# 22902339 memory corruption caused by undefined behavior in LLVM IR Module

# 24314687 static initialization of optimization passes doesn't work as

# intended

# 3.9.X for upstream.

--- include/llvm/IR/BasicBlock.h	2015-11-10 18:26:42.000000000 -0800

+++ include/llvm/IR/BasicBlock.h	2016-05-28 16:37:28.925076023 -0700

@@ -78,10 +78,11 @@

   LLVMContext &getContext() const;

   /// Instruction iterators...

-  typedef InstListType::iterator iterator;

-  typedef InstListType::const_iterator const_iterator;

-  typedef InstListType::reverse_iterator reverse_iterator;

-  typedef InstListType::const_reverse_iterator const_reverse_iterator;

+  typedef SymbolTableList<Instruction>::iterator iterator;

+  typedef SymbolTableList<Instruction>::const_iterator const_iterator;

+  typedef SymbolTableList<Instruction>::reverse_iterator reverse_iterator;

+  typedef SymbolTableList<Instruction>::const_reverse_iterator

+          const_reverse_iterator;

   /// \brief Creates a new BasicBlock.

   ///

@@ -148,8 +149,8 @@

   /// suitable for inserting a non-PHI instruction.

   ///

   /// In particular, it skips all PHIs and LandingPad instructions.

-  iterator getFirstInsertionPt();

-  const_iterator getFirstInsertionPt() const {

+  BasicBlock::iterator getFirstInsertionPt();

+  BasicBlock::const_iterator getFirstInsertionPt() const {

     return const_cast<BasicBlock*>(this)->getFirstInsertionPt();

   }

###

--- include/llvm/IR/Value.h	2016-02-04 08:59:45.000000000 -0800

+++ include/llvm/IR/Value.h	2016-05-29 12:21:18.779271419 -0700

@@ -74,6 +74,7 @@

   const unsigned char SubclassID;   // Subclass identifier (for isa/dyn_cast)

   unsigned char HasValueHandle : 1; // Has a ValueHandle pointing to this?

+

 protected:

   /// \brief Hold subclass data that can be dropped.

   ///

@@ -113,17 +114,25 @@

 private:

   template <typename UseT> // UseT == 'Use' or 'const Use'

-  class use_iterator_impl

-      : public std::iterator<std::forward_iterator_tag, UseT *> {

+  class use_iterator_impl :

+    public std::iterator<std::forward_iterator_tag, UseT *> {

     UseT *U;

-    explicit use_iterator_impl(UseT *u) : U(u) {}

+

+    explicit use_iterator_impl(UseT *u)

+      : std::iterator<std::forward_iterator_tag, UseT *>(), U(u) { }

     friend class Value;

   public:

-    use_iterator_impl() : U() {}

+    use_iterator_impl()

+      : std::iterator<std::forward_iterator_tag, UseT *>(), U(nullptr) { }

-    bool operator==(const use_iterator_impl &x) const { return U == x.U; }

-    bool operator!=(const use_iterator_impl &x) const { return !operator==(x); }

+    bool operator==(const use_iterator_impl &x) const {

+      return U == x.U;

+    }

+

+    bool operator!=(const use_iterator_impl &x) const {

+      return !operator==(x);

+    }

     use_iterator_impl &operator++() { // Preincrement

       assert(U && "Cannot increment end iterator!");

@@ -150,18 +159,28 @@

   template <typename UserTy> // UserTy == 'User' or 'const User'

   class user_iterator_impl

-      : public std::iterator<std::forward_iterator_tag, UserTy *> {

+  : public std::iterator<std::forward_iterator_tag, UserTy *> {

+  private:

     use_iterator_impl<Use> UI;

-    explicit user_iterator_impl(Use *U) : UI(U) {}

+

+    explicit user_iterator_impl(Use *U)

+      : std::iterator<std::forward_iterator_tag, UserTy *>(), UI(U) { }

     friend class Value;

   public:

-    user_iterator_impl() {}

+    user_iterator_impl()

+    : std::iterator<std::forward_iterator_tag, UserTy *>(), UI() { }

-    bool operator==(const user_iterator_impl &x) const { return UI == x.UI; }

-    bool operator!=(const user_iterator_impl &x) const { return !operator==(x); }

+    bool operator==(const user_iterator_impl &x) const {

+      return UI == x.UI;

+    }

-    /// \brief Returns true if this iterator is equal to user_end() on the value.

