[Bug rtl-optimization/54365] New: ARM optimization bug when pointer arithmetic wraps

[Bug rtl-optimization/54365] New: ARM optimization bug when pointer arithmetic wraps

[glaw@undo-software.com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54365

             Bug #: 54365
           Summary: ARM optimization bug when pointer arithmetic wraps
    Classification: Unclassified
           Product: gcc
           Version: 4.6.3
            Status: UNCONFIRMED
          Severity: major
          Priority: P3
         Component: rtl-optimization
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: glaw@undo-software.com


Created attachment 28077
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=28077
Simple program showing the bug.

Apologies if I've got the wrong component - it was a bit of a guess!

The attached program shows a fairly simple, but I think nasty, bug in GCC on
ARM. It seems to be present on at least versions 4.4.5, 4.5.1 and 4.6.3. If
compiled without optimisation, it behaves as I expect: adding 4 to a pointer
such that it wraps gives a pointer that is less than the original.  With -O2,
that is not the case. I note that the problem does not occur if I use integer
types.

Transcript follows (.c file attached separately and in transcript below for
convenience):

 $ cat compilerbug.c 
#include <stdio.h>

int
main( void)
{
    unsigned char* addr = (unsigned char*)0xfffffffe;
    unsigned len = 4;

    if ( addr+len < addr)
    {
        printf( "it wraps\n");
    }
    else
    {
        printf( "no wrap\n");
    }

    return 0;
}
 $ gcc --version
gcc (Ubuntu/Linaro 4.6.3-1ubuntu5) 4.6.3
Copyright (C) 2011 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

 $ gcc compilerbug.c 
 $ ./a.out 
it wraps
 $ # As expected. Now let's try with optimisations.
 $ gcc -O2 compilerbug.c 
 $ ./a.out 
no wrap
 $ # Oh dear!

[Bug rtl-optimization/54365] ARM optimization bug when pointer arithmetic wraps

[pinskia at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54365

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> 2012-08-24 18:23:50 UTC ---
This code as far as I Know is undefined.  Pointer arithmetic overflow is
undefined and not wrapping.  Mainly because there is no way to add a positive
number to an object and get back a NULL pointer.

[Bug rtl-optimization/54365] ARM optimization bug when pointer arithmetic wraps

[glaw@undo-software.com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54365

--- Comment #2 from Greg Law <glaw@undo-software.com> 2012-08-24 18:38:24 UTC ---
Yes, I think you're right: I hadn't appreciated that.

Still, even though it's undefined, it's slightly strange behaviour for the
compiler to adopt. I guess it's reasonable to close this bug as invalid though
if you consider that the most appropriate action.

[Bug rtl-optimization/54365] ARM optimization bug when pointer arithmetic wraps

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54365

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
                 CC|                            |jakub at gcc dot gnu.org
         Resolution|                            |INVALID

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-08-24 18:42:46 UTC ---
Invalid.

[Bug rtl-optimization/54365] ARM optimization bug when pointer arithmetic wraps

[fweimer at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54365

Florian Weimer <fweimer at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com

--- Comment #4 from Florian Weimer <fweimer at redhat dot com> 2012-08-27 07:39:15 UTC ---
(In reply to comment #0)
>  $ gcc -O2 compilerbug.c 
>  $ ./a.out 
> no wrap
>  $ # Oh dear!

Could you try with "-O2 -fwrapv" for completeness?  Thanks.

[Bug rtl-optimization/54365] ARM optimization bug when pointer arithmetic wraps

[glaw@undo-software.com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54365

--- Comment #5 from Greg Law <glaw@undo-software.com> 2012-08-30 13:23:54 UTC ---
-fwrapv doesn't appear to make a difference:

 $ gcc compilerbug.c 
 $ ./a.out 
it wraps
 $ gcc -O2 compilerbug.c 
 $ ./a.out 
no wrap
 $ gcc -O2 -fwrapv compilerbug.c
 $ ./a.out
no wrap
 $

[Bug rtl-optimization/54365] ARM optimization bug when pointer arithmetic wraps

[fweimer at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54365

--- Comment #6 from Florian Weimer <fweimer at redhat dot com> 2012-08-30 13:33:05 UTC ---
(In reply to comment #5)
> -fwrapv doesn't appear to make a difference:
> 
>  $ gcc compilerbug.c 
>  $ ./a.out 
> it wraps
>  $ gcc -O2 compilerbug.c 
>  $ ./a.out 
> no wrap
>  $ gcc -O2 -fwrapv compilerbug.c
>  $ ./a.out
> no wrap
>  $

This is surprising.  Is there a way to extend the effect of -fwrapv to pointer
arithmetic?

[Bug rtl-optimization/54365] ARM optimization bug when pointer arithmetic wraps

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54365

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> 2012-08-30 13:45:13 UTC ---
This is not surprising, just use integer arithmetic instead of pointer
arithmetic.  Pointer arithmetic not only has undefined wrapping, it is defined
only within the bounds of the object it points into (or one past the last byte
in it, but you can't dereference it in that case).

[Bug rtl-optimization/54365] ARM optimization bug when pointer arithmetic wraps

[fweimer at redhat dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54365

--- Comment #8 from Florian Weimer <fweimer at redhat dot com> 2012-08-30 13:56:04 UTC ---
(In reply to comment #7)
> This is not surprising, just use integer arithmetic instead of pointer
> arithmetic.  Pointer arithmetic not only has undefined wrapping, it is defined
> only within the bounds of the object it points into (or one past the last byte
> in it, but you can't dereference it in that case).

I was hoping that -fwrapv would turn pointer arithmetic into pure address
arithmetic as well.  The -fwrapv documentation only mentions integer arithmetic
so this is not a bug, it's just ... surprising.