == SSV.size());
885 if (SSV.size() <= 1) return;
886
887 // We will insert calls to __asan_* run-time functions.
888 // LLVM AddressSanitizer pass may decide to inline them later.
889 llvm::Type *Args[2] = {IntPtrTy, IntPtrTy};
890 llvm::FunctionType *FTy =
891 llvm::FunctionType::get(CGM.VoidTy, Args, false);
892 llvm::Constant *F = CGM.CreateRuntimeFunction(
893 FTy, Prologue ? "__asan_poison_intra_object_redzone"
894 : "__asan_unpoison_intra_object_redzone");
895
896 llvm::Value *ThisPtr = LoadCXXThis();
897 ThisPtr = Builder.CreatePtrToInt(ThisPtr, IntPtrTy);
898 uint64_t TypeSize = Info.getNonVirtualSize().getQuantity();
899 // For each field check if it has sufficient padding,
900 // if so (un)poison it with a call.
901 for (size_t i = 0; i < SSV.size(); i++) {
902 uint64_t AsanAlignment = 8;
903 uint64_t NextField = i == SSV.size() - 1 ? TypeSize : SSV[i + 1].Offset;
904 uint64_t PoisonSize = NextField - SSV[i].Offset - SSV[i].Size;
905 uint64_t EndOffset = SSV[i].Offset + SSV[i].Size;
906 if (PoisonSize < AsanAlignment || !SSV[i].Size ||
907 (NextField % AsanAlignment) != 0)
908 continue;
909 Builder.CreateCall(
910 F, {Builder.CreateAdd(ThisPtr, Builder.getIntN(PtrSize, EndOffset)),
911 Builder.getIntN(PtrSize, PoisonSize)});
912 }
913 }
914
915 /// EmitConstructorBody - Emits the body of the current constructor.
EmitConstructorBody(FunctionArgList & Args)916 void CodeGenFunction::EmitConstructorBody(FunctionArgList &Args) {
917 EmitAsanPrologueOrEpilogue(true);
918 const CXXConstructorDecl *Ctor = cast<CXXConstructorDecl>(CurGD.getDecl());
919 CXXCtorType CtorType = CurGD.getCtorType();
920
921 assert((CGM.getTarget().getCXXABI().hasConstructorVariants() ||
922 CtorType == Ctor_Complete) &&
923 "can only generate complete ctor for this ABI");
924
925 // Before we go any further, try the complete->base constructor
926 // delegation optimization.
927 if (CtorType == Ctor_Complete && IsConstructorDelegationValid(Ctor) &&
928 CGM.getTarget().getCXXABI().hasConstructorVariants()) {
929 EmitDelegateCXXConstructorCall(Ctor, Ctor_Base, Args, Ctor->getLocEnd());
930 return;
931 }
932
933 const FunctionDecl *Definition = nullptr;
934 Stmt *Body = Ctor->getBody(Definition);
935 assert(Definition == Ctor && "emitting wrong constructor body");
936
937 // Enter the function-try-block before the constructor prologue if
938 // applicable.
939 bool IsTryBody = (Body && isa<CXXTryStmt>(Body));
940 if (IsTryBody)
941 EnterCXXTryStmt(*cast<CXXTryStmt>(Body), true);
942
943 incrementProfileCounter(Body);
944
945 RunCleanupsScope RunCleanups(*this);
946
947 // TODO: in restricted cases, we can emit the vbase initializers of
948 // a complete ctor and then delegate to the base ctor.
949
950 // Emit the constructor prologue, i.e. the base and member
951 // initializers.
952 EmitCtorPrologue(Ctor, CtorType, Args);
953
954 // Emit the body of the statement.
955 if (IsTryBody)
956 EmitStmt(cast<CXXTryStmt>(Body)->getTryBlock());
957 else if (Body)
958 EmitStmt(Body);
959
960 // Emit any cleanup blocks associated with the member or base
961 // initializers, which includes (along the exceptional path) the
962 // destructors for those members and bases that were fully
963 // constructed.
964 RunCleanups.ForceCleanup();
965
966 if (IsTryBody)
967 ExitCXXTryStmt(*cast<CXXTryStmt>(Body), true);
968 }
969
970 namespace {
971 /// RAII object to indicate that codegen is copying the value representation
972 /// instead of the object representation. Useful when copying a struct or
973 /// class which has uninitialized members and we're only performing
974 /// lvalue-to-rvalue conversion on the object but not its members.
975 class CopyingValueRepresentation {
976 public:
CopyingValueRepresentation(CodeGenFunction & CGF)977 explicit CopyingValueRepresentation(CodeGenFunction &CGF)
978 : CGF(CGF), OldSanOpts(CGF.SanOpts) {
979 CGF.SanOpts.set(SanitizerKind::Bool, false);
980 CGF.SanOpts.set(SanitizerKind::Enum, false);
981 }
~CopyingValueRepresentation()982 ~CopyingValueRepresentation() {
983 CGF.SanOpts = OldSanOpts;
984 }
985 private:
986 CodeGenFunction &CGF;
987 SanitizerSet OldSanOpts;
988 };
989 }
990
991 namespace {
992 class FieldMemcpyizer {
993 public:
FieldMemcpyizer(CodeGenFunction & CGF,const CXXRecordDecl * ClassDecl,const VarDecl * SrcRec)994 FieldMemcpyizer(CodeGenFunction &CGF, const CXXRecordDecl *ClassDecl,
995 const VarDecl *SrcRec)
996 : CGF(CGF), ClassDecl(ClassDecl), SrcRec(SrcRec),
997 RecLayout(CGF.getContext().getASTRecordLayout(ClassDecl)),
998 FirstField(nullptr), LastField(nullptr), FirstFieldOffset(0),
999 LastFieldOffset(0), LastAddedFieldIndex(0) {}
1000
isMemcpyableField(FieldDecl * F) const1001 bool isMemcpyableField(FieldDecl *F) const {
1002 // Never memcpy fields when we are adding poisoned paddings.
1003 if (CGF.getContext().getLangOpts().SanitizeAddressFieldPadding)
1004 return false;
1005 Qualifiers Qual = F->getType().getQualifiers();
1006 if (Qual.hasVolatile() || Qual.hasObjCLifetime())
1007 return false;
1008 return true;
1009 }
1010
addMemcpyableField(FieldDecl * F)1011 void addMemcpyableField(FieldDecl *F) {
1012 if (!FirstField)
1013 addInitialField(F);
1014 else
1015 addNextField(F);
1016 }
1017
getMemcpySize(uint64_t FirstByteOffset) const1018 CharUnits getMemcpySize(uint64_t FirstByteOffset) const {
1019 unsigned LastFieldSize =
1020 LastField->isBitField() ?
1021 LastField->getBitWidthValue(CGF.getContext()) :
1022 CGF.getContext().getTypeSize(LastField->getType());
1023 uint64_t MemcpySizeBits =
1024 LastFieldOffset + LastFieldSize - FirstByteOffset +
1025 CGF.getContext().getCharWidth() - 1;
1026 CharUnits MemcpySize =
1027 CGF.getContext().toCharUnitsFromBits(MemcpySizeBits);
1028 return MemcpySize;
1029 }
1030
emitMemcpy()1031 void emitMemcpy() {
1032 // Give the subclass a chance to bail out if it feels the memcpy isn't
1033 // worth it (e.g. Hasn't aggregated enough data).
1034 if (!FirstField) {
1035 return;
1036 }
1037
1038 uint64_t FirstByteOffset;
1039 if (FirstField->isBitField()) {
1040 const CGRecordLayout &RL =
1041 CGF.getTypes().getCGRecordLayout(FirstField->getParent());
1042 const CGBitFieldInfo &BFInfo = RL.getBitFieldInfo(FirstField);
1043 // FirstFieldOffset is not appropriate for bitfields,
1044 // we need to use the storage offset instead.
1045 FirstByteOffset = CGF.getContext().toBits(BFInfo.StorageOffset);
1046 } else {
1047 FirstByteOffset = FirstFieldOffset;
1048 }
1049
1050 CharUnits MemcpySize = getMemcpySize(FirstByteOffset);
1051 QualType RecordTy = CGF.getContext().getTypeDeclType(ClassDecl);
1052 Address ThisPtr = CGF.LoadCXXThisAddress();
1053 LValue DestLV = CGF.MakeAddrLValue(ThisPtr, RecordTy);
1054 LValue Dest = CGF.EmitLValueForFieldInitialization(DestLV, FirstField);
1055 llvm::Value *SrcPtr = CGF.Builder.CreateLoad(CGF.GetAddrOfLocalVar(SrcRec));
1056 LValue SrcLV = CGF.MakeNaturalAlignAddrLValue(SrcPtr, RecordTy);
1057 LValue Src = CGF.EmitLValueForFieldInitialization(SrcLV, FirstField);
1058
1059 emitMemcpyIR(Dest.isBitField() ? Dest.getBitFieldAddress() : Dest.getAddress(),
1060 Src.isBitField() ? Src.getBitFieldAddress() : Src.getAddress(),
1061 MemcpySize);
1062 reset();
1063 }
1064
reset()1065 void reset() {
1066 FirstField = nullptr;
1067 }
1068
1069 protected:
1070 CodeGenFunction &CGF;
1071 const CXXRecordDecl *ClassDecl;
1072
1073 private:
1074
emitMemcpyIR(Address DestPtr,Address SrcPtr,CharUnits Size)1075 void emitMemcpyIR(Address DestPtr, Address SrcPtr, CharUnits Size) {
1076 llvm::PointerType *DPT = DestPtr.getType();
1077 llvm::Type *DBP =
1078 llvm::Type::getInt8PtrTy(CGF.getLLVMContext(), DPT->getAddressSpace());
1079 DestPtr = CGF.Builder.CreateBitCast(DestPtr, DBP);
1080
1081 llvm::PointerType *SPT = SrcPtr.getType();
1082 llvm::Type *SBP =
1083 llvm::Type::getInt8PtrTy(CGF.getLLVMContext(), SPT->getAddressSpace());
1084 SrcPtr = CGF.Builder.CreateBitCast(SrcPtr, SBP);
1085
1086 CGF.Builder.CreateMemCpy(DestPtr, SrcPtr, Size.getQuantity());
1087 }
1088
addInitialField(FieldDecl * F)1089 void addInitialField(FieldDecl *F) {
1090 FirstField = F;
1091 LastField = F;
1092 FirstFieldOffset = RecLayout.getFieldOffset(F->getFieldIndex());
1093 LastFieldOffset = FirstFieldOffset;
1094 LastAddedFieldIndex = F->getFieldIndex();
1095 return;
1096 }
1097
addNextField(FieldDecl * F)1098 void addNextField(FieldDecl *F) {
1099 // For the most part, the following invariant will hold:
1100 // F->getFieldIndex() == LastAddedFieldIndex + 1
1101 // The one exception is that Sema won't add a copy-initializer for an
1102 // unnamed bitfield, which will show up here as a gap in the sequence.
1103 assert(F->getFieldIndex() >= LastAddedFieldIndex + 1 &&
1104 "Cannot aggregate fields out of order.");
1105 LastAddedFieldIndex = F->getFieldIndex();
1106
1107 // The 'first' and 'last' fields are chosen by offset, rather than field
1108 // index. This allows the code to support bitfields, as well as regular
1109 // fields.
