Fixed instruction corruption bug for multiple returns.

src/IceASanInstrumentation.cpp

 //===- subzero/src/IceASanInstrumentation.cpp - ASan ------------*- C++ -*-===//
 //
 //                        The Subzero Code Generator
 //
 // This file is distributed under the University of Illinois Open Source
 // License. See LICENSE.TXT for details.
 //
 //===----------------------------------------------------------------------===//
 ///
 /// \file
@@ skipping 46 matching lines @@
 
 ICE_TLS_DEFINE_FIELD(std::vector<InstCall *> *, ASanInstrumentation,
                      LocalDtors);
 
 // Create redzones around all global variables, ensuring that the initializer
 // types of the redzones and their associated globals match so that they are
 // laid out together in memory.
 void ASanInstrumentation::instrumentGlobals(VariableDeclarationList &Globals) {
   if (DidProcessGlobals)
     return;
-
   VariableDeclarationList NewGlobals;
   // Global holding pointers to all redzones
   auto *RzArray = VariableDeclaration::create(&NewGlobals);
   // Global holding sizes of all redzones
   auto *RzSizes = VariableDeclaration::create(&NewGlobals);
 
   RzArray->setName(Ctx, RzArrayName);
   RzSizes->setName(Ctx, RzSizesName);
   RzArray->setIsConstant(true);
   RzSizes->setIsConstant(true);
@@ skipping 62 matching lines @@
   std::stringstream Name;
   Name << RzPrefix << RzNum++;
   return Name.str();
 }
 
 // Check for an alloca signaling the presence of local variables and add a
 // redzone if it is found
 void ASanInstrumentation::instrumentFuncStart(LoweringContext &Context) {
   if (ICE_TLS_GET_FIELD(LocalDtors) == nullptr)
     ICE_TLS_SET_FIELD(LocalDtors, new std::vector<InstCall *>());
-
   Cfg *Func = Context.getNode()->getCfg();
   bool HasLocals = false;
   LoweringContext C;
   C.init(Context.getNode());
   std::vector<Inst *> Initializations;
   Constant *InitFunc =
       Ctx->getConstantExternSym(Ctx->getGlobalString("__asan_poison"));
   Constant *DestroyFunc =
       Ctx->getConstantExternSym(Ctx->getGlobalString("__asan_unpoison"));
 
@@ skipping 126 matching lines @@
   Call->addArg(Op);
   Call->addArg(ConstantInteger32::create(Ctx, IceType_i32, Size));
   // play games to insert the call before the access instruction
   InstList::iterator Next = Context.getNext();
   Context.setInsertPoint(Context.getCur());
   Context.insert(Call);
   Context.setNext(Next);
 }
 
 void ASanInstrumentation::instrumentRet(LoweringContext &Context, InstRet *) {
+  Cfg *Func = Context.getNode()->getCfg();
   InstList::iterator Next = Context.getNext();
   Context.setInsertPoint(Context.getCur());
   for (InstCall *RzUnpoison : *ICE_TLS_GET_FIELD(LocalDtors)) {
-    Context.insert(RzUnpoison);
+    SizeT NumArgs = RzUnpoison->getNumArgs();
+    Variable *Dest = RzUnpoison->getDest();
+    Operand *CallTarget = RzUnpoison->getCallTarget();
+    bool HasTailCall = RzUnpoison->isTailcall();
+    bool IsTargetHelperCall = RzUnpoison->isTargetHelperCall();
+    auto *RzUnpoisonCpy = InstCall::create(Func, NumArgs, Dest, CallTarget,
+                                           HasTailCall, IsTargetHelperCall);

[tlively, 2016/07/06 19:47:05]

Since Insts are linked list nodes, they cannot be inserted multiple times, and
copies must be made.

+    for (int I = 0, Args = RzUnpoison->getNumArgs(); I < Args; ++I) {
+      RzUnpoisonCpy->addArg(RzUnpoison->getArg(I));
+    }
+    Context.insert(RzUnpoisonCpy);
   }
   Context.setNext(Next);
 }
 
 void ASanInstrumentation::instrumentStart(Cfg *Func) {
   Constant *ShadowMemInit =
       Ctx->getConstantExternSym(Ctx->getGlobalString("__asan_init"));
   constexpr SizeT NumArgs = 3;
   constexpr Variable *Void = nullptr;
   constexpr bool NoTailCall = false;
@@ skipping 12 matching lines @@
   Call->addArg(Ctx->getConstantSym(0, Ctx->getGlobalString(RzSizesName)));
 }
 
 // TODO(tlively): make this more efficient with swap idiom
 void ASanInstrumentation::finishFunc(Cfg *Func) {
   (void)Func;
   ICE_TLS_GET_FIELD(LocalDtors)->clear();
 }
 
 } // end of namespace Ice