[Bug analyzer/110483] New: Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[Bug analyzer/110483] New: Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[ro at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

            Bug ID: 110483
           Summary: Several gcc.dg/analyzer/out-of-bounds-diagram-*.c
                    tests FAIL
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: analyzer
          Assignee: dmalcolm at gcc dot gnu.org
          Reporter: ro at gcc dot gnu.org
  Target Milestone: ---
            Target: sparc*-sun-solaris2.11, pru-unknown-elf,
                    powerpc-ibm-aix7.2.5.0, avr-unknown-none

Several of the new gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL on
Solaris/SPARC (32 and 64-bit):

+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c (test for excess errors)
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c 2 blank line(s) in output
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-13.c expected multiline pattern
lines 17-42
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-15.c (test for excess errors)
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-15.c 2 blank line(s) in output
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-15.c expected multiline pattern
lines 16-41
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-4.c (test for excess errors)
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-4.c 2 blank line(s) in output
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-4.c expected multiline pattern
lines 23-44
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-5-ascii.c (test for excess errors)
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-5-ascii.c 2 blank line(s) in
output
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-5-ascii.c expected multiline
pattern lines 16-39
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-5-unicode.c (test for excess
errors)
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-5-unicode.c 2 blank line(s) in
output
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-5-unicode.c expected multiline
pattern lines 16-41
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-7.c (test for excess errors)
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-7.c 2 blank line(s) in output
+FAIL: gcc.dg/analyzer/out-of-bounds-diagram-7.c expected multiline pattern
lines 14-35

I also see gcc-testresults reports for several other targets, but it's
difficult
to the if that's the same issue without the actual gcc.log.

E.g. for

FAIL: gcc.dg/analyzer/out-of-bounds-diagram-5-unicode.c (test for excess
errors)

the log shows

Excess errors:
  ┌─────┬─────┬─────┬────┬────┐┌────┬────┬────┬────┬────┬────┬────┬──────┐
  │ [0] │ [0] │ [0] │[0] │[0] ││[0] │[0] │[0] │[0] │[0] │[0] │[0] │ [0]  │
  ├─────┼─────┼─────┼────┼────┤├────┼────┼────┼────┼────┼────┼────┼──────┤
  │0xe6 │0x96 │0x87 │0xe5│0xad││0x97│0xe5│0x8c│0x96│0xe3│0x81│0x91│ 0x00 │
  ├─────┴─────┴─────┼────┴────┴┴────┼────┴────┴────┼────┴────┴────┼──────┤
  │     U+6587      │    U+5b57     │    U+5316    │    U+3051    │U+0000│
  ├─────────────────┼───────────────┼──────────────┼──────────────┼──────┤
  │       文        │      字       │      化      │      け      │ NUL  │
  ├─────────────────┴───────────────┴──────────────┴──────────────┴──────┤
  │                  string literal (type: 'char[13]')                   │
  └──────────────────────────────────────────────────────────────────────┘
     │     │     │    │    │     │    │    │    │    │    │    │     │   
     │     │     │    │    │     │    │    │    │    │    │    │     │
     v     v     v    v    v     v    v    v    v    v    v    v     v   
  ┌─────┬────────────────┬────┐┌─────────────────────────────────────────┐
  │ [0] │      ...       │[4] ││                                         │
  ├─────┴────────────────┴────┤│            after valid range            │
  │  'buf' (type: 'char[5]')  ││                                         │
  └───────────────────────────┘└─────────────────────────────────────────┘
  ├─────────────┬─────────────┤├────────────────────┬────────────────────┤
                │                                   │
       ╭────────┴────────╮                ╭─────────┴─────────╮
       │capacity: 5 bytes│                │overflow of 8 bytes│
       ╰─────────────────╯                ╰───────────────────╯

while the test expects

  │ [0] │ [1] │ [2] │[3] │[4] ││[5] │[6] │[7] │[8] │[9] │[10]│[11]│ [12] │

above.

[Bug analyzer/110483] Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[ro at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

Rainer Orth <ro at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0

[Bug analyzer/110483] Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

--- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this; sorry about the failures.

What's the endianness of the hosts that this is happening on?

Is there a machine in the GCC compile farm that this happens on?

