MemorySanitizer checks for uninitialized memory and variable usage. It
instruments each instruction to update 'shadow' memory which indicates
which bits are 'poisoned', and inserts tests for dereferencing pointers
and conditional branching which makes use of not fully initialized data.
The instrumentation is done by the llvm::MemorySanitizerLegacyPass.
Functions must opt-in to the instrumentation with the 'SanitizeMemory'
attribute.
MemorySanitizer relies on several TLS variables for storing the shadow
value of function parameters and return values. The JIT makes calls to
__emutls_get_address() to obtain the address off these variables,
passing it the address of a __emutls_v.* control structure unique to
the TLS variable. We replace the former with our own function through
the symbol resolver, and the latter are represented by enum values, to
allow obtaining the real TLS variable's address in C++ code.
This is enabled behind a REACTOR_ENABLE_MEMORY_SANITIZER_INSTRUMENTATION
flag. For now, only enable CMake builds.
Bug: b/155148722
Change-Id: I6d755244589c9b0de19a283f9dff5d8a3bf6f24b
Reviewed-on: https://swiftshader-review.googlesource.com/c/SwiftShader/+/49829
Kokoro-Result: kokoro <noreply+kokoro@google.com>
Tested-by: Nicolas Capens <nicolascapens@google.com>
Reviewed-by: Antonio Maiorano <amaiorano@google.com>