+    bool operator!=(const user_iterator_impl &x) const {

+      return !operator==(x);

+    }

+

+    /// \brief Returns true if this iterator is equal to user_end()

+    /// on the value.

     bool atEnd() const { return *this == user_iterator_impl(); }

     user_iterator_impl &operator++() { // Preincrement

@@ -193,6 +212,7 @@

 protected:

   Value(Type *Ty, unsigned scid);

+

 public:

   virtual ~Value();

###

--- lib/IR/User.cpp	2015-09-23 18:00:49.000000000 -0700

+++ lib/IR/User.cpp	2016-05-29 12:13:16.188732011 -0700

@@ -12,6 +12,8 @@

 #include "llvm/IR/GlobalValue.h"

 #include "llvm/IR/Operator.h"

+#include <cstdlib>

+

 namespace llvm {

 class BasicBlock;

@@ -42,33 +44,53 @@

 void User::allocHungoffUses(unsigned N, bool IsPhi) {

   assert(HasHungOffUses && "alloc must have hung off uses");

-

-  static_assert(AlignOf<Use>::Alignment >= AlignOf<Use::UserRef>::Alignment,

-                "Alignment is insufficient for 'hung-off-uses' pieces");

+  static_assert(AlignOf<Use>::Alignment >=

+                AlignOf<Use::UserRef>::Alignment,

+                "Insufficient alignment for 'hung-off-uses' pieces");

   static_assert(AlignOf<Use::UserRef>::Alignment >=

-                    AlignOf<BasicBlock *>::Alignment,

-                "Alignment is insufficient for 'hung-off-uses' pieces");

+                AlignOf<BasicBlock*>::Alignment,

+                "Insufficient alignment for 'hung-off-uses' pieces");

   // Allocate the array of Uses, followed by a pointer (with bottom bit set) to

   // the User.

   size_t size = N * sizeof(Use) + sizeof(Use::UserRef);

   if (IsPhi)

     size += N * sizeof(BasicBlock *);

-  Use *Begin = static_cast<Use*>(::operator new(size));

+

+  size_t Alignment =

+    std::max<size_t>(AlignOf<Use>::Alignment,

+                     std::max<size_t>(AlignOf<BasicBlock*>::Alignment,

+                                      AlignOf<Use::UserRef>::Alignment));

+  size = llvm::RoundUpToAlignment(size, Alignment);

+  void *Mem;

+

+  if (posix_memalign(&Mem, Alignment, size) != 0) {

+    llvm::errs() << __PRETTY_FUNCTION__

+      << ": posix_memalign(3c) failed!\n";

+    abort();

+  }

+

+  (void) std::memset(Mem, 0, size);

+  Use *Begin = reinterpret_cast<Use*>(Mem);

   Use *End = Begin + N;

   (void) new(End) Use::UserRef(const_cast<User*>(this), 1);

   setOperandList(Use::initTags(Begin, End));

 }

 void User::growHungoffUses(unsigned NewNumUses, bool IsPhi) {

-  assert(HasHungOffUses && "realloc must have hung off uses");

-

+  assert(HasHungOffUses && "alloc must have hung off uses");

   unsigned OldNumUses = getNumOperands();

   // We don't support shrinking the number of uses.  We wouldn't have enough

   // space to copy the old uses in to the new space.

   assert(NewNumUses > OldNumUses && "realloc must grow num uses");

+  if (OldNumUses >= NewNumUses) {

+    llvm::errs() << __PRETTY_FUNCTION__

+      << ": reallocation must grow new uses!\n";

+    abort();

+  }

+

   Use *OldOps = getOperandList();

   allocHungoffUses(NewNumUses, IsPhi);

   Use *NewOps = getOperandList();

@@ -101,7 +123,6 @@

 MutableArrayRef<uint8_t> User::getDescriptor() {

   assert(HasDescriptor && "Don't call otherwise!");

-  assert(!HasHungOffUses && "Invariant!");

   auto *DI = reinterpret_cast<DescriptorInfo *>(getIntrusiveOperands()) - 1;

   assert(DI->SizeInBytes != 0 && "Should not have had a descriptor otherwise!");

@@ -114,20 +135,31 @@

 //                         User operator new Implementations

 //===----------------------------------------------------------------------===//

-void *User::allocateFixedOperandUser(size_t Size, unsigned Us,

-                                     unsigned DescBytes) {

+void* LLVM_ATTRIBUTE_NOINLINE

+User::allocateFixedOperandUser(size_t Size, unsigned Us, unsigned DescBytes) {

   assert(Us < (1u << NumUserOperandsBits) && "Too many operands");

   static_assert(sizeof(DescriptorInfo) % sizeof(void *) == 0, "Required below");

   unsigned DescBytesToAllocate =

-      DescBytes == 0 ? 0 : (DescBytes + sizeof(DescriptorInfo));

+    DescBytes == 0 ?  0 : (DescBytes + sizeof(DescriptorInfo));

+  DescBytesToAllocate = llvm::RoundUpToAlignment(DescBytesToAllocate, 8U);

   assert(DescBytesToAllocate % sizeof(void *) == 0 &&

          "We need this to satisfy alignment constraints for Uses");

-  uint8_t *Storage = static_cast<uint8_t *>(

-      ::operator new(Size + sizeof(Use) * Us + DescBytesToAllocate));

-  Use *Start = reinterpret_cast<Use *>(Storage + DescBytesToAllocate);

+  unsigned AllocSize = Size + sizeof(Use) * Us + DescBytesToAllocate;

+  AllocSize = std::max<unsigned>(AllocSize, alignof(void*));

+

+  uint8_t *Storage;

+  if (posix_memalign(reinterpret_cast<void**>(&Storage),

+                     llvm::AlignOf<uint64_t>::Alignment, AllocSize) != 0) {

+    llvm::errs() << __PRETTY_FUNCTION__

+      << ": posix_memalign(3c) failed!\n";

+    abort();

+  }

+

+  Use *Start = reinterpret_cast<Use*>(reinterpret_cast<void*>(

+      reinterpret_cast<uint8_t*>(Storage) + DescBytesToAllocate));

   Use *End = Start + Us;

   User *Obj = reinterpret_cast<User*>(End);

   Obj->NumUserOperands = Us;

@@ -153,7 +185,16 @@

 void *User::operator new(size_t Size) {

   // Allocate space for a single Use*

-  void *Storage = ::operator new(Size + sizeof(Use *));

+  void *Storage;

+  unsigned AllocSize = Size + sizeof(Use*);

+  AllocSize = std::max<unsigned>(AllocSize, sizeof(void*));

+  if (posix_memalign(&Storage, llvm::AlignOf<uint64_t>::Alignment,

+                     AllocSize) != 0) {

+    llvm::errs() << __PRETTY_FUNCTION__

+      << ": posix_memalign(3c) failed!\n";

+    abort();

+  }

+

   Use **HungOffOperandList = static_cast<Use **>(Storage);

   User *Obj = reinterpret_cast<User *>(HungOffOperandList + 1);

   Obj->NumUserOperands = 0;

@@ -170,7 +211,7 @@

 void User::operator delete(void *Usr) {

   // Hung off uses use a single Use* before the User, while other subclasses

   // use a Use[] allocated prior to the user.

