Added tests for bug detection on locals

tests_lit/asan_tests/errorlocaloffbymany.ll

Index: tests_lit/asan_tests/errorlocaloffbymany.ll
diff --git a/tests_lit/asan_tests/errorlocaloffbymany.ll b/tests_lit/asan_tests/errorlocaloffbymany.ll
new file mode 100644
index 0000000000000000000000000000000000000000..ca75cc43b3cf207d0a8ac2577a853b6df120bfbe
--- /dev/null
+++ b/tests_lit/asan_tests/errorlocaloffbymany.ll
@@ -0,0 +1,31 @@
+; Make sure off-by-many OOB accesses of locals are caught
+
+; REQUIRES: no_minimal_build
+
+; RUN: llvm-as %s -o - | pnacl-freeze > %t.pexe && %S/../../pydir/szbuild.py \

[Jim Stichnoth, 2016/06/28 13:46:08]

This is a very clever way to make a lit test actually run and produce results.

I noticed that these three files are essentially identical except for the
@access() function.  Do you think they can be combined into a single .ll file,
with multiple @access functions and multiple RUN lines?

If you could somehow get access to argc, you could run the executable as "a.out
1" or "a.out 1 2" or "a.out 1 2 3" and then have @_start() use the value of argc
to decide which version of @access() to dispatch.

[tlively, 2016/06/28 21:11:23]

Done.

+; RUN:     --fsanitize-address --sz="-allow-externally-defined-symbols" \
+; RUN:     %t.pexe -o %t && not --crash %t 2>&1 | FileCheck \
+; RUN:     --check-prefix=CHECK32 %s
+
+declare external void @exit(i32)
+
+; A global array
+@arr = internal constant [12 x i8] zeroinitializer
+
+define i32 @access() {
+  %arr = alloca i8, i32 12, align 1
+  %arraddr = ptrtoint i8* %arr to i32
+  %badaddr = add i32 20, %arraddr
+  %badptr = inttoptr i32 %badaddr to i32*
+  %result = load i32, i32* %badptr, align 1
+  ret i32 %result
+}
+
+define void @_start(i32 %__0) {
+  %result = call i32 @access()
+  call void @exit(i32 0)
+  unreachable
+}
+
+; CHECK32: Illegal access of 4 bytes at
+

[Jim Stichnoth, 2016/06/28 13:46:08]

remove trailing whitespace (i.e. blank line)

[tlively, 2016/06/28 21:11:23]

Done.