[compiler-rt] [llvm] [ASan] Do not instrument catch block parameters on Windows (PR #159618)
David Justo via llvm-commits
llvm-commits at lists.llvm.org
Fri Oct 17 08:58:10 PDT 2025
https://github.com/davidmrdavid updated https://github.com/llvm/llvm-project/pull/159618
>From ece2a2ba47d043f5225fd408c66749d8bd67c80c Mon Sep 17 00:00:00 2001
From: David Justo <dajusto at microsoft.com>
Date: Thu, 18 Sep 2025 10:17:12 -0700
Subject: [PATCH 01/10] do not asan-instrument catch parameters on windows
---
.../Instrumentation/AddressSanitizer.cpp | 16 +++++++++++++++-
1 file changed, 15 insertions(+), 1 deletion(-)
diff --git a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
index 42c3d4a4f4c46..986d3c2861af0 100644
--- a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
+++ b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
@@ -1397,6 +1397,16 @@ void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI,
MI->eraseFromParent();
}
+// Check if an alloca is a catch block parameter
+static bool isCatchParameter(const AllocaInst &AI) {
+ for (const Use &U : AI.uses()) {
+ if (isa<CatchPadInst>(U.getUser())) {
+ return true;
+ }
+ }
+ return false;
+}
+
/// Check if we want (and can) handle this alloca.
bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) {
auto [It, Inserted] = ProcessedAllocas.try_emplace(&AI);
@@ -1417,7 +1427,11 @@ bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) {
// swifterror allocas are register promoted by ISel
!AI.isSwiftError() &&
// safe allocas are not interesting
- !(SSGI && SSGI->isSafe(AI)));
+ !(SSGI && SSGI->isSafe(AI)) &&
+ // Mitigation for https://github.com/google/sanitizers/issues/749
+ // We don't instrument Windows catch-block parameters to avoid
+ // interfering with exception handling assumptions.
+ !(TargetTriple.isOSWindows() && isCatchParameter(AI)));
It->second = IsInteresting;
return IsInteresting;
>From bff409da82c600d5b07915b81f7ec51f99e7c276 Mon Sep 17 00:00:00 2001
From: David Justo <dajusto at microsoft.com>
Date: Thu, 18 Sep 2025 10:25:18 -0700
Subject: [PATCH 02/10] add basic unit test: catches exception 'inline' and in
another frame
---
.../Windows/basic_exception_handling.cpp | 36 +++++++++++++++++++
1 file changed, 36 insertions(+)
create mode 100644 compiler-rt/test/asan/TestCases/Windows/basic_exception_handling.cpp
diff --git a/compiler-rt/test/asan/TestCases/Windows/basic_exception_handling.cpp b/compiler-rt/test/asan/TestCases/Windows/basic_exception_handling.cpp
new file mode 100644
index 0000000000000..94ca4b9bf2df0
--- /dev/null
+++ b/compiler-rt/test/asan/TestCases/Windows/basic_exception_handling.cpp
@@ -0,0 +1,36 @@
+// RUN: %clangxx_asan %s -o %t
+// RUN: %run %t | FileCheck %s
+
+// This test tests that declaring a parameter in a catch-block does not produce a false positive
+// ASan error on Windows.
+
+// This code is based on the repro in https://github.com/google/sanitizers/issues/749
+#include <cstdio>
+#include <exception>
+
+void throwInFunction(){
+ throw std::exception("test2");
+}
+
+int main()
+{
+ // case 1: direct throw
+ try {
+ throw std::exception("test1");
+ } catch (const std::exception& ex){
+ puts(ex.what());
+ // CHECK: test1
+ }
+
+ // case 2: throw in function
+ try {
+ throwInFunction();
+ } catch (const std::exception& ex){
+ puts(ex.what());
+ // CHECK: test2
+ }
+
+ printf("Success!\n");
+ // CHECK: Success!
