[Bug sanitizer/63813] New: [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346

[Bug sanitizer/63813] New: [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63813

            Bug ID: 63813
           Summary: [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at
                    ubsan.c:346
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: burnus at gcc dot gnu.org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org,
                    mpolacek at gcc dot gnu.org

With yesterdays's GCC, compiling our big code fails with:

$ g++ -S -w -fsanitize=undefined -O1 poly21.ii

poly21.ii: In member function ‘void
sfm::PolygonBuilder::ProcessSingleExternalTopRight(const
sfm::PolygonSingleEvent&)’:
poly21.ii:23:8: internal compiler error: in ubsan_type_descriptor, at
ubsan.c:346
   void PolygonBuilder::ProcessSingleExternalTopRight (
        ^
0xcaaebc ubsan_type_descriptor(tree_node*, ubsan_print_style)
        ../../gcc/ubsan.c:346
0xcac58c ubsan_expand_null_ifn(gimple_stmt_iterator*)
        ../../gcc/ubsan.c:766


It was working on 7 November.

---------<cut>-------------------------------
namespace sfm
{
  class PolygonFragment { };
  typedef long AttributeValue;
  class CrossingEvent {
   public:
    inline AttributeValue GetValue () const;
  };
  class SingleCrossingEvent : public CrossingEvent { };
  class PolygonSingleEvent : public SingleCrossingEvent {
   public:
    inline PolygonFragment &GetFragment () const;
  };
  PolygonFragment &PolygonSingleEvent::GetFragment () const {
    return *reinterpret_cast <PolygonFragment *>(GetValue ());
  }
  class PolygonBuilder {
    void ProcessSingleExternalTopRight (const PolygonSingleEvent &inEvent);
    inline void CloseExternal (PolygonFragment &ioLeft,
                               PolygonFragment &ioRight);
    PolygonFragment *mCarryBelow;
  };
  void PolygonBuilder::ProcessSingleExternalTopRight (
      const PolygonSingleEvent &inEvent)
  {
    CloseExternal (*mCarryBelow, inEvent.GetFragment ());
  }
}
>From gcc-bugs-return-466318-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Nov 11 08:03:29 2014
Return-Path: <gcc-bugs-return-466318-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 451 invoked by alias); 11 Nov 2014 08:03:29 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 393 invoked by uid 48); 11 Nov 2014 08:03:26 -0000
From: "mpolacek at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug sanitizer/63813] [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346
Date: Tue, 11 Nov 2014 08:03:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: sanitizer
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: ice-on-valid-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: mpolacek at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status cf_reconfirmed_on everconfirmed
Message-ID: <bug-63813-4-RiulkjwOkY@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-63813-4@http.gcc.gnu.org/bugzilla/>
References: <bug-63813-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-11/txt/msg00790.txt.bz2
Content-length: 1907

https://gcc.gnu.org/bugzilla/show_bug.cgi?idc813

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-11-11
     Ever confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
I see a different ICE:

<built-in>: internal compiler error: Segmentation fault
0xec336e crash_signal
    /home/marek/src/gcc/gcc/toplev.c:358
0x18092ea ht_lookup_with_hash(ht*, unsigned char const*, unsigned long,
unsigned int, ht_lookup_option)
    /home/marek/src/gcc/libcpp/symtab.c:111
0x17fe12f lex_identifier
    /home/marek/src/gcc/libcpp/lex.c:1343
0x180086b _cpp_lex_direct
    /home/marek/src/gcc/libcpp/lex.c:2394
0x180160b _cpp_lex_token
    /home/marek/src/gcc/libcpp/lex.c:2162
0x17f255f lex_macro_node
    /home/marek/src/gcc/libcpp/directives.c:553
0x17f30f2 do_define
    /home/marek/src/gcc/libcpp/directives.c:594
0x17f5aae run_directive
    /home/marek/src/gcc/libcpp/directives.c:541
0x17f5b3b cpp_define(cpp_reader*, char const*)
    /home/marek/src/gcc/libcpp/directives.c:2392
0x948d78 builtin_define_with_hex_fp_value
    /home/marek/src/gcc/gcc/c-family/c-cppbuiltin.c:1442
0x9442f8 builtin_define_float_constants
    /home/marek/src/gcc/gcc/c-family/c-cppbuiltin.c:254
0x9476fc c_cpp_builtins(cpp_reader*)
    /home/marek/src/gcc/gcc/c-family/c-cppbuiltin.c:947
0x95a741 c_finish_options
    /home/marek/src/gcc/gcc/c-family/c-opts.c:1288
0x959f9c c_common_parse_file()
    /home/marek/src/gcc/gcc/c-family/c-opts.c:1032
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

