From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 4C6F63858C53; Thu,  5 Jan 2023 08:37:26 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 4C6F63858C53
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1672907846;
	bh=+PBif6Qa1fErkcJq7Ry2YqVn+gr82/NqYdNtpq3TGR0=;
	h=From:To:Subject:Date:From;
	b=D7ujZL8Kw0zlI66zNd0oXvLICgD3THOLQoGdauEJH2JhlPEr//vflM5cTj8GgHBs8
	 AZetD3g5VaLq+rUcZ/T71J+sP/HQAgGMHzCrhcaXVCH8SnIMVf831ytink0u3JfBb6
	 AJi6QNyoLJa3LtkCwrLqpZJVVDxVz6EQwy5m6ctg=
From: "nyh at math dot technion.ac.il" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/108296] New: __builtin_memcpy generating wrong code in some
 cases
Date: Thu, 05 Jan 2023 08:37:25 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Version: 12.2.1
X-Bugzilla-Keywords: 
X-Bugzilla-Severity: normal
X-Bugzilla-Who: nyh at math dot technion.ac.il
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status
 bug_severity priority component assigned_to reporter target_milestone
Message-ID: <bug-108296-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108296

            Bug ID: 108296
           Summary: __builtin_memcpy generating wrong code in some cases
           Product: gcc
           Version: 12.2.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: nyh at math dot technion.ac.il
  Target Milestone: ---

The following trivial code, copying a string over itself moved by one byte,
shows wrong results for __builtin_memcpy() on gcc 12.2.1:

#include <cstring>
int main(){
    char bufa[128] =3D "0123456789abcdefghijklmnopqrstuvwxyz";
    char bufb[128] =3D "0123456789abcdefghijklmnopqrstuvwxyz";
    memcpy(bufa, bufa+1, 27);
    printf("          memcpy: %s\n", bufa);
    __builtin_memcpy(bufb, bufb+1, 27);
    printf("__builtin_memcpy: %s\n", bufb);
}

As you can see running it, memcpy() returned the right result,
123456789abcdefghijklmnopqrrstuvwxyz (the first 27 characters shifted back,=
 so
"r" is double in the response), but __builtin_memcpy() returned the *wrong*
result - 123456789abdefgghijklmnopqrrstuvwxyz (the "c" character disappeared
and the "g" is  also doubled).


This bug was discovered in the OSv project
https://github.com/cloudius-systems/osv/issues/1212 with code that doesn't
(obviously) call __builtin_memcpy() directly, but rather had a 27-character
type being copied and the compiler implemented this copy with a call to
__builtin_memcpy(). The original miscompiling code in OSv  was something li=
ke
the following:

#include <cstdio>
int main(){
    char buf[128] =3D "0123456789abcdefghijklmnopqrstuvwxyz";
    struct [[gnu::packed]] data {
        char x[27];
    };
    void *p0 =3D buf;
    void *p1 =3D &buf[1];
    *static_cast<data*>(p0) =3D *static_cast<const data*>(p1);
    printf("%s", buf);
}

This appears to be a regression - this code did not miscompile in earlier g=
cc
releases.=