[Bug c/115876] New: runtime errors during bootstrap with -O3 -march=znver3 -fno-var-tracking-assignments

[Bug c/115876] New: runtime errors during bootstrap with -O3 -march=znver3 -fno-var-tracking-assignments

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

            Bug ID: 115876
           Summary: runtime errors during bootstrap with -O3 -march=znver3
                    -fno-var-tracking-assignments
           Product: gcc
           Version: 15.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

For a bootstrap with this configure script:

../trunk/configure \
    --disable-multilib \
    --disable-werror \
    --with-build-config=bootstrap-asan \
    --with-build-config=bootstrap-ubsan \
    --enable-checking=yes \
    --enable-languages=c,c++,fortran

sed 's;-O2;-O3 -march=znver3 -fno-var-tracking-assignments;' < Makefile >
Makefile.tmp
diff Makefile Makefile.tmp
mv Makefile.tmp Makefile

I get:

$ grep error: mk.out
../../trunk/gcc/ext-dce.cc:404:23: runtime error: left shift of negative value
-1
../../trunk/gcc/ext-dce.cc:417:33: runtime error: left shift of negative value
-1
../../trunk/gcc/ext-dce.cc:404:23: runtime error: left shift of negative value
-1
../../trunk/gcc/ext-dce.cc:417:33: runtime error: left shift of negative value
-1
../../trunk/gcc/ext-dce.cc:404:23: runtime error: left shift of negative value
-1
../../trunk/gcc/ext-dce.cc:404:23: runtime error: left shift of negative value
-1
../../trunk/gcc/ext-dce.cc:404:23: runtime error: left shift of negative value
-1
../../trunk/gcc/ext-dce.cc:404:23: runtime error: left shift of negative value
-1
../../trunk/gcc/ext-dce.cc:417:33: runtime error: left shift of negative value
-1
../../trunk/gcc/ext-dce.cc:600:15: runtime error: shift exponent 64 is too
large for 64-bit type 'long unsigned int'

[Bug rtl-optimization/115876] ext-dce.cc has ubsan issues; shifting negative values

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2024-07-11

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
All of except the last one could be fixed is mask is changed to `unsigned
HOST_WIDE_INT`.

The last one is:
                      bit = subreg_lsb (y).to_constant ();
                      if (dst_mask)
                        {
                          dst_mask <<= bit;
                          if (!dst_mask)
                            dst_mask = -0x100000000ULL;
                        }


is definitely broken and I am not sure I understand the logic here even.
because I don't know if it is saying if bit == BITS_PER_HOST_WIDE_INT, then it
should be -0x100000000ULL . Note ULL here seems also wrong, it should be using
HOST_WIDE_INT_C (this is wrong in the whole file too).

[Bug rtl-optimization/115876] ext-dce.cc has ubsan issues; shifting negative values

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED

[Bug rtl-optimization/115876] ext-dce.cc has ubsan issues; shifting negative values

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #2 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jeff Law <law@gcc.gnu.org>:

https://gcc.gnu.org/g:a6f551d079de1d151b272bcdd3d42316857c9d4e

commit r15-2011-ga6f551d079de1d151b272bcdd3d42316857c9d4e
Author: Jeff Law <jlaw@ventanamicro.com>
Date:   Fri Jul 12 13:11:33 2024 -0600

    [PR rtl-optimization/115876] Fix one of two ubsan reported issues in new
ext-dce.cc code

    David Binderman did a bootstrap build with ubsan enabled which triggered a
few
    errors in the new ext-dce.cc code.  This fixes the trivial case of shifting
    negative values.

    Bootstrapped and regression tested on x86.

    Pushing to the trunk.

    gcc/
            PR rtl-optimization/115876
            * ext-dce.cc (carry_backpropagate): Make mask and mmask unsigned.

[Bug rtl-optimization/115876] ext-dce.cc has ubsan issues; shifting negative values

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #3 from David Binderman <dcb314 at hotmail dot com> ---
I find doing a bootstrap build with -O3 -march=native, with
asan & ubsan, is a useful weekly sanity check.

I only have access to arm & x86_64, so the option exists
to extend this testing to other machine types.

[Bug rtl-optimization/115876] ext-dce.cc has ubsan issues; shifting negative values

