tree 5945f255dd3688a17049b024c3f8e4124b0ae26b
parent be044976b6c27a5553d7e83d60f64c4a72c0de52
author Camsyn <camsyn@foxmail.com> 1745484487 +0800
committer GitHub <noreply@github.com> 1745484487 +0200
gpgsig -----BEGIN PGP SIGNATURE-----
 
 wsFcBAABCAAQBQJoCfrHCRC1aQ7uu5UhlAAA08UQAHx2xC9xeUagxZVMRNJkPq/S
 D3/SbRVB3n1oZg40HKj611yGLSrU9RRdL0qizdIdte/b/A0x+hrd7FT/rbEHopUa
 WSP2kWuigy8Bzg6rb3UTLQcGEEqKnwIUSCvQ0ypDtfX5AvM3sD1ODRtJWVXhYeoW
 poBJ7bGqHOJU0rAuceHlSYwUdoOpY/P0QU1pVLlH8luxx8SHK1aAo1GtysYHuEcn
 0cSGG8U295cx/FKMmq5POPdGN0VdbKRp5UVIf6i9i7+HWAZPvnM1vNRQHkdtTO5l
 v8DqjqY58itWsNVbh0iAS/1j6/8Tzjt7Km/8HesmK/VchTdbVkx0TYMJhWbitwak
 v9UqT294VHSSl2Gzs8lKi4VClJJgu9GXn5YQRXNx4r+lhJtvKwvDLYx5akJj3Oa6
 8ATMGojnyQOI86YJcP0ffFIaTKQDmdmmwkaetX/fnNqGUR8QR8RtswLwOIp4LDCt
 CTb6cH7vhA9yoyO6BKG42qqapPMNhqclV8hm4D+QdkQoNZEP/GmGYOtbJ3u0QfQj
 lcyvtSpMD3lchVrwvdI2mVL5LQwRybkPEJv4aJ4vDlWJ2qz8LF2ijHwXT04e5Lss
 Nmba2XBErnIMgyaHAtOrdUSu3EhzK203gGbBJ925ookJUKxNlqkqO2v+SV2OtOpk
 dcfHrPea6qsYnpcHHhXM
 =2/2m
 -----END PGP SIGNATURE-----
 

[TSan, SanitizerBinaryMetadata] Analyze the capture status for `alloca` rather than arbitrary `Addr` (#132756)

This PR is based on my last PR #132752 (the first commit of this PR),
but addressing a different issue.

This commit addresses the limitation in `PointerMayBeCaptured` analysis
when dealing with derived pointers (e.g. arr+1) as described in issue
#132739.

The current implementation of `PointerMayBeCaptured` may miss captures
of the underlying `alloca` when analyzing derived pointers, leading to
some FNs in TSan, as follows:
```cpp
void *Thread(void *a) {
  ((int*)a)[1] = 43;
  return 0;
}

int main() {
  int Arr[2] = {41, 42};
  pthread_t t;
  pthread_create(&t, 0, Thread, &Arr[0]);
  // Missed instrumentation here due to the FN of PointerMayBeCaptured
  Arr[1] = 43;
  barrier_wait(&barrier);
  pthread_join(t, 0);
}
```
Refer to this [godbolt page](https://godbolt.org/z/n67GrxdcE) to get the
compilation result of TSan.

Even when `PointerMayBeCaptured` working correctly, it should backtrack
to the original `alloca` firstly during analysis, causing redundancy to
the outer's `findAllocaForValue`.
```cpp
    const AllocaInst *AI = findAllocaForValue(Addr);
    // Instead of Addr, we should check whether its base pointer is captured.
    if (AI && !PointerMayBeCaptured(Addr, true)) ...
```

Key changes:
Directly analyze the capture status of the underlying `alloca` instead
of derived pointers to ensure accurate capture detection
```cpp
    const AllocaInst *AI = findAllocaForValue(Addr);
    // Instead of Addr, we should check whether its base pointer is captured.
    if (AI && !PointerMayBeCaptured(AI, true)) ...
```