public inbox for gcc-bugs@sourceware.org
help / color / mirror / Atom feed
* [Bug other/56881] New: Miscompilation (optimisation failure?) causing NULL dereference and segfault at runtime
@ 2013-04-08 16:48 devspam at moreofthesa dot me.uk
  2013-04-09 13:57 ` [Bug other/56881] " devspam at moreofthesa dot me.uk
                   ` (7 more replies)
  0 siblings, 8 replies; 9+ messages in thread
From: devspam at moreofthesa dot me.uk @ 2013-04-08 16:48 UTC (permalink / raw)
  To: gcc-bugs


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=56881

             Bug #: 56881
           Summary: Miscompilation (optimisation failure?) causing NULL
                    dereference and segfault at runtime
    Classification: Unclassified
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: other
        AssignedTo: unassigned@gcc.gnu.org
        ReportedBy: devspam@moreofthesa.me.uk


Created attachment 29828
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=29828
Source which triggers the problem at -O2

We (Unvanquished devs) have found what looks like an optimisation bug in gcc
4.8.0. The ‘offending’ code is this (lines 60 to 62 of
src/tools/lcc/cpp/hideset.c):

  hs1 = (Hideset)domalloc(len*sizeof(Hideset));
  memmove(hs1, nhs, len*sizeof(Hideset));
  hidesets[nhidesets] = hs1;

The allocation succeeds (domalloc is a malloc wrapper), the memmove is fine,
but hs1 somehow becomes NULL. So next time this function is called, there's a
NULL pointer which gets dereferenced a few lines above.

Putting a function call in between the first two lines above works around the
problem, as does swapping the latter two lines (as is done in
https://github.com/Unvanquished/Unvanquished/commit/9157ac0d3668fc059ce001620bbfa45ccf66c8df).

Pre-processed source is attached. I'm able to cause the problem with -Os, -O2
or -O3 but not -O0 or -O; I can try enabling or disabling specific
optimisations.

I'm using stock gcc-4.8 4.8.0-2 (Debian experimental), but another of us, an
Arch user, is using core/gcc 4.8.0-1 (base-devel) and is seeing the same
problem (which is why I'm reporting it here rather than in the Debian BTS).

Architecture is amd64 in both cases.
>From gcc-bugs-return-419515-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Apr 08 16:51:10 2013
Return-Path: <gcc-bugs-return-419515-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 1172 invoked by alias); 8 Apr 2013 16:51:09 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 904 invoked by uid 48); 8 Apr 2013 16:51:07 -0000
From: "fredrickprashanth at gmail dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c/56880] R_X86_64_COPY bug
Date: Mon, 08 Apr 2013 16:51:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: fredrickprashanth at gmail dot com
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Changed-Fields:
Message-ID: <bug-56880-4-G1nmzbZmPG@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-56880-4@http.gcc.gnu.org/bugzilla/>
References: <bug-56880-4@http.gcc.gnu.org/bugzilla/>
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
Content-Type: text/plain; charset="UTF-8"
MIME-Version: 1.0
X-SW-Source: 2013-04/txt/msg00660.txt.bz2
Content-length: 409


http://gcc.gnu.org/bugzilla/show_bug.cgi?idV880

--- Comment #1 from Fredrick <fredrickprashanth at gmail dot com> 2013-04-08 16:51:06 UTC ---
Another related bug would be that, we tried to disable copy relocation
using -z nocopyreloc. The binary crashed with SEGV.


./test_misc.bin: Symbol `test_dynamic' causes overflow in R_X86_64_32
relocation
Segmentation fault (core dumped)

-Fredrick


^ permalink raw reply	[flat|nested] 9+ messages in thread
end of thread, other threads:[~2013-04-14 15:24 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2013-04-08 16:48 [Bug other/56881] New: Miscompilation (optimisation failure?) causing NULL dereference and segfault at runtime devspam at moreofthesa dot me.uk
2013-04-09 13:57 ` [Bug other/56881] " devspam at moreofthesa dot me.uk
2013-04-09 14:45 ` mikpe at it dot uu.se
2013-04-10 14:49 ` devspam at moreofthesa dot me.uk
2013-04-10 15:02 ` devspam at moreofthesa dot me.uk
2013-04-13 17:53 ` mikpe at it dot uu.se
2013-04-13 20:39 ` mikpe at it dot uu.se
2013-04-14  8:56 ` mikpe at it dot uu.se
2013-04-14 15:24 ` steven at gcc dot gnu.org

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).