[qt/clang/llvm-project]: Summary of bulk changes made

Git repository change summary for qt/clang/llvm-project
Pushed by mirror-service into branch 'upstream/users/delcypher/fix-or_null_sized_by-codegen-bugs-part-3'.
Changed from 0000000000000000000000000000000000000000 to cb8a6025ed69198f607e1b590cfbf47d3f599c7d
Acknowledgement was received that this change introduces only existing code that has been pushed to another public open source repository.

This change contains the following new commits:

Git commit f306c2741b5334dedc34513cf1eab875defa86c3 by Dan Liew on 03/08/2026 at 22:34..
[CodeGen][NFC] Split __sized_by tests into their own file and rename test cases

In future patches the coverage of the __counted_by family attributes is
going to be increased. To help with this patch refactors the existing
test file.

1. Split `__sized_by` tests into their own file. In later commits files
   will be added for each attribute so it makes sense for each attribute
   to have its own file.
2. Replace `testN` test case names with human readable descriptions. Not
   all test cases that will be added in the future will apply to all
   attributes. If we kept on using the `testN` naming convention it
   would leave odd gaps in the test numbering because we try to keep
   what a test case tests consistent between files (i.e. `testN` would
   roughly test the same thing but with a different attribute). Using
   named test cases completely avoids this.
https://invent.kde.org/qt/clang/llvm-project/-/commit/f306c2741b5334dedc34513cf1eab875defa86c3

Git commit 14cb4c04f324d1b4d913bea1a6f89997ea788e77 by Dan Liew on 03/08/2026 at 22:39..
[CodeGen] Fix __builtin_dynamic_object_size for __sized_by / _or_null pointers

`emitCountedByPointerSize()` assumed a CountAttributedType is always
a __counted_by pointer. That isn't true, there are four versions of the
attribute:

* `__counted_by`: Already handled correctly.
* `__counted_by_or_null`: Incorectly handled.
* `__sized_by`: Incorreclty handled.
* `__sized_by_or_null`: Incorreclty handled.

In particular:

* __sized_by / __sized_by_or_null: the attribute argument is a byte count,
  but the object size was computed as count * sizeof(*ptr), over-reporting by
  the element size for any pointee larger than one byte. Use the count
  directly for the byte-counting variants.

* __counted_by_or_null / __sized_by_or_null: a null pointer describes no
  accessible memory, but the null case was ignored. Emit
  'count = ptr ? count : 0' so __bdos reports 0 for a null pointer. The null
  check needs the pointer value; where the size query already has one emitted
  (the pass_dynamic_object_size path, or a non-volatile field) it reuses that
  value rather than re-loading the field, so a volatile pointer field is
  loaded once rather than twice (except in the '&ptr[idx]' form, where the
  pointer is re-emitted; see the FIXME). A direct __bdos(p->buf) on a volatile
  field never reaches this path: like sizeof, __bdos bails to the default
  rather than emit a side-effecting volatile load just to answer a size query,
  so the field is loaded zero times (see test_bdos_of_volatile_pointer).

* __sized_by on a pointer to an incomplete (forward-declared) type
  crashed: the annotated pointee's element size was computed
  unconditionally, and getTypeSizeInChars() asserts on an incomplete
  type. The element size is only needed for __counted_by (whose pointee
  Sema guarantees is complete at a use site) and for scaling an index
  (whose element type is complete because it is being subscripted), so
  only compute it there.

Assisted-by: Claude Code
https://invent.kde.org/qt/clang/llvm-project/-/commit/14cb4c04f324d1b4d913bea1a6f89997ea788e77

Git commit cb8a6025ed69198f607e1b590cfbf47d3f599c7d by Dan Liew on 03/08/2026 at 22:41..
[CodeGen] Fix -fsanitize=array-bounds for __sized_by / _or_null pointers

`EmitCountedByBoundsChecking()` assumed a CountAttributedType is always
a __counted_by pointer. That isn't true, there are four versions of the
attribute:

* `__counted_by`: Already handled correctly.
* `__counted_by_or_null`: Incorectly handled.
* `__sized_by`: Incorreclty handled.
* `__sized_by_or_null`: Incorreclty handled.

In particular:

* __sized_by / __sized_by_or_null: the loaded bound is a byte count, but the
  element index was compared against it directly, so an access was only
  flagged once the index exceeded the byte count -- missing out-of-bounds
  accesses for a pointee larger than one byte. Scale the index to bytes
  ('index * sizeof(element)') before comparing. counted_by counts elements
  and is unchanged; a void (or otherwise zero-sized) pointee uses the GNU
  element size of 1, i.e. no scaling.

* __counted_by_or_null / __sized_by_or_null: a null pointer describes no
  accessible memory, but the null case was ignored, so an access through a
  null pointer with a non-zero count was not trapped. Treat the bound as 0
  when the pointer is null.

The index scaling is threaded through EmitBoundsCheckImpl via a new
IndexScale parameter; the runtime handler is still passed the unscaled
element index. Plain __counted_by and the general array-bounds path use a
scale of 1 and are unchanged.

Assisted-by: Claude Code
https://invent.kde.org/qt/clang/llvm-project/-/commit/cb8a6025ed69198f607e1b590cfbf47d3f599c7d