Skip to content

Commit 1295aa2

Browse files
nikicnikic
authored
[Clang] Add -fwrapv-pointer flag (#122486)
GCC supports three flags related to overflow behavior: * `-fwrapv`: Makes signed integer overflow well-defined. * `-fwrapv-pointer`: Makes pointer overflow well-defined. * `-fno-strict-overflow`: Implies `-fwrapv -fwrapv-pointer`, making both signed integer overflow and pointer overflow well-defined. Clang currently only supports `-fno-strict-overflow` and `-fwrapv`, but not `-fwrapv-pointer`. This PR proposes to introduce `-fwrapv-pointer` and adjust the semantics of `-fwrapv` to match GCC. This allows signed integer overflow and pointer overflow to be controlled independently, while `-fno-strict-overflow` still exists to control both at the same time (and that option is consistent across GCC and Clang).
1 parent 458542f commit 1295aa2

File tree

14 files changed

+94
-41
lines changed

14 files changed

+94
-41
lines changed

‎clang/docs/ReleaseNotes.rst‎

Lines changed: 14 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -79,7 +79,15 @@ code bases.
7979
Undefined behavior due to pointer addition overflow can be reliably detected
8080
using ``-fsanitize=pointer-overflow``. It is also possible to use
8181
``-fno-strict-overflow`` to opt-in to a language dialect where signed integer
82-
and pointer overflow are well-defined.
82+
and pointer overflow are well-defined. Since Clang 20, it is also possible
83+
to use ``-fwrapv-pointer`` to only make pointer overflow well-defined, while
84+
not affecting the behavior of signed integer overflow.
85+
86+
- The ``-fwrapv`` flag now only makes signed integer overflow well-defined,
87+
without affecting pointer overflow, which is controlled by a new
88+
``-fwrapv-pointer`` flag. The ``-fno-strict-overflow`` flag now implies
89+
both ``-fwrapv`` and ``-fwrapv-pointer`` and as such retains its old meaning.
90+
The new behavior matches GCC.
8391

8492
C/C++ Language Potentially Breaking Changes
8593
-------------------------------------------
@@ -521,6 +529,11 @@ New Compiler Flags
521529
- clang-cl and clang-dxc now support ``-fdiagnostics-color=[auto|never|always]``
522530
in addition to ``-f[no-]color-diagnostics``.
523531

532+
- The new ``-fwrapv-pointer`` flag opts-in to a language dialect where pointer
533+
overflow is well-defined. The ``-fwrapv`` flag previously implied
534+
``-fwrapv-pointer`` as well, but no longer does. ``-fno-strict-overflow``
535+
implies ``-fwrapv -fwrapv-pointer``. The flags now match GCC.
536+
524537
Deprecated Compiler Flags
525538
-------------------------
526539

‎clang/include/clang/Basic/LangOptions.def‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -407,6 +407,7 @@ VALUE_LANGOPT(TrivialAutoVarInitMaxSize, 32, 0,
407407
"stop trivial automatic variable initialization if var size exceeds the specified size (in bytes). Must be greater than 0.")
408408
ENUM_LANGOPT(SignedOverflowBehavior, SignedOverflowBehaviorTy, 2, SOB_Undefined,
409409
"signed integer overflow handling")
410+
LANGOPT(PointerOverflowDefined, 1, 0, "make pointer overflow defined")
410411
ENUM_LANGOPT(ThreadModel , ThreadModelKind, 2, ThreadModelKind::POSIX, "Thread Model")
411412

412413
BENIGN_LANGOPT(ArrowDepth, 32, 256,

‎clang/include/clang/Driver/Options.td‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -4301,6 +4301,11 @@ def fwrapv : Flag<["-"], "fwrapv">, Group<f_Group>,
43014301
HelpText<"Treat signed integer overflow as two's complement">;
43024302
def fno_wrapv : Flag<["-"], "fno-wrapv">, Group<f_Group>,
43034303
Visibility<[ClangOption, CLOption, FlangOption]>;
4304+
def fwrapv_pointer : Flag<["-"], "fwrapv-pointer">, Group<f_Group>,
4305+
Visibility<[ClangOption, CLOption, CC1Option, FlangOption, FC1Option]>,
4306+
HelpText<"Treat pointer overflow as two's complement">;
4307+
def fno_wrapv_pointer : Flag<["-"], "fno-wrapv-pointer">, Group<f_Group>,
4308+
Visibility<[ClangOption, CLOption, FlangOption]>;
43044309
def fwritable_strings : Flag<["-"], "fwritable-strings">, Group<f_Group>,
43054310
Visibility<[ClangOption, CC1Option]>,
43064311
HelpText<"Store string literals as writable data">,