The row of indices is is created here in
string_region_spatial_item::make_table:
    if (m_show_full_string)
      {
       for (byte_offset_t byte_idx = bytes.get_start_byte_offset ();
            byte_idx < bytes.get_next_byte_offset ();
            byte_idx = byte_idx + 1)
         add_column_for_byte (t, btm, sm, byte_idx,
                              byte_idx_table_y, byte_val_table_y);
where class string_region_spatial_item has:
  void add_column_for_byte (table &t, const bit_to_table_map &btm,
                            style_manager &sm,
                            const byte_offset_t byte_idx,
                            const int byte_idx_table_y,
                            const int byte_val_table_y) const
  {
    tree string_cst = get_string_cst ();
    gcc_assert (byte_idx >= 0);
    gcc_assert (byte_idx < TREE_STRING_LENGTH (string_cst));

    const byte_range bytes (byte_idx, 1);
    if (1) // show_byte_indices
      {
        const table::rect_t idx_table_rect
          = btm.get_table_rect (&m_string_reg, bytes, byte_idx_table_y, 1);
        t.set_cell_span (idx_table_rect,
                         fmt_styled_string (sm, "[%li]",
                                            byte_idx.ulow ()));
      }

so presumably an issue with:

                         fmt_styled_string (sm, "[%li]",
                                            byte_idx.ulow ()));
on those hosts.

Possibly an endianness-handling mistake by me?

[Bug analyzer/110483] Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[ro at CeBiTec dot Uni-Bielefeld.DE]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

--- Comment #2 from ro at CeBiTec dot Uni-Bielefeld.DE <ro at CeBiTec dot Uni-Bielefeld.DE> ---
> --- Comment #1 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
> Thanks for filing this; sorry about the failures.
>
> What's the endianness of the hosts that this is happening on?

Solaris/SPARC and AIX are both big endian, while avr and pru are little
endian.  As I said, without full access to the logs its hard to tell if
the failure is always the same.

> Is there a machine in the GCC compile farm that this happens on?

There are gcc (Solaris 11.4/SPARC) and gcc211 (Solaris 11.3/SPARC, so
you'd need to configure with --enable-obsolete), as well as gcc111 (AIX
7.1.1) and gcc119 (AIX 7.2.2).  However, I've run my Solaris builds on
local machines.

> so presumably an issue with:
>
>                          fmt_styled_string (sm, "[%li]",
>                                             byte_idx.ulow ()));
> on those hosts.
>
> Possibly an endianness-handling mistake by me?

It certainly smells like that.

[Bug analyzer/110483] [14 Regression] Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

--- Comment #3 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:939439a90f234f9e70d30240bf5c227eebe2b43f

commit r14-9199-g939439a90f234f9e70d30240bf5c227eebe2b43f
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Tue Feb 27 14:49:42 2024 -0500

    analyzer: use correct format code for string literal indices
[PR110483,PR111802]

    On e.g. gcc211 the use of "%li" with unsigned HOST_WIDE_INT led to this
warning:
    ../../src/gcc/analyzer/access-diagram.cc: In member function âvoid
ana::string_literal_spatial_item::add_column_for_byte(text_art::table&, const
ana::bit_to_table_map&, text_art::style_manager&, ana::byte_offset_t,
ana::byte_offset_t, int, int) constâ:
    ../../src/gcc/analyzer/access-diagram.cc:1909:40: warning: format â%liâ
expects argument of type âlong intâ, but argument 3 has type âlong long
unsigned intâ [-Wformat=]
              byte_idx_within_string.ulow ()));
                                            ^
    and to all values being erroneously printed as "0".

    Fixed thusly.

    gcc/analyzer/ChangeLog:
            PR analyzer/110483
            PR analyzer/111802
            * access-diagram.cc
            (string_literal_spatial_item::add_column_for_byte): Use %wu for
            printing unsigned HOST_WIDE_INT.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug analyzer/110483] [14 Regression] Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Should be fixed by the above patch; closing.  Please reopen if you still see
these issues.

[Bug analyzer/110483] [14 Regression] Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[ro at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

Rainer Orth <ro at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-02-29
         Resolution|FIXED                       |---
             Status|RESOLVED                    |REOPENED

--- Comment #5 from Rainer Orth <ro at gcc dot gnu.org> ---
Thanks for the patch.  Last night's bootstrap showed that all C tests PASS now.

However, two of the tests FAIL when compiled as C++:

FAIL: c-c++-common/analyzer/out-of-bounds-diagram-3.c  -std=c++98  (test for
warnings, line 25)
FAIL: c-c++-common/analyzer/out-of-bounds-diagram-3.c  -std=c++98  at line 20
(test for warnings, line 19)
FAIL: c-c++-common/analyzer/out-of-bounds-diagram-3.c  -std=c++98  expected
multiline pattern lines 30-45

and same for -std=c++(14|17|20).  When compiling manually, there's no output at
all.