+ return 0;
+}
\ No newline at end of file
>From 043848d2fecc459b5d250298c20cb115d2f1c4ef Mon Sep 17 00:00:00 2001
From: David Justo <dajusto at microsoft.com>
Date: Thu, 18 Sep 2025 11:08:07 -0700
Subject: [PATCH 03/10] apply clang-format on
`compiler-rt/test/asan/TestCases/Windows/basic_exception_handling.cpp`
---
.../Windows/basic_exception_handling.cpp | 41 +++++++++----------
1 file changed, 19 insertions(+), 22 deletions(-)
diff --git a/compiler-rt/test/asan/TestCases/Windows/basic_exception_handling.cpp b/compiler-rt/test/asan/TestCases/Windows/basic_exception_handling.cpp
index 94ca4b9bf2df0..f8dd49e64c760 100644
--- a/compiler-rt/test/asan/TestCases/Windows/basic_exception_handling.cpp
+++ b/compiler-rt/test/asan/TestCases/Windows/basic_exception_handling.cpp
@@ -8,29 +8,26 @@
#include <cstdio>
#include <exception>
-void throwInFunction(){
- throw std::exception("test2");
-}
+void throwInFunction() { throw std::exception("test2"); }
-int main()
-{
- // case 1: direct throw
- try {
- throw std::exception("test1");
- } catch (const std::exception& ex){
- puts(ex.what());
- // CHECK: test1
- }
+int main() {
+ // case 1: direct throw
+ try {
+ throw std::exception("test1");
+ } catch (const std::exception &ex) {
+ puts(ex.what());
+ // CHECK: test1
+ }
- // case 2: throw in function
- try {
- throwInFunction();
- } catch (const std::exception& ex){
- puts(ex.what());
- // CHECK: test2
- }
+ // case 2: throw in function
+ try {
+ throwInFunction();
+ } catch (const std::exception &ex) {
+ puts(ex.what());
+ // CHECK: test2
+ }
- printf("Success!\n");
- // CHECK: Success!
- return 0;
+ printf("Success!\n");
+ // CHECK: Success!
+ return 0;
}
\ No newline at end of file
>From 2326be0809f140351ae1f740a18d9214ca878019 Mon Sep 17 00:00:00 2001
From: David Justo <dajusto at microsoft.com>
Date: Mon, 22 Sep 2025 20:22:14 -0700
Subject: [PATCH 04/10] optimization: disable catch-parameter instrumentation
via a linear pass over function basic blocks
---
.../Instrumentation/AddressSanitizer.cpp | 38 +++++++++++--------
1 file changed, 23 insertions(+), 15 deletions(-)
diff --git a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
index 986d3c2861af0..598fa8e9421c9 100644
--- a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
+++ b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
@@ -847,6 +847,7 @@ struct AddressSanitizer {
bool maybeInsertAsanInitAtFunctionEntry(Function &F);
bool maybeInsertDynamicShadowAtFunctionEntry(Function &F);
void markEscapedLocalAllocas(Function &F);
+ void markCatchParametersAsUninteresting(Function &F);
private:
friend struct FunctionStackPoisoner;
@@ -1397,16 +1398,6 @@ void AddressSanitizer::instrumentMemIntrinsic(MemIntrinsic *MI,
MI->eraseFromParent();
}
-// Check if an alloca is a catch block parameter
-static bool isCatchParameter(const AllocaInst &AI) {
- for (const Use &U : AI.uses()) {
- if (isa<CatchPadInst>(U.getUser())) {
- return true;
- }
- }
- return false;
-}
-
/// Check if we want (and can) handle this alloca.
bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) {
auto [It, Inserted] = ProcessedAllocas.try_emplace(&AI);
@@ -1427,11 +1418,7 @@ bool AddressSanitizer::isInterestingAlloca(const AllocaInst &AI) {
// swifterror allocas are register promoted by ISel
!AI.isSwiftError() &&
// safe allocas are not interesting
- !(SSGI && SSGI->isSafe(AI)) &&
- // Mitigation for https://github.com/google/sanitizers/issues/749
- // We don't instrument Windows catch-block parameters to avoid
- // interfering with exception handling assumptions.
- !(TargetTriple.isOSWindows() && isCatchParameter(AI)));
+ !(SSGI && SSGI->isSafe(AI)));
It->second = IsInteresting;
return IsInteresting;
@@ -2989,6 +2976,24 @@ void AddressSanitizer::markEscapedLocalAllocas(Function &F) {
}
}
}
+// Mitigation for https://github.com/google/sanitizers/issues/749
+// We don't instrument Windows catch-block parameters to avoid
+// interfering with exception handling assumptions.
