public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug sanitizer/109313] New: Incorrect line number in Use-After-Scope report
@ 2023-03-28 7:43 shaohua.li at inf dot ethz.ch
2023-03-28 17:57 ` [Bug sanitizer/109313] " pinskia at gcc dot gnu.org
0 siblings, 1 reply; 2+ messages in thread
From: shaohua.li at inf dot ethz.ch @ 2023-03-28 7:43 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109313
Bug ID: 109313
Summary: Incorrect line number in Use-After-Scope report
Product: gcc
Version: 13.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: sanitizer
Assignee: unassigned at gcc dot gnu.org
Reporter: shaohua.li at inf dot ethz.ch
CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
Target Milestone: ---
For the following code, Asan reports an incorrect line number at -O1 and above.
Compiler explorer: https://godbolt.org/z/KsroWf9M6
% cat -n a.c
1 int a, b;
2 int main() {
3 int *c=&a;
4 b = 0;
5 for (; b < 1; b++) {
6 int d=1;
7 c = &d;
8 if (a)
9 break;
10 }
11 if (*c) {
12 int e[1]={2};
13 return e[0];
14 }
15 }
%
% gcc-tk -O0 -fsanitize=address a.c && ./a.out
=================================================================
==1==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f2293700030
at pc 0x0000004012de bp 0x7ffca6ef0690 sp 0x7ffca6ef0688
READ of size 4 at 0x7f2293700030 thread T0
#0 0x4012dd in main /a.c:11
...
%
% gcc-tk -O1 -fsanitize=address a.c && ./a.out
=================================================================
==1==ERROR: AddressSanitizer: stack-use-after-scope on address 0x7f7c4d200020
at pc 0x0000004011ee bp 0x7fff0179f250 sp 0x7fff0179f248
READ of size 4 at 0x7f7c4d200020 thread T0
#0 0x4011ed in main /a.c:5
...
%
^ permalink raw reply [flat|nested] 2+ messages in thread
* [Bug sanitizer/109313] Incorrect line number in Use-After-Scope report
2023-03-28 7:43 [Bug sanitizer/109313] New: Incorrect line number in Use-After-Scope report shaohua.li at inf dot ethz.ch
@ 2023-03-28 17:57 ` pinskia at gcc dot gnu.org
0 siblings, 0 replies; 2+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-03-28 17:57 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109313
--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
When ccp3 changes (correctly):
<bb 4> [local count: 958878296]:
.ASAN_MARK (POISON, &d, 4);
[/app/example.cpp:6:24] b.1_2 = b;
[/app/example.cpp:6:24] _3 = b.1_2 + 1;
[/app/example.cpp:6:24] b = _3;
[/app/example.cpp:6:18] if (_3 <= 0)
goto <bb 3>; [94.50%]
else
goto <bb 6>; [5.50%]
<bb 5> [local count: 55807731]:
.ASAN_MARK (POISON, &d, 4);
<bb 6> [local count: 114863531]:
[/app/example.cpp:12:13] _5 = d;
Into:
<bb 4> [local count: 958878296]:
d_9 = .ASAN_POISON ();
[/app/example.cpp:6:24] b.1_2 = b;
[/app/example.cpp:6:24] _3 = b.1_2 + 1;
[/app/example.cpp:6:24] b = _3;
[/app/example.cpp:6:18] if (_3 <= 0)
goto <bb 3>; [94.50%]
else
goto <bb 6>; [5.50%]
<bb 5> [local count: 55807731]:
d_6 = .ASAN_POISON ();
<bb 6> [local count: 114863531]:
# d_22 = PHI <[0:0] d_6(5), [0:0] d_9(4)>
[/app/example.cpp:12:13] _5 = d_22;
The location of the load is missing and now is always a direct poison call
without any location info left over.
I am not sure how this would work out really ...
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2023-03-28 17:57 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-03-28 7:43 [Bug sanitizer/109313] New: Incorrect line number in Use-After-Scope report shaohua.li at inf dot ethz.ch
2023-03-28 17:57 ` [Bug sanitizer/109313] " pinskia at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).