* [Bug tree-optimization/113012] [14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
@ 2023-12-14 2:33 ` pinskia at gcc dot gnu.org
2023-12-14 3:00 ` [Bug tree-optimization/113012] [13/14 " pinskia at gcc dot gnu.org
` (13 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-12-14 2:33 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
Andrew Pinski <pinskia at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Keywords| |ice-on-valid-code
Target Milestone|--- |14.0
Component|middle-end |tree-optimization
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug tree-optimization/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
2023-12-14 2:33 ` [Bug tree-optimization/113012] " pinskia at gcc dot gnu.org
@ 2023-12-14 3:00 ` pinskia at gcc dot gnu.org
2023-12-14 3:02 ` pinskia at gcc dot gnu.org
` (12 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-12-14 3:00 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
Andrew Pinski <pinskia at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|UNCONFIRMED |NEW
Ever confirmed|0 |1
Last reconfirmed| |2023-12-14
--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced testcase:
```
typedef __SIZE_TYPE__ size_t;
extern void *reallocarray(void *__ptr, size_t __nmemb, size_t __size)
__attribute__((__alloc_size__(2, 3)));
void miZeroLine(int npt, int Nspans, int list_len, int ady) {
int *pwidthInit, *widths;
pwidthInit = reallocarray(0, (list_len), (sizeof(int)));
widths = pwidthInit - 1;
while (--npt > 0)
{
if (ady + 1 > Nspans)
widths = pwidthInit - 1;
++*widths;
++widths;
}
}
```
Note I am not 100% sure the above code is well defined due to subtracting one
from the allocated array.
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug tree-optimization/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
2023-12-14 2:33 ` [Bug tree-optimization/113012] " pinskia at gcc dot gnu.org
2023-12-14 3:00 ` [Bug tree-optimization/113012] [13/14 " pinskia at gcc dot gnu.org
@ 2023-12-14 3:02 ` pinskia at gcc dot gnu.org
2023-12-14 3:03 ` pinskia at gcc dot gnu.org
` (11 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-12-14 3:02 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #1)
> Note I am not 100% sure the above code is well defined due to subtracting
> one from the allocated array.
and yes this represents exactly what the code does.
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug tree-optimization/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (2 preceding siblings ...)
2023-12-14 3:02 ` pinskia at gcc dot gnu.org
@ 2023-12-14 3:03 ` pinskia at gcc dot gnu.org
2023-12-14 3:14 ` [Bug sanitizer/113012] " pinskia at gcc dot gnu.org
` (10 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-12-14 3:03 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note once we remove the -1, GCC does not ICE. I am 99% sure it is undefined to
go one before the begining of the array, only one past the end of the array is
well defined.
Note I am not shocked that xorg has undefined code in it too.
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (3 preceding siblings ...)
2023-12-14 3:03 ` pinskia at gcc dot gnu.org
@ 2023-12-14 3:14 ` pinskia at gcc dot gnu.org
2023-12-14 12:53 ` jakub at gcc dot gnu.org
` (9 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: pinskia at gcc dot gnu.org @ 2023-12-14 3:14 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
Andrew Pinski <pinskia at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
See Also| |https://gcc.gnu.org/bugzill
| |a/show_bug.cgi?id=70090
--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Maybe r13-222-g28896b38fabce818e59266b0063a46b3bc1b700f .
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (4 preceding siblings ...)
2023-12-14 3:14 ` [Bug sanitizer/113012] " pinskia at gcc dot gnu.org
@ 2023-12-14 12:53 ` jakub at gcc dot gnu.org
2023-12-14 13:59 ` rguenth at gcc dot gnu.org
` (8 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: jakub at gcc dot gnu.org @ 2023-12-14 12:53 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #3)
> Note I am not shocked that xorg has undefined code in it too.
Do you know about any large package which doesn't have any undefined code in
it?
Anyway, this is definitely UB.
Of course, doing that in say uintptr_t rather than in pointer and only cast to
pointer when dereferencing could be fine (but then bdos will not track it I
think).
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (5 preceding siblings ...)
