[Bug testsuite/64427] New: gcc.target/i386/pr64291-1.c is invalid

[Bug testsuite/64427] New: gcc.target/i386/pr64291-1.c is invalid

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64427

            Bug ID: 64427
           Summary: gcc.target/i386/pr64291-1.c is invalid
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: testsuite
          Assignee: unassigned at gcc dot gnu.org
          Reporter: hjl.tools at gmail dot com

gcc.target/i386/pr64291-1.c has

void f(void*,...);
void g(void*,long,long);
int nnn=0;
long test=0;

typedef struct
{
  int _mp_size;
  unsigned long *_mp_d;
} __mpz_struct;
typedef __mpz_struct mpz_t[1];

int main ()
{
  mpz_t n, d;
  long nn, dn;
  unsigned long *np, *dup, *dnp, *qp;
  long alloc, itch;

  f (n);
  f (d);
  qp = (unsigned long*)__builtin_alloca(4099*8) + 1;
  dnp = (unsigned long*)__builtin_alloca (2049*8);
  alloc = 1;
  for (test = 0; test < 1; test++)
    {
      dn = d->_mp_size;
      dup = d->_mp_d;
      f (dnp, dup, dn);
      dnp[dn - 1] |= 1UL<<63;
      f (0);
      nn = nnn;
      np = n->_mp_d;
      qp[-1] = -757136820;
      qp[nn - dn + 1] = 14883681;
      f (0);
      if (dn >= 6)
    f (0);
      itch = nn + 1;
      if (itch + 1> alloc)
    {
      g(0,alloc*8,(itch+1)*8);
      alloc = itch + 1;
    }
      f (np, nn);
    }
  return 0;
}

and pr64291-2.c has

extern void abort (void);
void f(void*p,...){}
void g(void*p,long a,long b){if (a!=8) abort();}

Since stack variables, n and d, aren't initialized, this testcase is
invalid.

[Bug testsuite/64427] gcc.target/i386/pr64291-1.c is invalid

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64427

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-12-28
   Target Milestone|---                         |5.0
     Ever confirmed|0                           |1

--- Comment #1 from H.J. Lu <hjl.tools at gmail dot com> ---
Also, for 32-bit targets, like -m32 and -mx32, GCC complains:

/export/gnu/import/git/gcc/gcc/testsuite/gcc.target/i386/pr64291-1.c:33:25:
warning: left shift count >= width of type [-Wshift-count-overflow]

[Bug testsuite/64427] gcc.target/i386/pr64291-1.c is invalid

[glisse at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64427

--- Comment #2 from Marc Glisse <glisse at gcc dot gnu.org> ---
Restricting the testcase to x86_64 would be fine with me.

As far as main is concerned, f could have written in n and d. The uninitialized
values are only passed around, it doesn't seem relevant.

[Bug testsuite/64427] gcc.target/i386/pr64291-1.c is invalid

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64427

--- Comment #3 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Marc Glisse from comment #2)
> Restricting the testcase to x86_64 would be fine with me.
> 
> As far as main is concerned, f could have written in n and d. The
> uninitialized values are only passed around, it doesn't seem relevant.

There are

  mpz_t n, d;
  long nn, dn;
  unsigned long *np, *dup, *dnp, *qp;
  long alloc, itch;

  f (n);
  f (d);
  qp = (unsigned long*)__builtin_alloca(4099*8) + 1;
  dnp = (unsigned long*)__builtin_alloca (2049*8);
  alloc = 1;
  for (test = 0; test < 1; test++)
    {
      dn = d->_mp_size;
      ^^^^^^^^^^^^^^^^^^
      dup = d->_mp_d;
      f (dnp, dup, dn);
      dnp[dn - 1] |= 1UL<<63;
          ^^^^^^^^^^
"dn" here contains some random value, which may be > size of dnp and
program may crash which happens with -m32 for me.

[Bug testsuite/64427] gcc.target/i386/pr64291-1.c is invalid

[glisse at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64427

--- Comment #4 from Marc Glisse <glisse at gcc dot gnu.org> ---
Created attachment 34342
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34342&action=edit
Fixed testcase

Ah, sorry, I had missed dn indeed. The attached tgz runs ok under valgrind, and
fails the assertion with a compiler from before the patch.

[Bug testsuite/64427] gcc.target/i386/pr64291-1.c is invalid

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64427

--- Comment #5 from H.J. Lu <hjl.tools at gmail dot com> ---
(In reply to Marc Glisse from comment #4)
> Created attachment 34342 [details]
> Fixed testcase
> 
> Ah, sorry, I had missed dn indeed. The attached tgz runs ok under valgrind,
> and fails the assertion with a compiler from before the patch.

Since this is your test, can you fix it
directly with -m32 compilation? Thanks.

[Bug testsuite/64427] gcc.target/i386/pr64291-1.c is invalid

[hjl at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64427

--- Comment #6 from hjl at gcc dot gnu.org <hjl at gcc dot gnu.org> ---
Author: hjl
Date: Mon Jan 12 17:08:04 2015
New Revision: 219479

URL: https://gcc.gnu.org/viewcvs?rev=219479&root=gcc&view=rev
Log:
Avoid undefined behavior in gcc.target/i386/pr64291-1.c

    PR testsuite/64427
    * gcc.target/i386/pr64291-1.c: Limit to lp64 tarrget.  Avoid
    undefined behavior.
    * gcc.target/i386/pr64291-2.c: Updated.

Modified:
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/gcc.target/i386/pr64291-1.c
    trunk/gcc/testsuite/gcc.target/i386/pr64291-2.c

[Bug testsuite/64427] gcc.target/i386/pr64291-1.c is invalid

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64427

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from H.J. Lu <hjl.tools at gmail dot com> ---
Fixed.

[Bug testsuite/64427] gcc.target/i386/pr64291-1.c is invalid

[glisse at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64427

--- Comment #8 from Marc Glisse <glisse at gcc dot gnu.org> ---
(In reply to H.J. Lu from comment #7)
> Fixed.

Thanks HJ! Sorry for not doing it myself sooner...