[Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined

[Bug middle-end/113012] New: [14 regression] ICE when building xorg-server with -fsanitize=undefined

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

            Bug ID: 113012
           Summary: [14 regression] ICE when building xorg-server with
                    -fsanitize=undefined
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sjames at gcc dot gnu.org
  Target Milestone: ---

Created attachment 56875
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56875&action=edit
mizerline.c.i

Hit this when building xorg-server. Only hit it by chance when poking at
something else...

```
$ gcc -c mizerline.c.i -fsanitize=undefined -O2
gimplification failed:
0 <integer_cst 0x7fd309002f78 type <integer_type 0x7fd309023000 sizetype>
constant 0>
during GIMPLE pass: objsz
In function ‘miZeroLine’:
cc1: internal compiler error: gimplification failed
0x55aa6617eb5b gimplify_expr(tree_node**, gimple**, gimple**, bool
(*)(tree_node*), int)
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/gimplify.cc:17753
0x55aa678d24bf gimplify_modify_expr
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/gimplify.cc:6418
0x55aa678c383c gimplify_expr(tree_node**, gimple**, gimple**, bool
(*)(tree_node*), int)
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/gimplify.cc:16719
0x55aa67b39946 force_gimple_operand_1(tree_node*, gimple**, bool
(*)(tree_node*), tree_node*)
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/gimplify-me.cc:78
0x55aa67acd61a gimplify_size_expressions
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/tree-object-size.cc:1088
0x55aa67acd61a compute_builtin_object_size(tree_node*, int, tree_node**)
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/tree-object-size.cc:1199
0x55aa678ef777 fold_builtin_object_size
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/builtins.cc:11556
0x55aa678ef777 fold_builtin_2
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/builtins.cc:10575
0x55aa678ef777 fold_builtin_n(unsigned int, tree_node*, tree_node*,
tree_node**, int, bool) [clone .isra.0]
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/builtins.cc:10687
0x55aa67a1122d dynamic_object_sizes_execute_one
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/tree-object-size.cc:2078
0x55aa67a1122d object_sizes_execute
       
/usr/src/debug/sys-devel/gcc-14.0.0_pre20231210/gcc-14-20231210/gcc/tree-object-size.cc:2140
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.
```

```
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-pc-linux-gnu/14/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with:
/var/tmp/portage/sys-devel/gcc-14.0.0_pre20231210/work/gcc-14-20231210/configure
--host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/usr
--bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/14
--includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/14/include
--datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14
--mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14/man
--infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/14/info
--with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/14/include/g++-v14
--disable-silent-rules --disable-dependency-tracking
--with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/14/python
--enable-languages=c,c++,fortran,rust --enable-obsolete --enable-secureplt
--disable-werror --with-system-zlib --enable-nls --without-included-gettext
--disable-libunwind-exceptions --enable-checking=yes,extra,rtl
--with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened
14.0.0_pre20231210 p10' --with-gcc-major-version-only --enable-libstdcxx-time
--enable-lto --disable-libstdcxx-pch --enable-shared --enable-threads=posix
--enable-__cxa_atexit --enable-clocale=gnu --enable-multilib
--with-multilib-list=m32,m64 --disable-fixed-point --enable-targets=all
--enable-libgomp --disable-libssp --disable-libada --enable-cet
--disable-systemtap --enable-valgrind-annotations --disable-vtable-verify
--disable-libvtv --with-zstd --with-isl --disable-isl-version-check
--enable-default-pie --enable-host-pie --enable-host-bind-now
--enable-default-ssp --with-build-config='bootstrap-O3 bootstrap-lto
bootstrap-cet'
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.0 20231210 (experimental) (Gentoo Hardened 14.0.0_pre20231210
p10)
```

[Bug tree-optimization/113012] [14 regression] ICE when building xorg-server with -fsanitize=undefined

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
   Target Milestone|---                         |14.0
          Component|middle-end                  |tree-optimization

[Bug tree-optimization/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-12-14

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced testcase:
```
typedef __SIZE_TYPE__ size_t;
extern void *reallocarray(void *__ptr, size_t __nmemb, size_t __size)
    __attribute__((__alloc_size__(2, 3)));
void miZeroLine(int npt, int Nspans, int list_len, int ady) {
  int *pwidthInit, *widths;
  pwidthInit = reallocarray(0, (list_len), (sizeof(int)));
  widths = pwidthInit - 1;
  while (--npt > 0)
  {
    if (ady + 1 > Nspans)
      widths = pwidthInit - 1;
    ++*widths;
    ++widths;
  }
}

```

Note I am not 100% sure the above code is well defined due to subtracting one
from the allocated array.

[Bug tree-optimization/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #1)
> Note I am not 100% sure the above code is well defined due to subtracting
> one from the allocated array.

and yes this represents exactly what the code does.

[Bug tree-optimization/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note once we remove the -1, GCC does not ICE. I am 99% sure it is undefined to
go one before the begining of the array, only one past the end of the array is
well defined.

Note I am not shocked that xorg has undefined code in it too.

[Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=70090

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Maybe r13-222-g28896b38fabce818e59266b0063a46b3bc1b700f .

[Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #3)
> Note I am not shocked that xorg has undefined code in it too.

Do you know about any large package which doesn't have any undefined code in
it?

Anyway, this is definitely UB.
Of course, doing that in say uintptr_t rather than in pointer and only cast to
pointer when dereferencing could be fine (but then bdos will not track it I
think).

[Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Btw, we're trying to gimplify

_29 = _35;, 0 = _36;

built here:

#0  bundle_sizes (name=<integer_cst 0x7ffff6a0bf78>, 
    expr=<ssa_name 0x7ffff6824ab0 36>)
    at /home/rguenther/src/trunk/gcc/tree-object-size.cc:242
#1  0x0000000001804ee4 in object_sizes_set (osi=0x7fffffffd7c0, varno=12, 
    val=<ssa_name 0x7ffff6824ab0 36>, wholeval=<ssa_name 0x7ffff6824a68 35>)
    at /home/rguenther/src/trunk/gcc/tree-object-size.cc:277
#2  0x0000000001805203 in object_sizes_set_temp (osi=0x7fffffffd7c0, varno=12)
    at /home/rguenther/src/trunk/gcc/tree-object-size.cc:333
#3  0x0000000001809ce5 in collect_object_sizes_for (osi=0x7fffffffd7c0, 
    var=<ssa_name 0x7ffff6824240 12>)
    at /home/rguenther/src/trunk/gcc/tree-object-size.cc:1718
#4  0x0000000001809236 in dynamic_object_size (osi=0x7fffffffd7c0, 
    var=<ssa_name 0x7ffff6824240 12>, size=0x7fffffffd690, 
    wholesize=0x7fffffffd688)
    at /home/rguenther/src/trunk/gcc/tree-object-size.cc:1483
#5  0x0000000001809b09 in phi_dynamic_object_size (osi=0x7fffffffd7c0, 
    var=<ssa_name 0x7ffff6824048 5>)
    at /home/rguenther/src/trunk/gcc/tree-object-size.cc:1642

that's

  tree oldval = osize.size;

being INTEGER_CST zero which doesn't exactly look "wrong"?  Or does this
mean there's conflicting sizes?

I believe there's something wrong with the processing of dynamic object sizes.

[Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P1                          |P2
   Target Milestone|14.0                        |13.3

[Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Obviously we shouldn't ICE on this.
But, saying 0 as usable size on such UB pointer is I think completely valid
(making it clear that you can't really dereference such pointer nor anything
derived from it, even *++widths is invalid), just obviously it can't appear as
lhs of assignment...

[Bug sanitizer/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly more readable testcase:
int *
foo (int x, int y, int z, int w)
{
  int *p = __builtin_malloc (z * sizeof (int));
  int *q = p - 1;
  while (--x > 0)
    {
      if (w + 1 > y)
        q = p - 1;
      ++*q;
      ++q;
    }
  return p;
}

[Bug tree-optimization/113012] [13/14 regression] ICE when building xorg-server with -fsanitize=undefined

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Siddhesh Poyarekar
<siddhesh@gcc.gnu.org>:

https://gcc.gnu.org/g:576c1fc4401a9dae9757ac2e4fa37d05e130fa3d

commit r14-6730-g576c1fc4401a9dae9757ac2e4fa37d05e130fa3d
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date:   Mon Dec 18 09:44:00 2023 -0500

    tree-object-size: Always set computed bit for bdos [PR113012]

    It is always safe to set the computed bit for dynamic object sizes at
    the end of collect_object_sizes_for because even in case of a dependency
    loop encountered in nested calls, we have an SSA temporary to actually
    finish the object size expression.  The reexamine pass for dynamic
    object sizes is only for propagation of unknowns and gimplification of
    the size expressions, not for loop resolution as in the case of static
    object sizes.

    gcc/ChangeLog:

            PR tree-optimization/113012
            * tree-object-size.cc (compute_builtin_object_size): Expand
            comment for dynamic object sizes.
            (collect_object_sizes_for): Always set COMPUTED bitmap for
            dynamic object sizes.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/113012
            * gcc.dg/ubsan/pr113012.c: New test case.

    Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>

[Bug tree-optimization/113012] [13 regression] ICE when building xorg-server with -fsanitize=undefined

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[13/14 regression] ICE when |[13 regression] ICE when
                   |building xorg-server with   |building xorg-server with
                   |-fsanitize=undefined        |-fsanitize=undefined

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Is this fixed for 14, right?

[Bug tree-optimization/113012] [13 regression] ICE when building xorg-server with -fsanitize=undefined

[siddhesh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

--- Comment #11 from Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> ---
Yes, I'll test and push the 13 backport by the end of the week if there are no
reported regressions on trunk.

[Bug tree-optimization/113012] [13 regression] ICE when building xorg-server with -fsanitize=undefined

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

--- Comment #12 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-13 branch has been updated by Siddhesh Poyarekar
<siddhesh@gcc.gnu.org>:

https://gcc.gnu.org/g:db86a6009fc83e8cb21cae49c7c55fc2b1186008

commit r13-8210-gdb86a6009fc83e8cb21cae49c7c55fc2b1186008
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date:   Mon Dec 18 09:44:00 2023 -0500

    tree-object-size: Always set computed bit for bdos [PR113012]

    It is always safe to set the computed bit for dynamic object sizes at
    the end of collect_object_sizes_for because even in case of a dependency
    loop encountered in nested calls, we have an SSA temporary to actually
    finish the object size expression.  The reexamine pass for dynamic
    object sizes is only for propagation of unknowns and gimplification of
    the size expressions, not for loop resolution as in the case of static
    object sizes.

    gcc/ChangeLog:

            PR tree-optimization/113012
            * tree-object-size.cc (compute_builtin_object_size): Expand
            comment for dynamic object sizes.
            (collect_object_sizes_for): Always set COMPUTED bitmap for
            dynamic object sizes.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/113012
            * gcc.dg/ubsan/pr113012.c: New test case.

    Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
    (cherry picked from commit 576c1fc4401a9dae9757ac2e4fa37d05e130fa3d)

[Bug tree-optimization/113012] [13 regression] ICE when building xorg-server with -fsanitize=undefined

[siddhesh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113012

Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #13 from Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> ---
... and now fixed on the 13 branch too.