[llvm] [llubi] Add support for exposed provenance (PR #200596)

[Nikita Popov via llvm-commits]

================
@@ -237,8 +237,33 @@ class Context {
   // Mapping from tags to provenances. Tags are lazily generated when a
   // pointer is captured by memory.
   DenseMap<APInt, IntrusiveRefCntPtr<Provenance>> TaggedProvenances;
-  // TODO: Maintains a global list of 'exposed' provenances. This is used to
-  // convert an address back to a pointer with a previously exposed provenance.
+  // Maintains a global list of 'exposed' provenances. This is used to convert
+  // an address back to a pointer with a previously exposed provenance. In
+  // theory the provenance is picked from all previously exposed provenances
+  // using angelic non-determinism. Since llubi is just an interpreter, we make
+  // two approximations:
+  //   1. Each address maps to at most one memory object during the execution of
+  //   the program, as AllocationBase increases monotonically.
+  //   2. We maintain the set of exposed provenances. When ptrtoint/addr
+  //   executes,
+  //      the provenance is inserted to the set. When inttoptr executes, it
+  //      yields a pointer with a wildcard provenance. That is, each later use
+  //      will check whether there is an exposed provenance in the snapshot
+  //      allowing the operation. The invalid provenance will be masked out
+  //      after the operation. If we cannot pick one, it is UB.
+
+  /// Exposed provenances are grouped by associated memory objects for efficient
+  /// invalidation.
+  struct ExposedProvenanceSet {
+    SmallVector<IntrusiveRefCntPtr<Provenance>> List;
+    SmallVector<uint64_t> GenerationList;
----------------
nikic wrote:

Might be cleaner to make this one list of std::pair, than two synchronized lists?

https://github.com/llvm/llvm-project/pull/200596