2023-12-14 12:53 ` jakub at gcc dot gnu.org
@ 2023-12-14 13:59 ` rguenth at gcc dot gnu.org
2023-12-14 14:00 ` rguenth at gcc dot gnu.org
` (7 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: rguenth at gcc dot gnu.org @ 2023-12-14 13:59 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P3 |P1
--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Btw, we're trying to gimplify
_29 = _35;, 0 = _36;
built here:
#0 bundle_sizes (name=<integer_cst 0x7ffff6a0bf78>,
expr=<ssa_name 0x7ffff6824ab0 36>)
at /home/rguenther/src/trunk/gcc/tree-object-size.cc:242
#1 0x0000000001804ee4 in object_sizes_set (osi=0x7fffffffd7c0, varno=12,
val=<ssa_name 0x7ffff6824ab0 36>, wholeval=<ssa_name 0x7ffff6824a68 35>)
at /home/rguenther/src/trunk/gcc/tree-object-size.cc:277
#2 0x0000000001805203 in object_sizes_set_temp (osi=0x7fffffffd7c0, varno=12)
at /home/rguenther/src/trunk/gcc/tree-object-size.cc:333
#3 0x0000000001809ce5 in collect_object_sizes_for (osi=0x7fffffffd7c0,
var=<ssa_name 0x7ffff6824240 12>)
at /home/rguenther/src/trunk/gcc/tree-object-size.cc:1718
#4 0x0000000001809236 in dynamic_object_size (osi=0x7fffffffd7c0,
var=<ssa_name 0x7ffff6824240 12>, size=0x7fffffffd690,
wholesize=0x7fffffffd688)
at /home/rguenther/src/trunk/gcc/tree-object-size.cc:1483
#5 0x0000000001809b09 in phi_dynamic_object_size (osi=0x7fffffffd7c0,
var=<ssa_name 0x7ffff6824048 5>)
at /home/rguenther/src/trunk/gcc/tree-object-size.cc:1642
that's
tree oldval = osize.size;
being INTEGER_CST zero which doesn't exactly look "wrong"? Or does this
mean there's conflicting sizes?
I believe there's something wrong with the processing of dynamic object sizes.
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (6 preceding siblings ...)
2023-12-14 13:59 ` rguenth at gcc dot gnu.org
@ 2023-12-14 14:00 ` rguenth at gcc dot gnu.org
2023-12-14 14:07 ` jakub at gcc dot gnu.org
` (6 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: rguenth at gcc dot gnu.org @ 2023-12-14 14:00 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
Richard Biener <rguenth at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Priority|P1 |P2
Target Milestone|14.0 |13.3
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (7 preceding siblings ...)
2023-12-14 14:00 ` rguenth at gcc dot gnu.org
@ 2023-12-14 14:07 ` jakub at gcc dot gnu.org
2023-12-14 14:20 ` jakub at gcc dot gnu.org
` (5 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: jakub at gcc dot gnu.org @ 2023-12-14 14:07 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Obviously we shouldn't ICE on this.
But, saying 0 as usable size on such UB pointer is I think completely valid
(making it clear that you can't really dereference such pointer nor anything
derived from it, even *++widths is invalid), just obviously it can't appear as
lhs of assignment...
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (8 preceding siblings ...)
2023-12-14 14:07 ` jakub at gcc dot gnu.org
@ 2023-12-14 14:20 ` jakub at gcc dot gnu.org
2023-12-20 0:29 ` [Bug tree-optimization/113012] " cvs-commit at gcc dot gnu.org
` (4 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: jakub at gcc dot gnu.org @ 2023-12-14 14:20 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly more readable testcase:
int *
foo (int x, int y, int z, int w)
{
int *p = __builtin_malloc (z * sizeof (int));
int *q = p - 1;
while (--x > 0)
{
if (w + 1 > y)
q = p - 1;
++*q;
++q;
}
return p;
}
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug tree-optimization/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (9 preceding siblings ...)
2023-12-14 14:20 ` jakub at gcc dot gnu.org
@ 2023-12-20 0:29 ` cvs-commit at gcc dot gnu.org
2024-01-09 15:55 ` [Bug tree-optimization/113012] [13 " jakub at gcc dot gnu.org
` (3 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2023-12-20 0:29 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Siddhesh Poyarekar
<siddhesh@gcc.gnu.org>:
https://gcc.gnu.org/g:576c1fc4401a9dae9757ac2e4fa37d05e130fa3d
commit r14-6730-g576c1fc4401a9dae9757ac2e4fa37d05e130fa3d
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date: Mon Dec 18 09:44:00 2023 -0500
tree-object-size: Always set computed bit for bdos [PR113012]
It is always safe to set the computed bit for dynamic object sizes at
the end of collect_object_sizes_for because even in case of a dependency
loop encountered in nested calls, we have an SSA temporary to actually
finish the object size expression. The reexamine pass for dynamic
object sizes is only for propagation of unknowns and gimplification of
the size expressions, not for loop resolution as in the case of static
object sizes.
gcc/ChangeLog:
PR tree-optimization/113012
* tree-object-size.cc (compute_builtin_object_size): Expand
comment for dynamic object sizes.