1110 uint64_t FOffset = RecLayout.getFieldOffset(F->getFieldIndex());
1111 if (FOffset < FirstFieldOffset) {
1112 FirstField = F;
1113 FirstFieldOffset = FOffset;
1114 } else if (FOffset > LastFieldOffset) {
1115 LastField = F;
1116 LastFieldOffset = FOffset;
1117 }
1118 }
1119
1120 const VarDecl *SrcRec;
1121 const ASTRecordLayout &RecLayout;
1122 FieldDecl *FirstField;
1123 FieldDecl *LastField;
1124 uint64_t FirstFieldOffset, LastFieldOffset;
1125 unsigned LastAddedFieldIndex;
1126 };
1127
1128 class ConstructorMemcpyizer : public FieldMemcpyizer {
1129 private:
1130
1131 /// Get source argument for copy constructor. Returns null if not a copy
1132 /// constructor.
getTrivialCopySource(CodeGenFunction & CGF,const CXXConstructorDecl * CD,FunctionArgList & Args)1133 static const VarDecl *getTrivialCopySource(CodeGenFunction &CGF,
1134 const CXXConstructorDecl *CD,
1135 FunctionArgList &Args) {
1136 if (CD->isCopyOrMoveConstructor() && CD->isDefaulted())
1137 return Args[CGF.CGM.getCXXABI().getSrcArgforCopyCtor(CD, Args)];
1138 return nullptr;
1139 }
1140
1141 // Returns true if a CXXCtorInitializer represents a member initialization
1142 // that can be rolled into a memcpy.
isMemberInitMemcpyable(CXXCtorInitializer * MemberInit) const1143 bool isMemberInitMemcpyable(CXXCtorInitializer *MemberInit) const {
1144 if (!MemcpyableCtor)
1145 return false;
1146 FieldDecl *Field = MemberInit->getMember();
1147 assert(Field && "No field for member init.");
1148 QualType FieldType = Field->getType();
1149 CXXConstructExpr *CE = dyn_cast<CXXConstructExpr>(MemberInit->getInit());
1150
1151 // Bail out on non-memcpyable, not-trivially-copyable members.
1152 if (!(CE && isMemcpyEquivalentSpecialMember(CE->getConstructor())) &&
1153 !(FieldType.isTriviallyCopyableType(CGF.getContext()) ||
1154 FieldType->isReferenceType()))
1155 return false;
1156
1157 // Bail out on volatile fields.
1158 if (!isMemcpyableField(Field))
1159 return false;
1160
1161 // Otherwise we're good.
1162 return true;
1163 }
1164
1165 public:
ConstructorMemcpyizer(CodeGenFunction & CGF,const CXXConstructorDecl * CD,FunctionArgList & Args)1166 ConstructorMemcpyizer(CodeGenFunction &CGF, const CXXConstructorDecl *CD,
1167 FunctionArgList &Args)
1168 : FieldMemcpyizer(CGF, CD->getParent(), getTrivialCopySource(CGF, CD, Args)),
1169 ConstructorDecl(CD),
1170 MemcpyableCtor(CD->isDefaulted() &&
1171 CD->isCopyOrMoveConstructor() &&
1172 CGF.getLangOpts().getGC() == LangOptions::NonGC),
1173 Args(Args) { }
1174
addMemberInitializer(CXXCtorInitializer * MemberInit)1175 void addMemberInitializer(CXXCtorInitializer *MemberInit) {
1176 if (isMemberInitMemcpyable(MemberInit)) {
1177 AggregatedInits.push_back(MemberInit);
1178 addMemcpyableField(MemberInit->getMember());
1179 } else {
1180 emitAggregatedInits();
1181 EmitMemberInitializer(CGF, ConstructorDecl->getParent(), MemberInit,
1182 ConstructorDecl, Args);
1183 }
1184 }
1185
emitAggregatedInits()1186 void emitAggregatedInits() {
1187 if (AggregatedInits.size() <= 1) {
1188 // This memcpy is too small to be worthwhile. Fall back on default
1189 // codegen.
1190 if (!AggregatedInits.empty()) {
1191 CopyingValueRepresentation CVR(CGF);
1192 EmitMemberInitializer(CGF, ConstructorDecl->getParent(),
1193 AggregatedInits[0], ConstructorDecl, Args);
1194 AggregatedInits.clear();
1195 }
1196 reset();
1197 return;
1198 }
1199
1200 pushEHDestructors();
1201 emitMemcpy();
1202 AggregatedInits.clear();
1203 }
1204
pushEHDestructors()1205 void pushEHDestructors() {
1206 Address ThisPtr = CGF.LoadCXXThisAddress();
1207 QualType RecordTy = CGF.getContext().getTypeDeclType(ClassDecl);
1208 LValue LHS = CGF.MakeAddrLValue(ThisPtr, RecordTy);
1209
1210 for (unsigned i = 0; i < AggregatedInits.size(); ++i) {
1211 CXXCtorInitializer *MemberInit = AggregatedInits[i];
1212 QualType FieldType = MemberInit->getAnyMember()->getType();
1213 QualType::DestructionKind dtorKind = FieldType.isDestructedType();
1214 if (!CGF.needsEHCleanup(dtorKind))
1215 continue;
1216 LValue FieldLHS = LHS;
1217 EmitLValueForAnyFieldInitialization(CGF, MemberInit, FieldLHS);
1218 CGF.pushEHDestroy(dtorKind, FieldLHS.getAddress(), FieldType);
1219 }
1220 }
1221
finish()1222 void finish() {
1223 emitAggregatedInits();
1224 }
1225
1226 private:
1227 const CXXConstructorDecl *ConstructorDecl;
1228 bool MemcpyableCtor;
1229 FunctionArgList &Args;
1230 SmallVector<CXXCtorInitializer*, 16> AggregatedInits;
1231 };
1232
1233 class AssignmentMemcpyizer : public FieldMemcpyizer {
1234 private:
1235
1236 // Returns the memcpyable field copied by the given statement, if one
1237 // exists. Otherwise returns null.
getMemcpyableField(Stmt * S)1238 FieldDecl *getMemcpyableField(Stmt *S) {
1239 if (!AssignmentsMemcpyable)
1240 return nullptr;
1241 if (BinaryOperator *BO = dyn_cast<BinaryOperator>(S)) {
1242 // Recognise trivial assignments.
1243 if (BO->getOpcode() != BO_Assign)
1244 return nullptr;
1245 MemberExpr *ME = dyn_cast<MemberExpr>(BO->getLHS());
1246 if (!ME)
1247 return nullptr;
1248 FieldDecl *Field = dyn_cast<FieldDecl>(ME->getMemberDecl());
1249 if (!Field || !isMemcpyableField(Field))
1250 return nullptr;
1251 Stmt *RHS = BO->getRHS();
1252 if (ImplicitCastExpr *EC = dyn_cast<ImplicitCastExpr>(RHS))
1253 RHS = EC->getSubExpr();
1254 if (!RHS)
1255 return nullptr;
1256 MemberExpr *ME2 = dyn_cast<MemberExpr>(RHS);
1257 if (dyn_cast<FieldDecl>(ME2->getMemberDecl()) != Field)
1258 return nullptr;
1259 return Field;
1260 } else if (CXXMemberCallExpr *MCE = dyn_cast<CXXMemberCallExpr>(S)) {
1261 CXXMethodDecl *MD = dyn_cast<CXXMethodDecl>(MCE->getCalleeDecl());
1262 if (!(MD && isMemcpyEquivalentSpecialMember(MD)))
1263 return nullptr;
1264 MemberExpr *IOA = dyn_cast<MemberExpr>(MCE->getImplicitObjectArgument());
1265 if (!IOA)
1266 return nullptr;
1267 FieldDecl *Field = dyn_cast<FieldDecl>(IOA->getMemberDecl());
1268 if (!Field || !isMemcpyableField(Field))
1269 return nullptr;
1270 MemberExpr *Arg0 = dyn_cast<MemberExpr>(MCE->getArg(0));
1271 if (!Arg0 || Field != dyn_cast<FieldDecl>(Arg0->getMemberDecl()))
1272 return nullptr;
1273 return Field;
1274 } else if (CallExpr *CE = dyn_cast<CallExpr>(S)) {
1275 FunctionDecl *FD = dyn_cast<FunctionDecl>(CE->getCalleeDecl());
1276 if (!FD || FD->getBuiltinID() != Builtin::BI__builtin_memcpy)
1277 return nullptr;
1278 Expr *DstPtr = CE->getArg(0);
1279 if (ImplicitCastExpr *DC = dyn_cast<ImplicitCastExpr>(DstPtr))
1280 DstPtr = DC->getSubExpr();
1281 UnaryOperator *DUO = dyn_cast<UnaryOperator>(DstPtr);
1282 if (!DUO || DUO->getOpcode() != UO_AddrOf)
1283 return nullptr;
1284 MemberExpr *ME = dyn_cast<MemberExpr>(DUO->getSubExpr());
1285 if (!ME)
1286 return nullptr;
1287 FieldDecl *Field = dyn_cast<FieldDecl>(ME->getMemberDecl());
1288 if (!Field || !isMemcpyableField(Field))
1289 return nullptr;
1290 Expr *SrcPtr = CE->getArg(1);
1291 if (ImplicitCastExpr *SC = dyn_cast<ImplicitCastExpr>(SrcPtr))
1292 SrcPtr = SC->getSubExpr();
1293 UnaryOperator *SUO = dyn_cast<UnaryOperator>(SrcPtr);
1294 if (!SUO || SUO->getOpcode() != UO_AddrOf)
1295 return nullptr;
1296 MemberExpr *ME2 = dyn_cast<MemberExpr>(SUO->getSubExpr());
1297 if (!ME2 || Field != dyn_cast<FieldDecl>(ME2->getMemberDecl()))
1298 return nullptr;
1299 return Field;
1300 }
1301
1302 return nullptr;
1303 }
1304
1305 bool AssignmentsMemcpyable;
1306 SmallVector<Stmt*, 16> AggregatedStmts;
1307
1308 public:
1309
AssignmentMemcpyizer(CodeGenFunction & CGF,const CXXMethodDecl * AD,FunctionArgList & Args)1310 AssignmentMemcpyizer(CodeGenFunction &CGF, const CXXMethodDecl *AD,
1311 FunctionArgList &Args)
1312 : FieldMemcpyizer(CGF, AD->getParent(), Args[Args.size() - 1]),
1313 AssignmentsMemcpyable(CGF.getLangOpts().getGC() == LangOptions::NonGC) {
1314 assert(Args.size() == 2);
1315 }
1316
emitAssignment(Stmt * S)1317 void emitAssignment(Stmt *S) {
1318 FieldDecl *F = getMemcpyableField(S);
1319 if (F) {
1320 addMemcpyableField(F);
1321 AggregatedStmts.push_back(S);
1322 } else {
1323 emitAggregatedStmts();
1324 CGF.EmitStmt(S);
1325 }
1326 }
1327
emitAggregatedStmts()1328 void emitAggregatedStmts() {
1329 if (AggregatedStmts.size() <= 1) {
1330 if (!AggregatedStmts.empty()) {
1331 CopyingValueRepresentation CVR(CGF);
1332 CGF.EmitStmt(AggregatedStmts[0]);
1333 }
1334 reset();
1335 }
1336
1337 emitMemcpy();
1338 AggregatedStmts.clear();
1339 }
1340
finish()1341 void finish() {
1342 emitAggregatedStmts();
1343 }
1344 };
1345 } // end anonymous namespace
1346
isInitializerOfDynamicClass(const CXXCtorInitializer * BaseInit)1347 static bool isInitializerOfDynamicClass(const CXXCtorInitializer *BaseInit) {
1348 const Type *BaseType = BaseInit->getBaseClass();
1349 const auto *BaseClassDecl =
1350 cast<CXXRecordDecl>(BaseType->getAs<RecordType>()->getDecl());
1351 return BaseClassDecl->isDynamicClass();
1352 }
1353
1354 /// EmitCtorPrologue - This routine generates necessary code to initialize
1355 /// base classes and non-static data members belonging to this constructor.
EmitCtorPrologue(const CXXConstructorDecl * CD,CXXCtorType CtorType,FunctionArgList & Args)1356 void CodeGenFunction::EmitCtorPrologue(const CXXConstructorDecl *CD,
1357 CXXCtorType CtorType,
1358 FunctionArgList &Args) {
1359 if (CD->isDelegatingConstructor())
1360 return EmitDelegatingCXXConstructorCall(CD, Args);
1361
1362 const CXXRecordDecl *ClassDecl = CD->getParent();
1363
1364 CXXConstructorDecl::init_const_iterator B = CD->init_begin(),
1365 E = CD->init_end();
1366
1367 llvm::BasicBlock *BaseCtorContinueBB = nullptr;
1368 if (ClassDecl->getNumVBases() &&
1369 !CGM.getTarget().getCXXABI().hasConstructorVariants()) {
1370 // The ABIs that don't have constructor variants need to put a branch
1371 // before the virtual base initialization code.
