[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> ---
I also saw

FAIL: c-c++-common/ubsan/object-size-10.c   -O2 -flto -fuse-linker-plugin
-fno-fat-lto-objects  execution test

at random on Linux/ia32.

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[bernd.edlinger at hotmail dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

Bernd Edlinger <bernd.edlinger at hotmail dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |bernd.edlinger at hotmail dot de

--- Comment #4 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
I have never seen these test cases fail in my tests.

But I do not quite understand how you configure your tests.

For instance how you produced
https://gcc.gnu.org/ml/gcc-testresults/2015-01/msg01188.html


I assume you do:

../src/configure --prefix=/usr/5.0.0 --enable-clocale=gnu --with-system-zlib
--enable-shared --with-demangler-in-ld --with-fpmath=sse
--enable-languages=c,c++,fortran,java,lto,objc

But how do you start the test that it uses all the different combinations
of -fpic options?

make -k check RUNTESTFLAGS=???

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #5 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Bernd Edlinger from comment #4)
> I have never seen these test cases fail in my tests.
>
> But how do you start the test that it uses all the different combinations
> of -fpic options?
> 
> make -k check RUNTESTFLAGS=???

I used

# make check RUNTESTFLAGS="--target_board='unix{-fpic,-mcmodel=medium,-fpic\
-mcmodel=medium,-mcmodel=large,-fpic\ -mcmodel=large}'"

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[vries at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

vries at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2015-04-02
                 CC|                            |vries at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #6 from vries at gcc dot gnu.org ---
I have seen this a couple of times as well on x86_64.

Next time I encounter it, I'll try to post the full FAIL message, I think the
FAIL message is longer than one line. The line producing the failure looks
like:
...
                        fail "$name output pattern test, is ${output}, should
match $texttmp"
...

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[vries at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #7 from vries at gcc dot gnu.org ---
Created attachment 35215
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35215&action=edit
relevant bit of gcc.log

> Next time I encounter it, I'll try to post the full FAIL message

I ran into this while testing an AFAIU unrelated patch.

I suppose the output scan fails because of the '<memory cannot be printed>'
messages. I have no idea whether those messages indicate a problem, or are
harmless.

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[bernd.edlinger at hotmail dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #8 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
(In reply to vries from comment #7)
> Created attachment 35215 [details]
> relevant bit of gcc.log
> 
> > Next time I encounter it, I'll try to post the full FAIL message
> 
> I ran into this while testing an AFAIU unrelated patch.
> 
> I suppose the output scan fails because of the '<memory cannot be printed>'
> messages. I have no idea whether those messages indicate a problem, or are
> harmless.

I think you are right!

I tried this:

gcc -O2 -g -fsanitize=undefined object-size-9.c
./a.out
object-size-9.c:21:10: runtime error: load of address 0x7ffeddb0a16c with
insufficient space for an object of type 'char'
0x7ffeddb0a16c: note: pointer points here
  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  c5 9e 33 c2 de 7f 00 00  00
00 00 00 00 00 00 00
              ^ 
object-size-9.c:64:13: runtime error: index 12 out of bounds for type 'U [10]'
object-size-9.c:64:16: runtime error: load of address 0x000000600ff0 with
insufficient space for an object of type 'unsigned int'
0x000000600ff0: note: pointer points here
<memory cannot be printed>
object-size-9.c:78:11: runtime error: load of address 0x000000600ff0 with
insufficient space for an object of type 'unsigned int'
0x000000600ff0: note: pointer points here
<memory cannot be printed>


BUT if I do
gdb ./a.out
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
Copyright (C) 2014 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.  Type "show copying"
and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<http://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
<http://www.gnu.org/software/gdb/documentation/>.
For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./a.out...done.
(gdb) r
Starting program: /home/ed/gnu/gcc-test/a.out 
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
warning: File "/home/ed/gnu/install/lib64/libstdc++.so.6.0.21-gdb.py"
auto-loading has been declined by your `auto-load safe-path' set to
"$debugdir:$datadir/auto-load".
To enable execution of this file add
    add-auto-load-safe-path
/home/ed/gnu/install/lib64/libstdc++.so.6.0.21-gdb.py
line to your configuration file "/home/ed/.gdbinit".
To completely disable this security protection add
    set auto-load safe-path /
line to your configuration file "/home/ed/.gdbinit".
For more information about this security protection see the
"Auto-loading safe path" section in the GDB manual.  E.g., run from the shell:
    info "(gdb)Auto-loading safe path"
object-size-9.c:21:10: runtime error: load of address 0x7fffffffdeec with
insufficient space for an object of type 'char'
0x7fffffffdeec: note: pointer points here
  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  c5 8e d2 f6 ff 7f 00 00  00
00 00 00 00 00 00 00
              ^ 
object-size-9.c:64:13: runtime error: index 12 out of bounds for type 'U [10]'
object-size-9.c:64:16: runtime error: load of address 0x000000600ff0 with
insufficient space for an object of type 'unsigned int'
0x000000600ff0: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  11 1c 01 00
              ^ 
object-size-9.c:78:11: runtime error: load of address 0x000000600ff0 with
insufficient space for an object of type 'unsigned int'
0x000000600ff0: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  11 1c 01 00
              ^ 
[Inferior 1 (process 27836) exited normally]
(gdb) 

the address stays the same, it is after the end of "s" but close
to the next page boundary. depending on the different environment
the output varies, one or two lines. I assume the output of the
memory content would crash if it is so close to a page boundary?

