[Bug sanitizer/115793] New: signed integer overflow check missing at optimization levels -O2, -O3, and -Os

[Bug sanitizer/115793] New: signed integer overflow check missing at optimization levels -O2, -O3, and -Os

[bic60176 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115793

            Bug ID: 115793
           Summary: signed integer overflow check missing at optimization
                    levels -O2, -O3, and -Os
           Product: gcc
           Version: 14.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: bic60176 at gmail dot com
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org
  Target Milestone: ---

Created attachment 58593
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58593&action=edit
testcase

OS: Ubuntu 22.04.3 LTS
We found a case that UBSAN not reporting signed integer overflow when compiling
with gcc-14.1.0 at optimization levels -O2, -O3, and -Os.

$ ../compiler-builds/gcc-14.1.0_build/bin/gcc -fsanitize=undefined
-fsanitize=address -g -lgcc_s -I/home/csmith/include/csmith-2.3.0 -O0
testcase.c -o exec

$ timeout 1s ./exec 2>exec.err
0
testcase.c:8:54: runtime error: signed integer overflow: 56506 * 42049 cannot
be represented in type 'int'

$ ../compiler-builds/gcc-14.1.0_build/bin/gcc -fsanitize=undefined
-fsanitize=address -g -lgcc_s -I/home/csmith/include/csmith-2.3.0 -O2
testcase.c -o exec

$ timeout 1s ./exec 2>exec.err
0

[Bug sanitizer/115793] signed integer overflow check missing at optimization levels -O2, -O3, and -Os

[bic60176 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115793

--- Comment #1 from Bi6c <bic60176 at gmail dot com> ---
When compiling with gcc-13.2.0 at -O0, -O1, -O2, -O3, and -Os, UBSAN reported
signed integer overflow error.
We wonder if the code was optimized out because of optimization level -O2, -O3,
and -Os in gcc-14.

[Bug sanitizer/115793] signed integer overflow check missing at optimization levels -O2, -O3, and -Os

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115793

Xi Ruoyao <xry111 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |xry111 at gcc dot gnu.org

--- Comment #2 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
Hmm I remember there's an opening bug report for this but I cannot find it...

[Bug sanitizer/115793] signed integer overflow check missing at optimization levels -O2, -O3, and -Os

[bic60176 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115793

--- Comment #3 from Bi6c <bic60176 at gmail dot com> ---
(In reply to Xi Ruoyao from comment #2)
> Hmm I remember there's an opening bug report for this but I cannot find it...

Is this considered a duplicated bug?

[Bug sanitizer/115793] signed integer overflow check missing at optimization levels -O2, -O3, and -Os

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115793

--- Comment #4 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
(In reply to Bi6c from comment #3)
> (In reply to Xi Ruoyao from comment #2)
> > Hmm I remember there's an opening bug report for this but I cannot find it...
> 
> Is this considered a duplicated bug?

If we can find that duplicate... Or maybe my memory is just broken.

[Bug sanitizer/115793] signed integer overflow check missing at optimization levels -O2, -O3, and -Os

[bic60176 at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115793

--- Comment #5 from Bi6c <bic60176 at gmail dot com> ---
gcc-trunk also not reporting signed integer overflow at -O2, -O3, and -Os
(https://godbolt.org/z/8xnq1bo7s).

[Bug sanitizer/115793] signed integer overflow check missing at optimization levels -O2, -O3, and -Os

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115793

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
This bugreport is based on the unwarranted assumption that UBSAN reports all UB
even at higher optimization levels.  It doesn't, that is part of the tradeoff
between code speed and amount of reported issues.  We don't report all the UB
in clearly dead code even at -O0, here VRP simply figures out that the
multiplication result would be
  # RANGE [irange] int [-INF, +INF] MASK 0xe441 VALUE 0x8d9f133a
  _2 = .UBSAN_CHECK_MUL (56506, 42049);
and because that result is only used in (_2 & 65534) == 0 comparison, that
comparison is folded to 0 and so the multiplication is optimized away.
With e.g. -O2 -fsanitize=undefined, one generally gets diagnosed UB that will
still happen in the program, which won't be DCEd.

[Bug sanitizer/115793] signed integer overflow check missing at optimization levels -O2, -O3, and -Os

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115793

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
.