1372 BaseCtorContinueBB =
1373 CGM.getCXXABI().EmitCtorCompleteObjectHandler(*this, ClassDecl);
1374 assert(BaseCtorContinueBB);
1375 }
1376
1377 llvm::Value *const OldThis = CXXThisValue;
1378 // Virtual base initializers first.
1379 for (; B != E && (*B)->isBaseInitializer() && (*B)->isBaseVirtual(); B++) {
1380 if (CGM.getCodeGenOpts().StrictVTablePointers &&
1381 CGM.getCodeGenOpts().OptimizationLevel > 0 &&
1382 isInitializerOfDynamicClass(*B))
1383 CXXThisValue = Builder.CreateInvariantGroupBarrier(LoadCXXThis());
1384 EmitBaseInitializer(*this, ClassDecl, *B, CtorType);
1385 }
1386
1387 if (BaseCtorContinueBB) {
1388 // Complete object handler should continue to the remaining initializers.
1389 Builder.CreateBr(BaseCtorContinueBB);
1390 EmitBlock(BaseCtorContinueBB);
1391 }
1392
1393 // Then, non-virtual base initializers.
1394 for (; B != E && (*B)->isBaseInitializer(); B++) {
1395 assert(!(*B)->isBaseVirtual());
1396
1397 if (CGM.getCodeGenOpts().StrictVTablePointers &&
1398 CGM.getCodeGenOpts().OptimizationLevel > 0 &&
1399 isInitializerOfDynamicClass(*B))
1400 CXXThisValue = Builder.CreateInvariantGroupBarrier(LoadCXXThis());
1401 EmitBaseInitializer(*this, ClassDecl, *B, CtorType);
1402 }
1403
1404 CXXThisValue = OldThis;
1405
1406 InitializeVTablePointers(ClassDecl);
1407
1408 // And finally, initialize class members.
1409 FieldConstructionScope FCS(*this, LoadCXXThisAddress());
1410 ConstructorMemcpyizer CM(*this, CD, Args);
1411 for (; B != E; B++) {
1412 CXXCtorInitializer *Member = (*B);
1413 assert(!Member->isBaseInitializer());
1414 assert(Member->isAnyMemberInitializer() &&
1415 "Delegating initializer on non-delegating constructor");
1416 CM.addMemberInitializer(Member);
1417 }
1418 CM.finish();
1419 }
1420
1421 static bool
1422 FieldHasTrivialDestructorBody(ASTContext &Context, const FieldDecl *Field);
1423
1424 static bool
HasTrivialDestructorBody(ASTContext & Context,const CXXRecordDecl * BaseClassDecl,const CXXRecordDecl * MostDerivedClassDecl)1425 HasTrivialDestructorBody(ASTContext &Context,
1426 const CXXRecordDecl *BaseClassDecl,
1427 const CXXRecordDecl *MostDerivedClassDecl)
1428 {
1429 // If the destructor is trivial we don't have to check anything else.
1430 if (BaseClassDecl->hasTrivialDestructor())
1431 return true;
1432
1433 if (!BaseClassDecl->getDestructor()->hasTrivialBody())
1434 return false;
1435
1436 // Check fields.
1437 for (const auto *Field : BaseClassDecl->fields())
1438 if (!FieldHasTrivialDestructorBody(Context, Field))
1439 return false;
1440
1441 // Check non-virtual bases.
1442 for (const auto &I : BaseClassDecl->bases()) {
1443 if (I.isVirtual())
1444 continue;
1445
1446 const CXXRecordDecl *NonVirtualBase =
1447 cast<CXXRecordDecl>(I.getType()->castAs<RecordType>()->getDecl());
1448 if (!HasTrivialDestructorBody(Context, NonVirtualBase,
1449 MostDerivedClassDecl))
1450 return false;
1451 }
1452
1453 if (BaseClassDecl == MostDerivedClassDecl) {
1454 // Check virtual bases.
1455 for (const auto &I : BaseClassDecl->vbases()) {
1456 const CXXRecordDecl *VirtualBase =
1457 cast<CXXRecordDecl>(I.getType()->castAs<RecordType>()->getDecl());
1458 if (!HasTrivialDestructorBody(Context, VirtualBase,
1459 MostDerivedClassDecl))
1460 return false;
1461 }
1462 }
1463
1464 return true;
1465 }
1466
1467 static bool
FieldHasTrivialDestructorBody(ASTContext & Context,const FieldDecl * Field)1468 FieldHasTrivialDestructorBody(ASTContext &Context,
1469 const FieldDecl *Field)
1470 {
1471 QualType FieldBaseElementType = Context.getBaseElementType(Field->getType());
1472
1473 const RecordType *RT = FieldBaseElementType->getAs<RecordType>();
1474 if (!RT)
1475 return true;
1476
1477 CXXRecordDecl *FieldClassDecl = cast<CXXRecordDecl>(RT->getDecl());
1478
1479 // The destructor for an implicit anonymous union member is never invoked.
1480 if (FieldClassDecl->isUnion() && FieldClassDecl->isAnonymousStructOrUnion())
1481 return false;
1482
1483 return HasTrivialDestructorBody(Context, FieldClassDecl, FieldClassDecl);
1484 }
1485
1486 /// CanSkipVTablePointerInitialization - Check whether we need to initialize
1487 /// any vtable pointers before calling this destructor.
CanSkipVTablePointerInitialization(CodeGenFunction & CGF,const CXXDestructorDecl * Dtor)1488 static bool CanSkipVTablePointerInitialization(CodeGenFunction &CGF,
1489 const CXXDestructorDecl *Dtor) {
1490 const CXXRecordDecl *ClassDecl = Dtor->getParent();
1491 if (!ClassDecl->isDynamicClass())
1492 return true;
1493
1494 if (!Dtor->hasTrivialBody())
1495 return false;
1496
1497 // Check the fields.
1498 for (const auto *Field : ClassDecl->fields())
1499 if (!FieldHasTrivialDestructorBody(CGF.getContext(), Field))
1500 return false;
1501
1502 return true;
1503 }
1504
1505 /// EmitDestructorBody - Emits the body of the current destructor.
EmitDestructorBody(FunctionArgList & Args)1506 void CodeGenFunction::EmitDestructorBody(FunctionArgList &Args) {
1507 const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CurGD.getDecl());
1508 CXXDtorType DtorType = CurGD.getDtorType();
1509
1510 Stmt *Body = Dtor->getBody();
1511 if (Body)
1512 incrementProfileCounter(Body);
1513
1514 // The call to operator delete in a deleting destructor happens
1515 // outside of the function-try-block, which means it's always
1516 // possible to delegate the destructor body to the complete
1517 // destructor. Do so.
1518 if (DtorType == Dtor_Deleting) {
1519 EnterDtorCleanups(Dtor, Dtor_Deleting);
1520 EmitCXXDestructorCall(Dtor, Dtor_Complete, /*ForVirtualBase=*/false,
1521 /*Delegating=*/false, LoadCXXThisAddress());
1522 PopCleanupBlock();
1523 return;
1524 }
1525
1526 // If the body is a function-try-block, enter the try before
1527 // anything else.
1528 bool isTryBody = (Body && isa<CXXTryStmt>(Body));
1529 if (isTryBody)
1530 EnterCXXTryStmt(*cast<CXXTryStmt>(Body), true);
1531 EmitAsanPrologueOrEpilogue(false);
1532
1533 // Enter the epilogue cleanups.
1534 RunCleanupsScope DtorEpilogue(*this);
1535
1536 // If this is the complete variant, just invoke the base variant;
1537 // the epilogue will destruct the virtual bases. But we can't do
1538 // this optimization if the body is a function-try-block, because
1539 // we'd introduce *two* handler blocks. In the Microsoft ABI, we
1540 // always delegate because we might not have a definition in this TU.
1541 switch (DtorType) {
1542 case Dtor_Comdat:
1543 llvm_unreachable("not expecting a COMDAT");
1544
1545 case Dtor_Deleting: llvm_unreachable("already handled deleting case");
1546
1547 case Dtor_Complete:
1548 assert((Body || getTarget().getCXXABI().isMicrosoft()) &&
1549 "can't emit a dtor without a body for non-Microsoft ABIs");
1550
1551 // Enter the cleanup scopes for virtual bases.
1552 EnterDtorCleanups(Dtor, Dtor_Complete);
1553
1554 if (!isTryBody) {
1555 EmitCXXDestructorCall(Dtor, Dtor_Base, /*ForVirtualBase=*/false,
1556 /*Delegating=*/false, LoadCXXThisAddress());
1557 break;
1558 }
1559 // Fallthrough: act like we're in the base variant.
1560
1561 case Dtor_Base:
1562 assert(Body);
1563
1564 // Enter the cleanup scopes for fields and non-virtual bases.
1565 EnterDtorCleanups(Dtor, Dtor_Base);
1566
1567 // Initialize the vtable pointers before entering the body.
1568 if (!CanSkipVTablePointerInitialization(*this, Dtor)) {
1569 // Insert the llvm.invariant.group.barrier intrinsic before initializing
1570 // the vptrs to cancel any previous assumptions we might have made.
1571 if (CGM.getCodeGenOpts().StrictVTablePointers &&
1572 CGM.getCodeGenOpts().OptimizationLevel > 0)
1573 CXXThisValue = Builder.CreateInvariantGroupBarrier(LoadCXXThis());
1574 InitializeVTablePointers(Dtor->getParent());
1575 }
1576
1577 if (isTryBody)
1578 EmitStmt(cast<CXXTryStmt>(Body)->getTryBlock());
1579 else if (Body)
1580 EmitStmt(Body);
1581 else {
1582 assert(Dtor->isImplicit() && "bodyless dtor not implicit");
1583 // nothing to do besides what's in the epilogue
1584 }
1585 // -fapple-kext must inline any call to this dtor into
1586 // the caller's body.
1587 if (getLangOpts().AppleKext)
1588 CurFn->addFnAttr(llvm::Attribute::AlwaysInline);
1589
1590 break;
1591 }
1592
1593 // Jump out through the epilogue cleanups.
1594 DtorEpilogue.ForceCleanup();
1595
1596 // Exit the try if applicable.
1597 if (isTryBody)
1598 ExitCXXTryStmt(*cast<CXXTryStmt>(Body), true);
1599 }
1600
emitImplicitAssignmentOperatorBody(FunctionArgList & Args)1601 void CodeGenFunction::emitImplicitAssignmentOperatorBody(FunctionArgList &Args) {
1602 const CXXMethodDecl *AssignOp = cast<CXXMethodDecl>(CurGD.getDecl());
1603 const Stmt *RootS = AssignOp->getBody();
1604 assert(isa<CompoundStmt>(RootS) &&
1605 "Body of an implicit assignment operator should be compound stmt.");
1606 const CompoundStmt *RootCS = cast<CompoundStmt>(RootS);
1607
1608 LexicalScope Scope(*this, RootCS->getSourceRange());
1609
1610 AssignmentMemcpyizer AM(*this, AssignOp, Args);
1611 for (auto *I : RootCS->body())
1612 AM.emitAssignment(I);
1613 AM.finish();
1614 }
1615
1616 namespace {
1617 /// Call the operator delete associated with the current destructor.