+void AddressSanitizer::markCatchParametersAsUninteresting(Function &F) {
+ for (BasicBlock &BB : F) {
+ for (Instruction &I : BB) {
+ if (auto *CatchPad = dyn_cast<CatchPadInst>(&I)) {
+ // Mark the parameters to a catch-block as uninteresting to avoid
+ // instrumenting them
+ for (Value *Operand : CatchPad->arg_operands()) {
+ if (auto *AI = dyn_cast<AllocaInst>(Operand)) {
+ ProcessedAllocas[AI] = false;
+ }
+ }
+ }
+ }
+ }
+}
bool AddressSanitizer::suppressInstrumentationSiteForDebug(int &Instrumented) {
bool ShouldInstrument =
@@ -3032,6 +3037,9 @@ bool AddressSanitizer::instrumentFunction(Function &F,
// can be passed to that intrinsic.
markEscapedLocalAllocas(F);
+ if (TargetTriple.isOSWindows())
+ markCatchParametersAsUninteresting(F);
+
// We want to instrument every address only once per basic block (unless there
// are calls between uses).
SmallPtrSet<Value *, 16> TempsToInstrument;
>From e4551b1622f102893cca32975d8c73266c4255e6 Mon Sep 17 00:00:00 2001
From: David Justo <dajusto at microsoft.com>
Date: Mon, 13 Oct 2025 14:15:40 -0700
Subject: [PATCH 05/10] add IR instrumentation unit test with `opt`
---
.../asan-win-dont-instrument-catchpad.ll | 90 +++++++++++++++++++
1 file changed, 90 insertions(+)
create mode 100644 llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
diff --git a/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll b/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
new file mode 100644
index 0000000000000..52b14908ab4f2
--- /dev/null
+++ b/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
@@ -0,0 +1,90 @@
+; This test ensures that catch parameters are not instrumented on Windows.
+
+; This file was generated using the following source
+;
+; ```C++
+; #include <exception>
+; #include <cstdio>
+;
+; int main() {
+; try {
+; throw 1;
+; } catch (const int ex) {
+; printf("%d\n", ex);
+; return -1;
+; }
+; return 0;
+; }
+;
+; ```
+; then running the following sequence of commands
+;
+; ```
+; clang.exe -g0 -O0 -emit-llvm -c main.cpp -o main.bc
+; llvm-extract.exe -func=main main.bc -o main_func.bc
+; llvm-dis.exe main_func.bc -o main_func_dis.ll
+; ```
+; and finally manually trimming the resulting `.ll` file to remove
+; unnecessary metadata, and manually adding the `sanitize_address` annotation;
+; needed for the ASan pass to run.
+
+; RUN: opt < %s -passes=asan -S | FileCheck %s
+; CHECK: %ex = alloca i32, align 4
+; CHECK: catchpad within %{{.*}} [ptr @"??_R0H at 8", i32 0, ptr %ex]
+
+target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
+target triple = "x86_64-pc-windows-msvc"
+
+%rtti.TypeDescriptor2 = type { ptr, ptr, [3 x i8] }
+%eh.ThrowInfo = type { i32, i32, i32, i32 }
+
+@"??_R0H at 8" = external global %rtti.TypeDescriptor2
+ at _TI1H = external unnamed_addr constant %eh.ThrowInfo, section ".xdata"
+@"??_C at _03PMGGPEJJ@?$CFd?6?$AA@" = external dso_local unnamed_addr constant [4 x i8], align 1
+
+; Function Attrs: mustprogress noinline norecurse optnone uwtable sanitize_address
+define dso_local noundef i32 @main() #0 personality ptr @__CxxFrameHandler3 {
+entry:
+ %retval = alloca i32, align 4
+ %tmp = alloca i32, align 4
+ %ex = alloca i32, align 4
+ store i32 0, ptr %retval, align 4
+ store i32 1, ptr %tmp, align 4
+ invoke void @_CxxThrowException(ptr %tmp, ptr @_TI1H) #2
+ to label %unreachable unwind label %catch.dispatch
+
+catch.dispatch: ; preds = %entry
+ %0 = catchswitch within none [label %catch] unwind to caller
+
+catch: ; preds = %catch.dispatch
+ %1 = catchpad within %0 [ptr @"??_R0H at 8", i32 0, ptr %ex]
+ %2 = load i32, ptr %ex, align 4
+ %call = call i32 (ptr, ...) @printf(ptr noundef @"??_C at _03PMGGPEJJ@?$CFd?6?$AA@", i32 noundef %2) [ "funclet"(token %1) ]
+ store i32 -1, ptr %retval, align 4
+ catchret from %1 to label %catchret.dest
+
+catchret.dest: ; preds = %catch
+ br label %return
+
+try.cont: ; No predecessors!