-  User *Obj = static_cast<User *>(Usr);

+  User *Obj = reinterpret_cast<User *>(Usr);

   if (Obj->HasHungOffUses) {

     assert(!Obj->HasDescriptor && "not supported!");

@@ -178,19 +219,19 @@

     // drop the hung off uses.

     Use::zap(*HungOffOperandList, *HungOffOperandList + Obj->NumUserOperands,

              /* Delete */ true);

-    ::operator delete(HungOffOperandList);

+    std::free(reinterpret_cast<void*>(HungOffOperandList));

   } else if (Obj->HasDescriptor) {

     Use *UseBegin = static_cast<Use *>(Usr) - Obj->NumUserOperands;

     Use::zap(UseBegin, UseBegin + Obj->NumUserOperands, /* Delete */ false);

     auto *DI = reinterpret_cast<DescriptorInfo *>(UseBegin) - 1;

-    uint8_t *Storage = reinterpret_cast<uint8_t *>(DI) - DI->SizeInBytes;

-    ::operator delete(Storage);

+    uint64_t *Storage = reinterpret_cast<uint64_t *>(DI) - DI->SizeInBytes;

+    std::free(reinterpret_cast<void*>(Storage));

   } else {

-    Use *Storage = static_cast<Use *>(Usr) - Obj->NumUserOperands;

+    Use *Storage = reinterpret_cast<Use *>(Usr) - Obj->NumUserOperands;

     Use::zap(Storage, Storage + Obj->NumUserOperands,

              /* Delete */ false);

-    ::operator delete(Storage);

+    std::free(reinterpret_cast<void*>(Storage));

   }

 }

###

--- include/llvm/IR/User.h	2015-12-18 23:52:49.000000000 -0900

+++ include/llvm/IR/User.h	2016-07-06 18:49:29.963198410 -0800

@@ -40,7 +40,7 @@

   friend struct HungoffOperandTraits;

   virtual void anchor();

-  LLVM_ATTRIBUTE_ALWAYS_INLINE inline static void *

+  static void* LLVM_ATTRIBUTE_NOINLINE

   allocateFixedOperandUser(size_t, unsigned, unsigned);

 protected:

###

--- include/llvm/IR/Attributes.h	2015-12-22 18:57:37.000000000 -0500

+++ include/llvm/IR/Attributes.h	2016-05-08 23:19:20.515430339 -0400

@@ -399,20 +399,25 @@

 public:

   AttrBuilder()

-      : Attrs(0), Alignment(0), StackAlignment(0), DerefBytes(0),

-        DerefOrNullBytes(0) {}

+    : Attrs(0), TargetDepAttrs(), Alignment(0), StackAlignment(0),

+  DerefBytes(0), DerefOrNullBytes(0) { }

+

   explicit AttrBuilder(uint64_t Val)

-      : Attrs(0), Alignment(0), StackAlignment(0), DerefBytes(0),

-        DerefOrNullBytes(0) {

+    : Attrs(0), TargetDepAttrs(), Alignment(0), StackAlignment(0),

+    DerefBytes(0), DerefOrNullBytes(0) {

     addRawValue(Val);

   }

+

   AttrBuilder(const Attribute &A)

-      : Attrs(0), Alignment(0), StackAlignment(0), DerefBytes(0),

-        DerefOrNullBytes(0) {

+    : Attrs(0), TargetDepAttrs(), Alignment(0), StackAlignment(0),

+    DerefBytes(0), DerefOrNullBytes(0) {

     addAttribute(A);

   }

+

   AttrBuilder(AttributeSet AS, unsigned Idx);

+  ~AttrBuilder() { }

+

   void clear();

   /// \brief Add an attribute to the builder.

