[ubsan PATCH] Fix compile-time hog with &TARGET_EXPRs (PR sanitizer/70342)

[ubsan PATCH] Fix compile-time hog with &TARGET_EXPRs (PR sanitizer/70342)

[Marek Polacek]

This test took forever to compile with -fsanitize=null, because the
instrumentation was creating incredible amount of duplicated expressions, in a
quadratic fashion.  I think the problem is that we instrument &TARGET_EXPR <>
expressions, which doesn't seem to be needed -- we only need to instrument the
initializers in TARGET_EXPRs.  With this patch, we avoid creating tons of useless
expressions and the compile time is reduced from ~ infinity to <1s.

Jakub, do you see any problem with this?

Bootstrapped/regtested on x86_64-linux, ok for trunk?

2016-04-27  Marek Polacek  <polacek@redhat.com>

	PR sanitizer/70342
	* c-ubsan.c (ubsan_maybe_instrument_reference_or_call): Don't
	null-instrument &TARGET_EXPR <...>.

	* g++.dg/ubsan/null-7.C: New test.

diff --git gcc/c-family/c-ubsan.c gcc/c-family/c-ubsan.c
index 4022bdf..b829c04 100644
--- gcc/c-family/c-ubsan.c
+++ gcc/c-family/c-ubsan.c
@@ -395,8 +395,11 @@ ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree ptype,
 	  int save_flag_delete_null_pointer_checks
 	    = flag_delete_null_pointer_checks;
 	  flag_delete_null_pointer_checks = 1;
-	  if (!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
-	      || strict_overflow_p)
+	  if ((!tree_single_nonzero_warnv_p (op, &strict_overflow_p)
+	       || strict_overflow_p)
+	      /* Instrumenting &TARGET_EXPR <...> is a waste and can result
+		 in compile-time hog; see PR70342.  */
+	      && TREE_CODE (TREE_OPERAND (op, 0)) != TARGET_EXPR)
 	    instrument = true;
 	  flag_delete_null_pointer_checks
 	    = save_flag_delete_null_pointer_checks;
diff --git gcc/testsuite/g++.dg/ubsan/null-7.C gcc/testsuite/g++.dg/ubsan/null-7.C
index e69de29..8284bc7 100644
--- gcc/testsuite/g++.dg/ubsan/null-7.C
+++ gcc/testsuite/g++.dg/ubsan/null-7.C
@@ -0,0 +1,24 @@
+// PR sanitizer/70342
+// { dg-do compile }
+// { dg-options "-fsanitize=null" }
+
+class A {};
+class B {
+public:
+  B(A);
+};
+class C {
+public:
+  C operator<<(B);
+};
+class D {
+  D(const int &);
+  C m_blackList;
+};
+D::D(const int &) {
+  m_blackList << A() << A() << A() << A() << A() << A() << A() << A() << A()
+              << A() << A() << A() << A() << A() << A() << A() << A() << A()
+              << A() << A() << A() << A() << A() << A() << A() << A() << A()
+              << A() << A() << A() << A() << A() << A() << A() << A() << A()
+              << A() << A() << A() << A() << A() << A() << A() << A() << A();
+}

	Marek

Re: [ubsan PATCH] Fix compile-time hog with &TARGET_EXPRs (PR sanitizer/70342)

[Jakub Jelinek]

On Wed, Apr 27, 2016 at 07:03:25PM +0200, Marek Polacek wrote:
> This test took forever to compile with -fsanitize=null, because the
> instrumentation was creating incredible amount of duplicated expressions, in a
> quadratic fashion.  I think the problem is that we instrument &TARGET_EXPR <>
> expressions, which doesn't seem to be needed -- we only need to instrument the
> initializers in TARGET_EXPRs.  With this patch, we avoid creating tons of useless
> expressions and the compile time is reduced from ~ infinity to <1s.
> 
> Jakub, do you see any problem with this?
> 
> Bootstrapped/regtested on x86_64-linux, ok for trunk?
> 
> 2016-04-27  Marek Polacek  <polacek@redhat.com>
> 
> 	PR sanitizer/70342
> 	* c-ubsan.c (ubsan_maybe_instrument_reference_or_call): Don't
> 	null-instrument &TARGET_EXPR <...>.
> 
> 	* g++.dg/ubsan/null-7.C: New test.

I wonder if this wouldn't be better handled in tree_single_nonzero_warnv_p,
perhaps like:

     case ADDR_EXPR:
       {
 	tree base = TREE_OPERAND (t, 0);
 
 	if (!DECL_P (base))
 	  base = get_base_address (base);
+
+	if (base && TREE_CODE (base) == TARGET_EXPR)
+	  base = TARGET_EXPR_SLOT (base);
 	
 	if (!base)
 	  return false;

(untested)?

	Jakub

Re: [ubsan PATCH] Fix compile-time hog with &TARGET_EXPRs (PR sanitizer/70342)

[Marek Polacek]

