Reviving TypeSanitizer - a sanitizer to catch type-based aliasing violations

Runtimes Sanitizers
23

Hi @fhahn. While looking into the above issue I found a larger problem with how Tysan instruments structs. In the current implementation, accessing member variables other than the first raises a false positive. For example, running the following code:

#include <stdio.h>
struct S{
    int a, b, c;
};
S s;
int main(){
    s.a = 1;
    s.b = 2;
    s.c = 3;
    printf("%d %d %d\n", s.a, s.b, s.c);
    return 0;
}

Raises the following

==2580513==ERROR: TypeSanitizer: type-aliasing-violation on address 0x55d2133b8d54 (pc 0x55d212a5b3af bp 0x7fff4293a040 sp 0x7fff429397f8 tid 2580513)
WRITE of size 4 at 0x55d2133b8d54 with type int (in X at offset 4) accesses part of an existing object of type X that starts at offset -4
    #0 0x55d212a5b3ae in main (/home/gbmatt/llvm-project/S+0x2f3ae)
==2580513==ERROR: TypeSanitizer: type-aliasing-violation on address 0x55d2133b8d58 (pc 0x55d212a5b507 bp 0x7fff4293a040 sp 0x7fff429397f8 tid 2580513)
WRITE of size 4 at 0x55d2133b8d58 with type int (in X at offset 8) accesses part of an existing object of type X that starts at offset -8
    #0 0x55d212a5b506 in main (/home/gbmatt/llvm-project/S+0x2f506) ==2580513==ERROR: TypeSanitizer: type-aliasing-violation on address 0x55d2133b8d54 (pc 0x55d212a5b7b2 bp 0x7fff4293a040 sp 0x7fff429397f8 tid 2580513)
READ of size 4 at 0x55d2133b8d54 with type int (in X at offset 4) accesses part of an existing object of type X that starts at offset -4
    #0 0x55d212a5b7b1 in main (/home/gbmatt/llvm-project/S+0x2f7b1) ==2580513==ERROR: TypeSanitizer: type-aliasing-violation on address 0x55d2133b8d58 (pc 0x55d212a5b91e bp 0x7fff4293a040 sp 0x7fff429397f8 tid 2580513)
READ of size 4 at 0x55d2133b8d58 with type int (in X at offset 8) accesses part of an existing object of type X that starts at offset -8`
    #0 0x55d212a5b91d in main (/home/gbmatt/llvm-project/S+0x2f91d)

I’ve made a fix for this with a new test as crated a pull request for it here [TySan] Fixed false positive when accessing offset member variables by gbMattN · Pull Request #95387 · llvm/llvm-project · GitHub"