[schwab@linux-m68k.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #4 from Andreas Schwab <schwab@linux-m68k.org> ---
This breaks build for m68k:

libtool: compile:  /daten/aranym/gcc/test/Build/./gcc/xgcc -shared-libgcc
-B/daten/aranym/gcc/test/Build/./gcc -nostdinc++
-L/daten/aranym/gcc/test/Build/m68k-linux/libstdc++-v3/src
-L/daten/aranym/gcc/test/Build/m68k-linux/libstdc++-v3/src/.libs
-L/daten/aranym/gcc/test/Build/m68k-linux/libstdc++-v3/libsupc++/.libs
-B/daten/cross/m68k-linux/m68k-linux/bin/
-B/daten/cross/m68k-linux/m68k-linux/lib/ -isystem
/daten/cross/m68k-linux/m68k-linux/include -isystem
/daten/cross/m68k-linux/m68k-linux/sys-include
-I/daten/aranym/gcc/test/libstdc++-v3/../libgcc
-I/daten/aranym/gcc/test/Build/m68k-linux/libstdc++-v3/include/m68k-linux
-I/daten/aranym/gcc/test/Build/m68k-linux/libstdc++-v3/include
-I/daten/aranym/gcc/test/libstdc++-v3/libsupc++ -std=gnu++17 -nostdinc++
-D_GLIBCXX_SHARED -fno-implicit-templates -Wall -Wextra -Wwrite-strings
-Wcast-qual -Wabi=2 -fdiagnostics-show-location=once -ffunction-sections
-fdata-sections -frandom-seed=fs_path.lo -fimplicit-templates -g -O2
-D_GNU_SOURCE -c ../../../../../libstdc++-v3/src/c++17/fs_path.cc  -fPIC -DPIC
-D_GLIBCXX_SHARED -o fs_path.o
during RTL pass: reload
../../../../../libstdc++-v3/src/c++17/floating_from_chars.cc: In function
‘std::from_chars_result std::from_chars(const char*, const char*, double&,
chars_format)’:
../../../../../libstdc++-v3/src/c++17/floating_from_chars.cc:1254:1: internal
compiler error: Segmentation fault
 1254 | }
      | ^

operands_match_p (x=<optimized out>, y=0x7ffff28671f8)
    at ../../gcc/reload.cc:2252
2252            j += hard_regno_nregs (j, ymode) - 1;
(gdb) p x
$1 = <optimized out>
(gdb) p y
$2 = (rtx) 0x7ffff28671f8
(gdb) pr
(subreg:DI (reg:SI 0 %d0 [orig:116 _213 ] [116]) 0)
(gdb) p j
$3 = -1

[Bug rtl-optimization/115876] ext-dce.cc has ubsan issues; shifting negative values

[schwab@linux-m68k.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #5 from Andreas Schwab <schwab@linux-m68k.org> ---
Note that the return type of carry_backpropagate should be unsigned as well,
but that does not fix the crash.

[Bug rtl-optimization/115876] ext-dce.cc has ubsan issues; shifting negative values

[schwab@linux-m68k.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #6 from Andreas Schwab <schwab@linux-m68k.org> ---
Probably that broke the sign extensions in carry_backpropagate.

[Bug rtl-optimization/115876] ext-dce.cc has ubsan issues; shifting negative values

[schwab@linux-m68k.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #7 from Andreas Schwab <schwab@linux-m68k.org> ---
It broke the ASHIFT case.

-        return mask >> INTVAL (XEXP (x, 1));
+        return (HOST_WIDE_INT)mask >> INTVAL (XEXP (x, 1));

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #8 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Strange.  My m68k bootstrap ran just fine, though I used QEMU rather than
Anarym.   Andreas, I don't guess you still have enough state lying around to
get register info and some surrounding assembly code at the fault point?

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #9 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jeff Law <law@gcc.gnu.org>:

https://gcc.gnu.org/g:94b21f13763638f64e83e7f9959c7f1523b9eaed

commit r15-2048-g94b21f13763638f64e83e7f9959c7f1523b9eaed
Author: Jeff Law <jlaw@ventanamicro.com>
Date:   Mon Jul 15 16:57:44 2024 -0600

    Fix sign/carry bit handling in ext-dce.

    My change to fix a ubsan issue broke handling propagation of the carry/sign
bit
    down through a right shift.  Thanks to Andreas for the analysis and
proposed
    fix and Sergei for the testcase.

            PR rtl-optimization/115876
            PR rtl-optimization/115916
    gcc/
            * ext-dce.cc (carry_backpropagate): Make return type unsigned as
well.
            Cast to signed for right shift to preserve sign bit.

    gcc/testsuite/

            * g++.dg/torture/pr115916.C: New test.

            Co-author: Andreas Schwab <schwab@linux-m68k.org>
            Co-author: Sergei Trofimovich <slyfox at gentoo dot org>

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #10 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 115967 has been marked as a duplicate of this bug. ***

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #11 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Our weekend ubsan bootstrap and test (of revision
r15-2173-ge0d997e913f811) still reported failures when compiling
testcase gfortran.dg/ieee/large_1.f90 (at -O2 and higher).

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #12 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to David Binderman from comment #3)
> I find doing a bootstrap build with -O3 -march=native, with
> asan & ubsan, is a useful weekly sanity check.

Today's sanity check shows this problem:

$ grep error: mk.out | sort | uniq -c
    196 ../../trunk/gcc/ext-dce.cc:696:15: runtime error: shift exponent 64 is
too large for 64-bit type 'long unsigned int'
$ 

The source code line is

              dst_mask <<= bit;

Perhaps it would be wise to sanity check the value of bit before use ?

