Commit Graph

475206 Commits

Author SHA1 Message Date
Konrad Kleine
5bd1b93cb2 Move CallInst::CreateFree to IRBuilderBase
Similarly to D158861 I'm moving the `CreateFree` method from `CallInst` to `IRBuilderBase`.

Differential Revision: https://reviews.llvm.org/D159418
2023-09-19 12:04:17 +02:00
Timm Bäder
ad4a513027 [clang][CFG] Cleanup functions
Add declarations declared with attribute(cleanup(...)) to the CFG,
similar to destructors.

Differential Revision: https://reviews.llvm.org/D157385
2023-09-19 11:56:44 +02:00
Daniel Krupp
97495d3159
[analyzer] TaintPropagation checker strlen() should not propagate (#66086)
strlen(..) call should not propagate taintedness,
because it brings in many false positive findings. It is a common
pattern to copy user provided input to another buffer. In these cases we
always
get warnings about tainted data used as the malloc parameter:

buf = malloc(strlen(tainted_txt) + 1); // false warning

This pattern can lead to a denial of service attack only, when the
attacker can directly specify the size of the allocated area as an
arbitrary large number (e.g. the value is converted from a user provided
string).

Later, we could reintroduce strlen() as a taint propagating function
with the consideration not to emit warnings when the tainted value
cannot be "arbitrarily large" (such as the size of an already allocated
memory block).

The change has been evaluated on the following open source projects:

- memcached: [1 lost false
positive](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=memcached_1.6.8_ednikru_taint_nostrlen_baseline&newcheck=memcached_1.6.8_ednikru_taint_nostrlen_new&is-unique=on&diff-type=Resolved)

- tmux: 0 lost reports
- twin [3 lost false
positives](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=twin_v0.8.1_ednikru_taint_nostrlen_baseline&newcheck=twin_v0.8.1_ednikru_taint_nostrlen_new&is-unique=on&diff-type=Resolved)
- vim [1 lost false
positive](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=vim_v8.2.1920_ednikru_taint_nostrlen_baseline&newcheck=vim_v8.2.1920_ednikru_taint_nostrlen_new&is-unique=on&diff-type=Resolved)
- openssl 0 lost reports
- sqliste [2 lost false
positives](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=sqlite_version-3.33.0_ednikru_taint_nostrlen_baseline&newcheck=sqlite_version-3.33.0_ednikru_taint_nostrlen_new&is-unique=on&diff-type=Resolved)
- ffmpeg 0 lost repots
- postgresql [3 lost false
positives](https://codechecker-demo.eastus.cloudapp.azure.com/Default/reports?run=postgres_REL_13_0_ednikru_taint_nostrlen_baseline&newcheck=postgres_REL_13_0_ednikru_taint_nostrlen_new&is-unique=on&diff-type=Resolved)
- tinyxml 0 lost reports
- libwebm 0 lost reports
- xerces 0 lost reports

In all cases the lost reports are originating from copying untrusted
environment variables into another buffer.

There are 2 types of lost false positive reports:
1) [Where the warning is emitted at the malloc call by the
TaintPropagation Checker
](https://codechecker-demo.eastus.cloudapp.azure.com/Default/report-detail?run=memcached_1.6.8_ednikru_taint_nostrlen_baseline&newcheck=memcached_1.6.8_ednikru_taint_nostrlen_new&is-unique=on&diff-type=Resolved&report-id=2648506&report-hash=2079221954026f17e1ecb614f5f054db&report-filepath=%2amemcached.c)
`
            len = strlen(portnumber_filename)+4+1;
            temp_portnumber_filename = malloc(len);
`