[Bug sanitizer/63813] [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63813

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
(In reply to Marek Polacek from comment #1)
> I see a different ICE:
> 
> <built-in>: internal compiler error: Segmentation fault
> 0xec336e crash_signal
> 	/home/marek/src/gcc/gcc/toplev.c:358
> 0x18092ea ht_lookup_with_hash(ht*, unsigned char const*, unsigned long,
> unsigned int, ht_lookup_option)
> 	/home/marek/src/gcc/libcpp/symtab.c:111
> 0x17fe12f lex_identifier
> 	/home/marek/src/gcc/libcpp/lex.c:1343

Forgotten make in the libcpp directory after r217292 ?
>From gcc-bugs-return-466320-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Nov 11 08:15:51 2014
Return-Path: <gcc-bugs-return-466320-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 9746 invoked by alias); 11 Nov 2014 08:15:51 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 9700 invoked by uid 48); 11 Nov 2014 08:15:47 -0000
From: "mpolacek at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug sanitizer/63813] [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346
Date: Tue, 11 Nov 2014 08:15:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: sanitizer
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords: ice-on-valid-code
X-Bugzilla-Severity: normal
X-Bugzilla-Who: mpolacek at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: mpolacek at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 5.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status assigned_to target_milestone
Message-ID: <bug-63813-4-Ec7AzURfFk@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-63813-4@http.gcc.gnu.org/bugzilla/>
References: <bug-63813-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-11/txt/msg00792.txt.bz2
Content-length: 626

https://gcc.gnu.org/bugzilla/show_bug.cgi?idc813

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |5.0

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #2)
> Forgotten make in the libcpp directory after r217292 ?

Oh well.  Mine then.

[Bug sanitizer/63813] [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346

[jiwang at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63813

Jiong Wang <jiwang at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jiwang at gcc dot gnu.org

--- Comment #4 from Jiong Wang <jiwang at gcc dot gnu.org> ---
run into the same issue on AArch64.

[Bug sanitizer/63813] [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63813

--- Comment #5 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Jakub tells me this started with r217260.

[Bug sanitizer/63813] [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63813

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|mpolacek at gcc dot gnu.org        |jakub at gcc dot gnu.org

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 34018
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34018&action=edit
gcc5-pr63813.patch

Untested fix.

[Bug sanitizer/63813] [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63813

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Tue Nov 18 22:15:42 2014
New Revision: 217741

URL: https://gcc.gnu.org/viewcvs?rev=217741&root=gcc&view=rev
Log:
    PR sanitizer/63813
    * c-ubsan.c (ubsan_maybe_instrument_reference_or_call): Change type
    argument to ptype, set type to TREE_TYPE (ptype).  Don't call
    get_pointer_alignment for non-pointers.  Use ptype, or if it is
    reference type, corresponding pointer type, as type of kind
    argument.
    (ubsan_maybe_instrument_reference,
    ubsan_maybe_instrument_member_call): Adjust callers.

    * g++.dg/ubsan/pr63813.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/ubsan/pr63813.C
Modified:
    trunk/gcc/c-family/ChangeLog
    trunk/gcc/c-family/c-ubsan.c
    trunk/gcc/testsuite/ChangeLog

[Bug sanitizer/63813] [5 Regression][UBSAN] ICE in ubsan_type_descriptor, at ubsan.c:346

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63813

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.