From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <gcc-bugs-return-493026-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Received: (qmail 51942 invoked by alias); 22 Jul 2015 14:36:26 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Received: (qmail 51828 invoked by uid 48); 22 Jul 2015 14:36:19 -0000
From: "mpolacek at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug sanitizer/66908] Uninitialized variable when compiled with UBsan
Date: Wed, 22 Jul 2015 14:36:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: sanitizer
X-Bugzilla-Version: unknown
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: mpolacek at gcc dot gnu.org
X-Bugzilla-Status: ASSIGNED
X-Bugzilla-Resolution:
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: mpolacek at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-66908-4-k0dV2rb4Hz@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-66908-4@http.gcc.gnu.org/bugzilla/>
References: <bug-66908-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2015-07/txt/msg01916.txt.bz2

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=66908

--- Comment #9 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Oh silly me!  This should work; Maxim, could you possibly try this patch?

--- gcc/c-family/c-ubsan.c
+++ gcc/c-family/c-ubsan.c
@@ -38,6 +38,7 @@ along with GCC; see the file COPYING3.  If not see
 #include "internal-fn.h"
 #include "stor-layout.h"
 #include "builtins.h"
+#include "gimplify.h"

 /* Instrument division by zero and INT_MIN / -1.  If not instrumenting,
    return NULL_TREE.  */
@@ -54,6 +55,9 @@ ubsan_instrument_division (location_t loc, tree op0, tree
op1)
   gcc_assert (TYPE_MAIN_VARIANT (TREE_TYPE (op0))
              == TYPE_MAIN_VARIANT (TREE_TYPE (op1)));

+  op0 = unshare_expr (op0);
+  op1 = unshare_expr (op1);
+
   if (TREE_CODE (type) == INTEGER_TYPE
       && (flag_sanitize & SANITIZE_DIVIDE))
     t = fold_build2 (EQ_EXPR, boolean_type_node,
@@ -134,6 +138,9 @@ ubsan_instrument_shift (location_t loc, enum tree_code
code,
   HOST_WIDE_INT op0_prec = TYPE_PRECISION (type0);
   tree uprecm1 = build_int_cst (op1_utype, op0_prec - 1);

+  op0 = unshare_expr (op0);
+  op1 = unshare_expr (op1);
+
   t = fold_convert_loc (loc, op1_utype, op1);
   t = fold_build2 (GT_EXPR, boolean_type_node, t, uprecm1);