[Bug sanitizer/59029] New: ICE with builtin function and -fsanitize=address

[Bug sanitizer/59029] New: ICE with builtin function and -fsanitize=address

[reichelt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59029

            Bug ID: 59029
           Summary: ICE with builtin function and -fsanitize=address
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: reichelt at gcc dot gnu.org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org

The following code snippet compiled with "-fsanitize=address -O" triggers an
ICE
since GCC 4.8.0 (when the address-sanitizer was introduced):

========================================
inline int foo(int* p)
{
  return __sync_fetch_and_add(p, 1);
}

void bar()
{
  foo(0);
}
========================================

bug.c: In function 'bar':
bug.c:6:6: internal compiler error: in get_mem_refs_of_builtin_call, at
asan.c:722
 inline int foo(int* p)
      ^
0x987d46 get_mem_refs_of_builtin_call
        ../../gcc/gcc/asan.c:722
0x98adb5 has_stmt_been_instrumented_p
        ../../gcc/gcc/asan.c:801
0x98adb5 transform_statements
        ../../gcc/gcc/asan.c:1919
0x98be62 asan_instrument
        ../../gcc/gcc/asan.c:2271
0x98be62 execute
        ../../gcc/gcc/asan.c:2311
Please submit a full bug report, [etc.]

In addition, the error location of the ICE is broken: the caret points to the
first line of the file whereas the reported line number is 6.

[Bug sanitizer/59029] ICE with builtin function and -fsanitize=address

[reichelt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59029

--- Comment #1 from Volker Reichelt <reichelt at gcc dot gnu.org> ---
The broken caret diagnostic seems to be a general problem of today's build.
I'll open a separate bug report for this.

[Bug sanitizer/59029] ICE with builtin function and -fsanitize=address

[y.gribov at samsung dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59029

Yury Gribov <y.gribov at samsung dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |y.gribov at samsung dot com

--- Comment #2 from Yury Gribov <y.gribov at samsung dot com> ---
Created attachment 31177
  --> http://gcc.gnu.org/bugzilla/attachment.cgi?id=31177&action=edit
Draft patch

Aha, looks like the ICE is caused by destination address being INTEGER_CST
instead of ADDR_EXPR. Attached patch seems to fix this (tested on x86_64).

@Volker: could you add your testcase to Asan testsuite?

-Y

[Bug sanitizer/59029] ICE with builtin function and -fsanitize=address

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59029

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2013-11-07
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |4.8.4
     Ever confirmed|0                           |1

[Bug sanitizer/59029] ICE with builtin function and -fsanitize=address

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59029

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Yury Gribov from comment #2)
> Created attachment 31177 [details]
> Draft patch
> 
> Aha, looks like the ICE is caused by destination address being INTEGER_CST
> instead of ADDR_EXPR. Attached patch seems to fix this (tested on x86_64).
> 
> @Volker: could you add your testcase to Asan testsuite?

Patch preapproved with the testcase and correct ChangeLog, just add
/* { dg-do compile } */

int
foo ()
{
  return __sync_fetch_and_add ((int *) 0, 1);
}

to testsuite/c-c++-common/asan/pr59029.c ?

[Bug sanitizer/59029] ICE with builtin function and -fsanitize=address

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59029

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to ygribov from comment #4)
> URL: http://gcc.gnu.org/viewcvs?rev=204508&root=gcc&view=rev
> Log:
> Allow integer literals as addresses in instrumented builtins.

Note, patches should still go to gcc-patches, even when you just say in subject
[committed] and in the description that it has been preapproved in the PR.
> gcc/
> 	PR sanitizer/59029
> 	* gcc/asan.c (get_mem_refs_of_builtin_call): Allow
> 	integer literals as addresses in instrumented builtins.

The gcc/ prefix shouldn't be there.
>From gcc-bugs-return-433830-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Nov 07 12:12:06 2013
Return-Path: <gcc-bugs-return-433830-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 11690 invoked by alias); 7 Nov 2013 12:12:05 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 11660 invoked by uid 48); 7 Nov 2013 12:12:01 -0000
From: "paolo.carlini at oracle dot com" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/59033] cannot control inherited constructors access
Date: Thu, 07 Nov 2013 12:12:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: paolo.carlini at oracle dot com
X-Bugzilla-Status: RESOLVED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status resolution
Message-ID: <bug-59033-4-YSuOFJAejV@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-59033-4@http.gcc.gnu.org/bugzilla/>
References: <bug-59033-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2013-11/txt/msg00607.txt.bz2
Content-length: 444

http://gcc.gnu.org/bugzilla/show_bug.cgi?idY033

Paolo Carlini <paolo.carlini at oracle dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |RESOLVED
         Resolution|---                         |INVALID

--- Comment #3 from Paolo Carlini <paolo.carlini at oracle dot com> ---
Closing then.

[Bug sanitizer/59029] ICE with builtin function and -fsanitize=address

[y.gribov at samsung dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59029

--- Comment #6 from Yury Gribov <y.gribov at samsung dot com> ---
(In reply to Jakub Jelinek from comment #5)
> Note, patches should still go to gcc-patches, even when you just say in
> subject
> [committed] and in the description that it has been preapproved in the PR.

Got it. Done.

> The gcc/ prefix shouldn't be there.

Right, my bad...

-Y

[Bug sanitizer/59029] ICE with builtin function and -fsanitize=address

[y.gribov at samsung dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59029

--- Comment #7 from Yury Gribov <y.gribov at samsung dot com> ---
Volker, could you close this bug if gcc trunk works for you?

[Bug sanitizer/59029] ICE with builtin function and -fsanitize=address

[reichelt at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59029

Volker Reichelt <reichelt at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Volker Reichelt <reichelt at gcc dot gnu.org> ---
Fixed on trunk by Yury's patch.