I am not sure what to do if the value is out of range.

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |15.0

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #13 from David Binderman <dcb314 at hotmail dot com> ---
The problem seems to be getting worse this week:

$ grep error: mk.2.out  | grep runtime | sort | uniq -c | sort -rn
    118 ../../trunk/gcc/ext-dce.cc:740:15: runtime error: shift exponent 64 is
too large for 64-bit type 'long unsigned int'
     22 ../../trunk/gcc/ext-dce.cc:498:29: runtime error: shift exponent 64 is
too large for 64-bit type 'long int'
     14 ../../trunk/gcc/ext-dce.cc:506:23: runtime error: shift exponent 64 is
too large for 64-bit type 'long unsigned int'
      4 ../../trunk/gcc/ext-dce.cc:519:33: runtime error: shift exponent 64 is
too large for 64-bit type 'long unsigned int'
      1 checking whether we are cross compiling...
../../trunk/gcc/ext-dce.cc:506:23: runtime error: shift exponent 64 is too
large for 64-bit type 'long unsigned int'
$

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #14 from Martin Jambor <jamborm at gcc dot gnu.org> ---
This issue is still present and unfortunately it is the kind of bug that either
creates manual periodic work because people need to go over logs to verify that
no new other UBSAN failure has appeared or it effectively prevents those new
failures from being discovered quickly because "UBSAN is known to be red"
(which I believe has happened because I do not see an issue filed for a failure
at fortran/trans-expr.cc).

Is this really a difficult issue to fix?  Could it get a bit more priority,
please?

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #15 from Jeffrey A. Law <law at gcc dot gnu.org> ---
It's on my list, just higher priority items to deal with right now.

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #16 from Jeffrey A. Law <law at gcc dot gnu.org> ---
At least part of these are coming from the use-side processing of TImode
operations in carry_backpropagate.  The right thing to do in that case is just
return the mode mask indicating all the chunks are potentially live rather than
trying to figure out a narrower mask and triggering undefined behavior in the
process.

I won't be surprised if there are other cases in the use side processing that
are problematic in this regard.  They shouldn't impact correctness of
transformations, but do need to be fixed to be ub-clean.  

Anyway, spinning the first fix in this space now...

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #17 from Jeffrey A. Law <law at gcc dot gnu.org> ---
And the other case is (subreg:SI (reg:TF) 12).  No great surprise that the bit
position is problematical for that.  Should be an easy fix.

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #18 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jeff Law <law@gcc.gnu.org>:

https://gcc.gnu.org/g:f10d2ee95356b9de6c44d701c4dfa8fb088714d2

commit r15-2989-gf10d2ee95356b9de6c44d701c4dfa8fb088714d2
Author: Jeff Law <jlaw@ventanamicro.com>
Date:   Sun Aug 18 16:55:52 2024 -0600

    [PR rtl-optimization/115876] Avoid ubsan in ext-dce.cc

    This fixes two general ubsan issues in ext-dce, both related to use-side
    processsing of modes > DImode.

    In ext_dce_process_uses we can be presented with something like this as a
use
    (subreg:SI (reg:TF) 12)

    That will result in an out of range shift for a HOST_WIDE_INT object. 
Where
    this happens is safe to just break from the SET context and process the
    subjects.  This will ultimately result in seeing (reg:TF) and we'll mark
all
    bit groups as live.

    In carry_backpropagate we can be presented with a TImode shift (for
example)
    and the shift count can be > 63 for such a shift.  This naturally trips
ubsan
    as well as we're operating on 64 bit objects.

    We can just return mmask in this case noting that every bit group is live.

    The combination of these two fixes eliminates all the reported ubsan issues
in
    ext-dce seen in a bootstrap and regression test on x86.

    While I was in there I went ahead and fixed the various hardcoded 63/64
values
    to be HOST_BITS_PER_WIDE_INT based.

    Bootstrapped and regression tested on x86 with no regressions.  Also built
with
    ubsan enabled and verified the build logs and testsuite logs don't call out
any
    issues in ext-dce anymore.

    Pushing to the trunk.

            PR rtl-optimization/115876
    gcc
            * ext-dce.cc (ext_dce_process_sets): Replace hardcoded 63/64
instances
            with HOST_BITS_PER_WIDE_INT based values.
            (carry_backpropagate): Handle modes with more bits than
            HOST_BITS_PER_WIDE_INT gracefully, avoiding undefined behavior.
            (ext_dce_process_uses): Handle subreg offsets which would result
            in ubsan shifts gracefully, avoiding undefined behavior.

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #19 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Should be fixed now.

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #20 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Indeed, the UBSAN failures I see now look like they are all PR 116370.  Thanks!

[Bug rtl-optimization/115876] [15 regression] ext-dce.cc has ubsan issues; shifting negative values

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115876

--- Comment #21 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Just sorry it took so long....