From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 2153) id 9D3EF389366C; Mon, 29 Nov 2021 08:50:29 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 9D3EF389366C MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Type: text/plain; charset="utf-8" From: Jakub Jelinek To: gcc-cvs@gcc.gnu.org Subject: [gcc r11-9339] bswap: Fix UB in find_bswap_or_nop_finalize [PR103435] X-Act-Checkin: gcc X-Git-Author: Jakub Jelinek X-Git-Refname: refs/heads/releases/gcc-11 X-Git-Oldrev: 333b0dc1792f48e822ebaaea6e104539918f47f2 X-Git-Newrev: 3479e49be805b077b215a1547aad20409e69af35 Message-Id: <20211129085029.9D3EF389366C@sourceware.org> Date: Mon, 29 Nov 2021 08:50:29 +0000 (GMT) X-BeenThere: gcc-cvs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-cvs mailing list List-Unsubscribe: , List-Archive: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 29 Nov 2021 08:50:29 -0000 https://gcc.gnu.org/g:3479e49be805b077b215a1547aad20409e69af35 commit r11-9339-g3479e49be805b077b215a1547aad20409e69af35 Author: Jakub Jelinek Date: Sat Nov 27 13:00:55 2021 +0100 bswap: Fix UB in find_bswap_or_nop_finalize [PR103435] On gcc.c-torture/execute/pr103376.c in the following code we trigger UB in the compiler. n->range is 8 because it is 64-bit load and rsize is 0 because it is a bswap sequence with load and known to be 0: /* Find real size of result (highest non-zero byte). */ if (n->base_addr) for (tmpn = n->n, rsize = 0; tmpn; tmpn >>= BITS_PER_MARKER, rsize++); else rsize = n->range; The shifts then shift uint64_t by 64 bits. For this case mask is 0 and we want both *cmpxchg and *cmpnop as 0, the operation can be done as both nop and bswap and callers will prefer nop. 2021-11-27 Jakub Jelinek PR tree-optimization/103435 * gimple-ssa-store-merging.c (find_bswap_or_nop_finalize): Avoid UB if n->range - rsize == 8, just clear both *cmpnop and *cmpxchg in that case. (cherry picked from commit 567d5f3d62fba2a23a9e975f7e7c7b61bb67cf24) Diff: --- gcc/gimple-ssa-store-merging.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/gcc/gimple-ssa-store-merging.c b/gcc/gimple-ssa-store-merging.c index 7eb50d65a20..0bd5cab3c54 100644 --- a/gcc/gimple-ssa-store-merging.c +++ b/gcc/gimple-ssa-store-merging.c @@ -826,12 +826,18 @@ find_bswap_or_nop_finalize (struct symbolic_number *n, uint64_t *cmpxchg, { mask = ((uint64_t) 1 << (rsize * BITS_PER_MARKER)) - 1; *cmpxchg &= mask; - *cmpnop >>= (n->range - rsize) * BITS_PER_MARKER; + if (n->range - rsize == sizeof (int64_t)) + *cmpnop = 0; + else + *cmpnop >>= (n->range - rsize) * BITS_PER_MARKER; } else { mask = ((uint64_t) 1 << (rsize * BITS_PER_MARKER)) - 1; - *cmpxchg >>= (n->range - rsize) * BITS_PER_MARKER; + if (n->range - rsize == sizeof (int64_t)) + *cmpxchg = 0; + else + *cmpxchg >>= (n->range - rsize) * BITS_PER_MARKER; *cmpnop &= mask; } n->range = rsize;