[all-commits] [llvm/llvm-project] 2df0db: [UBSan] Fix assertion failure in EmitCheckedInBoun...

[Adam Magier via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: 2df0db6952fb5e059b14470c96a922683dc95a66
      https://github.com/llvm/llvm-project/commit/2df0db6952fb5e059b14470c96a922683dc95a66
  Author: Adam Magier <adam.a.magier.foss at gmail.com>
  Date:   2026-08-03 (Mon, 03 Aug 2026)

  Changed paths:
    M clang/lib/CodeGen/CGExprScalar.cpp
    A clang/test/CodeGen/ubsan-pointer-overflow-constant-fold.c

  Log Message:
  -----------
  [UBSan] Fix assertion failure in EmitCheckedInBoundsGEP for constant-… (#191278)

…folded overflowing offsets

EmitGEPOffsetInBytes has two paths: for fully constant GEPs it subtracts
pointer values and always returns OffsetOverflows=false, but for
non-constant GEPs it iterates operands using checked arithmetic. The
assertion in EmitCheckedInBoundsGEP assumed a constant TotalOffset
implies no overflow, conflating the two paths.

In the non-constant path, the offset can be entirely constant-folded
(constant index * constant element size) while the GEP itself remains
non-constant (runtime base pointer). If that arithmetic overflows
intptr_t, we get a constant TotalOffset with OffsetOverflows=true,
triggering the assertion. This is easily hit on 16-bit targets like
MSP430 with realistic struct array indices.

Remove the assertion. The existing codegen already handles this
correctly: the constant OffsetOverflows=true propagates into the check
condition, making the sanitizer always fire at runtime.

Fixes: https://github.com/llvm/llvm-project/issues/48168

Assisted-by: Kiro CLI / Claude Opus 4.6 (1M context)



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications