llvm lint: buffer overflow in src/test/ui/foreign/foreign-truncated-arguments.rs

[matthiaskrgr]

code from tests/ui/foreign/foreign-truncated-arguments.rs

// run-pass
// compile-flags: -O
// Regression test for https://github.com/rust-lang/rust/issues/33868

#[repr(C)]
pub struct S {
    a: u32,
    b: f32,
    c: u32
}

#[no_mangle]
#[inline(never)]
pub extern "C" fn test(s: S) -> u32 {
    s.c
}

fn main() {
    assert_eq!(test(S{a: 0, b: 0.0, c: 42}), 42);
}

When checked with rustc -Cpasses=lint src/test/ui/foreign/foreign-truncated-arguments.rs, this generates the following llvm-ir lint warning:

Undefined behavior: Buffer overflow
  %13 = load { i64, i32 }, { i64, i32 }* %12, align 4

repo @ 2342cc3

[cuviper]

I captured the LLVM-IR in a single codegen unit, then ran opt -lint which has the same complaint, just on %4.

$ opt -disable-output -lint foreign-truncated-arguments.ll
Undefined behavior: Buffer overflow
  %4 = load { i64, i32 }, { i64, i32 }* %3, align 4

Here are the relevant snippets from that IR:

%S = type { [0 x i32], i32, [0 x i32], float, [0 x i32], i32, [0 x i32] }
[...]
; foreign_truncated_arguments::main
; Function Attrs: nonlazybind uwtable
define internal void @_ZN27foreign_truncated_arguments4main17h8a09fc9d120f0135E() unnamed_addr #1 {
start:
  %_26 = alloca i32*, align 8
  %_24 = alloca i32*, align 8
  %_22 = alloca { i64*, i64* }, align 8
  %_21 = alloca [2 x { i8*, i64* }], align 8
  %_14 = alloca %"core::fmt::Arguments", align 8
  %_4 = alloca %S, align 4
  %_3 = alloca i32, align 4
  %_1 = alloca { i32*, i32* }, align 8
  %0 = bitcast %S* %_4 to i32*
  store i32 0, i32* %0, align 4
  %1 = getelementptr inbounds %S, %S* %_4, i32 0, i32 3
  store float 0.000000e+00, float* %1, align 4
  %2 = getelementptr inbounds %S, %S* %_4, i32 0, i32 5
  store i32 42, i32* %2, align 4
  %3 = bitcast %S* %_4 to { i64, i32 }*
  %4 = load { i64, i32 }, { i64, i32 }* %3, align 4
  %5 = call i32 @test({ i64, i32 } %4)
  store i32 %5, i32* %_3, align 4
  br label %bb1

I expect S has size 12, but { i64, i32 } would have alignment padding up to size 16.

The lint goes away if I change all { i64, i32 } to packed <{ i64, i32 }>, but maybe we can do better than that.

[mmastrac]

We've been working on enabling ASAN in rusty_v8 (https://github.com/denoland/rusty_v8) and we suspect this is causing some real-world bugs when we call into V8 from Rust. In particular, some exceptions in V8 aren't correctly detected when we compile the Rust parts with opt-level=0.

[apiraino]

WG-prioritization assigning priority (Zulip discussion).

@rustbot label -I-prioritize +P-high