[Bug tree-optimization/105094] New: UBSAN in clear_bit_region(unsigned char*, unsigned int, unsigned int) (gimple-ssa-store-merging.cc:1834)

[Bug tree-optimization/105094] New: UBSAN in clear_bit_region(unsigned char*, unsigned int, unsigned int) (gimple-ssa-store-merging.cc:1834)

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105094

            Bug ID: 105094
           Summary: UBSAN in clear_bit_region(unsigned char*, unsigned
                    int, unsigned int) (gimple-ssa-store-merging.cc:1834)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-invalid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: jakub at gcc dot gnu.org
  Target Milestone: ---

Happens for:

$ g++ /home/marxin/Programming/gcc/gcc/testsuite/g++.dg/other/pr84964.C -O1
-fstore-merging -fpack-struct -ftrivial-auto-var-init=zero
/home/marxin/Programming/gcc/gcc/testsuite/g++.dg/other/pr84964.C:4:9: warning:
width of ‘a::b’ exceeds its type
    4 |   short b : -1ULL;
      |         ^
malloc(): invalid size (unsorted)
malloc(): invalid size (unsorted)
g++: internal compiler error: Aborted signal terminated program cc1plus
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
See <https://gcc.gnu.org/bugs/> for instructions.

Note we emit sorry if I remove any of the options.

[Bug tree-optimization/105094] UBSAN in clear_bit_region(unsigned char*, unsigned int, unsigned int) (gimple-ssa-store-merging.cc:1834)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105094

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-03-29
     Ever confirmed|0                           |1
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 52707
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52707&action=edit
gcc12-pr105094.patch

Untested fix.

[Bug tree-optimization/105094] [10/11/12 Regression] UBSAN in clear_bit_region(unsigned char*, unsigned int, unsigned int) (gimple-ssa-store-merging.cc:1834)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105094

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |10.4
            Summary|UBSAN in                    |[10/11/12 Regression] UBSAN
                   |clear_bit_region(unsigned   |in
                   |char*, unsigned int,        |clear_bit_region(unsigned
                   |unsigned int)               |char*, unsigned int,
                   |(gimple-ssa-store-merging.c |unsigned int)
                   |c:1834)                     |(gimple-ssa-store-merging.c
                   |                            |c:1834)
           Priority|P3                          |P2

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with my r10-179-g3afd514bca6ea572e614b5289c4429ace693311b change.

[Bug tree-optimization/105094] [10/11/12 Regression] UBSAN in clear_bit_region(unsigned char*, unsigned int, unsigned int) (gimple-ssa-store-merging.cc:1834)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105094

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:387e818cda0ffde86f624228c3da1ab28f453685

commit r12-7916-g387e818cda0ffde86f624228c3da1ab28f453685
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Mar 30 10:21:16 2022 +0200

    store-merging: Avoid ICEs on roughly ~0ULL/8 sized stores [PR105094]

    On the following testcase on 64-bit targets, store-merging sees
    a MEM_REF store from {} ctor with "negative" bitsize where bitoff + bitsize
    wraps around to very small end offset.  This later confuses the code
    so that it allocates just a few bytes of memory but fills in huge amounts
of
    it.  Later on there is a param_store_merging_max_size size check but due to
    the wrap-around we pass that.

    The following patch punts on such large bitsizes.

    2022-03-30  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/105094
            * gimple-ssa-store-merging.cc (mem_valid_for_store_merging): Punt
if
            bitsize <= 0 rather than just == 0.

            * gcc.dg/pr105094.c: New test.

[Bug tree-optimization/105094] [10/11/12 Regression] UBSAN in clear_bit_region(unsigned char*, unsigned int, unsigned int) (gimple-ssa-store-merging.cc:1834)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105094

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:5c4767659c817dc4cec897215ca8f9ea930e309e

commit r11-9740-g5c4767659c817dc4cec897215ca8f9ea930e309e
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Mar 30 10:21:16 2022 +0200

    store-merging: Avoid ICEs on roughly ~0ULL/8 sized stores [PR105094]

    On the following testcase on 64-bit targets, store-merging sees
    a MEM_REF store from {} ctor with "negative" bitsize where bitoff + bitsize
    wraps around to very small end offset.  This later confuses the code
    so that it allocates just a few bytes of memory but fills in huge amounts
of
    it.  Later on there is a param_store_merging_max_size size check but due to
    the wrap-around we pass that.

    The following patch punts on such large bitsizes.

    2022-03-30  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/105094
            * gimple-ssa-store-merging.c (mem_valid_for_store_merging): Punt if
            bitsize <= 0 rather than just == 0.

            * gcc.dg/pr105094.c: New test.

    (cherry picked from commit 387e818cda0ffde86f624228c3da1ab28f453685)

[Bug tree-optimization/105094] [10 Regression] UBSAN in clear_bit_region(unsigned char*, unsigned int, unsigned int) (gimple-ssa-store-merging.cc:1834)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105094

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[10/11/12 Regression] UBSAN |[10 Regression] UBSAN in
                   |in                          |clear_bit_region(unsigned
                   |clear_bit_region(unsigned   |char*, unsigned int,
                   |char*, unsigned int,        |unsigned int)
                   |unsigned int)               |(gimple-ssa-store-merging.c
                   |(gimple-ssa-store-merging.c |c:1834)
                   |c:1834)                     |

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 11.3+ and 12.1+.

[Bug tree-optimization/105094] [10 Regression] UBSAN in clear_bit_region(unsigned char*, unsigned int, unsigned int) (gimple-ssa-store-merging.cc:1834)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105094

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:8ea0c916cbb150c9a121eac95f2950d9bcea0b3e

commit r10-10701-g8ea0c916cbb150c9a121eac95f2950d9bcea0b3e
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Mar 30 10:21:16 2022 +0200

    store-merging: Avoid ICEs on roughly ~0ULL/8 sized stores [PR105094]

    On the following testcase on 64-bit targets, store-merging sees
    a MEM_REF store from {} ctor with "negative" bitsize where bitoff + bitsize
    wraps around to very small end offset.  This later confuses the code
    so that it allocates just a few bytes of memory but fills in huge amounts
of
    it.  Later on there is a param_store_merging_max_size size check but due to
    the wrap-around we pass that.

    The following patch punts on such large bitsizes.

    2022-03-30  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/105094
            * gimple-ssa-store-merging.c (mem_valid_for_store_merging): Punt if
            bitsize <= 0 rather than just == 0.

            * gcc.dg/pr105094.c: New test.

    (cherry picked from commit 387e818cda0ffde86f624228c3da1ab28f453685)

[Bug tree-optimization/105094] [10 Regression] UBSAN in clear_bit_region(unsigned char*, unsigned int, unsigned int) (gimple-ssa-store-merging.cc:1834)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105094

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 10.4 too.