###

--- include/llvm/IR/IRBuilder.h	2016-02-18 16:08:56.000000000 -0800

+++ include/llvm/IR/IRBuilder.h	2016-05-09 19:14:26.534949228 -0700

@@ -64,13 +64,15 @@

   ArrayRef<OperandBundleDef> DefaultOperandBundles;

 public:

-  IRBuilderBase(LLVMContext &context, MDNode *FPMathTag = nullptr,

+  IRBuilderBase(LLVMContext &Ctx, MDNode *FPMathTag = nullptr,

                 ArrayRef<OperandBundleDef> OpBundles = None)

-      : Context(context), DefaultFPMathTag(FPMathTag), FMF(),

-        DefaultOperandBundles(OpBundles) {

-    ClearInsertionPoint();

+  : CurDbgLocation(), BB(nullptr), InsertPt(), Context(Ctx),

+  DefaultFPMathTag(FPMathTag), FMF(), DefaultOperandBundles(OpBundles) {

+    InsertPt.reset(nullptr);

   }

+  virtual ~IRBuilderBase() { }

+

   //===--------------------------------------------------------------------===//

   // Builder configuration methods

   //===--------------------------------------------------------------------===//

###

--- lib/IR/IRBuilder.cpp	2015-11-18 21:56:52.000000000 -0800

+++ lib/IR/IRBuilder.cpp	2016-05-13 17:40:40.999056490 -0700

@@ -18,8 +18,15 @@

 #include "llvm/IR/Intrinsics.h"

 #include "llvm/IR/LLVMContext.h"

 #include "llvm/IR/Statepoint.h"

+#include "llvm/LinkAllIR.h"

 using namespace llvm;

+namespace llvm {

+  /// See the file ${top_srcdir}/include/llvm/LinkAllIR.h for the

+  /// explanation for this hack.

+  ForceVMCoreLinking *ForceVMCoreLinking::FVMCL = new ForceVMCoreLinking();

+}

+

 /// CreateGlobalString - Make a new global variable with an initializer that

 /// has array of i8 type filled in with the nul terminated string value

 /// specified.  If Name is specified, it is the name of the global variable

###

--- lib/IR/Verifier.cpp	2016-01-12 18:31:14.000000000 -0800

+++ lib/IR/Verifier.cpp	2016-05-14 07:42:08.348333940 -0700

@@ -578,8 +578,12 @@

 void Verifier::visitAliaseeSubExpr(SmallPtrSetImpl<const GlobalAlias*> &Visited,

                                    const GlobalAlias &GA, const Constant &C) {

   if (const auto *GV = dyn_cast<GlobalValue>(&C)) {

+#if 0

+    // Check the DeclarationForLinker() for all the extern symbol references.

+    // This should not happen here in any scenario.

     Assert(!GV->isDeclarationForLinker(), "Alias must point to a definition",

            &GA);

+#endif

     if (const auto *GA2 = dyn_cast<GlobalAlias>(GV)) {

       Assert(Visited.insert(GA2).second, "Aliases cannot form a cycle", &GA);

###

--- include/llvm/IR/Metadata.h	2016-01-11 13:37:41.000000000 -0800

+++ include/llvm/IR/Metadata.h	2016-05-10 07:11:35.580234020 -0700

@@ -25,6 +25,7 @@

 #include "llvm/IR/LLVMContext.h"

 #include "llvm/IR/Value.h"

 #include "llvm/Support/ErrorHandling.h"

+#include "llvm/Support/raw_ostream.h"

 #include <type_traits>

 namespace llvm {

@@ -42,6 +43,7 @@

 /// This is a root class for typeless data in the IR.

 class Metadata {

   friend class ReplaceableMetadataImpl;

+  friend class MDNode;

   /// \brief RTTI.

   const unsigned char SubclassID;

@@ -51,7 +53,8 @@

   enum StorageType { Uniqued, Distinct, Temporary };

   /// \brief Storage flag for non-uniqued, otherwise unowned, metadata.

