[Bug target/100202] New: aarch64: UB in insv<mode> expander

[Bug target/100202] New: aarch64: UB in insv<mode> expander

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100202

            Bug ID: 100202
           Summary: aarch64: UB in insv<mode> expander
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: acoplan at gcc dot gnu.org
  Target Milestone: ---

Bootstrapping on aarch64 --with-build-config=bootstrap-ubsan shows the
following issue:

$ gcc/xgcc -B gcc ~/toolchain/src/gcc/gcc/testsuite/gcc.dg/torture/pr94482.c -c
-O
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.md:5548:64: runtime
error: shift exponent 64 is too large for 64-bit type 'long unsigned int'
    #0 0x3c12028 in gen_insvdi(rtx_def*, rtx_def*, rtx_def*, rtx_def*)
/home/alecop01/toolchain/src/gcc/gcc/config/aarch64/aarch64.md:5548
    #1 0x1a36ee8 in maybe_expand_insn(insn_code, unsigned int, expand_operand*)
/home/alecop01/toolchain/src/gcc/gcc/optabs.c:7820
    #2 0xff890c in store_bit_field_using_insv
/home/alecop01/toolchain/src/gcc/gcc/expmed.c:726
    #3 0x1016db8 in store_integral_bit_field
/home/alecop01/toolchain/src/gcc/gcc/expmed.c:1056
    #4 0x1016db8 in store_bit_field_1
/home/alecop01/toolchain/src/gcc/gcc/expmed.c:879
    #5 0x1018794 in store_bit_field(rtx_def*, poly_int<2u, unsigned long>,
poly_int<2u, unsigned long>, poly_int<2u, unsigned long>, poly_int<2u, unsigned
long>, machine_mode, rtx_def*, bool)
/home/alecop01/toolchain/src/gcc/gcc/expmed.c:1183
    #6 0x10a1264 in store_field
/home/alecop01/toolchain/src/gcc/gcc/expr.c:7353
    #7 0x1094598 in expand_assignment(tree_node*, tree_node*, bool)
/home/alecop01/toolchain/src/gcc/gcc/expr.c:5482
    #8 0xb35550 in expand_gimple_stmt_1
/home/alecop01/toolchain/src/gcc/gcc/cfgexpand.c:3910
    #9 0xb35550 in expand_gimple_stmt
/home/alecop01/toolchain/src/gcc/gcc/cfgexpand.c:4008
    #10 0xb51250 in expand_gimple_basic_block
/home/alecop01/toolchain/src/gcc/gcc/cfgexpand.c:6045
    #11 0xb5b2b0 in execute
/home/alecop01/toolchain/src/gcc/gcc/cfgexpand.c:6729
    #12 0x1b5ec1c in execute_one_pass(opt_pass*)
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2567
    #13 0x1b623b8 in execute_pass_list_1
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2656
    #14 0x1b624d4 in execute_pass_list(function*, opt_pass*)
/home/alecop01/toolchain/src/gcc/gcc/passes.c:2667
    #15 0xc7b2a4 in cgraph_node::expand()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:1830
    #16 0xc7ff24 in expand_all_functions
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:1994
    #17 0xc7ff24 in symbol_table::compile()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2358
    #18 0xc8b81c in symbol_table::compile()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2271
    #19 0xc8b81c in symbol_table::finalize_compilation_unit()
/home/alecop01/toolchain/src/gcc/gcc/cgraphunit.c:2539
    #20 0x1f97478 in compile_file
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:482
    #21 0x68d9b0 in do_compile
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:2201
    #22 0x68d9b0 in toplev::main(int, char**)
/home/alecop01/toolchain/src/gcc/gcc/toplev.c:2340
    #23 0x6910d0 in main /home/alecop01/toolchain/src/gcc/gcc/main.c:39
    #24 0xffff7f7896dc in __libc_start_main
(/lib/aarch64-linux-gnu/libc.so.6+0x206dc)
    #25 0x691b2c  (/data/alecop01/builds/bstrap-ubsan/gcc/cc1+0x691b2c)

[Bug target/100202] aarch64: UB in insv<mode> expander

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100202

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-07-19

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed, the code is:
  if (width == 0 || (pos + width) > GET_MODE_BITSIZE (<MODE>mode))
    FAIL;

  if (CONST_INT_P (value))
    {
      unsigned HOST_WIDE_INT mask = ((unsigned HOST_WIDE_INT)1 << width) - 1;


I think > should be >= .