[Bug sanitizer/115127] New: [12/13/14 Regression] passing zero to __builtin_ctz() check missing

[Bug sanitizer/115127] New: [12/13/14 Regression] passing zero to __builtin_ctz() check missing

[bic60176 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

            Bug ID: 115127
           Summary: [12/13/14 Regression] passing zero to __builtin_ctz()
                    check missing
           Product: gcc
           Version: 12.3.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: bic60176 at gmail dot com
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org
  Target Milestone: ---

Created attachment 58220
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58220&action=edit
test case

OS: Ubuntu 22.04.3 LTS
We found that UBSAN missed checking if zero is passed to __builtin_ctz() when
compiling with gcc-12.3.0, gcc-13.2.0, gcc-14.1.0.

$ ../compiler-builds/gcc-12.3.0_build/bin/gcc -fsanitize=undefined -g -lgcc_s
-I/home/csmith/include/csmith-2.3.0 testcase.c -o exec

$ timeout 1s ./exec 2>exec.err

$ cat exec.err

$ ../compiler-builds/gcc-11.4.0_build/bin/gcc -fsanitize=undefined -g -lgcc_s
-I/home/csmith/include/csmith-2.3.0 testcase.c -o exec

$ timeout 1s ./exec 2>exec.err

$ cat exec.err
test1_176.c:202:83: runtime error: passing zero to ctz(), which is not a valid
argument test1_176.c:202: runtime error: passing zero to ctz(), which is not a
valid argument test1_176.c:202: runtime error: passing zero to ctz(), which is
not a valid argument test1_176.c:202: runtime error: passing zero to ctz(),
which is not a valid argument test1_176.c:202: runtime error: passing zero to
ctz(), which is not a valid argument test1_176.c:202: runtime error: passing
zero to ctz(), which is not a valid argument

[Bug sanitizer/115127] [12/13/14/15 Regression] passing zero to __builtin_ctz() check missing

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13/14 Regression]       |[12/13/14/15 Regression]
                   |passing zero to             |passing zero to
                   |__builtin_ctz() check       |__builtin_ctz() check
                   |missing                     |missing
           Keywords|                            |needs-reduction
   Target Milestone|---                         |12.4

[Bug sanitizer/115127] [12/13/14/15 Regression] passing zero to __builtin_ctz() check missing

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2024-05-18
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |WAITING

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Can you attach the preprocessed source?

[Bug sanitizer/115127] [12/13/14/15 Regression] passing zero to __builtin_ctz() check missing

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Also I tested even the simplified testcase:
```
volatile int t = 1;

int main (int argc, char* argv[])
{
    volatile int print_hash_value = 0;
    if (t == 2) print_hash_value = 1;
    __builtin_ctz(print_hash_value);
    return 0;
}
```
And the trunk reports:
/app/example.cpp:261:5: runtime error: passing zero to ctz(), which is not a
valid argument

Just fine.

[Bug sanitizer/115127] [12/13/14/15 Regression] passing zero to __builtin_ctz() check missing

[bic60176 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

--- Comment #3 from Bi6c <bic60176 at gmail dot com> ---
Created attachment 58237
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58237&action=edit
preprocessed source file

[Bug sanitizer/115127] [12/13/14/15 Regression] passing zero to __builtin_ctz() check missing

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |UNCONFIRMED
     Ever confirmed|1                           |0

[Bug sanitizer/115127] [12/13/14/15 Regression] passing zero to __builtin_ctz() check missing

[bic60176 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

--- Comment #4 from Bi6c <bic60176 at gmail dot com> ---
(In reply to Andrew Pinski from comment #1)
> Can you attach the preprocessed source?

Yes. I attached the preprocessed source file.

[Bug sanitizer/115127] [12/13/14/15 Regression] passing zero to __builtin_ctz() check missing

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 115273 has been marked as a duplicate of this bug. ***

[Bug sanitizer/115127] [12/13/14/15 Regression] passing zero to __builtin_ctz() check missing since r12-151

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|2024-05-18 00:00:00         |2024-06-02
             Status|UNCONFIRMED                 |NEW
           Keywords|needs-bisection,            |
                   |needs-reduction             |
     Ever confirmed|0                           |1
            Summary|[12/13/14/15 Regression]    |[12/13/14/15 Regression]
                   |passing zero to             |passing zero to
                   |__builtin_ctz() check       |__builtin_ctz() check
                   |missing                     |missing since r12-151

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced testcase:
```
int f(int a)
{
        return __builtin_ctz(a) == 0;
}

int main(void)
{
        __builtin_printf("%d\n", f(0));
}
```


Caused by r12-151-g75f8900159133c .

[Bug sanitizer/115127] [12/13/14/15 Regression] passing zero to __builtin_ctz() check sometimes missing since r12-151

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115127

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.4                        |12.5

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.4 is being released, retargeting bugs to GCC 12.5.