‎clang/lib/CodeGen/CGBuiltin.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22284,7 +22284,7 @@ RValue CodeGenFunction::EmitBuiltinAlignTo(const CallExpr *E, bool AlignUp) {
2228422284
// By adding the mask, we ensure that align_up on an already aligned
2228522285
// value will not change the value.
2228622286
if (Args.Src->getType()->isPointerTy()) {
22287-
if (getLangOpts().isSignedOverflowDefined())
22287+
if (getLangOpts().PointerOverflowDefined)
2228822288
SrcForMask =
2228922289
Builder.CreateGEP(Int8Ty, SrcForMask, Args.Mask, "over_boundary");
2229022290
else

‎clang/lib/CodeGen/CGExpr.cpp‎

Lines changed: 13 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4318,14 +4318,14 @@ LValue CodeGenFunction::EmitArraySubscriptExpr(const ArraySubscriptExpr *E,
43184318
// GEP indexes are signed, and scaling an index isn't permitted to
43194319
// signed-overflow, so we use the same semantics for our explicit
43204320
// multiply. We suppress this if overflow is not undefined behavior.
4321-
if (getLangOpts().isSignedOverflowDefined()) {
4321+
if (getLangOpts().PointerOverflowDefined) {
43224322
Idx = Builder.CreateMul(Idx, numElements);
43234323
} else {
43244324
Idx = Builder.CreateNSWMul(Idx, numElements);
43254325
}
43264326

43274327
Addr = emitArraySubscriptGEP(*this, Addr, Idx, vla->getElementType(),
4328-
!getLangOpts().isSignedOverflowDefined(),
4328+
!getLangOpts().PointerOverflowDefined,
43294329
SignedIndices, E->getExprLoc());
43304330

43314331
} else if (const ObjCObjectType *OIT = E->getType()->getAs<ObjCObjectType>()){
@@ -4415,7 +4415,7 @@ LValue CodeGenFunction::EmitArraySubscriptExpr(const ArraySubscriptExpr *E,
44154415
QualType arrayType = Array->getType();
44164416
Addr = emitArraySubscriptGEP(
44174417
*this, ArrayLV.getAddress(), {CGM.getSize(CharUnits::Zero()), Idx},
4418-
E->getType(), !getLangOpts().isSignedOverflowDefined(), SignedIndices,
4418+
E->getType(), !getLangOpts().PointerOverflowDefined, SignedIndices,
44194419
E->getExprLoc(), &arrayType, E->getBase());
44204420
EltBaseInfo = ArrayLV.getBaseInfo();
44214421
EltTBAAInfo = CGM.getTBAAInfoForSubobject(ArrayLV, E->getType());
@@ -4424,10 +4424,9 @@ LValue CodeGenFunction::EmitArraySubscriptExpr(const ArraySubscriptExpr *E,
44244424
Addr = EmitPointerWithAlignment(E->getBase(), &EltBaseInfo, &EltTBAAInfo);
44254425
auto *Idx = EmitIdxAfterBase(/*Promote*/true);
44264426
QualType ptrType = E->getBase()->getType();
4427-
Addr = emitArraySubscriptGEP(*this, Addr, Idx, E->getType(),
4428-
!getLangOpts().isSignedOverflowDefined(),
4429-
SignedIndices, E->getExprLoc(), &ptrType,
4430-
E->getBase());
4427+
Addr = emitArraySubscriptGEP(
4428+
*this, Addr, Idx, E->getType(), !getLangOpts().PointerOverflowDefined,
4429+
SignedIndices, E->getExprLoc(), &ptrType, E->getBase());
44314430
}
44324431

