<table border="1" cellspacing="0" cellpadding="8">
    <tr>
        <th>Issue</th>
        <td>
            <a href=https://github.com/llvm/llvm-project/issues/91312>91312</a>
        </td>
    </tr>

    <tr>
        <th>Summary</th>
        <td>
            miscompile TLS wrapper, likely coroutine related, with sanitizer
        </td>
    </tr>

    <tr>
      <th>Labels</th>
      <td>
            new issue
      </td>
    </tr>

    <tr>
      <th>Assignees</th>
      <td>
      </td>
    </tr>

    <tr>
      <th>Reporter</th>
      <td>
          avikivity
      </td>
    </tr>
</table>

<pre>
    Prior to 533b7c1f6c696817df332cc7c9acbe3b454eadf2, compiling some coroutine that references a TLS variable generates this wrapper:

```
0000000000029d80 <_ZTWN2db13schema_tablesL14the_merge_lockE>:
   29d80: 50    pushq   %rax
   29d81: e8 4a b3 10 00        callq   0x1350d0 <__tls_init>
   29d86: 64 48 8b 04 25 00 00 00 00    movq    %fs:0x0, %rax
   29d8f: 48 8d 80 00 00 00 00  leaq    (%rax), %rax
                0000000000029d92: R_X86_64_TPOFF32      _ZN2db13schema_tablesL14the_merge_lockE
   29d96: 59    popq    %rcx
   29d97: c3    retq
   29d98: 0f 1f 84 00 00 00 00 00       nopl    (%rax,%rax)
```

It correctly calls __tls_init.

With 533b7c1f6c696817df332cc7c9acbe3b454eadf2 and later, up to 18.1.1, the following TLS wrapper is generated:

```
0000000000029d80 <_ZTWN2db13schema_tablesL14the_merge_lockE>:
   29d80: 50    pushq   %rax
   29d81: e8 00 00 00 00        callq   0x29d86 <_ZTWN2db13schema_tablesL14the_merge_lockE+0x6>
                0000000000029d82: R_X86_64_PLT32        _ZTH15data_type_for_vIN7seastar13basic_sstringIcjLj15ELb1EEEE-0x4
 29d86: 64 48 8b 04 25 00 00 00 00      movq    %fs:0x0, %rax
   29d8f: 48 8d 80 00 00 00 00          leaq    (%rax), %rax
                0000000000029d92: R_X86_64_TPOFF32      _ZN2db13schema_tablesL14the_merge_lockE
   29d96: 59    popq    %rcx
   29d97: c3    retq
   29d98: 0f 1f 84 00 00 00 00 00       nopl    (%rax,%rax)
```

The call to __tls_init was replaced by a call to some random function. When the coroutine is then called, it does not inirialize the object.

I will follow up with a full reproducer.
</pre>
<img width="1px" height="1px" alt="" src="http://email.email.llvm.org/o/eJzsVcFu4zYQ_Rr6MohBkZIlHnTIZm00QLANWgMp9iJQ1MhiQotakrKT_fqCsmPHQVCkQA89rCHIEDjzNPP03oz0Xm96xJJkX0j2dSbH0FlXyp1-0jsdXma1bV7Ke6etg2Ah47zOVdIu1EIsiiRvWs6ZUrkSUtXI6zRLUTYtI-wGlN0O2uh-A95uEZR1dgy6RwidDOCwRYe9Qg8S1nd_wk46LWuDsMEenQzoIXTaw97JYUBH-DWhXwl9vS_o8Zoe6fnHRFNQIPym-r5--MaaOuFedbiVVYjw_i5JQ4fVFt0GK2PV05Lw5QkdACYAwq8ho0CoGEbf_SBUEJY5-XwRlcQoLCCVUHNIKNApQ0ljYgZ9TnhGm0MxVTC-0r0O8W1vQRYRZJFCWkBRA02BZRHndBEqtnZ3rKD1hF_TZxr5_aCgNmJFoAYK-h7FoDygFMdMJt7DxGMqLskULIL-Uf1VLKpFWq3vf1-tOCNUVN8_x-6bAsXUbCYmXu3wSqu66ELkMUjxGOQw_Lg4K-IZbSFpoUgvOjw02dvBXDZ5c-72I-Uc7rch6tOhCuYF4vfzcP5i87eRDzp0n7YByL4BIwO6yPQ4RAslxTyZJ_E5dAitNcbuo0miB45aB-1PLmj-z8J_R_5Z-JOw_10t7At9XpzM8ZESi0sl3t-tjzpc_5ZkjQyyCi8DVq111e72W-5R-iBdwmvptaq8D073m1v1ePeYZMu7Olkul8sr-pweW_uMGeE_suPr75ct_9GW6w4nN0bfnP0Ie-nB4WCkwgbqF5CnoGnTONk3dgvt2KugbT-Hhw77yW3nHaTjdsF-SsQmEq4DNBY99DaA7rXT0uifOKXZ-hHV5Ri4hb025mjf6Ox9nAsS2tGYWJuzzajQzWdNyRvBhZxhmeRJRvOMCz7ryrZmKm-w5pwJxbDO5CIvpKhTVK1iVM50yShLaUZzKlKR8Xnd0IwlWKiCtmKRU5JS3Ept5sbstnPrNjPt_YilSHjCZkbWaPy01hnrcQ_TIWEsbnlXxpyretx4klKjffBnlKCDwXKr_WGB49vJFIky-gnjlDxx6dBMg4rdHFjwstdB_0Q3G50puxCGaBPCVoStNjp0Yz1XdkvYKr7y-Hc1OBtJJmw1FeoJW02N_B0AAP__qVl0bg">