[Bug target/100200] New: [10/11/12 Regression] UB evaluating aarch64_plus_immediate predicate

[Bug target/100200] New: [10/11/12 Regression] UB evaluating aarch64_plus_immediate predicate

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

            Bug ID: 100200
           Summary: [10/11/12 Regression] UB evaluating
                    aarch64_plus_immediate predicate
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: acoplan at gcc dot gnu.org
  Target Milestone: ---

Bootstrapping --with-build-config=bootstrap-ubsan on AArch64 and running:

gcc/xgcc -B gcc
~/toolchain/src/gcc/gcc/testsuite/gcc.c-torture/compile/pr65540.c -c -O

I get:

/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/predicates.md:129:23:
runtime error: negation of -9223372036854775808 cannot be represented in type
'long int'; cast to an unsigned type to negate this value to itself

[Bug target/100200] [10/11/12 Regression] UB evaluating aarch64_plus_immediate predicate

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

--- Comment #1 from Alex Coplan <acoplan at gcc dot gnu.org> ---
Backtrace is:

    #0 0x4340bc0 in aarch64_plus_immediate(rtx_def*, machine_mode)
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/predicates.md:129
    #1 0x2e0d168 in aarch64_rtx_costs
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.c:13000
    #2 0x2e1ae1c in aarch64_rtx_costs_wrapper
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.c:13824
    #3 0x1d97328 in rtx_cost(rtx_def*, machine_mode, rtx_code, int, bool)
/home/alecop01/toolchain/src/gcc/gcc/rtlanal.c:4626
    #4 0x49424bc in notreg_cost /home/alecop01/toolchain/src/gcc/gcc/cse.c:731
    #5 0x495882c in cse_insn /home/alecop01/toolchain/src/gcc/gcc/cse.c:5130
    #6 0x496e198 in cse_extended_basic_block
/home/alecop01/toolchain/src/gcc/gcc/cse.c:6590
    #7 0x496e198 in cse_main /home/alecop01/toolchain/src/gcc/gcc/cse.c:6769
    #8 0x4972808 in rest_of_handle_cse
/home/alecop01/toolchain/src/gcc/gcc/cse.c:7599
    #9 0x4972808 in execute /home/alecop01/toolchain/src/gcc/gcc/cse.c:7642
    #10 0x1b5ec1c in execute_one_pass(opt_pass*)
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2567
    #11 0x1b623b8 in execute_pass_list_1
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2656
    #12 0x1b623f0 in execute_pass_list_1
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2657
    #13 0x1b624d4 in execute_pass_list(function*, opt_pass*)
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2667
    #14 0xc7b2a4 in cgraph_node::expand()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:1830
    #15 0xc7ff24 in expand_all_functions
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:1994
    #16 0xc7ff24 in symbol_table::compile()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2358
    #17 0xc8b81c in symbol_table::compile()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2271
    #18 0xc8b81c in symbol_table::finalize_compilation_unit()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2539
    #19 0x1f97478 in compile_file
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:482
    #20 0x68d9b0 in do_compile
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:2201
    #21 0x68d9b0 in toplev::main(int, char**)
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:2340
    #22 0x6910d0 in main /home/alecop01/toolchain/src/gcc/gcc/main.c:39
    #23 0xffff7cc036dc in __libc_start_main
(/lib/aarch64-linux-gnu/libc.so.6+0x206dc)
    #24 0x691b2c  (/data/alecop01/builds/bstrap-ubsan/gcc/cc1+0x691b2c)

[Bug target/100200] [10/11/12 Regression] UB evaluating aarch64_plus_immediate predicate

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

--- Comment #2 from Alex Coplan <acoplan at gcc dot gnu.org> ---
Started with r10-3389-g835d50c66aa5bde2f354a6e63a2afa7d2f76a05a for the above
testcase. That commit just introduces a use of aarch64_plus_immediate. The
actual issue must be older.

[Bug target/100200] [10/11/12 Regression] UB evaluating aarch64_plus_immediate predicate

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |10.4

[Bug target/100200] [10/11/12 Regression] UB evaluating aarch64_plus_immediate predicate

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-04-26
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 50680
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50680&action=edit
gcc11-pr100200.patch

Untested fix.

