From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugzilla@gcc.gnu.org>
Received: by sourceware.org (Postfix, from userid 48)
	id 3A2363895FC9; Fri, 13 Jan 2023 18:30:08 +0000 (GMT)
DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 3A2363895FC9
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org;
	s=default; t=1673634608;
	bh=We+r2AOQQOPR2Gf5RyJwHq6m+LYwJCEyYkuP0vA+uhg=;
	h=From:To:Subject:Date:In-Reply-To:References:From;
	b=DraF2zT+sfP2EeSr8+wxH4IMJHjco2Fvhsmvn8shVEQQ16tnUncxhhN48lY9vhsQL
	 vYQuq4kdeeqoQ9oHPqkKuirjMD7AaGKCSJ+A7eErEBSfmHo+edyuI+/aq9a2fUlYgs
	 r3Wt8xpbIM52Eiixr9gxBWQJBVmEstDgfrjI4p6c=
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/108398] tree-object-size trips up with
 pointer arithmetic if an intermediate result is an invalid pointer
Date: Fri, 13 Jan 2023 18:30:07 +0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 12.1.0
X-Bugzilla-Keywords: wrong-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: jakub at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Resolution: 
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags: 
X-Bugzilla-Changed-Fields: cc
Message-ID: <bug-108398-4-rUVBrey1YP@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-108398-4@http.gcc.gnu.org/bugzilla/>
References: <bug-108398-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
List-Id: <gcc-bugs.sourceware.org>

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D108398

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Siddhesh Poyarekar from comment #3)
> Oops, sorry I messed up the reproducer, here's the correct one.  The
> principles don't really change though:
>=20
> unsigned steps[2];
>=20
> int main(void) {
>     unsigned n_steps =3D sizeof (steps) / sizeof (unsigned);
>=20
>     for (unsigned *io =3D steps; 0 < n_steps; io++) {
>         if (*io =3D=3D 0) {
> 	    __builtin_printf ("%zu\n", __builtin_dynamic_object_size (io, 0));
> 	    if (__builtin_dynamic_object_size (io, 0) < sizeof (unsigned))
> 		__builtin_abort ();
>             n_steps--;
> 	    io--;
>         }
>     }
>=20
>     return 0;
> }

How can this be valid?  In the first iteration it already invokes UB, *io =
=3D=3D 0,
so it will do n_steps-- (why is it misindented?) and then io--, which is
invalid,
because io =3D=3D steps and steps - 1 is invalid pointer arithmetics.
If you want to do what you do in the body, then better steps[0] should not =
be
0...=