[Bug ipa/103230] New: ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[Bug ipa/103230] New: ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

            Bug ID: 103230
           Summary: ipa-modref-tree.h:550:33: runtime error: load of value
                    255, which is not a valid value for type 'bool'
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: hubicka at gcc dot gnu.org, marxin at gcc dot gnu.org
            Blocks: 63426
  Target Milestone: ---

Happens with UBSAN compiler for:

$ gcc gcc/testsuite/gcc.c-torture/execute/pr71494.c -O1  -flto
...
/home/marxin/Programming/gcc/gcc/ipa-modref-tree.h:550:33: runtime error: load
of value 255, which is not a valid value for type 'bool'
    #0 0x18acc38 in modref_tree<tree_node*>::merge(modref_tree<tree_node*>*,
vec<modref_parm_map, va_heap, vl_ptr>*, modref_parm_map*, bool)
/home/marxin/Programming/gcc/gcc/ipa-modref-tree.h:550
    #1 0x188452c in modref_propagate_in_scc
/home/marxin/Programming/gcc/gcc/ipa-modref.c:4385
    #2 0x188a2b7 in execute /home/marxin/Programming/gcc/gcc/ipa-modref.c:4932
    #3 0x1f513bc in execute_one_pass(opt_pass*)
/home/marxin/Programming/gcc/gcc/passes.c:2567
    #4 0x1f54a44 in execute_ipa_pass_list(opt_pass*)
/home/marxin/Programming/gcc/gcc/passes.c:2996
    #5 0xb3bd3c in do_whole_program_analysis
/home/marxin/Programming/gcc/gcc/lto/lto.c:469
    #6 0xb3c538 in lto_main() /home/marxin/Programming/gcc/gcc/lto/lto.c:637
    #7 0x2417b3b in compile_file /home/marxin/Programming/gcc/gcc/toplev.c:452
    #8 0x2422188 in do_compile /home/marxin/Programming/gcc/gcc/toplev.c:2156
    #9 0x2422c03 in toplev::main(int, char**)
/home/marxin/Programming/gcc/gcc/toplev.c:2308
    #10 0x6edfd90 in main /home/marxin/Programming/gcc/gcc/main.c:39
    #11 0x7ffff6f1453f in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
    #12 0x7ffff6f145eb in __libc_start_main_impl ../csu/libc-start.c:409
    #13 0xaa3b74 in _start (/dev/shm/objdir2/gcc/lto1+0xaa3b74)


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63426
[Bug 63426] [meta-bug] Issues found with -fsanitize=undefined

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
      Known to fail|                            |12.0
           Priority|P3                          |P1
   Last reconfirmed|                            |2021-11-14
   Target Milestone|---                         |12.0
             Status|UNCONFIRMED                 |NEW

Re: [Bug ipa/103230] New: ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[Jan Hubicka]

> Happens with UBSAN compiler for:
> 
> $ gcc gcc/testsuite/gcc.c-torture/execute/pr71494.c -O1  -flto
> ...
> /home/marxin/Programming/gcc/gcc/ipa-modref-tree.h:550:33: runtime error: load
> of value 255, which is not a valid value for type 'bool'
>     #0 0x18acc38 in modref_tree<tree_node*>::merge(modref_tree<tree_node*>*,
> vec<modref_parm_map, va_heap, vl_ptr>*, modref_parm_map*, bool)
> /home/marxin/Programming/gcc/gcc/ipa-modref-tree.h:550
>     #1 0x188452c in modref_propagate_in_scc

At 4385 I have:
       changed |= cur_summary_lto->stores->merge
		(callee_summary_lto->stores, &parm_map, &chain_map, !first);                     

parm-map is the vector, however there is no read of it.
There is bool which is relevant only when parm_index is not unknown, so
I suspect it may a full copy with uninitialized bool which would be
harmless. We had similar issues with asan before.