+ store i32 0, ptr %retval, align 4
+ br label %return
+
+return: ; preds = %try.cont, %catchret.dest
+ %3 = load i32, ptr %retval, align 4
+ ret i32 %3
+
+unreachable: ; preds = %entry
+ unreachable
+}
+
+declare dso_local void @_CxxThrowException(ptr, ptr)
+
+declare dso_local i32 @__CxxFrameHandler3(...)
+
+; Function Attrs: mustprogress noinline optnone uwtable
+declare dso_local i32 @printf(ptr noundef, ...) #1
+
+attributes #0 = { mustprogress noinline norecurse optnone uwtable sanitize_address }
+attributes #1 = { mustprogress noinline optnone uwtable }
+attributes #2 = { noreturn }
\ No newline at end of file
>From 65f17410826fad2a224127514b616a9b0bdda4ed Mon Sep 17 00:00:00 2001
From: David Justo <dajusto at microsoft.com>
Date: Tue, 14 Oct 2025 16:09:27 -0700
Subject: [PATCH 06/10] remove unecessary braces in if-statement
---
llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
index 9b878fbfd6809..8279eb2941794 100644
--- a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
+++ b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
@@ -2997,9 +2997,8 @@ void AddressSanitizer::markCatchParametersAsUninteresting(Function &F) {
// Mark the parameters to a catch-block as uninteresting to avoid
// instrumenting them
for (Value *Operand : CatchPad->arg_operands()) {
- if (auto *AI = dyn_cast<AllocaInst>(Operand)) {
+ if (auto *AI = dyn_cast<AllocaInst>(Operand))
ProcessedAllocas[AI] = false;
- }
}
}
}
>From fe312ecad80f111989f1b563baa2900747e1a9b2 Mon Sep 17 00:00:00 2001
From: David Justo <dajusto at microsoft.com>
Date: Tue, 14 Oct 2025 16:10:06 -0700
Subject: [PATCH 07/10] minimize `.ll` test
---
.../asan-win-dont-instrument-catchpad.ll | 47 ++++---------------
1 file changed, 10 insertions(+), 37 deletions(-)
diff --git a/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll b/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
index 52b14908ab4f2..719887412913a 100644
--- a/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
+++ b/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
@@ -32,25 +32,15 @@
; CHECK: %ex = alloca i32, align 4
; CHECK: catchpad within %{{.*}} [ptr @"??_R0H at 8", i32 0, ptr %ex]
-target datalayout = "e-m:e-i64:64-f80:128-n8:16:32:64-S128"
target triple = "x86_64-pc-windows-msvc"
-%rtti.TypeDescriptor2 = type { ptr, ptr, [3 x i8] }
-%eh.ThrowInfo = type { i32, i32, i32, i32 }
-
-@"??_R0H at 8" = external global %rtti.TypeDescriptor2
- at _TI1H = external unnamed_addr constant %eh.ThrowInfo, section ".xdata"
-@"??_C at _03PMGGPEJJ@?$CFd?6?$AA@" = external dso_local unnamed_addr constant [4 x i8], align 1
+@"??_R0H at 8" = external global ptr
; Function Attrs: mustprogress noinline norecurse optnone uwtable sanitize_address
-define dso_local noundef i32 @main() #0 personality ptr @__CxxFrameHandler3 {
+define noundef i32 @main() sanitize_address personality ptr @__CxxFrameHandler3 {
entry:
- %retval = alloca i32, align 4
- %tmp = alloca i32, align 4
%ex = alloca i32, align 4
- store i32 0, ptr %retval, align 4
- store i32 1, ptr %tmp, align 4
- invoke void @_CxxThrowException(ptr %tmp, ptr @_TI1H) #2
+ invoke void @throw()
to label %unreachable unwind label %catch.dispatch
catch.dispatch: ; preds = %entry
@@ -58,33 +48,16 @@ catch.dispatch: ; preds = %entry
catch: ; preds = %catch.dispatch
%1 = catchpad within %0 [ptr @"??_R0H at 8", i32 0, ptr %ex]
- %2 = load i32, ptr %ex, align 4
- %call = call i32 (ptr, ...) @printf(ptr noundef @"??_C at _03PMGGPEJJ@?$CFd?6?$AA@", i32 noundef %2) [ "funclet"(token %1) ]
- store i32 -1, ptr %retval, align 4
- catchret from %1 to label %catchret.dest
-
-catchret.dest: ; preds = %catch
- br label %return
-
-try.cont: ; No predecessors!