-  unsigned Storage : 2;

+  unsigned Storage;

+

   // TODO: expose remaining bits to subclasses.

   unsigned short SubclassData16;

@@ -91,8 +94,9 @@

 protected:

   Metadata(unsigned ID, StorageType Storage)

-      : SubclassID(ID), Storage(Storage), SubclassData16(0), SubclassData32(0) {

-  }

+    : SubclassID(ID), Storage(Storage), SubclassData16(0),

+    SubclassData32(0) { }

+

   ~Metadata() = default;

   /// \brief Default handling of a changed operand, which asserts.

@@ -283,13 +287,15 @@

   LLVMContext &Context;

   uint64_t NextIndex;

   SmallDenseMap<void *, std::pair<OwnerTy, uint64_t>, 4> UseMap;

+

   /// Flag that can be set to false if this metadata should not be

   /// RAUW'ed, e.g. if it is used as the key of a map.

   bool CanReplace;

 public:

-  ReplaceableMetadataImpl(LLVMContext &Context)

-      : Context(Context), NextIndex(0), CanReplace(true) {}

+  ReplaceableMetadataImpl(LLVMContext &Ctx)

+    : Context(Ctx), NextIndex(0), UseMap(), CanReplace(true) { }

+

   ~ReplaceableMetadataImpl() {

     assert(UseMap.empty() && "Cannot destroy in-use replaceable metadata");

   }

@@ -327,7 +333,7 @@

 /// Because of full uniquing support, each value is only wrapped by a single \a

 /// ValueAsMetadata object, so the lookup maps are far more efficient than

 /// those using ValueHandleBase.

-class ValueAsMetadata : public Metadata, ReplaceableMetadataImpl {

+class ValueAsMetadata : public Metadata, public ReplaceableMetadataImpl {

   friend class ReplaceableMetadataImpl;

   friend class LLVMContextImpl;

@@ -343,6 +349,7 @@

       : Metadata(ID, Uniqued), ReplaceableMetadataImpl(V->getContext()), V(V) {

     assert(V && "Expected valid value");

   }

+

   ~ValueAsMetadata() = default;

 public:

@@ -396,6 +403,7 @@

   static ConstantAsMetadata *get(Constant *C) {

     return ValueAsMetadata::getConstant(C);

   }

+

   static ConstantAsMetadata *getIfExists(Constant *C) {

     return ValueAsMetadata::getConstantIfExists(C);

   }

@@ -421,6 +429,7 @@

   static LocalAsMetadata *get(Value *Local) {

     return ValueAsMetadata::getLocal(Local);

   }

+

   static LocalAsMetadata *getIfExists(Value *Local) {

     return ValueAsMetadata::getLocalIfExists(Local);

   }

@@ -748,6 +757,7 @@

       : Ptr(ReplaceableUses.release()) {

     assert(getReplaceableUses() && "Expected non-null replaceable uses");

   }

+

   ~ContextAndReplaceableUses() { delete getReplaceableUses(); }

   operator LLVMContext &() { return getContext(); }

@@ -756,11 +766,13 @@

   bool hasReplaceableUses() const {

     return Ptr.is<ReplaceableMetadataImpl *>();

   }

+

   LLVMContext &getContext() const {

     if (hasReplaceableUses())

       return getReplaceableUses()->getContext();

     return *Ptr.get<LLVMContext *>();

   }

+

   ReplaceableMetadataImpl *getReplaceableUses() const {

     if (hasReplaceableUses())

       return Ptr.get<ReplaceableMetadataImpl *>();

@@ -820,10 +832,11 @@

 class MDNode : public Metadata {

   friend class ReplaceableMetadataImpl;

   friend class LLVMContextImpl;

+  friend class MDNodeFwdDecl;

+  friend class MDTuple;

   MDNode(const MDNode &) = delete;

   void operator=(const MDNode &) = delete;

-  void *operator new(size_t) = delete;

   unsigned NumOperands;

   unsigned NumUnresolved;

@@ -831,17 +844,21 @@

 protected:

   ContextAndReplaceableUses Context;

-  void *operator new(size_t Size, unsigned NumOps);

-  void operator delete(void *Mem);