[Bug c/13421] New: IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[Bug c/13421] New: IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[vik dot heyndrickx at pandora dot be]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2236 bytes --]

kernel-2.4.22-1.2115.nptl, glibc-2.3.2-101.1
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man --
infodir=/usr/share/info --enable-shared --enable-threads=posix --disable-
checking --with-system-zlib --enable-__cxa_atexit --host=i386-redhat-linux
Thread model: posix
gcc version 3.3.2 20031022 (Red Hat Linux 3.3.2-1)

Circumstances: “-ftrapv” is a gcc compiler option used to detect signed integer 
overflow conditions, and as such is frequently used to debug programs. This 
flag is by default disabled.
On IA32 these days adressible memory for a process can be larger than 2^31 
octets. It is possible for a memory block whose lower bound address is less 
than 2^31 en whose upper bound address is larger than 2^31, to be assigned. 
Subtracting these two addresses is a normal operation to determine the size of 
that block. It appears however that when “-ftrapv” is used to compile a 
program, execution of this program is aborted when subtracting these pointers. 
In my opinion this should not happen, because there is nothing illegal about.

Example of failing program test.c (it looks "manufactured", but is short, the 
real program I encountered this problem with is less manufactured, I got the 
addresses from malloc(), and that program was long):

<cut>
long signed diff = 0;

void setdiff (unsigned char *a, unsigned char *b) {
        diff = b - a;
}

int main (void) {
        unsigned char *a, *b;

        a = (unsigned char*)0x7FFFF000u;
        b = (unsigned char*)0x80000001u;
        setdiff (a, b);
        return 0;
}
</cut>

Compiler command line:
gcc -ftrapv test.c

execution of the resulting program a.out:
Aborted

-- 
           Summary: IA32 bigmem pointer subtraction and –ftrapv option
                    causes unjustified program abort
           Product: gcc
           Version: 3.3.2
            Status: UNCONFIRMED
          Severity: critical
          Priority: P2
         Component: c
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: vik dot heyndrickx at pandora dot be
                CC: gcc-bugs at gcc dot gnu dot org
  GCC host triplet: gcc version 3.3.2 20031022 (Red Hat Linux 3.3.2-1)


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2003-12-17 16:43 -------
Pointers are signed on i386. Use a cast to unsigned to get the effect you want.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[falk at debian dot org]

------- Additional Comments From falk at debian dot org  2003-12-17 16:58 -------
I don't understand why you consider this invalid. The code looks OK to me,
assuming the pointers were really gained from malloc. Could you elaborate?


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2003-12-17 17:01 -------
Pointers are signed so the subtraction is also signed which causes this problem.
If you want to use the difference without the abort from -ftrapv then do (unsgined)(a)-
(unsigned)(b).

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[vik dot heyndrickx at pandora dot be]

------- Additional Comments From vik dot heyndrickx at pandora dot be  2003-12-17 17:03 -------
That is a (working) workaround, not a solution IMHO.
The workaround you propose means that basically any subtraction of any pair of 
pointer need to be casted to unsigned because in theory any data structure may 
end up near the middle of the address space. Otherwise anyone risks random 
aborts.

Even more, if I would want to write a portable program, I cannot do it using 
your proposed workaround because in general there is no such thing as an 
integer data type that can hold a pointer.


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2003-12-17 17:16 -------
But pointers are singed so you have to, sorry but that is the only way for this to work.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|                            |INVALID


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[vik dot heyndrickx at pandora dot be]

------- Additional Comments From vik dot heyndrickx at pandora dot be  2003-12-17 17:28 -------
Is there any need for having pointers to be signed?

Is there any need for -ftrapv checks to be done on pointers even when they are 
signed?

Could the GCC documentation to be changed, so that it mentions that if -ftrapv 
is used, a perfectly legal program may and will crash unexpectedly and randomly 
on signed pointer platforms...


