[Bug lto/61048] New: compiling with -fsanitize=address crashes GCC if pointers are used

[Bug lto/61048] New: compiling with -fsanitize=address crashes GCC if pointers are used

[fabian@ritter-vogt.de]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=61048

            Bug ID: 61048
           Summary: compiling with -fsanitize=address crashes GCC if
                    pointers are used
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: lto
          Assignee: unassigned at gcc dot gnu.org
          Reporter: fabian@ritter-vogt.de

test.cpp:
include <iostream>
int main()
{
        int *i = reinterpret_cast<int*>(0xC1000000);
        std::cout << *i << std::endl;
}

Compile with:
arm-none-eabi-g++ test.cpp -c -o test.o -fsanitize=address -flto
Link with:
arm-none-eabi-g++ test.o -o test -Wl,-flto

arm-none-eabi-g++ -v:
Using built-in specs.
COLLECT_GCC=arm-none-eabi-g++
COLLECT_LTO_WRAPPER=/opt/nspire/Ndless/ndless-sdk/toolchain/install/lib/gcc/arm-none-eabi/4.9.0/lto-wrapper
Target: arm-none-eabi
Configured with: ../gcc-4.9.0/configure --target=arm-none-eabi
--prefix=/opt/nspire/Ndless/ndless-sdk/toolchain/install --enable-interwork
--enable-multilib --enable-languages=c,c++ --with-system-zlib --with-newlib
--with-headers=../newlib-2.0.0/newlib/libc/include --disable-shared
--with-gnu-as --with-gnu-ld --with-float=soft --disable-werror
Thread model: single
gcc version 4.9.0 (GCC)

Result:
lto1: internal compiler error: in streamer_get_builtin_tree, at
tree-streamer-in.c:1124
0x914191 streamer_get_builtin_tree(lto_input_block*, data_in*)
        ../../gcc-4.9.0/gcc/tree-streamer-in.c:1124
0x6f55d4 lto_input_tree_1(lto_input_block*, data_in*, LTO_tags, unsigned int)
        ../../gcc-4.9.0/gcc/lto-streamer-in.c:1265
0x6f57c1 lto_input_scc(lto_input_block*, data_in*, unsigned int*, unsigned
int*)
        ../../gcc-4.9.0/gcc/lto-streamer-in.c:1193
0x50375e lto_read_decls
        ../../gcc-4.9.0/gcc/lto/lto.c:1879
0x504ef5 lto_file_finalize
        ../../gcc-4.9.0/gcc/lto/lto.c:2214
0x504ef5 lto_create_files_from_ids
        ../../gcc-4.9.0/gcc/lto/lto.c:2224
0x504ef5 lto_file_read
        ../../gcc-4.9.0/gcc/lto/lto.c:2264
0x504ef5 read_cgraph_and_symbols
        ../../gcc-4.9.0/gcc/lto/lto.c:2967
0x504ef5 lto_main()
        ../../gcc-4.9.0/gcc/lto/lto.c:3412
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
lto-wrapper:
/opt/nspire/Ndless/ndless-sdk/toolchain/install/bin/arm-none-eabi-g++ returned
1 exit status
/opt/nspire/Ndless/ndless-sdk/toolchain/install/arm-none-eabi/bin/ld.real:
lto-wrapper failed
collect2: error: ld returned 1 exit status

It compiles fine if I remove "-flto" (disregarding undefined references)

[Bug lto/61048] compiling with -fsanitize=address crashes GCC if pointers are used

[i.palachev at samsung dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61048

Ilya Palachev <i.palachev at samsung dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |i.palachev at samsung dot com

--- Comment #1 from Ilya Palachev <i.palachev at samsung dot com> ---
The error happens for the following sequence of commands

g++ test.cpp -c -o test.o -fsanitize=address -flto
g++ test.o -o test -Wl,-flto

And does not happen for the following sequence of commands:

g++ test.cpp -c -o test.o -fsanitize=address -flto
g++ test.o -o test -Wl,-flto -fsanitize=address

The ICE happens because sanitizer builtins are not initialized (returned tree
is null).
I've tried to force their initialization as follows:

diff --git a/gcc/lto/lto.c b/gcc/lto/lto.c
index bc53632..f5ca849 100644
--- a/gcc/lto/lto.c
+++ b/gcc/lto/lto.c
@@ -55,6 +55,7 @@ along with GCC; see the file COPYING3.  If not see
 #include "ipa-inline.h"
 #include "params.h"
 #include "ipa-utils.h"
+#include "asan.h"