1618 struct CallDtorDelete final : EHScopeStack::Cleanup {
CallDtorDelete__anonba83d5a10411::CallDtorDelete1619 CallDtorDelete() {}
1620
Emit__anonba83d5a10411::CallDtorDelete1621 void Emit(CodeGenFunction &CGF, Flags flags) override {
1622 const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CGF.CurCodeDecl);
1623 const CXXRecordDecl *ClassDecl = Dtor->getParent();
1624 CGF.EmitDeleteCall(Dtor->getOperatorDelete(), CGF.LoadCXXThis(),
1625 CGF.getContext().getTagDeclType(ClassDecl));
1626 }
1627 };
1628
1629 struct CallDtorDeleteConditional final : EHScopeStack::Cleanup {
1630 llvm::Value *ShouldDeleteCondition;
1631 public:
CallDtorDeleteConditional__anonba83d5a10411::CallDtorDeleteConditional1632 CallDtorDeleteConditional(llvm::Value *ShouldDeleteCondition)
1633 : ShouldDeleteCondition(ShouldDeleteCondition) {
1634 assert(ShouldDeleteCondition != nullptr);
1635 }
1636
Emit__anonba83d5a10411::CallDtorDeleteConditional1637 void Emit(CodeGenFunction &CGF, Flags flags) override {
1638 llvm::BasicBlock *callDeleteBB = CGF.createBasicBlock("dtor.call_delete");
1639 llvm::BasicBlock *continueBB = CGF.createBasicBlock("dtor.continue");
1640 llvm::Value *ShouldCallDelete
1641 = CGF.Builder.CreateIsNull(ShouldDeleteCondition);
1642 CGF.Builder.CreateCondBr(ShouldCallDelete, continueBB, callDeleteBB);
1643
1644 CGF.EmitBlock(callDeleteBB);
1645 const CXXDestructorDecl *Dtor = cast<CXXDestructorDecl>(CGF.CurCodeDecl);
1646 const CXXRecordDecl *ClassDecl = Dtor->getParent();
1647 CGF.EmitDeleteCall(Dtor->getOperatorDelete(), CGF.LoadCXXThis(),
1648 CGF.getContext().getTagDeclType(ClassDecl));
1649 CGF.Builder.CreateBr(continueBB);
1650
1651 CGF.EmitBlock(continueBB);
1652 }
1653 };
1654
1655 class DestroyField final : public EHScopeStack::Cleanup {
1656 const FieldDecl *field;
1657 CodeGenFunction::Destroyer *destroyer;
1658 bool useEHCleanupForArray;
1659
1660 public:
DestroyField(const FieldDecl * field,CodeGenFunction::Destroyer * destroyer,bool useEHCleanupForArray)1661 DestroyField(const FieldDecl *field, CodeGenFunction::Destroyer *destroyer,
1662 bool useEHCleanupForArray)
1663 : field(field), destroyer(destroyer),
1664 useEHCleanupForArray(useEHCleanupForArray) {}
1665
Emit(CodeGenFunction & CGF,Flags flags)1666 void Emit(CodeGenFunction &CGF, Flags flags) override {
1667 // Find the address of the field.
1668 Address thisValue = CGF.LoadCXXThisAddress();
1669 QualType RecordTy = CGF.getContext().getTagDeclType(field->getParent());
1670 LValue ThisLV = CGF.MakeAddrLValue(thisValue, RecordTy);
1671 LValue LV = CGF.EmitLValueForField(ThisLV, field);
1672 assert(LV.isSimple());
1673
1674 CGF.emitDestroy(LV.getAddress(), field->getType(), destroyer,
1675 flags.isForNormalCleanup() && useEHCleanupForArray);
1676 }
1677 };
1678
EmitSanitizerDtorCallback(CodeGenFunction & CGF,llvm::Value * Ptr,CharUnits::QuantityType PoisonSize)1679 static void EmitSanitizerDtorCallback(CodeGenFunction &CGF, llvm::Value *Ptr,
1680 CharUnits::QuantityType PoisonSize) {
1681 // Pass in void pointer and size of region as arguments to runtime
1682 // function
1683 llvm::Value *Args[] = {CGF.Builder.CreateBitCast(Ptr, CGF.VoidPtrTy),
1684 llvm::ConstantInt::get(CGF.SizeTy, PoisonSize)};
1685
1686 llvm::Type *ArgTypes[] = {CGF.VoidPtrTy, CGF.SizeTy};
1687
1688 llvm::FunctionType *FnType =
1689 llvm::FunctionType::get(CGF.VoidTy, ArgTypes, false);
1690 llvm::Value *Fn =
1691 CGF.CGM.CreateRuntimeFunction(FnType, "__sanitizer_dtor_callback");
1692 CGF.EmitNounwindRuntimeCall(Fn, Args);
1693 }
1694
1695 class SanitizeDtorMembers final : public EHScopeStack::Cleanup {
1696 const CXXDestructorDecl *Dtor;
1697
1698 public:
SanitizeDtorMembers(const CXXDestructorDecl * Dtor)1699 SanitizeDtorMembers(const CXXDestructorDecl *Dtor) : Dtor(Dtor) {}
1700
1701 // Generate function call for handling object poisoning.
1702 // Disables tail call elimination, to prevent the current stack frame
1703 // from disappearing from the stack trace.
Emit(CodeGenFunction & CGF,Flags flags)1704 void Emit(CodeGenFunction &CGF, Flags flags) override {
1705 const ASTRecordLayout &Layout =
1706 CGF.getContext().getASTRecordLayout(Dtor->getParent());
1707
1708 // Nothing to poison.
1709 if (Layout.getFieldCount() == 0)
1710 return;
1711
1712 // Prevent the current stack frame from disappearing from the stack trace.
1713 CGF.CurFn->addFnAttr("disable-tail-calls", "true");
1714
1715 // Construct pointer to region to begin poisoning, and calculate poison
1716 // size, so that only members declared in this class are poisoned.
1717 ASTContext &Context = CGF.getContext();
1718 unsigned fieldIndex = 0;
1719 int startIndex = -1;
1720 // RecordDecl::field_iterator Field;
1721 for (const FieldDecl *Field : Dtor->getParent()->fields()) {
1722 // Poison field if it is trivial
1723 if (FieldHasTrivialDestructorBody(Context, Field)) {
1724 // Start sanitizing at this field
1725 if (startIndex < 0)
1726 startIndex = fieldIndex;
1727
1728 // Currently on the last field, and it must be poisoned with the
1729 // current block.
1730 if (fieldIndex == Layout.getFieldCount() - 1) {
1731 PoisonMembers(CGF, startIndex, Layout.getFieldCount());
1732 }
1733 } else if (startIndex >= 0) {
1734 // No longer within a block of memory to poison, so poison the block
1735 PoisonMembers(CGF, startIndex, fieldIndex);
1736 // Re-set the start index
1737 startIndex = -1;
1738 }
1739 fieldIndex += 1;
1740 }
1741 }
1742
1743 private:
1744 /// \param layoutStartOffset index of the ASTRecordLayout field to
1745 /// start poisoning (inclusive)
1746 /// \param layoutEndOffset index of the ASTRecordLayout field to
1747 /// end poisoning (exclusive)
PoisonMembers(CodeGenFunction & CGF,unsigned layoutStartOffset,unsigned layoutEndOffset)1748 void PoisonMembers(CodeGenFunction &CGF, unsigned layoutStartOffset,
1749 unsigned layoutEndOffset) {
1750 ASTContext &Context = CGF.getContext();
1751 const ASTRecordLayout &Layout =
1752 Context.getASTRecordLayout(Dtor->getParent());
1753
1754 llvm::ConstantInt *OffsetSizePtr = llvm::ConstantInt::get(
1755 CGF.SizeTy,
1756 Context.toCharUnitsFromBits(Layout.getFieldOffset(layoutStartOffset))
1757 .getQuantity());
1758
1759 llvm::Value *OffsetPtr = CGF.Builder.CreateGEP(
1760 CGF.Builder.CreateBitCast(CGF.LoadCXXThis(), CGF.Int8PtrTy),
1761 OffsetSizePtr);
1762
1763 CharUnits::QuantityType PoisonSize;
1764 if (layoutEndOffset >= Layout.getFieldCount()) {
1765 PoisonSize = Layout.getNonVirtualSize().getQuantity() -
1766 Context.toCharUnitsFromBits(
1767 Layout.getFieldOffset(layoutStartOffset))
1768 .getQuantity();
1769 } else {
1770 PoisonSize = Context.toCharUnitsFromBits(
1771 Layout.getFieldOffset(layoutEndOffset) -
1772 Layout.getFieldOffset(layoutStartOffset))
1773 .getQuantity();
1774 }
1775
1776 if (PoisonSize == 0)
1777 return;
1778
1779 EmitSanitizerDtorCallback(CGF, OffsetPtr, PoisonSize);
1780 }
1781 };
1782
1783 class SanitizeDtorVTable final : public EHScopeStack::Cleanup {
1784 const CXXDestructorDecl *Dtor;
1785
1786 public:
SanitizeDtorVTable(const CXXDestructorDecl * Dtor)1787 SanitizeDtorVTable(const CXXDestructorDecl *Dtor) : Dtor(Dtor) {}
1788
1789 // Generate function call for handling vtable pointer poisoning.
Emit(CodeGenFunction & CGF,Flags flags)1790 void Emit(CodeGenFunction &CGF, Flags flags) override {
1791 assert(Dtor->getParent()->isDynamicClass());
1792 (void)Dtor;
1793 ASTContext &Context = CGF.getContext();
1794 // Poison vtable and vtable ptr if they exist for this class.
1795 llvm::Value *VTablePtr = CGF.LoadCXXThis();
1796
1797 CharUnits::QuantityType PoisonSize =
1798 Context.toCharUnitsFromBits(CGF.PointerWidthInBits).getQuantity();
1799 // Pass in void pointer and size of region as arguments to runtime
1800 // function
1801 EmitSanitizerDtorCallback(CGF, VTablePtr, PoisonSize);
1802 }
1803 };
1804 } // end anonymous namespace
1805
1806 /// \brief Emit all code that comes at the end of class's
1807 /// destructor. This is to call destructors on members and base classes
1808 /// in reverse order of their construction.
EnterDtorCleanups(const CXXDestructorDecl * DD,CXXDtorType DtorType)1809 void CodeGenFunction::EnterDtorCleanups(const CXXDestructorDecl *DD,
1810 CXXDtorType DtorType) {
1811 assert((!DD->isTrivial() || DD->hasAttr<DLLExportAttr>()) &&
1812 "Should not emit dtor epilogue for non-exported trivial dtor!");
1813
1814 // The deleting-destructor phase just needs to call the appropriate
1815 // operator delete that Sema picked up.
1816 if (DtorType == Dtor_Deleting) {
1817 assert(DD->getOperatorDelete() &&
1818 "operator delete missing - EnterDtorCleanups");
1819 if (CXXStructorImplicitParamValue) {
1820 // If there is an implicit param to the deleting dtor, it's a boolean
1821 // telling whether we should call delete at the end of the dtor.
1822 EHStack.pushCleanup<CallDtorDeleteConditional>(
1823 NormalAndEHCleanup, CXXStructorImplicitParamValue);
1824 } else {
1825 EHStack.pushCleanup<CallDtorDelete>(NormalAndEHCleanup);
1826 }
1827 return;
1828 }
1829
1830 const CXXRecordDecl *ClassDecl = DD->getParent();
1831
1832 // Unions have no bases and do not call field destructors.
1833 if (ClassDecl->isUnion())
1834 return;
1835
1836 // The complete-destructor phase just destructs all the virtual bases.
1837 if (DtorType == Dtor_Complete) {
1838 // Poison the vtable pointer such that access after the base
1839 // and member destructors are invoked is invalid.
1840 if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor &&
1841 SanOpts.has(SanitizerKind::Memory) && ClassDecl->getNumVBases() &&
1842 ClassDecl->isPolymorphic())
1843 EHStack.pushCleanup<SanitizeDtorVTable>(NormalAndEHCleanup, DD);
1844
1845 // We push them in the forward order so that they'll be popped in
1846 // the reverse order.
1847 for (const auto &Base : ClassDecl->vbases()) {
1848 CXXRecordDecl *BaseClassDecl
1849 = cast<CXXRecordDecl>(Base.getType()->getAs<RecordType>()->getDecl());
1850
1851 // Ignore trivial destructors.
