[Bug sanitizer/109700] New: [13/14 regression] ICE with address sanitizer after declaring __builtin_alloca

[Bug sanitizer/109700] New: [13/14 regression] ICE with address sanitizer after declaring __builtin_alloca

[jlegg at feralinteractive dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109700

            Bug ID: 109700
           Summary: [13/14 regression] ICE with address sanitizer after
                    declaring __builtin_alloca
           Product: gcc
           Version: 13.1.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jlegg at feralinteractive dot com
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
  Target Milestone: ---

Created attachment 54971
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54971&action=edit
Preprocessed source, GCC 13.1.1

When compiling this as C++:
void *__builtin_alloca(unsigned long);
void f(int *);
void g() {
  int x;
  int *y = (int *)__builtin_alloca(sizeof(int));
  *y = 0;
  f(&x);
}

using g++ -fsanitize=address -Og test.cpp -c, I get the following error with
GCC 13.1.1:
during GIMPLE pass: ehcleanup
test.cpp: In function ‘void g()’:
test.cpp:3:6: internal compiler error: in mark_reachable_handlers, at
tree-eh.cc:4063
    3 | void g() {
      |      ^

The GCC trunk option on Compiler Explorer currently
((Compiler-Explorer-Build-gcc-4d68c7f7b5aea5e95f44c3af13a24aa3daae9cf5-binutils-2.40)
14.0.0 20230501 (experimental)) has a different internal compiler error:
<source>: In function 'void g()':
<source>:5:6: error: BB 2 cannot throw but has an EH edge
    5 | void g() {
      |      ^
during GIMPLE pass: asan
<source>:5:6: internal compiler error: verify_flow_info failed
0x23643ae internal_error(char const*, ...)
        ???:0
0xe18267 verify_flow_info()
        ???:0

GCC 12.2 compiles this code.

[Bug sanitizer/109700] [13/14 regression] ICE with address sanitizer after declaring __builtin_alloca

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109700

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-invalid-code

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
You are not supposed to declare builtin functions (especially not when the
declaration isn't even correct).

[Bug sanitizer/109700] [13/14 regression] ICE with address sanitizer after declaring __builtin_alloca

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109700

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
It is replacing __builtin_alloca with __builtin_alloca_with_align .
__builtin_alloca is NOT known not to throw with the definition provided and
that is the cause of the issue.
Adding [[gnu::nothrow]] fixes the issue.

[Bug sanitizer/109700] ICE with address sanitizer after declaring __builtin_alloca

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109700

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |10.1.0, 12.2.0, 8.1.0
            Summary|[13/14 regression] ICE with |ICE with address sanitizer
                   |address sanitizer after     |after declaring
                   |declaring __builtin_alloca  |__builtin_alloca
      Known to work|                            |7.1.0

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note GCC 12.2.0 also ICEs; just not with checking enabled (or even just
-fchecking).

[Bug sanitizer/109700] ICE with address sanitizer after declaring __builtin_alloca

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109700

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Most likely started with r8-1884-ge3174bdf35c172f (just like PR 104449 ). PR
104449  was supposed to fix part of this but it seems like it didn't.

[Bug sanitizer/109700] ICE with address sanitizer after declaring __builtin_alloca

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109700

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-05-02

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note GCC 9.x ICEs even without checking enabled. It just happens GCC 10.x-12.x
does not.

Anyways don't declare __builtin_alloca; it is NOT needed.

[Bug sanitizer/109700] ICE with address sanitizer after declaring __builtin_alloca

[jlegg at feralinteractive dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109700

--- Comment #6 from James Legg <jlegg at feralinteractive dot com> ---
Yes, declaring bulitin functions is bad, but I didn't expect the ICE.

It wasn't done intentionally. glibc's alloca.h defines a alloca(s) macro as
__builtin_alloca(s). I had some code defining _alloca as alloca for
compatibility with code written to use MSC's _alloca function, and some code
intended to build with MSC that attempted to declare _alloca instead of
including the appropriate header, but due to macro expansion it was actually
declaring __builtin_alloca.

[Bug sanitizer/109700] ICE with address sanitizer after declaring __builtin_alloca since r8-1884-ge3174bdf35c172f

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=109700

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|ICE with address sanitizer  |ICE with address sanitizer
                   |after declaring             |after declaring
                   |__builtin_alloca            |__builtin_alloca since
                   |                            |r8-1884-ge3174bdf35c172f

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #4)
> Most likely started with r8-1884-ge3174bdf35c172f (just like PR 104449 ). PR
> 104449  was supposed to fix part of this but it seems like it didn't.

Yes, started with r8-1884-ge3174bdf35c172f.