From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id A321A3857C51; Wed, 21 Dec 2022 11:52:49 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org A321A3857C51
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1671623569;
	bh=Kc/XUsrb4xSEaWp0nHoIIILvKTlFP+h+tFLltBHsVPc=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=bf5icBZYFr85V2eZeYOuvS3L9JTqMoxOvcC/h5SGXdHAwg88URDztafL3aatPt1g9
	 SUZj+E32E8AdTOkiWOAd1/NSmglMSfIwCPhlO2uBiVD8YKdj4kf6aQGIh09GswcNnc
	 pDiF8HVT1WskosLt1X/PrqSE4vmgWOtmHgKYRETE=
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/108060] [10/11/12/13 Regression] UBsan missed an out-of-bound
 bug at -O0 since r7-1900-g8a1b7b7fd75a3847
Date: Wed, 21 Dec 2022 11:52:49 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Version: 13.0
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P2
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 10.5
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: priority component
Message-ID: <bug-108060-4-FxY5I1Yxwk@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-108060-4@http.gcc.gnu.org/bugzilla/>
References: <bug-108060-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108060

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
          Component|sanitizer                   |c

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
The frontend emits

{
  b =3D -32768;
  a[.UBSAN_BOUNDS (0B, SAVE_EXPR <(int) b>, 7);, SAVE_EXPR <(int) b>;] =3D
a[(int) b] | (int) c;
}

and appearantly expects that the side-effects of the LHS are evaluated befo=
re
the side-effects of the RHS.  It also doesn't look at the RHS at all,
likely the instrumentation happens before GENERICizing the |=3D operator.

I think this is a frontend mistake.

The C++ frontend splits turns a[b] |=3D c into a[b] =3D a[b] | c before
instrumentation.=