1852 if (BaseClassDecl->hasTrivialDestructor())
1853 continue;
1854
1855 EHStack.pushCleanup<CallBaseDtor>(NormalAndEHCleanup,
1856 BaseClassDecl,
1857 /*BaseIsVirtual*/ true);
1858 }
1859
1860 return;
1861 }
1862
1863 assert(DtorType == Dtor_Base);
1864 // Poison the vtable pointer if it has no virtual bases, but inherits
1865 // virtual functions.
1866 if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor &&
1867 SanOpts.has(SanitizerKind::Memory) && !ClassDecl->getNumVBases() &&
1868 ClassDecl->isPolymorphic())
1869 EHStack.pushCleanup<SanitizeDtorVTable>(NormalAndEHCleanup, DD);
1870
1871 // Destroy non-virtual bases.
1872 for (const auto &Base : ClassDecl->bases()) {
1873 // Ignore virtual bases.
1874 if (Base.isVirtual())
1875 continue;
1876
1877 CXXRecordDecl *BaseClassDecl = Base.getType()->getAsCXXRecordDecl();
1878
1879 // Ignore trivial destructors.
1880 if (BaseClassDecl->hasTrivialDestructor())
1881 continue;
1882
1883 EHStack.pushCleanup<CallBaseDtor>(NormalAndEHCleanup,
1884 BaseClassDecl,
1885 /*BaseIsVirtual*/ false);
1886 }
1887
1888 // Poison fields such that access after their destructors are
1889 // invoked, and before the base class destructor runs, is invalid.
1890 if (CGM.getCodeGenOpts().SanitizeMemoryUseAfterDtor &&
1891 SanOpts.has(SanitizerKind::Memory))
1892 EHStack.pushCleanup<SanitizeDtorMembers>(NormalAndEHCleanup, DD);
1893
1894 // Destroy direct fields.
1895 for (const auto *Field : ClassDecl->fields()) {
1896 QualType type = Field->getType();
1897 QualType::DestructionKind dtorKind = type.isDestructedType();
1898 if (!dtorKind) continue;
1899
1900 // Anonymous union members do not have their destructors called.
1901 const RecordType *RT = type->getAsUnionType();
1902 if (RT && RT->getDecl()->isAnonymousStructOrUnion()) continue;
1903
1904 CleanupKind cleanupKind = getCleanupKind(dtorKind);
1905 EHStack.pushCleanup<DestroyField>(cleanupKind, Field,
1906 getDestroyer(dtorKind),
1907 cleanupKind & EHCleanup);
1908 }
1909 }
1910
1911 /// EmitCXXAggrConstructorCall - Emit a loop to call a particular
1912 /// constructor for each of several members of an array.
1913 ///
1914 /// \param ctor the constructor to call for each element
1915 /// \param arrayType the type of the array to initialize
1916 /// \param arrayBegin an arrayType*
1917 /// \param zeroInitialize true if each element should be
1918 /// zero-initialized before it is constructed
EmitCXXAggrConstructorCall(const CXXConstructorDecl * ctor,const ConstantArrayType * arrayType,Address arrayBegin,const CXXConstructExpr * E,bool zeroInitialize)1919 void CodeGenFunction::EmitCXXAggrConstructorCall(
1920 const CXXConstructorDecl *ctor, const ConstantArrayType *arrayType,
1921 Address arrayBegin, const CXXConstructExpr *E, bool zeroInitialize) {
1922 QualType elementType;
1923 llvm::Value *numElements =
1924 emitArrayLength(arrayType, elementType, arrayBegin);
1925
1926 EmitCXXAggrConstructorCall(ctor, numElements, arrayBegin, E, zeroInitialize);
1927 }
1928
1929 /// EmitCXXAggrConstructorCall - Emit a loop to call a particular
1930 /// constructor for each of several members of an array.
1931 ///
1932 /// \param ctor the constructor to call for each element
1933 /// \param numElements the number of elements in the array;
1934 /// may be zero
1935 /// \param arrayBase a T*, where T is the type constructed by ctor
1936 /// \param zeroInitialize true if each element should be
1937 /// zero-initialized before it is constructed
EmitCXXAggrConstructorCall(const CXXConstructorDecl * ctor,llvm::Value * numElements,Address arrayBase,const CXXConstructExpr * E,bool zeroInitialize)1938 void CodeGenFunction::EmitCXXAggrConstructorCall(const CXXConstructorDecl *ctor,
1939 llvm::Value *numElements,
1940 Address arrayBase,
1941 const CXXConstructExpr *E,
1942 bool zeroInitialize) {
1943 // It's legal for numElements to be zero. This can happen both
1944 // dynamically, because x can be zero in 'new A[x]', and statically,
1945 // because of GCC extensions that permit zero-length arrays. There
1946 // are probably legitimate places where we could assume that this
1947 // doesn't happen, but it's not clear that it's worth it.
1948 llvm::BranchInst *zeroCheckBranch = nullptr;
1949
1950 // Optimize for a constant count.
1951 llvm::ConstantInt *constantCount
1952 = dyn_cast<llvm::ConstantInt>(numElements);
1953 if (constantCount) {
1954 // Just skip out if the constant count is zero.
1955 if (constantCount->isZero()) return;
1956
1957 // Otherwise, emit the check.
1958 } else {
1959 llvm::BasicBlock *loopBB = createBasicBlock("new.ctorloop");
1960 llvm::Value *iszero = Builder.CreateIsNull(numElements, "isempty");
1961 zeroCheckBranch = Builder.CreateCondBr(iszero, loopBB, loopBB);
1962 EmitBlock(loopBB);
1963 }
1964
1965 // Find the end of the array.
1966 llvm::Value *arrayBegin = arrayBase.getPointer();
1967 llvm::Value *arrayEnd = Builder.CreateInBoundsGEP(arrayBegin, numElements,
1968 "arrayctor.end");
1969
1970 // Enter the loop, setting up a phi for the current location to initialize.
1971 llvm::BasicBlock *entryBB = Builder.GetInsertBlock();
1972 llvm::BasicBlock *loopBB = createBasicBlock("arrayctor.loop");
1973 EmitBlock(loopBB);
1974 llvm::PHINode *cur = Builder.CreatePHI(arrayBegin->getType(), 2,
1975 "arrayctor.cur");
1976 cur->addIncoming(arrayBegin, entryBB);
1977
1978 // Inside the loop body, emit the constructor call on the array element.
1979
1980 // The alignment of the base, adjusted by the size of a single element,
1981 // provides a conservative estimate of the alignment of every element.
1982 // (This assumes we never start tracking offsetted alignments.)
1983 //
1984 // Note that these are complete objects and so we don't need to
1985 // use the non-virtual size or alignment.
1986 QualType type = getContext().getTypeDeclType(ctor->getParent());
1987 CharUnits eltAlignment =
1988 arrayBase.getAlignment()
1989 .alignmentOfArrayElement(getContext().getTypeSizeInChars(type));
1990 Address curAddr = Address(cur, eltAlignment);
1991
1992 // Zero initialize the storage, if requested.
1993 if (zeroInitialize)
1994 EmitNullInitialization(curAddr, type);
1995
1996 // C++ [class.temporary]p4:
1997 // There are two contexts in which temporaries are destroyed at a different
1998 // point than the end of the full-expression. The first context is when a
1999 // default constructor is called to initialize an element of an array.
2000 // If the constructor has one or more default arguments, the destruction of
2001 // every temporary created in a default argument expression is sequenced
2002 // before the construction of the next array element, if any.
2003
2004 {
2005 RunCleanupsScope Scope(*this);
2006
2007 // Evaluate the constructor and its arguments in a regular
2008 // partial-destroy cleanup.
2009 if (getLangOpts().Exceptions &&
2010 !ctor->getParent()->hasTrivialDestructor()) {
2011 Destroyer *destroyer = destroyCXXObject;
2012 pushRegularPartialArrayCleanup(arrayBegin, cur, type, eltAlignment,
2013 *destroyer);
2014 }
2015
2016 EmitCXXConstructorCall(ctor, Ctor_Complete, /*ForVirtualBase=*/false,
2017 /*Delegating=*/false, curAddr, E);
2018 }
2019
2020 // Go to the next element.
2021 llvm::Value *next =
2022 Builder.CreateInBoundsGEP(cur, llvm::ConstantInt::get(SizeTy, 1),
2023 "arrayctor.next");
2024 cur->addIncoming(next, Builder.GetInsertBlock());
2025
2026 // Check whether that's the end of the loop.
2027 llvm::Value *done = Builder.CreateICmpEQ(next, arrayEnd, "arrayctor.done");
2028 llvm::BasicBlock *contBB = createBasicBlock("arrayctor.cont");
2029 Builder.CreateCondBr(done, contBB, loopBB);
2030
2031 // Patch the earlier check to skip over the loop.
2032 if (zeroCheckBranch) zeroCheckBranch->setSuccessor(0, contBB);
2033
2034 EmitBlock(contBB);
2035 }
2036
destroyCXXObject(CodeGenFunction & CGF,Address addr,QualType type)2037 void CodeGenFunction::destroyCXXObject(CodeGenFunction &CGF,
2038 Address addr,
2039 QualType type) {
2040 const RecordType *rtype = type->castAs<RecordType>();
2041 const CXXRecordDecl *record = cast<CXXRecordDecl>(rtype->getDecl());
2042 const CXXDestructorDecl *dtor = record->getDestructor();
2043 assert(!dtor->isTrivial());
2044 CGF.EmitCXXDestructorCall(dtor, Dtor_Complete, /*for vbase*/ false,
2045 /*Delegating=*/false, addr);
2046 }
2047
EmitCXXConstructorCall(const CXXConstructorDecl * D,CXXCtorType Type,bool ForVirtualBase,bool Delegating,Address This,const CXXConstructExpr * E)2048 void CodeGenFunction::EmitCXXConstructorCall(const CXXConstructorDecl *D,
2049 CXXCtorType Type,
2050 bool ForVirtualBase,
2051 bool Delegating, Address This,
2052 const CXXConstructExpr *E) {
2053 const CXXRecordDecl *ClassDecl = D->getParent();
2054
2055 // C++11 [class.mfct.non-static]p2:
2056 // If a non-static member function of a class X is called for an object that
2057 // is not of type X, or of a type derived from X, the behavior is undefined.
2058 // FIXME: Provide a source location here.
2059 EmitTypeCheck(CodeGenFunction::TCK_ConstructorCall, SourceLocation(),
2060 This.getPointer(), getContext().getRecordType(ClassDecl));
2061
2062 if (D->isTrivial() && D->isDefaultConstructor()) {
2063 assert(E->getNumArgs() == 0 && "trivial default ctor with args");
2064 return;
2065 }
2066
2067 // If this is a trivial constructor, just emit what's needed. If this is a
2068 // union copy constructor, we must emit a memcpy, because the AST does not
2069 // model that copy.
2070 if (isMemcpyEquivalentSpecialMember(D)) {
2071 assert(E->getNumArgs() == 1 && "unexpected argcount for trivial ctor");
2072
2073 const Expr *Arg = E->getArg(0);
2074 QualType SrcTy = Arg->getType();
2075 Address Src = EmitLValue(Arg).getAddress();
2076 QualType DestTy = getContext().getTypeDeclType(ClassDecl);
2077 EmitAggregateCopyCtor(This, Src, DestTy, SrcTy);
2078 return;
2079 }
2080
2081 CallArgList Args;
2082
2083 // Push the this ptr.
2084 Args.add(RValue::get(This.getPointer()), D->getThisType(getContext()));
2085
2086 // Add the rest of the user-supplied arguments.
2087 const FunctionProtoType *FPT = D->getType()->castAs<FunctionProtoType>();
2088 EmitCallArgs(Args, FPT, E->arguments(), E->getConstructor());
2089
2090 // Insert any ABI-specific implicit constructor arguments.
