public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
From: "jakub at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/108718] [10/11/12/13 Regression] csmith: possible bad code with -O2
Date: Thu, 16 Feb 2023 12:59:46 +0000 [thread overview]
Message-ID: <bug-108718-4-FT6qhNdo6a@http.gcc.gnu.org/bugzilla/> (raw)
In-Reply-To: <bug-108718-4@http.gcc.gnu.org/bugzilla/>
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108718
Jakub Jelinek <jakub at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |RESOLVED
Resolution|--- |INVALID
--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Martin Liška from comment #10)
> (In reply to David Binderman from comment #9)
> > Created attachment 54463 [details]
> > C source code
> >
> > After a further hour of reduction, a partially reduced program.
> >
> > cvise doesn't seem able to make much further progress with it.
>
> However, I see a segfault that happens for the code snippet now.
The reduced testcase has various flaws, i uninitialized at the start of first
loop in main, and the last loop in main iterating endlessly, main_j < 10 should
be probably the condition of the for loop.
Anyway, I think there are aliasing violations again,
*g_45 = &g_5[2][5];
is (implicitly) int while g_5[2][5] has type union { short } and e.g. func_13
stores
it through that g_45 pointer (so writes over g_5[2][5].f4 and g_5[2][6].f4,
that itself is an aliasing violation, and then reads/writes g_5[2][5].f4
through short * pointer in
((--*l_701));
The original testcase has that too:
union U0 {
uint64_t f0;
int32_t f1;
uint64_t f2;
int32_t f3;
uint16_t f4;
};
static union U0 g_5[5][10] =
{{{1UL},{18446744073709551610UL},{0x998AB5457D670012LL},{18446744073709551612UL},{0x998AB5457D670012LL},{18446744073709551610UL},{1UL},{1UL},{18446744073709551615UL},{18446744073709551607UL}},{{1UL},{6UL},{0x7F6FB807CFAF425FLL},{0UL},{1UL},{1UL},{0UL},{0x7F6FB807CFAF425FLL},{6UL},{1UL}},{{0xF996F377CC424770LL},{6UL},{18446744073709551615UL},{0xF0488F4F368A9017LL},{18446744073709551612UL},{18446744073709551607UL},{1UL},{18446744073709551607UL},{18446744073709551612UL},{0xF0488F4F368A9017LL}},{{0xF0488F4F368A9017LL},{18446744073709551610UL},{0xF0488F4F368A9017LL},{6UL},{18446744073709551612UL},{3UL},{1UL},{0x998AB5457D670012LL},{0x998AB5457D670012LL},{1UL}},{{18446744073709551612UL},{1UL},{3UL},{3UL},{1UL},{18446744073709551612UL},{6UL},{1UL},{18446744073709551612UL},{18446744073709551615UL}}};
static int32_t *g_45 = &g_5[2][5].f3;
and in func_13
uint16_t *l_701 = &g_5[2][5].f4;
...
(*g_45) |= (*g_90);
...
--(*l_701)
on the penultimate line in func_13 among other things. Though, (*g_45) |=
(*g_90);
actually isn't reached.
But, just setting awatch in -g -O0 compiled #c0, I can see it again doing UB,
e.g. func_26 does:
l_169[3][4] = (*g_45);
(*p_27) |= (safe_sub_func_int32_t_s_s(0x191EB41DL, p_29.f0));
where both g_45 and p_27 point to &g_5[2][5].f3 with int * type, and then
func_18 does:
return g_5[2][5].f4;
which reads it through union as unsigned short.
prev parent reply other threads:[~2023-02-16 12:59 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-02-08 13:53 [Bug c/108718] New: " dcb314 at hotmail dot com
2023-02-08 14:06 ` [Bug c/108718] " jakub at gcc dot gnu.org
2023-02-08 14:12 ` [Bug c/108718] [10/11/12/13 Regression] " jakub at gcc dot gnu.org
2023-02-08 17:06 ` pinskia at gcc dot gnu.org
2023-02-09 15:10 ` dcb314 at hotmail dot com
2023-02-09 20:12 ` jakub at gcc dot gnu.org
2023-02-10 10:19 ` rguenth at gcc dot gnu.org
2023-02-10 17:07 ` dcb314 at hotmail dot com
2023-02-15 8:17 ` dcb314 at hotmail dot com
2023-02-15 10:29 ` dcb314 at hotmail dot com
2023-02-15 10:39 ` marxin at gcc dot gnu.org
2023-02-15 17:00 ` dcb314 at hotmail dot com
2023-02-16 12:59 ` jakub at gcc dot gnu.org [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=bug-108718-4-FT6qhNdo6a@http.gcc.gnu.org/bugzilla/ \
--to=gcc-bugzilla@gcc.gnu.org \
--cc=gcc-bugs@gcc.gnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).