[Bug c++/32667] New: builtin operator= generates memcpy with overlapping memory regions

[Bug c++/32667] New: builtin operator= generates memcpy with overlapping memory regions

[Raimund dot Merkert at baesystems dot com]

This code generates a warning when run with valgrind:
#include <vector>

using namespace ::std;

struct X {
  double values[10];
};


int main()
{
  vector<X> x;

  x.push_back(X());
  for (vector<X>::iterator i=x.begin();i!=x.end();++i) {
    *i = *(x.end()-1);
  }
  return 0;
}

g++ test.cpp -o foo -O3 

Valgrind error:
valgrind --tool=memcheck foo
==24513== Memcheck, a memory error detector for x86-linux.
==24513== Copyright (C) 2002-2004, and GNU GPL'd, by Julian Seward et al.
==24513== Using valgrind-2.2.0, a program supervision framework for x86-linux.
==24513== Copyright (C) 2000-2004, and GNU GPL'd, by Julian Seward et al.
==24513== For more details, rerun with: -v
==24513==
==24513== Source and destination overlap in memcpy(0x1BB68028, 0x1BB68028, 80)
==24513==    at 0x1B9057E5: memcpy (in /usr/lib/valgrind/vgpreload_memcheck.so)
==24513==    by 0x8048696: main (in /home/ray/tmp/foo)
==24513==
==24513== ERROR SUMMARY: 1 errors from 1 contexts (suppressed: 17 from 1)
==24513== malloc/free: in use at exit: 0 bytes in 0 blocks.
==24513== malloc/free: 1 allocs, 1 frees, 80 bytes allocated.
==24513== For a detailed leak analysis,  rerun with: --leak-check=yes
==24513== For counts of detected errors, rerun with: -v

On my machine "man memcpy" says "...The memory areas may not overlap. Use
memmove(3) if the memory areas do overlap. ..."


-- 
           Summary: builtin operator= generates memcpy with overlapping
                    memory regions
           Product: gcc
           Version: 4.2.0
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: c++
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: Raimund dot Merkert at baesystems dot com
  GCC host triplet: i686-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=32667

[Bug c++/32667] builtin operator= generates memcpy with overlapping memory regions

[pcarlini at suse dot de]

------- Comment #1 from pcarlini at suse dot de  2007-07-07 18:19 -------
Interesting: mainline is not affected by the problem. I would guess thanks to
fixing libstdc++/29286 ??? 


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=32667

[Bug c++/32667] builtin operator= generates memcpy with overlapping memory regions

[Raimund dot Merkert at baesystems dot com]

------- Comment #2 from Raimund dot Merkert at baesystems dot com  2007-07-07 22:36 -------
This may be an old bug and may have crept in between 3.3.3 and 3.4.0 (latter
has it, former doesn't)


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=32667

[Bug middle-end/32667] builtin operator= generates memcpy with overlapping memory regions

[rguenth at gcc dot gnu dot org]

------- Comment #3 from rguenth at gcc dot gnu dot org  2007-07-08 19:46 -------
No, this doesn't have anything to do with aliasing.  4.3 simply inlines the
memcpys.  This is probably a middle-end issue with expanding structure
assignments.  2.95 and 3.3 also expanded the calls inline.  3.4 does not,
likewise 4.0, 4.1 and 4.2.

Note that this is likely not a problem in practice as memcpy (p, p, sizeof
(*p))
is difficult to implement in a way that would make it not work.  So,
downgrading
severity.


-- 

rguenth at gcc dot gnu dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu dot
                   |                            |org
           Severity|major                       |normal
             Status|UNCONFIRMED                 |NEW
          Component|c++                         |middle-end
     Ever Confirmed|0                           |1
           Keywords|                            |wrong-code
   Last reconfirmed|0000-00-00 00:00:00         |2007-07-08 19:46:19
               date|                            |


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=32667

[Bug middle-end/32667] builtin operator= generates memcpy with overlapping memory regions

[pcarlini at suse dot de]

------- Comment #4 from pcarlini at suse dot de  2007-07-08 20:53 -------
Thanks for the clarification, Richard.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=32667

[Bug middle-end/32667] builtin operator= generates memcpy with overlapping memory regions

[ppluzhnikov at google dot com]

------- Comment #5 from ppluzhnikov at google dot com  2009-05-06 16:36 -------
(In reply to comment #3)

> Note that this is likely not a problem in practice as 
>  memcpy (p, p, sizeof (*p)) is difficult to implement
> in a way that would make it not work.

>From Julian Seward:

JS> AIUI, POSIX says the src==dst case is not allowed (along with all other
JS> overlapping cases) because (eg) on PowerPC, it is possible to make a high
JS> performance memcpy that preallocates the destination area in D1 using
JS> dcbz instructions, which create the line in D1 and fill it full of
JS> zeroes.  This avoids dragging the destination line up the memory
JS> hierarchy only to completely overwrite it with stuff from the source.
JS>
JS> Result is however that if the src and dst overlap, in any way, including
JS> completely, then this causes zeroes to be written into the src area (!)
JS> which is certainly not what you want.

This bug is likely fixed by:
http://gcc.gnu.org/ml/gcc-patches/2009-04/msg00932.html


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=32667

[Bug middle-end/32667] builtin operator= generates memcpy with overlapping memory regions

[lu_zero at gentoo dot org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=32667

lu_zero at gentoo dot org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |lu_zero at gentoo dot org

--- Comment #6 from lu_zero at gentoo dot org 2011-12-05 16:59:07 UTC ---
Doesn't seem.

Here a reduced testcase courtesy of Mans Rullgard

struct foo {
    int x[64];
};

void __attribute__((noinline)) foo(struct foo *a, struct foo *b)
{
    *a = *b;
}

int main(void)
{
    struct foo a = { 0 };
    foo(&a, &a);
    return 0;
}

[Bug middle-end/32667] builtin operator= generates memcpy with overlapping memory regions

[mans at mansr dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=32667

Mans Rullgard <mans at mansr dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mans at mansr dot com

--- Comment #7 from Mans Rullgard <mans at mansr dot com> 2011-12-05 20:37:18 UTC ---
Note that the test case in comment #6 does not trigger the problem on x86 where
the copying is inlined. It does trigger on ARM and other targets where this
assignment results in a memcpy() call. All current stable releases show the
bug. I did not test with trunk.