How do you build ubsan compiler?
Honza

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[hubicka at kam dot mff.cuni.cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

--- Comment #1 from hubicka at kam dot mff.cuni.cz ---
> Happens with UBSAN compiler for:
> 
> $ gcc gcc/testsuite/gcc.c-torture/execute/pr71494.c -O1  -flto
> ...
> /home/marxin/Programming/gcc/gcc/ipa-modref-tree.h:550:33: runtime error: load
> of value 255, which is not a valid value for type 'bool'
>     #0 0x18acc38 in modref_tree<tree_node*>::merge(modref_tree<tree_node*>*,
> vec<modref_parm_map, va_heap, vl_ptr>*, modref_parm_map*, bool)
> /home/marxin/Programming/gcc/gcc/ipa-modref-tree.h:550
>     #1 0x188452c in modref_propagate_in_scc

At 4385 I have:
       changed |= cur_summary_lto->stores->merge
                (callee_summary_lto->stores, &parm_map, &chain_map, !first);    

parm-map is the vector, however there is no read of it.
There is bool which is relevant only when parm_index is not unknown, so
I suspect it may a full copy with uninitialized bool which would be
harmless. We had similar issues with asan before.

How do you build ubsan compiler?
Honza

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
> How do you build ubsan compiler?

F="-O0 -g -fsanitize=undefined" ; make -j16 all-host -k CFLAGS="$F"
CXXFLAGS="$F"  LDFLAGS="$F"

is the fastest approach.

Re: [Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[Jan Hubicka]

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230
> 
> --- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
> > How do you build ubsan compiler?
> 
> F="-O0 -g -fsanitize=undefined" ; make -j16 all-host -k CFLAGS="$F"
> CXXFLAGS="$F"  LDFLAGS="$F"
> 
> is the fastest approach.
Thanks, it is similar to what I tried.  I guess there should be no ";"
but yet it leds to misconfigured libiberty for me on kunlun.  I will
look into that.

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[hubicka at kam dot mff.cuni.cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

--- Comment #3 from hubicka at kam dot mff.cuni.cz ---
> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230
> 
> --- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
> > How do you build ubsan compiler?
> 
> F="-O0 -g -fsanitize=undefined" ; make -j16 all-host -k CFLAGS="$F"
> CXXFLAGS="$F"  LDFLAGS="$F"
> 
> is the fastest approach.
Thanks, it is similar to what I tried.  I guess there should be no ";"
but yet it leds to misconfigured libiberty for me on kunlun.  I will
look into that.

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to hubicka from comment #3)
> > https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230
> > 
> > --- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
> > > How do you build ubsan compiler?
> > 
> > F="-O0 -g -fsanitize=undefined" ; make -j16 all-host -k CFLAGS="$F"
> > CXXFLAGS="$F"  LDFLAGS="$F"
> > 
> > is the fastest approach.
> Thanks, it is similar to what I tried.  I guess there should be no ";"
> but yet it leds to misconfigured libiberty for me on kunlun.  I will
> look into that.

Note that kunlun may have an old system GCC compiler.

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
The canonical approach would be using config/bootstrap-ubsan.mk config file.

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
Still reproduces with the current master:
g:e69b7c5779863469479698f863ab25e0d9b4586e.

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
I think it is changed that is being read here.

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |marxin at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #8 from Martin Liška <marxin at gcc dot gnu.org> ---
I've got a patch candidate for it.

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Liska <marxin@gcc.gnu.org>:

https://gcc.gnu.org/g:74a4ece02df1b1b6f396fd0e24dbbf8b0897858a

commit r12-5399-g74a4ece02df1b1b6f396fd0e24dbbf8b0897858a
Author: Martin Liska <mliska@suse.cz>
Date:   Thu Nov 18 13:14:25 2021 +0100

    Fix IPA modref ubsan.

    modref_tree<tree_node*>::merge(modref_tree<tree_node*>*,
vec<modref_parm_map, va_heap, vl_ptr>*, modref_parm_map*, bool)

    is called with modref_parm_map chain_map;

    The variable has uninitialized m.parm_offset_known and it is accessed
    here:

    gcc/ipa-modref-tree.h:572 a.parm_offset_known &= m.parm_offset_known;

            PR ipa/103230

    gcc/ChangeLog:

            * ipa-modref-tree.h (struct modref_parm_map): Add default
            constructor.
            * ipa-modref.c (ipa_merge_modref_summary_after_inlining): Use it.

[Bug ipa/103230] ipa-modref-tree.h:550:33: runtime error: load of value 255, which is not a valid value for type 'bool'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103230

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #10 from Martin Liška <marxin at gcc dot gnu.org> ---
Fixed.