2) When pointers are set based on the length of the tainted string by
the ArrayOutofBoundsv2 checker.
For example [this
](https://codechecker-demo.eastus.cloudapp.azure.com/Default/report-detail?run=vim_v8.2.1920_ednikru_taint_nostrlen_baseline&newcheck=vim_v8.2.1920_ednikru_taint_nostrlen_new&is-unique=on&diff-type=Resolved&report-id=2649310&report-hash=79dc8522d2cd34ca8e1b2dc2db64b2df&report-filepath=%2aos_unix.c)case.
2023-09-19 11:04:50 +02:00
Clement Courbet
c809051215
[NFC] Preparatory work for D153131 (#66750) 2023-09-19 11:02:00 +02:00
David Spickett
91f46ece9e [lldb][AArch64] Document how to control the SVE/SSVE tests
A lot of these use defines that I made up for this purpose,
which is not obvious at first glance. Document that at the top
of each file.
2023-09-19 08:51:37 +00:00
Michal Paszkowski
2616c279d5 [SPIR-V] Preserve pointer address space for load/gep instructions
Differential Revision: https://reviews.llvm.org/D158761
2023-09-19 01:42:42 -07:00
Ingo Müller
86ddbdd3e7
[mlir][linalg][transform][python] Allow no args in MaskedVectorize. (#66541)
The mix-in of this op did not allow to pass in no argument. This special
case is now handled correctly and covered by the tests.
2023-09-19 10:34:47 +02:00
Ingo Müller
159e94a0c3
[mlir][linalg][transform] Add some debug output to vectorization. (NFC) (#66520)
This helps to understand what the problem is when vectorization of
structured ops failes due to mismatching vector sizes.
2023-09-19 10:34:24 +02:00
David Spickett
956860168b [lldb] Correct expected output for variable on 32 bit platforms
710276a250 added settings to control
leading zeros but the initial test case assumed a 64 bit target.
2023-09-19 08:28:34 +00:00
JinGu Kang
59c3dcafd8
[AArch64] Remove copy instruction between uaddlv with v4i16/v8i16 and dup (#66508)
If there are copy instructions between uaddlv with v4i16/v8i16 and dup
for transfer from gpr to fpr, try to remove them with duplane. It is a
follow-up patch of https://reviews.llvm.org/D159267
2023-09-19 09:05:12 +01:00
Michal Paszkowski
ec7baca17e [SPIR-V] Remove -opaque-pointers=0 from LITs, fixes for opaque pointers support
Differential Revision: https://reviews.llvm.org/D156049
2023-09-19 00:50:42 -07:00
Jie Fu
da57ced76d [examples] Remove unused variable 'BB' in BrainF.cpp (NFC)
/Users/jiefu/llvm-project/llvm/examples/BrainF/BrainF.cpp:92:15: error: unused variable 'BB' [-Werror,-Wunused-variable]
  BasicBlock* BB = builder->GetInsertBlock();
              ^
1 error generated.
2023-09-19 15:46:08 +08:00
David Spickett
ca723f2d40
[lldb][Docs] Document our major differences from the LLVM style (#66345)
Running:
$ clang-format -i $(find -regex "\./lldb/.*\.c") $(find -regex
"\./lldb/.*\.cpp") $(find -regex "\./lldb/.*\.h")

Resulted in:
 1602 files changed, 25090 insertions(+), 25849 deletions(-)
(note: this includes tests which we wouldn't format, just using this as
an example)

The vast majority of which were whitespace changes. So as far as
formatting we're not deviating from llvm for any reason other than not
churning old code.

Formatting aside, the major features of lldb (single line if, early
return) are all reflected in llvm's style. We differ mainly on variable
naming (proposed to change in
https://llvm.org/docs/Proposals/VariableNames.html anyway) and use of
asserts. Which was already documented.
2023-09-19 08:23:00 +01:00
Matthias Springer
6923a31542
[mlir][IR] Change MutableArrayRange to enumerate OpOperand & (#66622)
In line with #66515, change `MutableArrayRange::begin`/`end` to
enumerate `OpOperand &` instead of `Value`. Also remove
`ForOp::getIterOpOperands`/`setIterArg`, which are now redundant.

Note: `MutableOperandRange` cannot be made a derived class of
`indexed_accessor_range_base` (like `OperandRange`), because
`MutableOperandRange::assign` can change the number of operands in the
range.
2023-09-19 09:09:21 +02:00
Konrad Kleine
45bb45f2ae [llvm] Move CallInst::CreateMalloc to IRBuilderBase::CreateMalloc
This removes `CreateMalloc` from `CallInst` and adds it to the `IRBuilderBase`
class.

We no longer needed the `Instruction *InsertBefore` and
`BasicBlock *InsertAtEnd` arguments of the `createMalloc` helper
function because we're using `IRBuilder` now. That's why I we also don't
need 4 `CreateMalloc` functions, but only two.

