[Bug c++/101210] New: [7/8/9/10/11/12 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[Bug c++/101210] New: [7/8/9/10/11/12 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[jlegg at feralinteractive dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

            Bug ID: 101210
           Summary: [7/8/9/10/11/12 regression] spurious "reference
                    binding to misaligned address" ubsan error for integer
                    comparison
           Product: gcc
           Version: 11.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jlegg at feralinteractive dot com
  Target Milestone: ---

With -fsanitize=undefined, this C++ code:
int main()
{
        int x;
        int & y {x};
        return reinterpret_cast<long int>(&y) == 1;
}

Produces this error at runtime:
test.cc:5:40: runtime error: reference binding to misaligned address
0x000000000001 for type 'int', which requires 4 byte alignment
0x000000000001: note: pointer points here
<memory cannot be printed>

However, address 1 is never bound to a reference to an int. It is an integer
which is compared to another integer (which happens to be pointer sized and
derived from an address taken from a reference).

Checking various versions with compiler explorer, GCC 6 did not have this
issue, but later releases did.

[Bug c++/101210] [9/10/11/12 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[7/8/9/10/11/12 regression] |[9/10/11/12 regression]
                   |spurious "reference binding |spurious "reference binding
                   |to misaligned address"      |to misaligned address"
                   |ubsan error for integer     |ubsan error for integer
                   |comparison                  |comparison
                 CC|                            |jakub at gcc dot gnu.org
   Target Milestone|---                         |9.5

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I think this is caused by the PR70920 fix
r7-2226-g8f63caf6826e918678482413161e34b037a13fa7
We have (long) y == 1 where y has REFERENCE_TYPE and that match.pd
rule transforms it into y == 1 where 1 has also that REFERENCE_TYPE.
As ubsan instrumentation happens on partially GENERIC folded trees, doing that
in GENERIC for REFERENCE_TYPE is wrong, we should defer it to GIMPLE.

[Bug c++/101210] [9/10/11/12 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
   Last reconfirmed|                            |2021-06-28

[Bug c++/101210] [9/10/11/12 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 51069
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51069&action=edit
gcc12-pr101210.patch

Untested fix.

[Bug c++/101210] [9/10/11/12 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
You should Jakub likely use sanitize_flags_p rather than direct flag_sanitize?

[Bug c++/101210] [9/10/11/12 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
It should match what the FE is doing, and it uses
  if (TREE_CODE (stmt) == INTEGER_CST
      && TYPE_REF_P (TREE_TYPE (stmt))
      && (flag_sanitize & (SANITIZE_NULL | SANITIZE_ALIGNMENT))
      && !wtd->no_sanitize_p)

[Bug c++/101210] [9/10/11/12 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
You are right, it might be a location which I forgot to convert g:45b2222a13ea.

[Bug c++/101210] [9/10/11/12 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:53fd7544aff6d0a18869017cb9bb921a7f5dcd04

commit r12-1867-g53fd7544aff6d0a18869017cb9bb921a7f5dcd04
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jun 29 11:24:38 2021 +0200

    match.pd: Avoid (intptr_t)x eq/ne CST to x eq/ne (typeof x) CST opt in
GENERIC when sanitizing [PR101210]

    When we have (intptr_t) x == cst where x has REFERENCE_TYPE, this
    optimization creates x == cst out of it where cst has REFERENCE_TYPE.
    If it is done in GENERIC folding, it can results in ubsan failures
    where the INTEGER_CST with REFERENCE_TYPE is instrumented.

    Fixed by deferring it to GIMPLE folding in this case.

    2021-06-29  Jakub Jelinek  <jakub@redhat.com>

            PR c++/101210
            * match.pd ((intptr_t)x eq/ne CST to x eq/ne (typeof x) CST): Don't
            perform the optimization in GENERIC when sanitizing and x has a
            reference type.

            * g++.dg/ubsan/pr101210.C: New test.

[Bug c++/101210] [9/10/11 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[9/10/11/12 regression]     |[9/10/11 regression]
                   |spurious "reference binding |spurious "reference binding
                   |to misaligned address"      |to misaligned address"
                   |ubsan error for integer     |ubsan error for integer
                   |comparison                  |comparison

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk so far.