[Bug target/100200] [10/11/12 Regression] UB evaluating aarch64_plus_immediate predicate

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:618ae596ebcd1de03857d20485d1324931852569

commit r12-160-g618ae596ebcd1de03857d20485d1324931852569
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Apr 27 15:46:16 2021 +0200

    aarch64: Fix UB in the compiler [PR100200]

    The following patch fixes UBs in the compiler when negativing
    a CONST_INT containing HOST_WIDE_INT_MIN.  I've changed the spots where
    there wasn't an obvious earlier condition check or predicate that
    would fail for such CONST_INTs.

    2021-04-27  Jakub Jelinek  <jakub@redhat.com>

            PR target/100200
            * config/aarch64/predicates.md (aarch64_sub_immediate,
            aarch64_plus_immediate): Use -UINTVAL instead of -INTVAL.
            * config/aarch64/aarch64.md (casesi, rotl<mode>3): Likewise.
            * config/aarch64/aarch64.c (aarch64_print_operand,
            aarch64_split_atomic_op, aarch64_expand_subvti): Likewise.

[Bug target/100200] [10/11/12 Regression] UB evaluating aarch64_plus_immediate predicate

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:3fe1c1fd0eb5e4bbc1af313b3e9dd4605ec5a134

commit r11-8301-g3fe1c1fd0eb5e4bbc1af313b3e9dd4605ec5a134
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Apr 27 15:46:16 2021 +0200

    aarch64: Fix UB in the compiler [PR100200]

    The following patch fixes UBs in the compiler when negativing
    a CONST_INT containing HOST_WIDE_INT_MIN.  I've changed the spots where
    there wasn't an obvious earlier condition check or predicate that
    would fail for such CONST_INTs.

    2021-04-27  Jakub Jelinek  <jakub@redhat.com>

            PR target/100200
            * config/aarch64/predicates.md (aarch64_sub_immediate,
            aarch64_plus_immediate): Use -UINTVAL instead of -INTVAL.
            * config/aarch64/aarch64.md (casesi, rotl<mode>3): Likewise.
            * config/aarch64/aarch64.c (aarch64_print_operand,
            aarch64_split_atomic_op, aarch64_expand_subvti): Likewise.

    (cherry picked from commit 618ae596ebcd1de03857d20485d1324931852569)

[Bug target/100200] [10 Regression] UB evaluating aarch64_plus_immediate predicate

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[10/11/12 Regression] UB    |[10 Regression] UB
                   |evaluating                  |evaluating
                   |aarch64_plus_immediate      |aarch64_plus_immediate
                   |predicate                   |predicate

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk and for 11.2 so far.

[Bug target/100200] [10 Regression] UB evaluating aarch64_plus_immediate predicate

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:1c0c371d0ea297af2e3180c64cd18f2bfce919b1

commit r12-164-g1c0c371d0ea297af2e3180c64cd18f2bfce919b1
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Apr 27 17:50:53 2021 +0200

    aarch64: Fix up last commit [PR100200]

    Pedantically signed vs. unsigned mismatches in va_arg are only well defined
    if the value can be represented in both signed and unsigned integer types.

    2021-04-27  Jakub Jelinek  <jakub@redhat.com>

            PR target/100200
            * config/aarch64/aarch64.c (aarch64_print_operand): Cast -UINTVAL
            back to HOST_WIDE_INT.

[Bug target/100200] [10 Regression] UB evaluating aarch64_plus_immediate predicate

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:e89e883a450126d021874536ae102f60a1cacb78

commit r11-8303-ge89e883a450126d021874536ae102f60a1cacb78
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Apr 27 17:50:53 2021 +0200

    aarch64: Fix up last commit [PR100200]

    Pedantically signed vs. unsigned mismatches in va_arg are only well defined
    if the value can be represented in both signed and unsigned integer types.

    2021-04-27  Jakub Jelinek  <jakub@redhat.com>

            PR target/100200
            * config/aarch64/aarch64.c (aarch64_print_operand): Cast -UINTVAL
            back to HOST_WIDE_INT.

    (cherry picked from commit 1c0c371d0ea297af2e3180c64cd18f2bfce919b1)

[Bug target/100200] [10 Regression] UB evaluating aarch64_plus_immediate predicate

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.4                        |10.5

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 10.4 is being released, retargeting bugs to GCC 10.5.

[Bug target/100200] [10 Regression] UB evaluating aarch64_plus_immediate predicate

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100200

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.5                        |11.2
      Known to work|                            |11.2.0
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed in GCC 11.2.