44334432
LValue LV = MakeAddrLValue(Addr, E->getType(), EltBaseInfo, EltTBAAInfo);
@@ -4572,11 +4571,11 @@ LValue CodeGenFunction::EmitArraySectionExpr(const ArraySectionExpr *E,
45724571
: llvm::ConstantInt::get(IntPtrTy, ConstLength);
45734572
Idx = Builder.CreateAdd(LowerBoundVal, LengthVal, "lb_add_len",
45744573
/*HasNUW=*/false,
4575-
!getLangOpts().isSignedOverflowDefined());
4574+
!getLangOpts().PointerOverflowDefined);
45764575
if (Length && LowerBound) {
45774576
Idx = Builder.CreateSub(
45784577
Idx, llvm::ConstantInt::get(IntPtrTy, /*V=*/1), "idx_sub_1",
4579-
/*HasNUW=*/false, !getLangOpts().isSignedOverflowDefined());
4578+
/*HasNUW=*/false, !getLangOpts().PointerOverflowDefined);
45804579
}
45814580
} else
45824581
Idx = llvm::ConstantInt::get(IntPtrTy, ConstLength + ConstLowerBound);
@@ -4602,7 +4601,7 @@ LValue CodeGenFunction::EmitArraySectionExpr(const ArraySectionExpr *E,
46024601
Length->getType()->hasSignedIntegerRepresentation());
46034602
Idx = Builder.CreateSub(
46044603
LengthVal, llvm::ConstantInt::get(IntPtrTy, /*V=*/1), "len_sub_1",
4605-
/*HasNUW=*/false, !getLangOpts().isSignedOverflowDefined());
4604+
/*HasNUW=*/false, !getLangOpts().PointerOverflowDefined);
46064605
} else {
46074606
ConstLength = ConstLength.zextOrTrunc(PointerWidthInBits);
46084607
--ConstLength;
@@ -4629,12 +4628,12 @@ LValue CodeGenFunction::EmitArraySectionExpr(const ArraySectionExpr *E,
46294628
// GEP indexes are signed, and scaling an index isn't permitted to
46304629
// signed-overflow, so we use the same semantics for our explicit
46314630
// multiply. We suppress this if overflow is not undefined behavior.
4632-
if (getLangOpts().isSignedOverflowDefined())
4631+
if (getLangOpts().PointerOverflowDefined)
46334632
Idx = Builder.CreateMul(Idx, NumElements);
46344633
else
46354634
Idx = Builder.CreateNSWMul(Idx, NumElements);
46364635
EltPtr = emitArraySubscriptGEP(*this, Base, Idx, VLA->getElementType(),
4637-
!getLangOpts().isSignedOverflowDefined(),
4636+
!getLangOpts().PointerOverflowDefined,
46384637
/*signedIndices=*/false, E->getExprLoc());
46394638
} else if (const Expr *Array = isSimpleArrayDecayOperand(E->getBase())) {
46404639
// If this is A[i] where A is an array, the frontend will have decayed the
@@ -4654,7 +4653,7 @@ LValue CodeGenFunction::EmitArraySectionExpr(const ArraySectionExpr *E,
46544653
// Propagate the alignment from the array itself to the result.
46554654
EltPtr = emitArraySubscriptGEP(
46564655
*this, ArrayLV.getAddress(), {CGM.getSize(CharUnits::Zero()), Idx},
4657-
ResultExprTy, !getLangOpts().isSignedOverflowDefined(),
4656+
ResultExprTy, !getLangOpts().PointerOverflowDefined,
46584657
/*signedIndices=*/false, E->getExprLoc());
46594658
BaseInfo = ArrayLV.getBaseInfo();
46604659
TBAAInfo = CGM.getTBAAInfoForSubobject(ArrayLV, ResultExprTy);
@@ -4663,7 +4662,7 @@ LValue CodeGenFunction::EmitArraySectionExpr(const ArraySectionExpr *E,
46634662
emitOMPArraySectionBase(*this, E->getBase(), BaseInfo, TBAAInfo, BaseTy,
46644663
ResultExprTy, IsLowerBound);
46654664
EltPtr = emitArraySubscriptGEP(*this, Base, Idx, ResultExprTy,
4666-
!getLangOpts().isSignedOverflowDefined(),
4665+
!getLangOpts().PointerOverflowDefined,
46674666
/*signedIndices=*/false, E->getExprLoc());
46684667
}
46694668