Differential Revision: https://reviews.llvm.org/D158861
2023-09-19 09:05:48 +02:00
martinboehme
1d7b59ca8d
[clang][dataflow] Fix two null pointer dereferences in getMemberForAccessor(). (#66742)
The additions to the test trigger crashes without the fixes.
2023-09-19 09:03:20 +02:00
Konstantina Mitropoulou
3583d40b3c
[NFC][NewGVN] Update assume_dominating_icmp.ll (#66711) 2023-09-18 23:47:48 -07:00
Matt Arsenault
1328a8534b
AMDGPU: Fix handling of -0 in round lowering (#65761) 2023-09-19 09:14:17 +03:00
Christian Sigg
b9a6b28a58
[mlir][bazel] Small adjustment to 7db4a6f278 2023-09-19 08:08:59 +02:00
LLVM GN Syncbot
69ae904f6a [gn build] Port 44532a9dd4 2023-09-19 05:57:24 +00:00
ur4t
7ac1f60f01
[llvm-libgcc][CMake] Refactor llvm-libgcc (#65455)
There are some issues in `llvm-libgcc` before this patch:

Commit c5a20b5182 ([llvm-libgcc] initial
commit)
uses `$<TARGET_OBJECTS:unwind_static>` to get libunwind objects, which
is empty.
The built library is actually a shared version of libclang_rt.builtins.

When configuring with `llvm/CMakeLists.txt`, target `llvm-libgcc`
requires a
corresponding target in `llvm-libgcc/CMakeLists.txt`.

Per target installation is not handled by `llvm-libgcc`, which is not
consistent
with `libunwind`.


This patch fixes those issues by:

Reusing target `unwind_shared` in `libunwind`, linking
`compiler-rt.builtins`
objects into it, and applying version script.

Adding target `llvm-libgcc`, creating symlinks, and utilizing cmake's
dependency
and component mechanism to ensure link targets will be built and
installed along
with symlinks.

Mimicking `libunwind` to handle per target installation.


It is quite hard to set necessary options without further modifying the
order of
runtime projects in `runtimes/CMakeLists.txt`. So though this patch
reveals the
possibility of co-existence of `llvm-libgcc` and
`compiler-rt`/`libunwind` in
`LLVM_ENABLE_RUNTIMES`, we still inhibit it to minimize influence on
other
projects, considering that `llvm-libgcc` is only intended for toolchain
vendors,
and not for casual use.
2023-09-18 22:56:03 -07:00
Jason Molenda
44532a9dd4 Revert "[lldb] Add 'modify' type watchpoints, make it default (#66308)"
TestStepOverWatchpoint.py and TestUnalignedWatchpoint.py are failing
on the ubuntu and debian bots
https://lab.llvm.org/buildbot/#/builders/68/builds/60204
https://lab.llvm.org/buildbot/#/builders/96/builds/45623

and the newly added test TestModifyWatchpoint.py does not
work on windows bot
https://lab.llvm.org/buildbot/#/builders/219/builds/5708

I will debug tomorrow morning and reland.

This reverts commit 3692267ca8.
2023-09-18 22:50:39 -07:00
Fangrui Song
af935cf0ee
[CodeLayout] Fix X1_Y_X2 and Y_X2_X1 testing for jumps from Y (#66592)
The CHECK2 test in code_placement_ext_tsp_large.ll now has the same
result as
the CHECK test: when chain(0,2,3,4,1) is merged with chain(8), the
result is now
chain(0,2,3,4,8,1).

Ideally we should have test coverage for
-ext-tsp-chain-split-threshold=1, but
it seems challenging to craft one. Perhaps the default value of
-ext-tsp-chain-split-threshold can be decreased as the
-ext-tsp-enable-chain-split-along-jumps heuristic is now more powerful.
2023-09-18 22:50:17 -07:00
Fangrui Song
345f532f3f [ELF][test] Improve relocations referencing STT_SECTION tests for -r
Also add a --compress-debug-sections=zlib test to demonstrate issue #66738
2023-09-18 22:46:56 -07:00
Stella Laurenzo
33df617dfd
[mlir] Quality of life improvements to python API types. (#66723)
* Moves several orphaned methods from Operation/OpView -> _OperationBase
so that both hierarchies share them (whether unknown or known to ODS).
* Adds typing information for missing `MLIRError` exception.
* Adds `DiagnosticInfo` typing.
* Adds `DenseResourceElementsAttr` typing that was missing.
2023-09-18 21:30:41 -07:00
Jeff Bailey
acfb99d9fd
[libc] Specify path for making include/ subdirs (#66589)
When doing a clean build from vscode, it makes the subdirectories in the
source tree rather than in the build folder. Elsehwere in LLVM, they
prefix the MAKE_DIRECTORY calls, so this appears to be the correct
approach.
2023-09-18 21:00:51 -07:00
Wang Pengcheng
3017545e63
[RISCV] Fix inline asm error for block address (#66640)
After commit cedf2ea, `RISCVMergeBaseOffset` can handle `BlockAddress`
currently. But we didn't handle it in `PrintAsmMemoryOperand` so we
get `invalid operand in inline asm` error.