[Bug c++/101210] [9/10/11 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:86a9718e162b08cd4263402bcbf0d17a557bfcf1

commit r11-8768-g86a9718e162b08cd4263402bcbf0d17a557bfcf1
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jun 29 11:24:38 2021 +0200

    match.pd: Avoid (intptr_t)x eq/ne CST to x eq/ne (typeof x) CST opt in
GENERIC when sanitizing [PR101210]

    When we have (intptr_t) x == cst where x has REFERENCE_TYPE, this
    optimization creates x == cst out of it where cst has REFERENCE_TYPE.
    If it is done in GENERIC folding, it can results in ubsan failures
    where the INTEGER_CST with REFERENCE_TYPE is instrumented.

    Fixed by deferring it to GIMPLE folding in this case.

    2021-06-29  Jakub Jelinek  <jakub@redhat.com>

            PR c++/101210
            * match.pd ((intptr_t)x eq/ne CST to x eq/ne (typeof x) CST): Don't
            perform the optimization in GENERIC when sanitizing and x has a
            reference type.

            * g++.dg/ubsan/pr101210.C: New test.

    (cherry picked from commit 53fd7544aff6d0a18869017cb9bb921a7f5dcd04)

[Bug c++/101210] [9/10 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[9/10/11 regression]        |[9/10 regression] spurious
                   |spurious "reference binding |"reference binding to
                   |to misaligned address"      |misaligned address" ubsan
                   |ubsan error for integer     |error for integer
                   |comparison                  |comparison

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 11.2 too.

[Bug c++/101210] [9/10 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:208ad9a001f192c763e2c9682a4c296b4696a10c

commit r10-10628-g208ad9a001f192c763e2c9682a4c296b4696a10c
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jun 29 11:24:38 2021 +0200

    match.pd: Avoid (intptr_t)x eq/ne CST to x eq/ne (typeof x) CST opt in
GENERIC when sanitizing [PR101210]

    When we have (intptr_t) x == cst where x has REFERENCE_TYPE, this
    optimization creates x == cst out of it where cst has REFERENCE_TYPE.
    If it is done in GENERIC folding, it can results in ubsan failures
    where the INTEGER_CST with REFERENCE_TYPE is instrumented.

    Fixed by deferring it to GIMPLE folding in this case.

    2021-06-29  Jakub Jelinek  <jakub@redhat.com>

            PR c++/101210
            * match.pd ((intptr_t)x eq/ne CST to x eq/ne (typeof x) CST): Don't
            perform the optimization in GENERIC when sanitizing and x has a
            reference type.

            * g++.dg/ubsan/pr101210.C: New test.

    (cherry picked from commit 53fd7544aff6d0a18869017cb9bb921a7f5dcd04)

[Bug c++/101210] [9/10 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:57aeb7f535b9c04ed34ab9479498143ee73fb568

commit r9-10085-g57aeb7f535b9c04ed34ab9479498143ee73fb568
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jun 29 11:24:38 2021 +0200

    match.pd: Avoid (intptr_t)x eq/ne CST to x eq/ne (typeof x) CST opt in
GENERIC when sanitizing [PR101210]

    When we have (intptr_t) x == cst where x has REFERENCE_TYPE, this
    optimization creates x == cst out of it where cst has REFERENCE_TYPE.
    If it is done in GENERIC folding, it can results in ubsan failures
    where the INTEGER_CST with REFERENCE_TYPE is instrumented.

    Fixed by deferring it to GIMPLE folding in this case.

    2021-06-29  Jakub Jelinek  <jakub@redhat.com>

            PR c++/101210
            * match.pd ((intptr_t)x eq/ne CST to x eq/ne (typeof x) CST): Don't
            perform the optimization in GENERIC when sanitizing and x has a
            reference type.

            * g++.dg/ubsan/pr101210.C: New test.

    (cherry picked from commit 53fd7544aff6d0a18869017cb9bb921a7f5dcd04)

[Bug c++/101210] [9/10 regression] spurious "reference binding to misaligned address" ubsan error for integer comparison

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101210

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.