‎clang/lib/CodeGen/CGExprScalar.cpp‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -3043,7 +3043,7 @@ ScalarExprEmitter::EmitScalarPrePostIncDec(const UnaryOperator *E, LValue LV,
30433043
llvm::Value *numElts = CGF.getVLASize(vla).NumElts;
30443044
if (!isInc) numElts = Builder.CreateNSWNeg(numElts, "vla.negsize");
30453045
llvm::Type *elemTy = CGF.ConvertTypeForMem(vla->getElementType());
3046-
if (CGF.getLangOpts().isSignedOverflowDefined())
3046+
if (CGF.getLangOpts().PointerOverflowDefined)
30473047
value = Builder.CreateGEP(elemTy, value, numElts, "vla.inc");
30483048
else
30493049
value = CGF.EmitCheckedInBoundsGEP(
@@ -3054,7 +3054,7 @@ ScalarExprEmitter::EmitScalarPrePostIncDec(const UnaryOperator *E, LValue LV,
30543054
} else if (type->isFunctionType()) {
30553055
llvm::Value *amt = Builder.getInt32(amount);
30563056

3057-
if (CGF.getLangOpts().isSignedOverflowDefined())
3057+
if (CGF.getLangOpts().PointerOverflowDefined)
30583058
value = Builder.CreateGEP(CGF.Int8Ty, value, amt, "incdec.funcptr");
30593059
else
30603060
value =
@@ -3066,7 +3066,7 @@ ScalarExprEmitter::EmitScalarPrePostIncDec(const UnaryOperator *E, LValue LV,
30663066
} else {
30673067
llvm::Value *amt = Builder.getInt32(amount);
30683068
llvm::Type *elemTy = CGF.ConvertTypeForMem(type);
3069-
if (CGF.getLangOpts().isSignedOverflowDefined())
3069+
if (CGF.getLangOpts().PointerOverflowDefined)
30703070
value = Builder.CreateGEP(elemTy, value, amt, "incdec.ptr");
30713071
else
30723072
value = CGF.EmitCheckedInBoundsGEP(
@@ -3179,7 +3179,7 @@ ScalarExprEmitter::EmitScalarPrePostIncDec(const UnaryOperator *E, LValue LV,
31793179
llvm::Value *sizeValue =
31803180
llvm::ConstantInt::get(CGF.SizeTy, size.getQuantity());
31813181

3182-
if (CGF.getLangOpts().isSignedOverflowDefined())
3182+
if (CGF.getLangOpts().PointerOverflowDefined)
31833183
value = Builder.CreateGEP(CGF.Int8Ty, value, sizeValue, "incdec.objptr");
31843184
else
31853185
value = CGF.EmitCheckedInBoundsGEP(
@@ -4075,7 +4075,7 @@ static Value *emitPointerArithmetic(CodeGenFunction &CGF,
40754075
// signed-overflow, so we use the same semantics for our explicit
40764076
// multiply. We suppress this if overflow is not undefined behavior.
40774077
llvm::Type *elemTy = CGF.ConvertTypeForMem(vla->getElementType());
4078-
if (CGF.getLangOpts().isSignedOverflowDefined()) {
4078+
if (CGF.getLangOpts().PointerOverflowDefined) {
40794079
index = CGF.Builder.CreateMul(index, numElements, "vla.index");
40804080
pointer = CGF.Builder.CreateGEP(elemTy, pointer, index, "add.ptr");
40814081
} else {
@@ -4096,7 +4096,7 @@ static Value *emitPointerArithmetic(CodeGenFunction &CGF,
40964096
else
40974097
elemTy = CGF.ConvertTypeForMem(elementType);
40984098

4099-
if (CGF.getLangOpts().isSignedOverflowDefined())
4099+
if (CGF.getLangOpts().PointerOverflowDefined)
41004100
return CGF.Builder.CreateGEP(elemTy, pointer, index, "add.ptr");
41014101