2091 unsigned ExtraArgs = CGM.getCXXABI().addImplicitConstructorArgs(
2092 *this, D, Type, ForVirtualBase, Delegating, Args);
2093
2094 // Emit the call.
2095 llvm::Value *Callee = CGM.getAddrOfCXXStructor(D, getFromCtorType(Type));
2096 const CGFunctionInfo &Info =
2097 CGM.getTypes().arrangeCXXConstructorCall(Args, D, Type, ExtraArgs);
2098 EmitCall(Info, Callee, ReturnValueSlot(), Args, D);
2099
2100 // Generate vtable assumptions if we're constructing a complete object
2101 // with a vtable. We don't do this for base subobjects for two reasons:
2102 // first, it's incorrect for classes with virtual bases, and second, we're
2103 // about to overwrite the vptrs anyway.
2104 // We also have to make sure if we can refer to vtable:
2105 // - Otherwise we can refer to vtable if it's safe to speculatively emit.
2106 // FIXME: If vtable is used by ctor/dtor, or if vtable is external and we are
2107 // sure that definition of vtable is not hidden,
2108 // then we are always safe to refer to it.
2109 // FIXME: It looks like InstCombine is very inefficient on dealing with
2110 // assumes. Make assumption loads require -fstrict-vtable-pointers temporarily.
2111 if (CGM.getCodeGenOpts().OptimizationLevel > 0 &&
2112 ClassDecl->isDynamicClass() && Type != Ctor_Base &&
2113 CGM.getCXXABI().canSpeculativelyEmitVTable(ClassDecl) &&
2114 CGM.getCodeGenOpts().StrictVTablePointers)
2115 EmitVTableAssumptionLoads(ClassDecl, This);
2116 }
2117
EmitVTableAssumptionLoad(const VPtr & Vptr,Address This)2118 void CodeGenFunction::EmitVTableAssumptionLoad(const VPtr &Vptr, Address This) {
2119 llvm::Value *VTableGlobal =
2120 CGM.getCXXABI().getVTableAddressPoint(Vptr.Base, Vptr.VTableClass);
2121 if (!VTableGlobal)
2122 return;
2123
2124 // We can just use the base offset in the complete class.
2125 CharUnits NonVirtualOffset = Vptr.Base.getBaseOffset();
2126
2127 if (!NonVirtualOffset.isZero())
2128 This =
2129 ApplyNonVirtualAndVirtualOffset(*this, This, NonVirtualOffset, nullptr,
2130 Vptr.VTableClass, Vptr.NearestVBase);
2131
2132 llvm::Value *VPtrValue =
2133 GetVTablePtr(This, VTableGlobal->getType(), Vptr.VTableClass);
2134 llvm::Value *Cmp =
2135 Builder.CreateICmpEQ(VPtrValue, VTableGlobal, "cmp.vtables");
2136 Builder.CreateAssumption(Cmp);
2137 }
2138
EmitVTableAssumptionLoads(const CXXRecordDecl * ClassDecl,Address This)2139 void CodeGenFunction::EmitVTableAssumptionLoads(const CXXRecordDecl *ClassDecl,
2140 Address This) {
2141 if (CGM.getCXXABI().doStructorsInitializeVPtrs(ClassDecl))
2142 for (const VPtr &Vptr : getVTablePointers(ClassDecl))
2143 EmitVTableAssumptionLoad(Vptr, This);
2144 }
2145
2146 void
EmitSynthesizedCXXCopyCtorCall(const CXXConstructorDecl * D,Address This,Address Src,const CXXConstructExpr * E)2147 CodeGenFunction::EmitSynthesizedCXXCopyCtorCall(const CXXConstructorDecl *D,
2148 Address This, Address Src,
2149 const CXXConstructExpr *E) {
2150 if (isMemcpyEquivalentSpecialMember(D)) {
2151 assert(E->getNumArgs() == 1 && "unexpected argcount for trivial ctor");
2152 assert(D->isCopyOrMoveConstructor() &&
2153 "trivial 1-arg ctor not a copy/move ctor");
2154 EmitAggregateCopyCtor(This, Src,
2155 getContext().getTypeDeclType(D->getParent()),
2156 (*E->arg_begin())->getType());
2157 return;
2158 }
2159 llvm::Value *Callee = CGM.getAddrOfCXXStructor(D, StructorType::Complete);
2160 assert(D->isInstance() &&
2161 "Trying to emit a member call expr on a static method!");
2162
2163 const FunctionProtoType *FPT = D->getType()->castAs<FunctionProtoType>();
2164
2165 CallArgList Args;
2166
2167 // Push the this ptr.
2168 Args.add(RValue::get(This.getPointer()), D->getThisType(getContext()));
2169
2170 // Push the src ptr.
2171 QualType QT = *(FPT->param_type_begin());
2172 llvm::Type *t = CGM.getTypes().ConvertType(QT);
2173 Src = Builder.CreateBitCast(Src, t);
2174 Args.add(RValue::get(Src.getPointer()), QT);
2175
2176 // Skip over first argument (Src).
2177 EmitCallArgs(Args, FPT, drop_begin(E->arguments(), 1), E->getConstructor(),
2178 /*ParamsToSkip*/ 1);
2179
2180 EmitCall(CGM.getTypes().arrangeCXXMethodCall(Args, FPT, RequiredArgs::All),
2181 Callee, ReturnValueSlot(), Args, D);
2182 }
2183
2184 void
EmitDelegateCXXConstructorCall(const CXXConstructorDecl * Ctor,CXXCtorType CtorType,const FunctionArgList & Args,SourceLocation Loc)2185 CodeGenFunction::EmitDelegateCXXConstructorCall(const CXXConstructorDecl *Ctor,
2186 CXXCtorType CtorType,
2187 const FunctionArgList &Args,
2188 SourceLocation Loc) {
2189 CallArgList DelegateArgs;
2190
2191 FunctionArgList::const_iterator I = Args.begin(), E = Args.end();
2192 assert(I != E && "no parameters to constructor");
2193
2194 // this
2195 DelegateArgs.add(RValue::get(LoadCXXThis()), (*I)->getType());
2196 ++I;
2197
2198 // vtt
2199 if (llvm::Value *VTT = GetVTTParameter(GlobalDecl(Ctor, CtorType),
2200 /*ForVirtualBase=*/false,
2201 /*Delegating=*/true)) {
2202 QualType VoidPP = getContext().getPointerType(getContext().VoidPtrTy);
2203 DelegateArgs.add(RValue::get(VTT), VoidPP);
2204
2205 if (CGM.getCXXABI().NeedsVTTParameter(CurGD)) {
2206 assert(I != E && "cannot skip vtt parameter, already done with args");
2207 assert((*I)->getType() == VoidPP && "skipping parameter not of vtt type");
2208 ++I;
2209 }
2210 }
2211
2212 // Explicit arguments.
2213 for (; I != E; ++I) {
2214 const VarDecl *param = *I;
2215 // FIXME: per-argument source location
2216 EmitDelegateCallArg(DelegateArgs, param, Loc);
2217 }
2218
2219 llvm::Value *Callee =
2220 CGM.getAddrOfCXXStructor(Ctor, getFromCtorType(CtorType));
2221 EmitCall(CGM.getTypes()
2222 .arrangeCXXStructorDeclaration(Ctor, getFromCtorType(CtorType)),
2223 Callee, ReturnValueSlot(), DelegateArgs, Ctor);
2224 }
2225
2226 namespace {
2227 struct CallDelegatingCtorDtor final : EHScopeStack::Cleanup {
2228 const CXXDestructorDecl *Dtor;
2229 Address Addr;
2230 CXXDtorType Type;
2231
CallDelegatingCtorDtor__anonba83d5a10511::CallDelegatingCtorDtor2232 CallDelegatingCtorDtor(const CXXDestructorDecl *D, Address Addr,
2233 CXXDtorType Type)
2234 : Dtor(D), Addr(Addr), Type(Type) {}
2235
Emit__anonba83d5a10511::CallDelegatingCtorDtor2236 void Emit(CodeGenFunction &CGF, Flags flags) override {
2237 CGF.EmitCXXDestructorCall(Dtor, Type, /*ForVirtualBase=*/false,
2238 /*Delegating=*/true, Addr);
2239 }
2240 };
2241 } // end anonymous namespace
2242
2243 void
EmitDelegatingCXXConstructorCall(const CXXConstructorDecl * Ctor,const FunctionArgList & Args)2244 CodeGenFunction::EmitDelegatingCXXConstructorCall(const CXXConstructorDecl *Ctor,
2245 const FunctionArgList &Args) {
2246 assert(Ctor->isDelegatingConstructor());
2247
2248 Address ThisPtr = LoadCXXThisAddress();
2249
2250 AggValueSlot AggSlot =
2251 AggValueSlot::forAddr(ThisPtr, Qualifiers(),
2252 AggValueSlot::IsDestructed,
2253 AggValueSlot::DoesNotNeedGCBarriers,
2254 AggValueSlot::IsNotAliased);
2255
2256 EmitAggExpr(Ctor->init_begin()[0]->getInit(), AggSlot);
2257
2258 const CXXRecordDecl *ClassDecl = Ctor->getParent();
2259 if (CGM.getLangOpts().Exceptions && !ClassDecl->hasTrivialDestructor()) {
2260 CXXDtorType Type =
2261 CurGD.getCtorType() == Ctor_Complete ? Dtor_Complete : Dtor_Base;
2262
2263 EHStack.pushCleanup<CallDelegatingCtorDtor>(EHCleanup,
2264 ClassDecl->getDestructor(),
2265 ThisPtr, Type);
2266 }
2267 }
2268
EmitCXXDestructorCall(const CXXDestructorDecl * DD,CXXDtorType Type,bool ForVirtualBase,bool Delegating,Address This)2269 void CodeGenFunction::EmitCXXDestructorCall(const CXXDestructorDecl *DD,
2270 CXXDtorType Type,
2271 bool ForVirtualBase,
2272 bool Delegating,
2273 Address This) {
2274 CGM.getCXXABI().EmitDestructorCall(*this, DD, Type, ForVirtualBase,
2275 Delegating, This);
2276 }
2277
2278 namespace {
2279 struct CallLocalDtor final : EHScopeStack::Cleanup {
2280 const CXXDestructorDecl *Dtor;
2281 Address Addr;
2282
CallLocalDtor__anonba83d5a10611::CallLocalDtor2283 CallLocalDtor(const CXXDestructorDecl *D, Address Addr)
2284 : Dtor(D), Addr(Addr) {}
2285
Emit__anonba83d5a10611::CallLocalDtor2286 void Emit(CodeGenFunction &CGF, Flags flags) override {
2287 CGF.EmitCXXDestructorCall(Dtor, Dtor_Complete,
2288 /*ForVirtualBase=*/false,
2289 /*Delegating=*/false, Addr);
2290 }
2291 };
2292 }
2293
PushDestructorCleanup(const CXXDestructorDecl * D,Address Addr)2294 void CodeGenFunction::PushDestructorCleanup(const CXXDestructorDecl *D,
2295 Address Addr) {
2296 EHStack.pushCleanup<CallLocalDtor>(NormalAndEHCleanup, D, Addr);
2297 }
2298
PushDestructorCleanup(QualType T,Address Addr)2299 void CodeGenFunction::PushDestructorCleanup(QualType T, Address Addr) {
2300 CXXRecordDecl *ClassDecl = T->getAsCXXRecordDecl();
2301 if (!ClassDecl) return;
2302 if (ClassDecl->hasTrivialDestructor()) return;
2303
2304 const CXXDestructorDecl *D = ClassDecl->getDestructor();
2305 assert(D && D->isUsed() && "destructor not marked as used!");
2306 PushDestructorCleanup(D, Addr);
2307 }
2308
InitializeVTablePointer(const VPtr & Vptr)2309 void CodeGenFunction::InitializeVTablePointer(const VPtr &Vptr) {
2310 // Compute the address point.