This patch fixes the error.
2023-09-19 11:46:43 +08:00
Amir Ayupov
6a1cf545cc [BOLT][YAML] Only read first profile per function
D159460 regressed the bugfix in D156644. Fix that and emit a warning.
Add a test case.

Reviewed By: #bolt, maksfb

Differential Revision: https://reviews.llvm.org/D159529
2023-09-18 20:40:47 -07:00
Yingwei Zheng
4ea883cbbb
[InstCombine] Add pre-commit tests for PR66606. NFC. 2023-09-19 11:13:16 +08:00
Jacques Pienaar
31ebe98e48
[mlir][c] Expose AsmState. (#66693)
Enable usage where capturing AsmState is good (e.g., avoiding creating AsmState over and over again when walking IR and printing).

This also only changes one C API to verify plumbing. But using the AsmState makes the cost more explicit than the flags interface (which hides the traversals and construction here) and also enables a more efficient usage C side.
2023-09-18 20:12:12 -07:00
Yeting Kuo
6af39d914c
[RISCV][NFC] Simplify the sp-offset reduction by spimm of CM.PUSH/POP. (#66667)
When inserting prolgue/epilogue, we use the spimm of CM.PUSH/POP to
reduce the following offset for sp. Previously, we tried to use the free
space of the push stack to minimize the following sp-offset. But it's
useless, since the free space must be less than 16 and required stack should
be aligned to 16 before/after the adjustment.
2023-09-19 11:01:47 +08:00
Yunze Zhu
544535976d [RISCV][MC]Add support for Binary MCExpr
There is an issue: https://github.com/llvm/llvm-project/issues/64612
This issue happens because in RISCVMCCodeEmitter::getImmOpValue it only handles MCExpr kind Target and SymbolRef.
When code with format like .+ comes in, it comes with MCExpr kind Binary, the fixupkind remains fixup_riscv_invalid and reports error.

This patch make MCExpr kind Binary handled with the same way as MCExpr kind SymbolRef,
so code with binary expression can get correct fixupkind and be used to generate more complex relocation.

Differential Revision: https://reviews.llvm.org/D157694
2023-09-19 10:35:16 +08:00
LLVM GN Syncbot
4b7a08f0f8 [gn build] Port 3692267ca8 2023-09-19 02:17:16 +00:00
Jason Molenda
3692267ca8
[lldb] Add 'modify' type watchpoints, make it default (#66308)
Watchpoints in lldb can be either 'read', 'write', or 'read/write'. This
is exposing the actual behavior of hardware watchpoints. gdb has a
different behavior: a "write" type watchpoint only stops when the
watched memory region *changes*.

A user is using a watchpoint for one of three reasons:

1. Want to find what is changing/corrupting this memory.
2. Want to find what is writing to this memory.
3. Want to find what is reading from this memory.

I believe (1) is the most common use case for watchpoints, and it
currently can't be done in lldb -- the user needs to continue every time
the same value is written to the watched-memory manually. I think gdb's
behavior is the correct one. There are some use cases where a developer
wants to find every function that writes/reads to/from a memory region,
regardless of value, I want to still allow that functionality.

This is also a bit of groundwork for my large watchpoint support
proposal
https://discourse.llvm.org/t/rfc-large-watchpoint-support-in-lldb/72116
where I will be adding support for AArch64 MASK watchpoints which watch
power-of-2 memory regions. A user might ask to watch 24 bytes, and a
MASK watchpoint stub can do this with a 32-byte MASK watchpoint if it is
properly aligned. And we need to ignore writes to the final 8 bytes of
that watched region, and not show those hits to the user.

This patch adds a new 'modify' watchpoint type and it is the default.

rdar://108234227
2023-09-18 19:16:45 -07:00
Piotr Fusik
c724ac9330
[clang] Fix null dereference on return in lambda attribute statement expr (#66643)
clang was crashing on a lambda attribute with a statement expression
that contained a `return`.
It attempted to access the lambda type which was unknown at that point.