41024102
return CGF.EmitCheckedInBoundsGEP(

‎clang/lib/Driver/SanitizerArgs.cpp‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -575,6 +575,9 @@ SanitizerArgs::SanitizerArgs(const ToolChain &TC,
575575
options::OPT_fstrict_overflow, false);
576576
if (Args.hasFlagNoClaim(options::OPT_fwrapv, options::OPT_fno_wrapv, S))
577577
Add &= ~SanitizerKind::SignedIntegerOverflow;
578+
if (Args.hasFlagNoClaim(options::OPT_fwrapv_pointer,
579+
options::OPT_fno_wrapv_pointer, S))
580+
Add &= ~SanitizerKind::PointerOverflow;
578581
}
579582
Add &= Supported;
580583

‎clang/lib/Driver/ToolChains/CommonArgs.cpp‎

Lines changed: 11 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3095,12 +3095,19 @@ void tools::renderCommonIntegerOverflowOptions(const ArgList &Args,
30953095
ArgStringList &CmdArgs) {
30963096
// -fno-strict-overflow implies -fwrapv if it isn't disabled, but
30973097
// -fstrict-overflow won't turn off an explicitly enabled -fwrapv.
3098+
bool StrictOverflow = Args.hasFlag(options::OPT_fstrict_overflow,
3099+
options::OPT_fno_strict_overflow, true);
30983100
if (Arg *A = Args.getLastArg(options::OPT_fwrapv, options::OPT_fno_wrapv)) {
30993101
if (A->getOption().matches(options::OPT_fwrapv))
31003102
CmdArgs.push_back("-fwrapv");
3101-
} else if (Arg *A = Args.getLastArg(options::OPT_fstrict_overflow,
3102-
options::OPT_fno_strict_overflow)) {
3103-
if (A->getOption().matches(options::OPT_fno_strict_overflow))
3104-
CmdArgs.push_back("-fwrapv");
3103+
} else if (!StrictOverflow) {
3104+
CmdArgs.push_back("-fwrapv");
3105+
}
3106+
if (Arg *A = Args.getLastArg(options::OPT_fwrapv_pointer,
3107+
options::OPT_fno_wrapv_pointer)) {
3108+
if (A->getOption().matches(options::OPT_fwrapv_pointer))
3109+
CmdArgs.push_back("-fwrapv-pointer");
3110+
} else if (!StrictOverflow) {
3111+
CmdArgs.push_back("-fwrapv-pointer");
31053112
}
31063113
}

‎clang/lib/Frontend/CompilerInvocation.cpp‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3721,6 +3721,8 @@ void CompilerInvocationBase::GenerateLangArgs(const LangOptions &Opts,
37213721
} else if (Opts.SignedOverflowBehavior == LangOptions::SOB_Defined) {
37223722
GenerateArg(Consumer, OPT_fwrapv);
37233723
}
3724+
if (Opts.PointerOverflowDefined)
3725+
GenerateArg(Consumer, OPT_fwrapv_pointer);
37243726

37253727
if (Opts.MSCompatibilityVersion != 0) {
37263728
unsigned Major = Opts.MSCompatibilityVersion / 10000000;
@@ -4138,6 +4140,8 @@ bool CompilerInvocation::ParseLangArgs(LangOptions &Opts, ArgList &Args,
41384140
}
41394141
else if (Args.hasArg(OPT_fwrapv))
41404142
Opts.setSignedOverflowBehavior(LangOptions::SOB_Defined);
4143+
if (Args.hasArg(OPT_fwrapv_pointer))
4144+
Opts.PointerOverflowDefined = true;
41414145

41424146
Opts.MSCompatibilityVersion = 0;
41434147
if (const Arg *A = Args.getLastArg(OPT_fms_compatibility_version)) {

‎clang/lib/Sema/SemaExpr.cpp‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11798,7 +11798,7 @@ static std::optional<bool> isTautologicalBoundsCheck(Sema &S, const Expr *LHS,
1179811798
const Expr *RHS,
1179911799
BinaryOperatorKind Opc) {
1180011800
if (!LHS->getType()->isPointerType() ||
11801-
S.getLangOpts().isSignedOverflowDefined())
11801+
S.getLangOpts().PointerOverflowDefined)
1180211802
return std::nullopt;
1180311803

1180411804
// Canonicalize to >= or < predicate.

0 commit comments

Comments
 (0)