- store i32 0, ptr %retval, align 4
- br label %return
+ call void @opaque() [ "funclet"(token %1) ]
+ catchret from %1 to label %return
-return: ; preds = %try.cont, %catchret.dest
- %3 = load i32, ptr %retval, align 4
- ret i32 %3
+return: ; preds = %catch
+ ret i32 0
unreachable: ; preds = %entry
unreachable
}
-declare dso_local void @_CxxThrowException(ptr, ptr)
-
-declare dso_local i32 @__CxxFrameHandler3(...)
-
-; Function Attrs: mustprogress noinline optnone uwtable
-declare dso_local i32 @printf(ptr noundef, ...) #1
-
-attributes #0 = { mustprogress noinline norecurse optnone uwtable sanitize_address }
-attributes #1 = { mustprogress noinline optnone uwtable }
-attributes #2 = { noreturn }
\ No newline at end of file
+declare void @throw() noreturn
+declare void @opaque()
+declare i32 @__CxxFrameHandler3(...)
>From bd511b54fe39598b6cbfff5acd92e4ab0eb3729b Mon Sep 17 00:00:00 2001
From: David Justo <dajusto at microsoft.com>
Date: Tue, 14 Oct 2025 16:24:15 -0700
Subject: [PATCH 08/10] remove braces from the 'for' loop
---
llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
index 9b3cf7297a537..db932e49bfcee 100644
--- a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
+++ b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
@@ -3011,10 +3011,9 @@ void AddressSanitizer::markCatchParametersAsUninteresting(Function &F) {
if (auto *CatchPad = dyn_cast<CatchPadInst>(&I)) {
// Mark the parameters to a catch-block as uninteresting to avoid
// instrumenting them
- for (Value *Operand : CatchPad->arg_operands()) {
+ for (Value *Operand : CatchPad->arg_operands())
if (auto *AI = dyn_cast<AllocaInst>(Operand))
ProcessedAllocas[AI] = false;
- }
}
}
}
>From 0dec61a18e1a0ada133afbbb5c613b06fc429253 Mon Sep 17 00:00:00 2001
From: David Justo <david.justo.1996 at gmail.com>
Date: Fri, 17 Oct 2025 08:57:46 -0700
Subject: [PATCH 09/10] Update
llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
Co-authored-by: Antonio Frighetto <me at antoniofrighetto.com>
---
.../AddressSanitizer/asan-win-dont-instrument-catchpad.ll | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll b/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
index 719887412913a..807ff02eea2c0 100644
--- a/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
+++ b/llvm/test/Instrumentation/AddressSanitizer/asan-win-dont-instrument-catchpad.ll
@@ -36,7 +36,7 @@ target triple = "x86_64-pc-windows-msvc"
@"??_R0H at 8" = external global ptr
-; Function Attrs: mustprogress noinline norecurse optnone uwtable sanitize_address
+; Function Attrs: sanitize_address
define noundef i32 @main() sanitize_address personality ptr @__CxxFrameHandler3 {
entry:
%ex = alloca i32, align 4
>From 112f078a6b3e186bdfe0f7aaa0da554d66daea35 Mon Sep 17 00:00:00 2001
From: David Justo <david.justo.1996 at gmail.com>
Date: Fri, 17 Oct 2025 08:57:57 -0700
Subject: [PATCH 10/10] Update
llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
Co-authored-by: Antonio Frighetto <me at antoniofrighetto.com>
---
llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
index af91357aa82e4..af5cfdda635f7 100644
--- a/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
+++ b/llvm/lib/Transforms/Instrumentation/AddressSanitizer.cpp
@@ -3010,7 +3010,7 @@ void AddressSanitizer::markCatchParametersAsUninteresting(Function &F) {
for (Instruction &I : BB) {
if (auto *CatchPad = dyn_cast<CatchPadInst>(&I)) {
// Mark the parameters to a catch-block as uninteresting to avoid
- // instrumenting them
+ // instrumenting them.
for (Value *Operand : CatchPad->arg_operands())
if (auto *AI = dyn_cast<AllocaInst>(Operand))
ProcessedAllocas[AI] = false;
More information about the llvm-commits
mailing list