(collect_object_sizes_for): Always set COMPUTED bitmap for
dynamic object sizes.
gcc/testsuite/ChangeLog:
PR tree-optimization/113012
* gcc.dg/ubsan/pr113012.c: New test case.
Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug tree-optimization/113012] [13 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (10 preceding siblings ...)
2023-12-20 0:29 ` [Bug tree-optimization/113012] " cvs-commit at gcc dot gnu.org
@ 2024-01-09 15:55 ` jakub at gcc dot gnu.org
2024-01-09 15:59 ` siddhesh at gcc dot gnu.org
` (2 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: jakub at gcc dot gnu.org @ 2024-01-09 15:55 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
Jakub Jelinek <jakub at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Summary|[13/14 regression] ICE when |[13 regression] ICE when
|building xorg-server with |building xorg-server with
|-fsanitize=undefined |-fsanitize=undefined
--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Is this fixed for 14, right?
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug tree-optimization/113012] [13 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (11 preceding siblings ...)
2024-01-09 15:55 ` [Bug tree-optimization/113012] [13 " jakub at gcc dot gnu.org
@ 2024-01-09 15:59 ` siddhesh at gcc dot gnu.org
2024-01-11 17:14 ` cvs-commit at gcc dot gnu.org
2024-01-11 17:14 ` siddhesh at gcc dot gnu.org
14 siblings, 0 replies; 16+ messages in thread
From: siddhesh at gcc dot gnu.org @ 2024-01-09 15:59 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
--- Comment #11 from Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> ---
Yes, I'll test and push the 13 backport by the end of the week if there are no
reported regressions on trunk.
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug tree-optimization/113012] [13 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (12 preceding siblings ...)
2024-01-09 15:59 ` siddhesh at gcc dot gnu.org
@ 2024-01-11 17:14 ` cvs-commit at gcc dot gnu.org
2024-01-11 17:14 ` siddhesh at gcc dot gnu.org
14 siblings, 0 replies; 16+ messages in thread
From: cvs-commit at gcc dot gnu.org @ 2024-01-11 17:14 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
--- Comment #12 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Siddhesh Poyarekar
<siddhesh@gcc.gnu.org>:
https://gcc.gnu.org/g:db86a6009fc83e8cb21cae49c7c55fc2b1186008
commit r13-8210-gdb86a6009fc83e8cb21cae49c7c55fc2b1186008
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date: Mon Dec 18 09:44:00 2023 -0500
tree-object-size: Always set computed bit for bdos [PR113012]
It is always safe to set the computed bit for dynamic object sizes at
the end of collect_object_sizes_for because even in case of a dependency
loop encountered in nested calls, we have an SSA temporary to actually
finish the object size expression. The reexamine pass for dynamic
object sizes is only for propagation of unknowns and gimplification of
the size expressions, not for loop resolution as in the case of static
object sizes.
gcc/ChangeLog:
PR tree-optimization/113012
* tree-object-size.cc (compute_builtin_object_size): Expand
comment for dynamic object sizes.
(collect_object_sizes_for): Always set COMPUTED bitmap for
dynamic object sizes.
gcc/testsuite/ChangeLog:
PR tree-optimization/113012
* gcc.dg/ubsan/pr113012.c: New test case.
Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
(cherry picked from commit 576c1fc4401a9dae9757ac2e4fa37d05e130fa3d)
^ permalink raw reply [flat|nested] 16+ messages in thread* [Bug tree-optimization/113012] [13 regression] ICE when building xorg-server with -fsanitize=undefined
2023-12-14 2:29 [Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined sjames at gcc dot gnu.org
` (13 preceding siblings ...)
2024-01-11 17:14 ` cvs-commit at gcc dot gnu.org
@ 2024-01-11 17:14 ` siddhesh at gcc dot gnu.org
14 siblings, 0 replies; 16+ messages in thread
From: siddhesh at gcc dot gnu.org @ 2024-01-11 17:14 UTC (permalink / raw)
To: gcc-bugs
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012
Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> changed:
What |Removed |Added
----------------------------------------------------------------------------
Status|NEW |RESOLVED
Resolution|--- |FIXED
--- Comment #13 from Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> ---
... and now fixed on the 13 branch too.
^ permalink raw reply [flat|nested] 16+ messages in thread