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[bernd.edlinger at hotmail dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #9 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
this should avoid the random '<memory cannot be printed>' issue:

Index: object-size-9.c
===================================================================
--- object-size-9.c    (revision 222007)
+++ object-size-9.c    (working copy)
@@ -11,7 +11,7 @@
 #endif
 struct U { int a : 5; int b : 19; int c : 8; };
 struct S { struct U d[10]; };
-struct S s;
+struct S s __attribute__((aligned(4096)));

 int
 f1 (struct T x, int i)


But this still fails:
make check-gcc-c++ RUNTESTFLAGS="ubsan.exp=object-size-9.c
--target_board='unix{-fpic}'"

Running /home/ed/gnu/gcc-trunk/gcc/testsuite/g++.dg/ubsan/ubsan.exp ...
FAIL: c-c++-common/ubsan/object-size-9.c   -O2  output pattern test, is
c-c++-common/ubsan/object-size-9.c:21:11: runtime error: load of address
0x7ffdfb19d63c with insufficient space for an object of type 'char'
0x7ffdfb19d63c: note: pointer points here
  01 00 00 00 00 00 00 00  85 d3 55 06 3e 2b 00 00  00 00 00 00 00 00 00 00  00
00 00 00 00 00 00 00
              ^ 
c-c++-common/ubsan/object-size-9.c:34:8: runtime error: index 12 out of bounds
for type 'char [8]'
c-c++-common/ubsan/object-size-9.c:64:15: runtime error: index 12 out of bounds
for type 'U [10]'
c-c++-common/ubsan/object-size-9.c:64:17: runtime error: load of address
0x000000603030 with insufficient space for an object of type 'unsigned int'
0x000000603030: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  00 00 00 00
              ^ 
c-c++-common/ubsan/object-size-9.c:78:13: runtime error: load of address
0x000000603030 with insufficient space for an object of type 'unsigned int'
0x000000603030: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  00 00 00 00
              ^ 
, should match load of address [^
^M]* with insufficient space for an object of type 'char'[^
^M]*(
|
|^M)[^
^M]*note: pointer points here[^
^M]*(
|
|^M)[^
^M]*[^
^M]*(
|
|^M)[^
^M]*\^[^
^M]*(
|
|^M)[^
^M]*index 12 out of bounds for type 'char \[8\]'[^
^M]*(
|
|^M)[^
^M]*store to address [^
^M]* with insufficient space for an object of type 'char'[^
^M]*(
|
|^M)[^
^M]*note: pointer points here[^
^M]*(
|
|^M)[^
^M]*[^
^M]*(
|
|^M)[^
^M]*\^[^
^M]*(
|

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[bernd.edlinger at hotmail dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #10 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
Hmmm, the other issue is this:

g++ -g -O2 -fsanitize=undefined  object-size-9.c
./a.out
object-size-9.c:21:11: runtime error: load of address 0x7fffaad34acc with
insufficient space for an object of type 'char'
0x7fffaad34acc: note: pointer points here
  01 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  c5 1e c8 b1 fa 7f 00 00  00
00 00 00 00 00 00 00
              ^ 
object-size-9.c:34:8: runtime error: index 12 out of bounds for type 'char [8]'
object-size-9.c:34:15: runtime error: store to address 0x7fffaad34abc with
insufficient space for an object of type 'char'
0x7fffaad34abc: note: pointer points here
  01 00 00 00 00 00 00 00  61 62 63 64 65 66 67 00  01 00 00 00 00 00 00 00  00
00 00 00 00 00 00 00
              ^ 
object-size-9.c:50:11: runtime error: store to address 0x7fffaad34abc with
insufficient space for an object of type 'char'
0x7fffaad34abc: note: pointer points here
  01 00 00 00 7a 00 00 00  61 62 63 64 65 66 67 00  01 00 00 00 00 00 00 00  00
00 00 00 00 00 00 00
              ^ 
object-size-9.c:64:15: runtime error: index 12 out of bounds for type 'U [10]'
object-size-9.c:64:17: runtime error: load of address 0x000000601790 with
insufficient space for an object of type 'unsigned int'
0x000000601790: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  00 00 00 00
              ^ 
object-size-9.c:78:13: runtime error: load of address 0x000000601790 with
insufficient space for an object of type 'unsigned int'
0x000000601790: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  00 00 00 00
              ^ 



