public inbox for gcc-cvs@sourceware.org help / color / mirror / Atom feed
From: Richard Biener <rguenth@gcc.gnu.org> To: gcc-cvs@gcc.gnu.org Subject: [gcc r14-300] tree-optimization/109170 - bogus use-after-free with __builtin_expect Date: Thu, 27 Apr 2023 13:00:44 +0000 (GMT) [thread overview] Message-ID: <20230427130044.4036B385840E@sourceware.org> (raw) https://gcc.gnu.org/g:65369ab62cee68eb7f6ef65e3d12d1969a9e20ee commit r14-300-g65369ab62cee68eb7f6ef65e3d12d1969a9e20ee Author: Richard Biener <rguenther@suse.de> Date: Fri Mar 17 13:14:49 2023 +0100 tree-optimization/109170 - bogus use-after-free with __builtin_expect The following generalizes the range-op for __builtin_expect by using the fnspec machinery. PR tree-optimization/109170 * gimple-range-op.cc (gimple_range_op_handler::maybe_builtin_call): Handle __builtin_expect and similar via cfn_pass_through_arg1 and inspecting the calls fnspec. * builtins.cc (builtin_fnspec): Handle BUILT_IN_EXPECT and BUILT_IN_EXPECT_WITH_PROBABILITY. Diff: --- gcc/builtins.cc | 2 ++ gcc/gimple-range-op.cc | 19 +++++++++++-------- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/gcc/builtins.cc b/gcc/builtins.cc index 878596c240a..bd07873a80e 100644 --- a/gcc/builtins.cc +++ b/gcc/builtins.cc @@ -11718,6 +11718,8 @@ builtin_fnspec (tree callee) case BUILT_IN_RETURN_ADDRESS: return ".c"; case BUILT_IN_ASSUME_ALIGNED: + case BUILT_IN_EXPECT: + case BUILT_IN_EXPECT_WITH_PROBABILITY: return "1cX "; /* But posix_memalign stores a pointer into the memory pointed to by its first argument. */ diff --git a/gcc/gimple-range-op.cc b/gcc/gimple-range-op.cc index f7409e35a99..04e27d6aa05 100644 --- a/gcc/gimple-range-op.cc +++ b/gcc/gimple-range-op.cc @@ -43,6 +43,7 @@ along with GCC; see the file COPYING3. If not see #include "range.h" #include "value-query.h" #include "gimple-range.h" +#include "attr-fnspec.h" // Given stmt S, fill VEC, up to VEC_SIZE elements, with relevant ssa-names // on the statement. For efficiency, it is an error to not pass in enough @@ -984,14 +985,16 @@ gimple_range_op_handler::maybe_builtin_call () m_int = &op_cfn_parity; break; - case CFN_BUILT_IN_EXPECT: - case CFN_BUILT_IN_EXPECT_WITH_PROBABILITY: - m_valid = true; - m_op1 = gimple_call_arg (call, 0); - m_int = &op_cfn_pass_through_arg1; - break; - default: - break; + { + unsigned arg; + if (gimple_call_fnspec (call).returns_arg (&arg) && arg == 0) + { + m_valid = true; + m_op1 = gimple_call_arg (call, 0); + m_int = &op_cfn_pass_through_arg1; + } + break; + } } }
reply other threads:[~2023-04-27 13:00 UTC|newest] Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20230427130044.4036B385840E@sourceware.org \ --to=rguenth@gcc.gnu.org \ --cc=gcc-cvs@gcc.gnu.org \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).