From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id C5D16385B513; Tue, 15 Aug 2023 17:57:14 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org C5D16385B513 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1692122234; bh=GPUa/4B2jRXbrjtu08xTJHFsJ5akaQb3a44nhImELgQ=; h=From:To:Subject:Date:In-Reply-To:References:From; b=oEY9vyLohjg8aoWR3YfrlG6A4puom3Zspgl0lXmxNXutfsVdoVocI0Yba3as4F6W3 Oh7HPFUgxnAQnxKuBb9qbkK906XcvA7H5jTJUd5tLCFVOjkfI/WpRCbMqtkz+BMQzd VC6XUsm4py6b9ZRIwrwGRAs+FsRZchqUrHj6ro+I= From: "amacleod at redhat dot com" To: gcc-bugs@gcc.gnu.org Subject: [Bug middle-end/111009] [12/13/14 regression] -fno-strict-overflow erroneously elides null pointer checks and causes SIGSEGV on perf from linux-6.4.10 Date: Tue, 15 Aug 2023 17:57:13 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: middle-end X-Bugzilla-Version: 14.0 X-Bugzilla-Keywords: wrong-code X-Bugzilla-Severity: normal X-Bugzilla-Who: amacleod at redhat dot com X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P2 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: 12.4 X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D111009 --- Comment #4 from Andrew Macleod --- (In reply to Richard Biener from comment #3) > bool > operator_addr_expr::fold_range (irange &r, tree type, > const irange &lh, > const irange &rh, > relation_trio) const > {=20 > if (empty_range_varying (r, type, lh, rh)) > return true; >=20=20=20 > // Return a non-null pointer of the LHS type (passed in op2). > if (lh.zero_p ()) > r =3D range_zero (type);=20 >=20 > not sure how this is called, but we can only derive this if the offset > is zero as well, definitely if targetm.addr_space.zero_address_valid, > but I think this is true in general. >=20 > else if (!contains_zero_p (lh)) > r =3D range_nonzero (type); >=20 > and this is only true for TYPE_OVERFLOW_UNDEFINED (type), with > -fwrapv-pointer we could wrap to zero. >=20 > That is, it's _not_ GIMPLE undefined behavior to compute &0->bar. > It looks like without -fwrapv-pointer we elide the if (!a) check, > dereferencing it when dso && dso !=3D curr. I suppose that looks reasona= ble > with a =3D &dso->maj, when dso !=3D 0 then a !=3D 0 unless ->maj wraps. Range-ops won't see anything like &dso->maj.. it sees rangers and nothing e= lse. it just gets the result of that expression determined by someone else. . so= if it see [0,0] for the range, that means &dso->maj has been determined to be = 0. When folding, addressof has some funky mechanics, and it symbolically proce= sses the trees in gimple-range-fold.cc in fold_using_range::range_of_address I think it takes care of all the funky things you mention. I also notice in the earlier comment where we set _13 to 0... the code you quoted where _13 was recomputed by ranger. it ends with=20=20=20 GORI TRUE : (797) recomputation (_13) [irange] _Bool [1, 1] The result was [1,1] as far as ranger was concerned o the edge from 3->16 so that prop0bably isn't how gimple fold determined it was zero. Is there still an issue here?=