2311 llvm::Value *VTableAddressPoint =
2312 CGM.getCXXABI().getVTableAddressPointInStructor(
2313 *this, Vptr.VTableClass, Vptr.Base, Vptr.NearestVBase);
2314
2315 if (!VTableAddressPoint)
2316 return;
2317
2318 // Compute where to store the address point.
2319 llvm::Value *VirtualOffset = nullptr;
2320 CharUnits NonVirtualOffset = CharUnits::Zero();
2321
2322 if (CGM.getCXXABI().isVirtualOffsetNeededForVTableField(*this, Vptr)) {
2323 // We need to use the virtual base offset offset because the virtual base
2324 // might have a different offset in the most derived class.
2325
2326 VirtualOffset = CGM.getCXXABI().GetVirtualBaseClassOffset(
2327 *this, LoadCXXThisAddress(), Vptr.VTableClass, Vptr.NearestVBase);
2328 NonVirtualOffset = Vptr.OffsetFromNearestVBase;
2329 } else {
2330 // We can just use the base offset in the complete class.
2331 NonVirtualOffset = Vptr.Base.getBaseOffset();
2332 }
2333
2334 // Apply the offsets.
2335 Address VTableField = LoadCXXThisAddress();
2336
2337 if (!NonVirtualOffset.isZero() || VirtualOffset)
2338 VTableField = ApplyNonVirtualAndVirtualOffset(
2339 *this, VTableField, NonVirtualOffset, VirtualOffset, Vptr.VTableClass,
2340 Vptr.NearestVBase);
2341
2342 // Finally, store the address point. Use the same LLVM types as the field to
2343 // support optimization.
2344 llvm::Type *VTablePtrTy =
2345 llvm::FunctionType::get(CGM.Int32Ty, /*isVarArg=*/true)
2346 ->getPointerTo()
2347 ->getPointerTo();
2348 VTableField = Builder.CreateBitCast(VTableField, VTablePtrTy->getPointerTo());
2349 VTableAddressPoint = Builder.CreateBitCast(VTableAddressPoint, VTablePtrTy);
2350
2351 llvm::StoreInst *Store = Builder.CreateStore(VTableAddressPoint, VTableField);
2352 CGM.DecorateInstructionWithTBAA(Store, CGM.getTBAAInfoForVTablePtr());
2353 if (CGM.getCodeGenOpts().OptimizationLevel > 0 &&
2354 CGM.getCodeGenOpts().StrictVTablePointers)
2355 CGM.DecorateInstructionWithInvariantGroup(Store, Vptr.VTableClass);
2356 }
2357
2358 CodeGenFunction::VPtrsVector
getVTablePointers(const CXXRecordDecl * VTableClass)2359 CodeGenFunction::getVTablePointers(const CXXRecordDecl *VTableClass) {
2360 CodeGenFunction::VPtrsVector VPtrsResult;
2361 VisitedVirtualBasesSetTy VBases;
2362 getVTablePointers(BaseSubobject(VTableClass, CharUnits::Zero()),
2363 /*NearestVBase=*/nullptr,
2364 /*OffsetFromNearestVBase=*/CharUnits::Zero(),
2365 /*BaseIsNonVirtualPrimaryBase=*/false, VTableClass, VBases,
2366 VPtrsResult);
2367 return VPtrsResult;
2368 }
2369
getVTablePointers(BaseSubobject Base,const CXXRecordDecl * NearestVBase,CharUnits OffsetFromNearestVBase,bool BaseIsNonVirtualPrimaryBase,const CXXRecordDecl * VTableClass,VisitedVirtualBasesSetTy & VBases,VPtrsVector & Vptrs)2370 void CodeGenFunction::getVTablePointers(BaseSubobject Base,
2371 const CXXRecordDecl *NearestVBase,
2372 CharUnits OffsetFromNearestVBase,
2373 bool BaseIsNonVirtualPrimaryBase,
2374 const CXXRecordDecl *VTableClass,
2375 VisitedVirtualBasesSetTy &VBases,
2376 VPtrsVector &Vptrs) {
2377 // If this base is a non-virtual primary base the address point has already
2378 // been set.
2379 if (!BaseIsNonVirtualPrimaryBase) {
2380 // Initialize the vtable pointer for this base.
2381 VPtr Vptr = {Base, NearestVBase, OffsetFromNearestVBase, VTableClass};
2382 Vptrs.push_back(Vptr);
2383 }
2384
2385 const CXXRecordDecl *RD = Base.getBase();
2386
2387 // Traverse bases.
2388 for (const auto &I : RD->bases()) {
2389 CXXRecordDecl *BaseDecl
2390 = cast<CXXRecordDecl>(I.getType()->getAs<RecordType>()->getDecl());
2391
2392 // Ignore classes without a vtable.
2393 if (!BaseDecl->isDynamicClass())
2394 continue;
2395
2396 CharUnits BaseOffset;
2397 CharUnits BaseOffsetFromNearestVBase;
2398 bool BaseDeclIsNonVirtualPrimaryBase;
2399
2400 if (I.isVirtual()) {
2401 // Check if we've visited this virtual base before.
2402 if (!VBases.insert(BaseDecl).second)
2403 continue;
2404
2405 const ASTRecordLayout &Layout =
2406 getContext().getASTRecordLayout(VTableClass);
2407
2408 BaseOffset = Layout.getVBaseClassOffset(BaseDecl);
2409 BaseOffsetFromNearestVBase = CharUnits::Zero();
2410 BaseDeclIsNonVirtualPrimaryBase = false;
2411 } else {
2412 const ASTRecordLayout &Layout = getContext().getASTRecordLayout(RD);
2413
2414 BaseOffset = Base.getBaseOffset() + Layout.getBaseClassOffset(BaseDecl);
2415 BaseOffsetFromNearestVBase =
2416 OffsetFromNearestVBase + Layout.getBaseClassOffset(BaseDecl);
2417 BaseDeclIsNonVirtualPrimaryBase = Layout.getPrimaryBase() == BaseDecl;
2418 }
2419
2420 getVTablePointers(
2421 BaseSubobject(BaseDecl, BaseOffset),
2422 I.isVirtual() ? BaseDecl : NearestVBase, BaseOffsetFromNearestVBase,
2423 BaseDeclIsNonVirtualPrimaryBase, VTableClass, VBases, Vptrs);
2424 }
2425 }
2426
InitializeVTablePointers(const CXXRecordDecl * RD)2427 void CodeGenFunction::InitializeVTablePointers(const CXXRecordDecl *RD) {
2428 // Ignore classes without a vtable.
2429 if (!RD->isDynamicClass())
2430 return;
2431
2432 // Initialize the vtable pointers for this class and all of its bases.
2433 if (CGM.getCXXABI().doStructorsInitializeVPtrs(RD))
2434 for (const VPtr &Vptr : getVTablePointers(RD))
2435 InitializeVTablePointer(Vptr);
2436
2437 if (RD->getNumVBases())
2438 CGM.getCXXABI().initializeHiddenVirtualInheritanceMembers(*this, RD);
2439 }
2440
GetVTablePtr(Address This,llvm::Type * VTableTy,const CXXRecordDecl * RD)2441 llvm::Value *CodeGenFunction::GetVTablePtr(Address This,
2442 llvm::Type *VTableTy,
2443 const CXXRecordDecl *RD) {
2444 Address VTablePtrSrc = Builder.CreateElementBitCast(This, VTableTy);
2445 llvm::Instruction *VTable = Builder.CreateLoad(VTablePtrSrc, "vtable");
2446 CGM.DecorateInstructionWithTBAA(VTable, CGM.getTBAAInfoForVTablePtr());
2447
2448 if (CGM.getCodeGenOpts().OptimizationLevel > 0 &&
2449 CGM.getCodeGenOpts().StrictVTablePointers)
2450 CGM.DecorateInstructionWithInvariantGroup(VTable, RD);
2451
2452 return VTable;
2453 }
2454
2455 // If a class has a single non-virtual base and does not introduce or override
2456 // virtual member functions or fields, it will have the same layout as its base.
2457 // This function returns the least derived such class.
2458 //
2459 // Casting an instance of a base class to such a derived class is technically
2460 // undefined behavior, but it is a relatively common hack for introducing member
2461 // functions on class instances with specific properties (e.g. llvm::Operator)
2462 // that works under most compilers and should not have security implications, so
2463 // we allow it by default. It can be disabled with -fsanitize=cfi-cast-strict.
2464 static const CXXRecordDecl *
LeastDerivedClassWithSameLayout(const CXXRecordDecl * RD)2465 LeastDerivedClassWithSameLayout(const CXXRecordDecl *RD) {
2466 if (!RD->field_empty())
2467 return RD;
2468
2469 if (RD->getNumVBases() != 0)
2470 return RD;
2471
2472 if (RD->getNumBases() != 1)
2473 return RD;
2474
2475 for (const CXXMethodDecl *MD : RD->methods()) {
2476 if (MD->isVirtual()) {
2477 // Virtual member functions are only ok if they are implicit destructors
2478 // because the implicit destructor will have the same semantics as the
2479 // base class's destructor if no fields are added.
2480 if (isa<CXXDestructorDecl>(MD) && MD->isImplicit())
2481 continue;
2482 return RD;
2483 }
2484 }
2485
2486 return LeastDerivedClassWithSameLayout(
2487 RD->bases_begin()->getType()->getAsCXXRecordDecl());
2488 }
2489
EmitVTablePtrCheckForCall(const CXXMethodDecl * MD,llvm::Value * VTable,CFITypeCheckKind TCK,SourceLocation Loc)2490 void CodeGenFunction::EmitVTablePtrCheckForCall(const CXXMethodDecl *MD,
2491 llvm::Value *VTable,
2492 CFITypeCheckKind TCK,
2493 SourceLocation Loc) {
2494 const CXXRecordDecl *ClassDecl = MD->getParent();
2495 if (!SanOpts.has(SanitizerKind::CFICastStrict))
2496 ClassDecl = LeastDerivedClassWithSameLayout(ClassDecl);
2497
2498 EmitVTablePtrCheck(ClassDecl, VTable, TCK, Loc);
2499 }
2500
EmitVTablePtrCheckForCast(QualType T,llvm::Value * Derived,bool MayBeNull,CFITypeCheckKind TCK,SourceLocation Loc)2501 void CodeGenFunction::EmitVTablePtrCheckForCast(QualType T,
2502 llvm::Value *Derived,
2503 bool MayBeNull,
2504 CFITypeCheckKind TCK,
2505 SourceLocation Loc) {
2506 if (!getLangOpts().CPlusPlus)
2507 return;
2508
2509 auto *ClassTy = T->getAs<RecordType>();
2510 if (!ClassTy)
2511 return;
2512
2513 const CXXRecordDecl *ClassDecl = cast<CXXRecordDecl>(ClassTy->getDecl());
2514
2515 if (!ClassDecl->isCompleteDefinition() || !ClassDecl->isDynamicClass())
2516 return;
2517
2518 if (!SanOpts.has(SanitizerKind::CFICastStrict))
2519 ClassDecl = LeastDerivedClassWithSameLayout(ClassDecl);
2520
2521 llvm::BasicBlock *ContBlock = nullptr;
2522
2523 if (MayBeNull) {
2524 llvm::Value *DerivedNotNull =
2525 Builder.CreateIsNotNull(Derived, "cast.nonnull");
2526
2527 llvm::BasicBlock *CheckBlock = createBasicBlock("cast.check");
2528 ContBlock = createBasicBlock("cast.cont");
2529
2530 Builder.CreateCondBr(DerivedNotNull, CheckBlock, ContBlock);
2531
2532 EmitBlock(CheckBlock);
2533 }
2534
2535 llvm::Value *VTable =
2536 GetVTablePtr(Address(Derived, getPointerAlign()), Int8PtrTy, ClassDecl);
2537
2538 EmitVTablePtrCheck(ClassDecl, VTable, TCK, Loc);
2539
2540 if (MayBeNull) {
2541 Builder.CreateBr(ContBlock);
2542 EmitBlock(ContBlock);
2543 }
2544 }
2545
EmitVTablePtrCheck(const CXXRecordDecl * RD,llvm::Value * VTable,CFITypeCheckKind TCK,SourceLocation Loc)2546 void CodeGenFunction::EmitVTablePtrCheck(const CXXRecordDecl *RD,
2547 llvm::Value *VTable,
2548 CFITypeCheckKind TCK,
2549 SourceLocation Loc) {
2550 if (CGM.IsCFIBlacklistedRecord(RD))
2551 return;
2552
2553 SanitizerScope SanScope(this);
2554
2555 llvm::Metadata *MD =
2556 CGM.CreateMetadataIdentifierForType(QualType(RD->getTypeForDecl(), 0));
2557 llvm::Value *BitSetName = llvm::MetadataAsValue::get(getLLVMContext(), MD);
2558
2559 llvm::Value *CastedVTable = Builder.CreateBitCast(VTable, Int8PtrTy);
2560 llvm::Value *BitSetTest =
2561 Builder.CreateCall(CGM.getIntrinsic(llvm::Intrinsic::bitset_test),
2562 {CastedVTable, BitSetName});
2563
2564 if (CGM.getCodeGenOpts().SanitizeCfiCrossDso) {
2565 if (auto TypeId = CGM.CreateCfiIdForTypeMetadata(MD)) {
2566 EmitCfiSlowPathCheck(BitSetTest, TypeId, CastedVTable);
2567 return;
2568 }
2569 }
2570
2571 SanitizerMask M;
2572 switch (TCK) {
2573 case CFITCK_VCall:
2574 M = SanitizerKind::CFIVCall;
2575 break;
2576 case CFITCK_NVCall:
2577 M = SanitizerKind::CFINVCall;
2578 break;
2579 case CFITCK_DerivedCast:
2580 M = SanitizerKind::CFIDerivedCast;
2581 break;
2582 case CFITCK_UnrelatedCast:
2583 M = SanitizerKind::CFIUnrelatedCast;
2584 break;
2585 }
2586
2587 llvm::Constant *StaticData[] = {
2588 EmitCheckSourceLocation(Loc),
2589 EmitCheckTypeDescriptor(QualType(RD->getTypeForDecl(), 0)),
2590 llvm::ConstantInt::get(Int8Ty, TCK),
2591 };
2592 EmitCheck(std::make_pair(BitSetTest, M), "cfi_bad_type", StaticData,
2593 CastedVTable);
2594 }
2595
2596 // FIXME: Ideally Expr::IgnoreParenNoopCasts should do this, but it doesn't do
2597 // quite what we want.