On Thu, Apr 28, 2016 at 11:07:30AM +0200, Jakub Jelinek wrote:
> On Wed, Apr 27, 2016 at 07:03:25PM +0200, Marek Polacek wrote:
> > This test took forever to compile with -fsanitize=null, because the
> > instrumentation was creating incredible amount of duplicated expressions, in a
> > quadratic fashion.  I think the problem is that we instrument &TARGET_EXPR <>
> > expressions, which doesn't seem to be needed -- we only need to instrument the
> > initializers in TARGET_EXPRs.  With this patch, we avoid creating tons of useless
> > expressions and the compile time is reduced from ~ infinity to <1s.
> > 
> > Jakub, do you see any problem with this?
> > 
> > Bootstrapped/regtested on x86_64-linux, ok for trunk?
> > 
> > 2016-04-27  Marek Polacek  <polacek@redhat.com>
> > 
> > 	PR sanitizer/70342
> > 	* c-ubsan.c (ubsan_maybe_instrument_reference_or_call): Don't
> > 	null-instrument &TARGET_EXPR <...>.
> > 
> > 	* g++.dg/ubsan/null-7.C: New test.
> 
> I wonder if this wouldn't be better handled in tree_single_nonzero_warnv_p,
> perhaps like:
> 
>      case ADDR_EXPR:
>        {
>  	tree base = TREE_OPERAND (t, 0);
>  
>  	if (!DECL_P (base))
>  	  base = get_base_address (base);
> +
> +	if (base && TREE_CODE (base) == TARGET_EXPR)
> +	  base = TARGET_EXPR_SLOT (base);
>  	
>  	if (!base)
>  	  return false;
> 
> (untested)?

That works too, though it of course affects all users, not just ubsan.  Here's
the patch with your suggested change.

Bootstrapped/regtested on x86_64-linux, ok for trunk?

2016-04-28  Marek Polacek  <polacek@redhat.com>
	    Jakub Jelinek  <jakub@redhat.com>

	PR sanitizer/70342
	* fold-const.c (tree_single_nonzero_warnv_p): For TARGET_EXPR, use
	TARGET_EXPR_SLOT as a base.

	* g++.dg/ubsan/null-7.C: New test.

diff --git gcc/fold-const.c gcc/fold-const.c
index 96d8484..171ac83 100644
--- gcc/fold-const.c
+++ gcc/fold-const.c
@@ -13531,6 +13531,9 @@ tree_single_nonzero_warnv_p (tree t, bool *strict_overflow_p)
 	if (!DECL_P (base))
 	  base = get_base_address (base);
 
+	if (base && TREE_CODE (base) == TARGET_EXPR)
+	  base = TARGET_EXPR_SLOT (base);
+
 	if (!base)
 	  return false;
 
diff --git gcc/testsuite/g++.dg/ubsan/null-7.C gcc/testsuite/g++.dg/ubsan/null-7.C
index e69de29..8284bc7 100644
--- gcc/testsuite/g++.dg/ubsan/null-7.C
+++ gcc/testsuite/g++.dg/ubsan/null-7.C
@@ -0,0 +1,24 @@
+// PR sanitizer/70342
+// { dg-do compile }
+// { dg-options "-fsanitize=null" }
+
+class A {};
+class B {
+public:
+  B(A);
+};
+class C {
+public:
+  C operator<<(B);
+};
+class D {
+  D(const int &);
+  C m_blackList;
+};
+D::D(const int &) {
+  m_blackList << A() << A() << A() << A() << A() << A() << A() << A() << A()
+              << A() << A() << A() << A() << A() << A() << A() << A() << A()
+              << A() << A() << A() << A() << A() << A() << A() << A() << A()
+              << A() << A() << A() << A() << A() << A() << A() << A() << A()
+              << A() << A() << A() << A() << A() << A() << A() << A() << A();
+}

	Marek

Re: [ubsan PATCH] Fix compile-time hog with &TARGET_EXPRs (PR sanitizer/70342)

[Jakub Jelinek]

On Thu, Apr 28, 2016 at 04:10:01PM +0200, Marek Polacek wrote:
> That works too, though it of course affects all users, not just ubsan.  Here's

Of course, but I think that is a good thing ;)

> the patch with your suggested change.
> 
> Bootstrapped/regtested on x86_64-linux, ok for trunk?
> 
> 2016-04-28  Marek Polacek  <polacek@redhat.com>
> 	    Jakub Jelinek  <jakub@redhat.com>
> 
> 	PR sanitizer/70342
> 	* fold-const.c (tree_single_nonzero_warnv_p): For TARGET_EXPR, use
> 	TARGET_EXPR_SLOT as a base.
> 
> 	* g++.dg/ubsan/null-7.C: New test.

Ok for trunk.
For 6.2 dunno, either the same patch after a while, or perhaps your original
patch is safer (though, wonder if e.g. one can construct a testcase where it
will use instrument &(TARGET_EXPR <...>.field) nested many times and still
trigger the compile time hog with your patch).

	Jakub

Re: [ubsan PATCH] Fix compile-time hog with &TARGET_EXPRs (PR sanitizer/70342)

[Marek Polacek]

On Thu, Apr 28, 2016 at 04:15:41PM +0200, Jakub Jelinek wrote:
> On Thu, Apr 28, 2016 at 04:10:01PM +0200, Marek Polacek wrote:
> > That works too, though it of course affects all users, not just ubsan.  Here's
> 
> Of course, but I think that is a good thing ;)
> 
> > the patch with your suggested change.
> > 
> > Bootstrapped/regtested on x86_64-linux, ok for trunk?
> > 
> > 2016-04-28  Marek Polacek  <polacek@redhat.com>
> > 	    Jakub Jelinek  <jakub@redhat.com>
> > 
> > 	PR sanitizer/70342
> > 	* fold-const.c (tree_single_nonzero_warnv_p): For TARGET_EXPR, use
> > 	TARGET_EXPR_SLOT as a base.
> > 
> > 	* g++.dg/ubsan/null-7.C: New test.
> 
> Ok for trunk.

Thanks, committed.

> For 6.2 dunno, either the same patch after a while, or perhaps your original
> patch is safer (though, wonder if e.g. one can construct a testcase where it
> will use instrument &(TARGET_EXPR <...>.field) nested many times and still
> trigger the compile time hog with your patch).

Dunno either.  I think I'll backport the same patch after a week or so.

	Marek