BUT:

g++ -g -O2 -fsanitize=undefined -fpic object-size-9.c
./a.out
object-size-9.c:21:11: runtime error: load of address 0x7ffc0615bf6c with
insufficient space for an object of type 'char'
0x7ffc0615bf6c: note: pointer points here
  01 00 00 00 00 00 00 00  35 53 6d d0 c4 7f 00 00  00 00 00 00 00 00 00 00  00
00 00 00 00 00 00 00
              ^ 
object-size-9.c:34:8: runtime error: index 12 out of bounds for type 'char [8]'
object-size-9.c:64:15: runtime error: index 12 out of bounds for type 'U [10]'
object-size-9.c:64:17: runtime error: load of address 0x0000006015f0 with
insufficient space for an object of type 'unsigned int'
0x0000006015f0: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  00 00 00 00
              ^ 
object-size-9.c:78:13: runtime error: load of address 0x0000006015f0 with
insufficient space for an object of type 'unsigned int'
0x0000006015f0: note: pointer points here
 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00
00 00 00  00 00 00 00
              ^ 



... So with -fpic the following two messages are completely missing:

object-size-9.c:34:15: runtime error: store to address 0x7ffc0973608c with
insufficient space for an object of type 'char'
0x7ffc0973608c: note: pointer points here
  01 00 00 00 00 00 00 00  61 62 63 64 65 66 67 00  01 00 00 00 00 00 00 00  00
00 00 00 00 00 00 00
              ^ 
object-size-9.c:50:11: runtime error: store to address 0x7ffc0973608c with
insufficient space for an object of type 'char'
0x7ffc0973608c: note: pointer points here
  01 00 00 00 7a 00 00 00  61 62 63 64 65 66 67 00  01 00 00 00 00 00 00 00  00
00 00 00 00 00 00 00
              ^

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[bernd.edlinger at hotmail dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #11 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
I don't know if that is a bug or not.

I see that -fpic does not inline f2 and f3.

The two messages seem to be always missing when
not inlined...

So, how about this:

Index: gcc/testsuite/c-c++-common/ubsan/object-size-9.c
===================================================================
--- gcc/testsuite/c-c++-common/ubsan/object-size-9.c    (revision 222007)
+++ gcc/testsuite/c-c++-common/ubsan/object-size-9.c    (working copy)
@@ -11,7 +11,7 @@
 #endif
 struct U { int a : 5; int b : 19; int c : 8; };
 struct S { struct U d[10]; };
-struct S s;
+struct S s __attribute__((aligned(4096)));

 int
 f1 (struct T x, int i)
@@ -27,7 +27,7 @@
 /* { dg-output "\[^\n\r]*\\^\[^\n\r]*(\n|\r\n|\r)" } */

 #ifdef __cplusplus
-struct C
+inline struct C
 f2 (int i)
 {
   struct C x;
@@ -41,7 +41,7 @@
 /* { dg-output "\[^\n\r]*\[^\n\r]*(\n|\r\n|\r)" { target { c++ } } } */
 /* { dg-output "\[^\n\r]*\\^\[^\n\r]*(\n|\r\n|\r)" { target { c++ } } } */

-struct C
+inline struct C
 f3 (int i)
 {
   struct C x;


With this patch,

make check-gcc-c++ RUNTESTFLAGS="ubsan.exp=object-size-9.c
--target_board='unix{-fpic,-mcmodel=medium,-fpic\
-mcmodel=medium,-mcmodel=large,-fpic\ -mcmodel=large}'"

passes, but

make check-gcc-c++ RUNTESTFLAGS="ubsan.exp=object-size-9.c
--target_board='unix{-fno-inline}'"

still fails of course.

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[bernd.edlinger at hotmail dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #12 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
The same could happen also with object-size-10.c:

https://gcc.gnu.org/ml/gcc-testresults/2015-04/msg01293.html

FAIL: c-c++-common/ubsan/object-size-10.c   -O2  execution test
FAIL: c-c++-common/ubsan/object-size-10.c   -O2 -flto -fno-use-linker-plugin
-flto-partition=none  execution test

I can't reproduce that one, but it may possibly also be a
pointer value too close to a page boundary?

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[bernd.edlinger at hotmail dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #13 from Bernd Edlinger <bernd.edlinger at hotmail dot de> ---
Created attachment 35747
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=35747&action=edit
Proposed Fix

that's what I think should fix the sporadic fall-out on both test cases.

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[edlinger at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

--- Comment #14 from Bernd Edlinger <edlinger at gcc dot gnu.org> ---
Author: edlinger
Date: Thu Sep 17 19:43:00 2015
New Revision: 227886

URL: https://gcc.gnu.org/viewcvs?rev=227886&root=gcc&view=rev
Log:
2015-09-17  Bernd Edlinger  <bernd.edlinger@hotmail.de>

        PR sanitizer/64078
        * c-c++-common/ubsan/object-size-9.c (s): Add alignment attribute.
        (f2, f3): Make the function static.
        * c-c++-common/ubsan/object-size-10.c (a, b): Add alignment attribute.

Modified:
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/c-c++-common/ubsan/object-size-10.c
    trunk/gcc/testsuite/c-c++-common/ubsan/object-size-9.c

[Bug sanitizer/64078] FAIL: c-c++-common/ubsan/object-size-9.c

[edlinger at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64078

Bernd Edlinger <edlinger at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #15 from Bernd Edlinger <edlinger at gcc dot gnu.org> ---
fixed on trunk.