Fixes https://github.com/llvm/llvm-project/issues/48527
2023-09-19 04:02:04 +02:00
Fangrui Song
7db4a6f278 [bazel] Port cbd475040f (mlir/lib/Dialect/MLProgram) 2023-09-18 18:47:21 -07:00
Vitaly Buka
dc810e880f [NFC][hwasan] Collect heap related data early (#66682) 2023-09-18 18:41:00 -07:00
Danila Malyutin
a668c0f687
[LoopPredication] Fix division by zero in case of zero branch weights (#66506)
Treat the case where all branch weights are zero as if there was no
profile.
Fixes #66382
2023-09-19 04:38:29 +03:00
Vitaly Buka
d307d20717 [NFC][hwasan] Make PrintAddressDescription method of BaseReport (#66682) 2023-09-18 18:34:12 -07:00
Vitaly Buka
13deda4f22 [NFC][hwasan] Remove default argument 2023-09-18 18:28:24 -07:00
Vitaly Buka
8519d4fda1 [NFC][hwasan] Add access_size into base report (#66682) 2023-09-18 18:21:40 -07:00
Allen
48caa0723c
[LAA] Analyze pointers forked by a phi (#65834)
Given a function like the following: https://godbolt.org/z/T9c99fr88
```c
1161_noReadWrite(int *Preds) {
  for (int i = 0; i < LEN_1D-1; ++i) {
    if (Preds[i] != 0)
      b[i] = c[i] + 1;
    else
      a[i] = i * i;
  }
}
```

LLVM will optimize the IR to a single store by a phi instruction:

   ```llvm
      %1 = load ptr, ptr @a, align 64
      %2 = load ptr, ptr @b, align 64
      ...
    for.inc:
      %.sink = phi ptr [ %1, %if.then ], [ %2, %if.else ]
      %add.sink = phi double [ %add, %if.then ], [ %conv8, %if.else ]
%arrayidx7 = getelementptr inbounds double, ptr %.sink, i64 %indvars.iv
      store double %add.sink, ptr %arrayidx7, align 8
   ```

LAA is currently unable to analyze such IR, since ScalarEvolution will
return a SCEVUnknown for the forked pointer operand of the store.

This patch adds initial optional support for analyzing both
possibilities for the pointer and allowing LAA to generate runtime
checks for the bounds if required, refers to D108699, but here address
the phi node.

Fixes https://github.com/llvm/llvm-project/issues/64888

Reviewed By: huntergr-arm, fhahn
Differential Revision: https://reviews.llvm.org/D158965
2023-09-19 09:16:47 +08:00
Vitaly Buka
542f91f755 [NFC][hwasan] Store thread id in SavedStackAllocations (#66682) 2023-09-18 18:13:57 -07:00
Spenser Bauman
0a0c7e8978
[mlir][tensor] Bufferize tensor.reshape with non-identity layouts (#65654)
Bufferization of tensor.reshape generates a memref.reshape operation.
memref.reshape requires the source memref to have an identity layout.
The bufferization process may result in the source memref having a
non-identity layout, resulting in a verification failure.

This change causes the bufferization interface for tensor.reshape to
copy the source memref to a new buffer when the source has a
non-identity layout.
2023-09-19 09:50:43 +09:00
Vitaly Buka
810bca56f0 [NFC][hwasan] Move PrintAddressDescription (#66682) 2023-09-18 17:20:50 -07:00
Vitaly Buka
9094b3b4ae [NFC][hwasan] Extract BaseReport (#66682) 2023-09-18 17:19:53 -07:00
MaheshRavishankar
170a25a793
[mlir][TilingInterface] Make the tiling set tile sizes function use OpFoldResult. (#66566) 2023-09-18 17:18:51 -07:00
Vitaly Buka
75fdf2e7b6 [NFC][hwasan] Move Report classes together (#66682) 2023-09-18 17:16:01 -07:00
Vitaly Buka
d39d86da4a [NFC][hwasan] Use unnamed namespace and static (#66682) 2023-09-18 17:16:01 -07:00
Vitaly Buka
0fb6da8bab [NFC][hwasan] Create *Report classes (#66682)
This prepare the code for rework to collect all nececcecary data before
symbolization. Symbolization as any untrivial computations may affect
hwasan metadata.
2023-09-18 17:14:44 -07:00