<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><meta http-equiv=Content-Type content="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 15 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Consolas;
panose-1:2 11 6 9 2 2 4 3 2 4;}
@font-face
{font-family:"Lucida Sans Unicode";
panose-1:2 11 6 2 3 5 4 2 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0cm;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:#0563C1;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:#954F72;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0cm;
mso-margin-bottom-alt:auto;
margin-left:0cm;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri",sans-serif;
color:windowtext;}
span.pre
{mso-style-name:pre;}
span.EmailStyle20
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:612.0pt 792.0pt;
margin:72.0pt 72.0pt 72.0pt 72.0pt;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link="#0563C1" vlink="#954F72"><div class=WordSection1><p class=MsoNormal>You<span style='font-family:"Times New Roman",serif'>’</span>re right: non-inbounds GEPs may return OOB pointers. OOB pointers cannot be dereferenced.<o:p></o:p></p><p class=MsoNormal>OOB pointers can still be used as input to GEP to bring them back to being within bounds.<o:p></o:p></p><p class=MsoNormal>OOB pointers can also be used for pointer comparisons.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Nuno<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><div><div style='border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0cm 0cm 0cm'><p class=MsoNormal><b>From:</b> Gautam Chakrabarti via llvm-dev<br><b>Sent:</b> 07 January 2020 06:37<br><b>To:</b> LLVM Dev <llvm-dev@lists.llvm.org><br><b>Subject:</b> [llvm-dev] Semantics of any out-of-bounds address returned by GEP<o:p></o:p></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Hi,<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am looking to get some clarification about out-of-bounds address that may be returned by a GEP.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>My understanding is that in the absence of the <span style='font-family:"Courier New"'>inbounds</span> keyword, a GEP may return a pointer that is out-of-bounds of the underlying allocated object. Is it correct that any such out-of-bounds address must not be dereferenced?<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>I am a bit confused by the current wordings on this.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><a href="https://llvm.org/docs/LangRef.html#getelementptr-instruction">https://llvm.org/docs/LangRef.html#getelementptr-instruction</a> says:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>“<span style='font-size:10.5pt;font-family:"Lucida Sans Unicode",sans-serif;color:black;background:white'>If the </span><span class=pre><span style='font-size:10.5pt;font-family:Consolas;color:black;background:white'>inbounds</span></span><span style='font-size:10.5pt;font-family:"Lucida Sans Unicode",sans-serif;color:black;background:white'> keyword is not present, .... The result value of the </span><span class=pre><span style='font-size:10.5pt;font-family:Consolas;color:black;background:white'>getelementptr</span></span><span style='font-size:10.5pt;font-family:"Lucida Sans Unicode",sans-serif;color:black;background:white'> may be outside the object pointed to by the base pointer. The result value may not necessarily be used to access memory though, even if it happens to point into allocated storage.</span>”<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This seems to say that the out-of-bounds pointer may or may not be used to access memory.<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>However, <a href="https://llvm.org/docs/GetElementPtr.html#how-is-gep-different-from-ptrtoint-arithmetic-and-inttoptr">https://llvm.org/docs/GetElementPtr.html#how-is-gep-different-from-ptrtoint-arithmetic-and-inttoptr</a> says:<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>“<span style='font-size:10.5pt;font-family:"Lucida Sans Unicode",sans-serif;color:black;background:white'>Also, GEP carries additional pointer aliasing rules. It’s invalid to take a GEP from one object, address into a different separately allocated object, and dereference it. IR producers (front-ends) must follow this rule, and consumers (optimizers, specifically alias analysis) benefit from being able to rely on it.</span>”<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>This quite clearly says the out-of-bounds address shall not be dereferenced through. This also seems to be the assumption in AliasAnalysis implementation (as already stated in above documentation).<o:p></o:p></p><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal>Thanks,<o:p></o:p></p><p class=MsoNormal>Gautam<o:p></o:p></p></div></body></html>