public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug tree-optimization/111839] New: Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0
@ 2023-10-16 19:25 shaohua.li at inf dot ethz.ch
2023-10-16 19:28 ` [Bug tree-optimization/111839] [12/13/14 Regression] " pinskia at gcc dot gnu.org
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: shaohua.li at inf dot ethz.ch @ 2023-10-16 19:25 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839
Bug ID: 111839
Summary: Wrong code at -O3 on x86_64-linux-gnu since
r12-2097-g9f34b780b0
Product: gcc
Version: 14.0
Status: UNCONFIRMED
Keywords: wrong-code
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: shaohua.li at inf dot ethz.ch
CC: rguenth at gcc dot gnu.org
Target Milestone: ---
gcc at -O3 produced the wrong code.
Bisected to r12-2097-g9f34b780b0
Compiler explorer: https://godbolt.org/z/Ea1hGGnob
$ cat a.c
int printf(const char *, ...);
long a;
int b, c, e, g, i;
long *d, *h;
char f = -26;
int main() {
long j;
c = 0;
for (; c != 7; ++c) {
long k=0;
long l = k;
long **m = &d;
for (; f + i!=0; i++)
h = &l;
g = h != (*m = &j);
int *n = &b;
*n = g;
for (; e;)
for (; a; a = a + 1)
;
}
printf("%d\n", b);
}
$
$ gcc -fsanitize=address,undefined a.c && ./a.out
1
$ gcc -O3 a.c && ./a.out
0
$
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug tree-optimization/111839] [12/13/14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0
2023-10-16 19:25 [Bug tree-optimization/111839] New: Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0 shaohua.li at inf dot ethz.ch
@ 2023-10-16 19:28 ` pinskia at gcc dot gnu.org
2023-10-17 3:42 ` pinskia at gcc dot gnu.org
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-10-16 19:28 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839
Andrew Pinski <pinskia at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|Wrong code at -O3 on |[12/13/14 Regression] Wrong
|x86_64-linux-gnu since |code at -O3 on
|r12-2097-g9f34b780b0 |x86_64-linux-gnu since
| |r12-2097-g9f34b780b0
Target Milestone|--- |12.4
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug tree-optimization/111839] [12/13/14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0
2023-10-16 19:25 [Bug tree-optimization/111839] New: Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0 shaohua.li at inf dot ethz.ch
2023-10-16 19:28 ` [Bug tree-optimization/111839] [12/13/14 Regression] " pinskia at gcc dot gnu.org
@ 2023-10-17 3:42 ` pinskia at gcc dot gnu.org
2023-10-17 6:42 ` rguenth at gcc dot gnu.org
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-10-17 3:42 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839
Andrew Pinski <pinskia at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Last reconfirmed| |2023-10-17
Ever confirmed|0 |1
Status|UNCONFIRMED |NEW
--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Partition 1: size 8 align 8
l j
So another -fstack-reuse= issue.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug tree-optimization/111839] [12/13/14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0
2023-10-16 19:25 [Bug tree-optimization/111839] New: Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0 shaohua.li at inf dot ethz.ch
2023-10-16 19:28 ` [Bug tree-optimization/111839] [12/13/14 Regression] " pinskia at gcc dot gnu.org
2023-10-17 3:42 ` pinskia at gcc dot gnu.org
@ 2023-10-17 6:42 ` rguenth at gcc dot gnu.org
2024-03-05 15:58 ` jakub at gcc dot gnu.org
2024-06-20 9:14 ` [Bug tree-optimization/111839] [12/13/14/15 " rguenth at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: rguenth at gcc dot gnu.org @ 2023-10-17 6:42 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P3 |P2
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug tree-optimization/111839] [12/13/14 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0
2023-10-16 19:25 [Bug tree-optimization/111839] New: Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0 shaohua.li at inf dot ethz.ch
` (2 preceding siblings ...)
2023-10-17 6:42 ` rguenth at gcc dot gnu.org
@ 2024-03-05 15:58 ` jakub at gcc dot gnu.org
2024-06-20 9:14 ` [Bug tree-optimization/111839] [12/13/14/15 " rguenth at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: jakub at gcc dot gnu.org @ 2024-03-05 15:58 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839
Jakub Jelinek <jakub at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
CC| |jakub at gcc dot gnu.org
--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly cleaned up.
long a, *d, *h;
int b, c, e, g, i;
signed char f = -26;
int
main ()
{
long j;
for (c = 0; c != 7; ++c)
{
long k = 0;
long l = k;
long **m = &d;
for (; f + i != 0; i++)
h = &l;
g = h != (*m = &j);
int *n = &b;
*n = g;
while (e)
while (a)
++a;
}
if (b != 1)
__builtin_abort ();
}
I'd say this is just invalid code.
In the c == 0 iteration, h is set to address of l, local in the loop (many
times).
But when that l var goes out of the scope at the end of the iteration, the h
pointer pointing to it becomes invalid, it doesn't point to any valid object.
In the c == 1 iteration, it isn't reinitialized, so I think using it for the
comparison is UB.
ASan use-after-scope can't catch such sort of thing, it can catch stuff when
such pointer is dereferenced, but that is not the case here. Plus, when l
starts lifetime in the c == 1 and later iterations, it would be unpoisoned
again and nothing would be reported even if it was dereferenced.
This is essentially
int *p;
int
main ()
{
for (int i = 0; i < 10; ++i)
{
int l = 0;
if (i == 0)
p = &l;
*p = 42;
}
}
which isn't reported with -fsanitize=address -fsanitize-address-use-after-scope
-g
by either gcc or clang, yet is clearly undefined behavior. The earlier
testcase
doesn't dereference but IMHO has the same problem.
^ permalink raw reply [flat|nested] 6+ messages in thread
* [Bug tree-optimization/111839] [12/13/14/15 Regression] Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0
2023-10-16 19:25 [Bug tree-optimization/111839] New: Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0 shaohua.li at inf dot ethz.ch
` (3 preceding siblings ...)
2024-03-05 15:58 ` jakub at gcc dot gnu.org
@ 2024-06-20 9:14 ` rguenth at gcc dot gnu.org
4 siblings, 0 replies; 6+ messages in thread
From: rguenth at gcc dot gnu.org @ 2024-06-20 9:14 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111839
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Target Milestone|12.4 |12.5
--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.4 is being released, retargeting bugs to GCC 12.5.
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2024-06-20 9:14 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2023-10-16 19:25 [Bug tree-optimization/111839] New: Wrong code at -O3 on x86_64-linux-gnu since r12-2097-g9f34b780b0 shaohua.li at inf dot ethz.ch
2023-10-16 19:28 ` [Bug tree-optimization/111839] [12/13/14 Regression] " pinskia at gcc dot gnu.org
2023-10-17 3:42 ` pinskia at gcc dot gnu.org
2023-10-17 6:42 ` rguenth at gcc dot gnu.org
2024-03-05 15:58 ` jakub at gcc dot gnu.org
2024-06-20 9:14 ` [Bug tree-optimization/111839] [12/13/14/15 " rguenth at gcc dot gnu.org
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).