 /* Number of parallel tasks to run, -1 if we want to use GNU Make jobserver. 
*/
@@ -1856,6 +1857,9 @@ lto_read_decls (struct lto_file_decl_data *decl_data,
const void *data,
   data_in = lto_data_in_create (decl_data, (const char *) data +
string_offset,
                                header->string_size, resolutions);

+  /* Initialize sanitizer builtins if necessary.  */
+  initialize_sanitizer_builtins();
+
   /* We do not uniquify the pre-loaded cache entries, those are middle-end
      internal types that should not be merged.  */



But after applying this patch the following error happens during the 2nd
command:

g++ test.o -o test -Wl,-flto 
/tmp/ccEhycoY.ltrans0.ltrans.o:ccEhycoY.ltrans0.o:function
__static_initialization_and_destruction_0(int, int): error: undefined reference
to '__asan_before_dynamic_init'
/tmp/ccEhycoY.ltrans0.ltrans.o:ccEhycoY.ltrans0.o:function
__static_initialization_and_destruction_0(int, int): error: undefined reference
to '__asan_after_dynamic_init'
collect2: error: ld returned 1 exit status

[Bug lto/61048] compiling with -fsanitize=address crashes GCC if pointers are used

[i.palachev at samsung dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61048

--- Comment #2 from Ilya Palachev <i.palachev at samsung dot com> ---
Suggested a patch that fixes this issue.
https://gcc.gnu.org/ml/gcc-patches/2014-10/msg01264.html

[Bug lto/61048] compiling with -fsanitize=address crashes GCC if pointers are used

[i.palachev at samsung dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61048

--- Comment #3 from Ilya Palachev <i.palachev at samsung dot com> ---
Created attachment 33714
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33714&action=edit
Patch that fixes the ICE.

[Bug lto/61048] compiling with -fsanitize=address crashes GCC if pointers are used

[i.palachev at samsung dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61048

--- Comment #4 from Ilya Palachev <i.palachev at samsung dot com> ---
> g++ test.o -o test -Wl,-flto 
> /tmp/ccEhycoY.ltrans0.ltrans.o:ccEhycoY.ltrans0.o:function
> __static_initialization_and_destruction_0(int, int): error: undefined
> reference to '__asan_before_dynamic_init'
> /tmp/ccEhycoY.ltrans0.ltrans.o:ccEhycoY.ltrans0.o:function
> __static_initialization_and_destruction_0(int, int): error: undefined
> reference to '__asan_after_dynamic_init'
> collect2: error: ld returned 1 exit status

Such error is usual when option -fsanitize=address is not specified at the 2nd
stage. For example, without option -flto gcc prints the following error:

g++ -c test.cpp -fsanitize=address -o test_nolto.o
g++ test_nolto.o -o test_nolto
test_nolto.o:test.cpp:function main: error: undefined reference to
'__asan_report_load4'
test_nolto.o:test.cpp:function __static_initialization_and_destruction_0(int,
int): error: undefined reference to '__asan_before_dynamic_init'
test_nolto.o:test.cpp:function __static_initialization_and_destruction_0(int,
int): error: undefined reference to '__asan_after_dynamic_init'
test_nolto.o:test.cpp:function _GLOBAL__sub_D_00099_0_main: error: undefined
reference to '__asan_unregister_globals'
test_nolto.o:test.cpp:function _GLOBAL__sub_I_00099_1_main: error: undefined
reference to '__asan_init_v4'
test_nolto.o:test.cpp:function _GLOBAL__sub_I_00099_1_main: error: undefined
reference to '__asan_register_globals'
collect2: error: ld returned 1 exit status

So it seems that above patch provides that gcc produces correct output.

[Bug lto/61048] compiling with -fsanitize=address crashes GCC if pointers are used

[i.palachev at samsung dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61048

Ilya Palachev <i.palachev at samsung dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
  Attachment #33714|0                           |1
        is obsolete|                            |

--- Comment #5 from Ilya Palachev <i.palachev at samsung dot com> ---
Created attachment 33725
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33725&action=edit
Patch that fixes the ICE (2nd version)

The 2nd version of patch was posted at
https://gcc.gnu.org/ml/gcc-patches/2014-10/msg01364.html