-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |UNCONFIRMED
         Resolution|INVALID                     |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[pinskia at gcc dot gnu dot org]

------- Additional Comments From pinskia at gcc dot gnu dot org  2003-12-17 17:53 -------
Pointers signness are determined by the ABI.
Here are the list of targets that are unsigned:
./alpha/vms.h:#define POINTERS_EXTEND_UNSIGNED 0
./ia64/hpux.h:#define POINTERS_EXTEND_UNSIGNED -1
./mips/mips.h:#define POINTERS_EXTEND_UNSIGNED 0
./s390/s390.h:#define POINTERS_EXTEND_UNSIGNED -1
./sparc/sparc.h:#define POINTERS_EXTEND_UNSIGNED 1
There are not many.
-ftrapv is done for all signed "addition, subtraction, multiplication operations".
So this is a request for documentation about -ftrapv and pointer arightatic.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|critical                    |minor
             Status|UNCONFIRMED                 |NEW
     Ever Confirmed|                            |1
           Keywords|                            |documentation
   Last reconfirmed|0000-00-00 00:00:00         |2003-12-17 17:53:14
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[falk dot hueffner at student dot uni-tuebingen dot de]

------- Additional Comments From falk dot hueffner at student dot uni-tuebingen dot de  2003-12-17 18:05 -------
Subject: Re:  IA32 bigmem pointer subtraction and ftrapv option causes unjustified program abort

"pinskia at gcc dot gnu dot org" <gcc-bugzilla@gcc.gnu.org> writes:

> ------- Additional Comments From pinskia at gcc dot gnu dot org  2003-12-17 17:53 -------
> Pointers signness are determined by the ABI.
> Here are the list of targets that are unsigned:
> ./alpha/vms.h:#define POINTERS_EXTEND_UNSIGNED 0
> ./ia64/hpux.h:#define POINTERS_EXTEND_UNSIGNED -1
> ./mips/mips.h:#define POINTERS_EXTEND_UNSIGNED 0
> ./s390/s390.h:#define POINTERS_EXTEND_UNSIGNED -1
> ./sparc/sparc.h:#define POINTERS_EXTEND_UNSIGNED 1
> There are not many.
> -ftrapv is done for all signed "addition, subtraction,
> multiplication operations".  So this is a request for documentation
> about -ftrapv and pointer arightatic.

Pointer signedness is an implementation detail which should not matter
to conforming programs IMHO. Also I would suppose it is feasible to
generate unsigned difference/division for pointer difference on any
platform.

Roger, you fixed bug 1823 which is related. Do you have any opinion on
this?



-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[zack at gcc dot gnu dot org]

------- Additional Comments From zack at gcc dot gnu dot org  2003-12-17 18:21 -------
1) Indeed, this subtraction operation should work fine whether or not pointers
are unsigned, and whether or not -ftrapv is in use.  This is not a documentation
bug.

2) POINTERS_EXTEND_UNSIGNED does not mean what you think it means.  From the manual:

  `POINTERS_EXTEND_UNSIGNED'
     A C expression whose value is greater than zero if pointers that
     need to be extended from being `POINTER_SIZE' bits wide to `Pmode'
     are to be zero-extended and zero if they are to be sign-extended.
     If the value is less then zero then there must be an "ptr_extend"
     instruction that extends a pointer from `POINTER_SIZE' to `Pmode'.

     You need not define this macro if the `POINTER_SIZE' is equal to
     the width of `Pmode'.

In particular, this *only* affects extension of pointers from POINTER_SIZE to
Pmode.  It says *nothing* about whether address arithmetic should be treated as
signed.  I don't think we even have a way of talking about that.

-- 
           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|minor                       |normal
           Keywords|documentation               |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[bangerth at dealii dot org]

------- Additional Comments From bangerth at dealii dot org  2003-12-18 10:39 -------
Just as a sidenote: the integer type that can hold pointers is, at 
least in C++, ptrdiff_t. Casting to this type should get you where 
you want. 
 
W. 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[vik dot heyndrickx at pandora dot be]

------- Additional Comments From vik dot heyndrickx at pandora dot be  2003-12-18 12:21 -------
(In reply to comment #10)
> Just as a sidenote: the integer type that can hold pointers is, at 
> least in C++, ptrdiff_t. Casting to this type should get you where 
> you want. 