skipNoOpCastsAndParens(const Expr * E)2598 static const Expr *skipNoOpCastsAndParens(const Expr *E) {
2599 while (true) {
2600 if (const ParenExpr *PE = dyn_cast<ParenExpr>(E)) {
2601 E = PE->getSubExpr();
2602 continue;
2603 }
2604
2605 if (const CastExpr *CE = dyn_cast<CastExpr>(E)) {
2606 if (CE->getCastKind() == CK_NoOp) {
2607 E = CE->getSubExpr();
2608 continue;
2609 }
2610 }
2611 if (const UnaryOperator *UO = dyn_cast<UnaryOperator>(E)) {
2612 if (UO->getOpcode() == UO_Extension) {
2613 E = UO->getSubExpr();
2614 continue;
2615 }
2616 }
2617 return E;
2618 }
2619 }
2620
2621 bool
CanDevirtualizeMemberFunctionCall(const Expr * Base,const CXXMethodDecl * MD)2622 CodeGenFunction::CanDevirtualizeMemberFunctionCall(const Expr *Base,
2623 const CXXMethodDecl *MD) {
2624 // When building with -fapple-kext, all calls must go through the vtable since
2625 // the kernel linker can do runtime patching of vtables.
2626 if (getLangOpts().AppleKext)
2627 return false;
2628
2629 // If the most derived class is marked final, we know that no subclass can
2630 // override this member function and so we can devirtualize it. For example:
2631 //
2632 // struct A { virtual void f(); }
2633 // struct B final : A { };
2634 //
2635 // void f(B *b) {
2636 // b->f();
2637 // }
2638 //
2639 const CXXRecordDecl *MostDerivedClassDecl = Base->getBestDynamicClassType();
2640 if (MostDerivedClassDecl->hasAttr<FinalAttr>())
2641 return true;
2642
2643 // If the member function is marked 'final', we know that it can't be
2644 // overridden and can therefore devirtualize it.
2645 if (MD->hasAttr<FinalAttr>())
2646 return true;
2647
2648 // Similarly, if the class itself is marked 'final' it can't be overridden
2649 // and we can therefore devirtualize the member function call.
2650 if (MD->getParent()->hasAttr<FinalAttr>())
2651 return true;
2652
2653 Base = skipNoOpCastsAndParens(Base);
2654 if (const DeclRefExpr *DRE = dyn_cast<DeclRefExpr>(Base)) {
2655 if (const VarDecl *VD = dyn_cast<VarDecl>(DRE->getDecl())) {
2656 // This is a record decl. We know the type and can devirtualize it.
2657 return VD->getType()->isRecordType();
2658 }
2659
2660 return false;
2661 }
2662
2663 // We can devirtualize calls on an object accessed by a class member access
2664 // expression, since by C++11 [basic.life]p6 we know that it can't refer to
2665 // a derived class object constructed in the same location.
2666 if (const MemberExpr *ME = dyn_cast<MemberExpr>(Base))
2667 if (const ValueDecl *VD = dyn_cast<ValueDecl>(ME->getMemberDecl()))
2668 return VD->getType()->isRecordType();
2669
2670 // We can always devirtualize calls on temporary object expressions.
2671 if (isa<CXXConstructExpr>(Base))
2672 return true;
2673
2674 // And calls on bound temporaries.
2675 if (isa<CXXBindTemporaryExpr>(Base))
2676 return true;
2677
2678 // Check if this is a call expr that returns a record type.
2679 if (const CallExpr *CE = dyn_cast<CallExpr>(Base))
2680 return CE->getCallReturnType(getContext())->isRecordType();
2681
2682 // We can't devirtualize the call.
2683 return false;
2684 }
2685
EmitForwardingCallToLambda(const CXXMethodDecl * callOperator,CallArgList & callArgs)2686 void CodeGenFunction::EmitForwardingCallToLambda(
2687 const CXXMethodDecl *callOperator,
2688 CallArgList &callArgs) {
2689 // Get the address of the call operator.
2690 const CGFunctionInfo &calleeFnInfo =
2691 CGM.getTypes().arrangeCXXMethodDeclaration(callOperator);
2692 llvm::Value *callee =
2693 CGM.GetAddrOfFunction(GlobalDecl(callOperator),
2694 CGM.getTypes().GetFunctionType(calleeFnInfo));
2695
2696 // Prepare the return slot.
2697 const FunctionProtoType *FPT =
2698 callOperator->getType()->castAs<FunctionProtoType>();
2699 QualType resultType = FPT->getReturnType();
2700 ReturnValueSlot returnSlot;
2701 if (!resultType->isVoidType() &&
2702 calleeFnInfo.getReturnInfo().getKind() == ABIArgInfo::Indirect &&
2703 !hasScalarEvaluationKind(calleeFnInfo.getReturnType()))
2704 returnSlot = ReturnValueSlot(ReturnValue, resultType.isVolatileQualified());
2705
2706 // We don't need to separately arrange the call arguments because
2707 // the call can't be variadic anyway --- it's impossible to forward
2708 // variadic arguments.
2709
2710 // Now emit our call.
2711 RValue RV = EmitCall(calleeFnInfo, callee, returnSlot,
2712 callArgs, callOperator);
2713
2714 // If necessary, copy the returned value into the slot.
2715 if (!resultType->isVoidType() && returnSlot.isNull())
2716 EmitReturnOfRValue(RV, resultType);
2717 else
2718 EmitBranchThroughCleanup(ReturnBlock);
2719 }
2720
EmitLambdaBlockInvokeBody()2721 void CodeGenFunction::EmitLambdaBlockInvokeBody() {
2722 const BlockDecl *BD = BlockInfo->getBlockDecl();
2723 const VarDecl *variable = BD->capture_begin()->getVariable();
2724 const CXXRecordDecl *Lambda = variable->getType()->getAsCXXRecordDecl();
2725
2726 // Start building arguments for forwarding call
2727 CallArgList CallArgs;
2728
2729 QualType ThisType = getContext().getPointerType(getContext().getRecordType(Lambda));
2730 Address ThisPtr = GetAddrOfBlockDecl(variable, false);
2731 CallArgs.add(RValue::get(ThisPtr.getPointer()), ThisType);
2732
2733 // Add the rest of the parameters.
2734 for (auto param : BD->params())
2735 EmitDelegateCallArg(CallArgs, param, param->getLocStart());
2736
2737 assert(!Lambda->isGenericLambda() &&
2738 "generic lambda interconversion to block not implemented");
2739 EmitForwardingCallToLambda(Lambda->getLambdaCallOperator(), CallArgs);
2740 }
2741
EmitLambdaToBlockPointerBody(FunctionArgList & Args)2742 void CodeGenFunction::EmitLambdaToBlockPointerBody(FunctionArgList &Args) {
2743 if (cast<CXXMethodDecl>(CurCodeDecl)->isVariadic()) {
2744 // FIXME: Making this work correctly is nasty because it requires either
2745 // cloning the body of the call operator or making the call operator forward.
2746 CGM.ErrorUnsupported(CurCodeDecl, "lambda conversion to variadic function");
2747 return;
2748 }
2749
2750 EmitFunctionBody(Args, cast<FunctionDecl>(CurGD.getDecl())->getBody());
2751 }
2752
EmitLambdaDelegatingInvokeBody(const CXXMethodDecl * MD)2753 void CodeGenFunction::EmitLambdaDelegatingInvokeBody(const CXXMethodDecl *MD) {
2754 const CXXRecordDecl *Lambda = MD->getParent();
2755
2756 // Start building arguments for forwarding call
2757 CallArgList CallArgs;
2758
2759 QualType ThisType = getContext().getPointerType(getContext().getRecordType(Lambda));
2760 llvm::Value *ThisPtr = llvm::UndefValue::get(getTypes().ConvertType(ThisType));
2761 CallArgs.add(RValue::get(ThisPtr), ThisType);
2762
2763 // Add the rest of the parameters.
2764 for (auto Param : MD->params())
2765 EmitDelegateCallArg(CallArgs, Param, Param->getLocStart());
2766
2767 const CXXMethodDecl *CallOp = Lambda->getLambdaCallOperator();
2768 // For a generic lambda, find the corresponding call operator specialization
2769 // to which the call to the static-invoker shall be forwarded.
2770 if (Lambda->isGenericLambda()) {
2771 assert(MD->isFunctionTemplateSpecialization());
2772 const TemplateArgumentList *TAL = MD->getTemplateSpecializationArgs();
2773 FunctionTemplateDecl *CallOpTemplate = CallOp->getDescribedFunctionTemplate();
2774 void *InsertPos = nullptr;
2775 FunctionDecl *CorrespondingCallOpSpecialization =
2776 CallOpTemplate->findSpecialization(TAL->asArray(), InsertPos);
2777 assert(CorrespondingCallOpSpecialization);
2778 CallOp = cast<CXXMethodDecl>(CorrespondingCallOpSpecialization);
2779 }
2780 EmitForwardingCallToLambda(CallOp, CallArgs);
2781 }
2782
EmitLambdaStaticInvokeFunction(const CXXMethodDecl * MD)2783 void CodeGenFunction::EmitLambdaStaticInvokeFunction(const CXXMethodDecl *MD) {
2784 if (MD->isVariadic()) {
2785 // FIXME: Making this work correctly is nasty because it requires either
2786 // cloning the body of the call operator or making the call operator forward.
2787 CGM.ErrorUnsupported(MD, "lambda conversion to variadic function");
2788 return;
2789 }
2790
2791 EmitLambdaDelegatingInvokeBody(MD);
2792 }
2793