There's also

FAIL: c-c++-common/analyzer/out-of-bounds-diagram-11.c  -std=c++98  (test for
warnings, line 12)
FAIL: c-c++-common/analyzer/out-of-bounds-diagram-11.c  -std=c++98  expected
multiline pattern lines 18-36

Here's the full output:

/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:
In function ‘void test7(std::size_t)’:
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:41:47:
warning: allocated buffer size is not a multiple of the pointee's size
[CWE-131] [-Wanalyzer-allocation-size]
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:41:47:
note: (1) allocated ‘((size * 4) + 3)’ bytes and assigned to ‘int32_t*’ {aka
‘int*’} here; ‘sizeof (int32_t {aka int})’ is ‘4’
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:42:13:
warning: stack-based buffer overflow [CWE-121] [-Wanalyzer-out-of-bounds]
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:41:47:
note: (1) capacity: ‘((size * 4) + 3)’ bytes
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:42:13:
note: (2) write of 4 bytes at offset ‘(size * 4)’ exceeds the buffer

                                 ┌───────────────────────────────────────┐
                                 │          write of ‘(int) 42’          │
                                 └───────────────────────────────────────┘
                                           │                   │
                                           │                   │
                                           v                   v
  ┌──────────────────────────────────────────────────┐┌──────────────────┐
  │         buffer allocated on stack at (1)         ││after valid range │
  └──────────────────────────────────────────────────┘└──────────────────┘
  ├────────────────────────┬─────────────────────────┤├────────┬─────────┤
                           │                                   │
           ╭───────────────┴──────────────╮          ╭─────────┴────────╮
           │capacity: ‘size * 4 + 3’ bytes│          │overflow of 1 byte│
           ╰──────────────────────────────╯          ╰──────────────────╯

/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:
In function ‘char* test99(const char*, const char*)’:
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:80:25:
warning: heap-based buffer overflow [CWE-122] [-Wanalyzer-out-of-bounds]
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:74:44:
note: (1) capacity: ‘(len_x + len_y)’ bytes
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:75:3:
note: (2) following ‘false’ branch (when ‘result’ is non-NULL)...
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:77:20:
note: (3) ...to here
/vol/gcc/src/hg/master/local/gcc/testsuite/c-c++-common/analyzer/out-of-bounds-diagram-11.c:80:25:
note: (4) out-of-bounds write

I'm uncertain if this isn't another issue, though.

[Bug analyzer/110483] [14 Regression] Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

--- Comment #6 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks; let's keep using this PR for the stuff in comment #5.

I've been looking at these on gcc211 in the compile farm:
  * I see out-of-bounds-diagram-11.c failing as you describe (the overflow in
test6 isn't reported with g++ for some reason; it is for gcc)
  * out-of-bounds-diagram-3.c gets skipped on that machine due to 
    { dg-require-effective-target lp64 }
    "check_cached_effective_target lp64: returning 0 for unix"

Is there a config/cfarm machine you see the out-of-bounds-diagram-3.c failure
on?

[Bug analyzer/110483] [14 Regression] Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[ro at CeBiTec dot Uni-Bielefeld.DE]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

--- Comment #7 from ro at CeBiTec dot Uni-Bielefeld.DE <ro at CeBiTec dot Uni-Bielefeld.DE> ---
>   * out-of-bounds-diagram-3.c gets skipped on that machine due to 
>     { dg-require-effective-target lp64 }
>     "check_cached_effective_target lp64: returning 0 for unix"
>
> Is there a config/cfarm machine you see the out-of-bounds-diagram-3.c failure
> on?

GCC on Solaris is bi-arch by default, so this should be a matter of
running the testsuite with both -m32 and -m64, as described in
install.texi (Passing options and running multiple testsuites).

Since properly quoting RUNTESTFLAGS can be trick, I usually use a
site.exp instead like

global target_list

case "$target_triplet" in {
    { "sparc-*-solaris2*" } {
        set target_list { "unix{,-m64}" }
    }
}

and point the DEJAGNU env variable to its path.

[Bug analyzer/110483] [14/15 Regression] Several gcc.dg/analyzer/out-of-bounds-diagram-*.c tests FAIL

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110483

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|14.0                        |14.2

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 14.1 is being released, retargeting bugs to GCC 14.2.