No, it won't. ptrdiff_t exists also in C by the way. The problem is not the 
result of the subtraction but the subtraction itself. 
In essence the problem is the signedness of pointers. Later on, I realizes that 
when p is a pointer, and q is set to e.g. p + 2, that q < p for some values of 
p (e.g. (void*)0x7FFFFFFFu) on IA32. Signedness and an addressible flat memory 
space larger than 2^31 are not compatible.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[bangerth at dealii dot org]

------- Additional Comments From bangerth at dealii dot org  2003-12-18 13:11 -------
Well, if prtdiff_t doesn't work, I would say that this is a bug in gcc. 
That's also what Zack says in his first point. 
 
W. 

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug c/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[vik dot heyndrickx at pandora dot be]

------- Additional Comments From vik dot heyndrickx at pandora dot be  2003-12-19 10:23 -------
(In reply to comment #11)
> Later on, I realizes that when p is a pointer, and q is set to 
> e.g. p + 2, that q < p for some values of p 
> (e.g. (void*)0x7FFFFFFFu) on IA32. Signedness and an addressible
> flat memory space larger than 2^31 are not compatible.

To my big surprise I found out today that pointer on IA32 are treated as 
unsigneds. At least when comparing pointers. The IA32 asm code for comparing 
unsigneds and pointers is the same. It differs for signeds.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug middle-end/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[eggert at twinsun dot com]

------- Additional Comments From eggert at twinsun dot com  2004-04-06 05:13 -------
A point of clarification: even if pointers are changed to be consistently
unsigned internally (which seems to be the right thing to do, if pointer
comparison is unsigned), GCC must still check for overflow when subtracting
pointers. For example, suppose we have the 2 GiB array "a" successfully
allocated by "char *a = malloc (1u<<31);". Then the expression "(a + (1u<<31)) -
a" is of type ptrdiff_t, which is a signed 32-bit integer that cannot represent
(1u<<31). So this expression must generate a trap with -ftrapv, regardless of
whether pointers are unsigned internally.

-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

[Bug middle-end/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |15.0
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #18 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed for GCC 15.

[Bug middle-end/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

--- Comment #17 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:667c19de86b33648f5f4599f589a5e02adbb35cb

commit r15-67-g667c19de86b33648f5f4599f589a5e02adbb35cb
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Apr 16 14:05:35 2024 +0200

    middle-end/13421 - -ftrapv vs. POINTER_DIFF_EXPR

    Currently we expand POINTER_DIFF_EXPR using subv_optab when -ftrapv
    (but -fsanitize=undefined does nothing).  That's not consistent
    with the behavior of POINTER_PLUS_EXPR which never uses addv_optab
    with -ftrapv.  Both are because of the way we select whether to use
    the trapping or the non-trapping optab - we look at the result type
    of the expression and check

      trapv = INTEGRAL_TYPE_P (type) && TYPE_OVERFLOW_TRAPS (type);

    the bugreport correctly complains that -ftrapv affects pointer
    subtraction (there's no -ftrapv-pointer).  Now that we have
    POINTER_DIFF_EXPR we can honor that appropriately.

    The patch moves both POINTER_DIFF_EXPR and POINTER_PLUS_EXPR
    handling so they will never consider trapping (or saturating)
    optabs.

            PR middle-end/13421
            * optabs-tree.cc (optab_for_tree_code): Do not consider
            {add,sub}v or {us,ss}{add,sub} optabs for POINTER_DIFF_EXPR
            or POINTER_PLUS_EXPR.

[Bug middle-end/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |baiwfg2 at gmail dot com

--- Comment #16 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 110399 has been marked as a duplicate of this bug. ***

[Bug middle-end/13421] IA32 bigmem pointer subtraction and –ftrapv option causes unjustified program abort

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=13421

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |oss at malat dot biz

--- Comment #15 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 81801 has been marked as a duplicate of this bug. ***