public inbox for gcc-patches@gcc.gnu.org
 help / color / mirror / Atom feed
* [asan] Patch - fix an ICE in asan.c
@ 2012-11-09 20:37 Tobias Burnus
  2012-11-09 22:00 ` Tobias Burnus
                   ` (2 more replies)
  0 siblings, 3 replies; 15+ messages in thread
From: Tobias Burnus @ 2012-11-09 20:37 UTC (permalink / raw)
  To: gcc patches, Jakub Jelinek, Wei Mi, Kostya Serebryany, Xinliang David Li

[-- Attachment #1: Type: text/plain, Size: 1766 bytes --]

The attached test case ICEs (segfault) both on the asan branch and on 
the trunk with Dodji's patches:

fail31.ii: In static member function 'static std::size_t 
std::char_traits<char>::length(const char_type*)':
fail31.ii:13:19: internal compiler error: Segmentation fault
      static size_t length (const char_type * __s)
                    ^
0xae02ef crash_signal
         /projects/tob/gcc-git/gcc/gcc/toplev.c:334
0xaf031d gsi_next
         /projects/tob/gcc-git/gcc/gcc/gimple.h:5072
0xaf031d transform_statements
         /projects/tob/gcc-git/gcc/gcc/asan.c:1357
0xaf031d asan_instrument
         /projects/tob/gcc-git/gcc/gcc/asan.c:1556



The problem is in asa.c's transform_statements:

   FOR_EACH_BB (bb)
     {
       if (bb->index >= saved_last_basic_block) continue;
       for (i = gsi_start_bb (bb); !gsi_end_p (i); gsi_next (&i))
         {
           gimple s = gsi_stmt (i);

           if (gimple_assign_single_p (s))
             instrument_assignment (&i);
           else if (is_gimple_call (s))
             maybe_instrument_call (&i);
     }


Here, "gsi_end_p(i)" is the check "i->ptr == NULL" and gsi_next(&i) is 
"i->ptr = i->ptr->gsbase.next;"

Thus, it looks fine at a glance. However, the problem is that the 
gsi_end_p check is done before the loop body while "gsi_next" is called 
after the loop body. That's fine unless "i" is modified in between, 
which happens in

instrument_strlen_call (gimple_stmt_iterator *iter)
...
   gimple_stmt_iterator gsi = *iter;
...
   *iter = gsi;
}

After the call, iter->ptr == NULL.


Is the patch okay for the ASAN branch?*

Tobias

* I still have to do an all-language bootstrap and regtesting, though 
the latter is probably pointless as there is currently not a single 
-fasan test case.

[-- Attachment #2: patch.diff --]
[-- Type: text/x-patch, Size: 315 bytes --]

--- gcc/asan.c.orig	2012-11-09 21:26:26.000000000 +0100
+++ gcc/asan.c	2012-11-09 21:26:00.000000000 +0100
@@ -1362,6 +1362,8 @@ transform_statements (void)
 	    instrument_assignment (&i);
 	  else if (is_gimple_call (s))
 	    maybe_instrument_call (&i);
+	  if (gsi_end_p (i))
+	    break;
         }
     }
 }

[-- Attachment #3: fail31.ii --]
[-- Type: text/plain, Size: 1462 bytes --]

namespace std
{
  template < typename _Alloc > class allocator;
  template < class _CharT > struct char_traits;
    template < typename _CharT, typename _Traits =
    char_traits < _CharT >, typename _Alloc =
    allocator < _CharT > >class basic_string;
  typedef basic_string < char >string;
  typedef long unsigned int size_t;
    template <> struct char_traits <char >
  {
    typedef char char_type;
    static size_t length (const char_type * __s)
    {
      return __builtin_strlen (__s);
    }
  };
  namespace __gnu_cxx
  {
    template < typename _Tp > class new_allocator
    {
    public:
      typedef size_t size_type;
        template < typename _Tp1 > struct rebind
      {
	typedef new_allocator < _Tp1 > other;
      };
    };
  }
template < typename _Tp > class allocator:public __gnu_cxx::new_allocator <
    _Tp >
  {
  };
  template < typename _CharT, typename _Traits, typename _Alloc >
    class basic_string
  {
    typedef typename _Alloc::template rebind <
      _CharT >::other _CharT_alloc_type;
    typedef _Traits traits_type;
    typedef typename _CharT_alloc_type::size_type size_type;
  public:
    basic_string & operator= (const _CharT * __s)
    {
      return this->assign (__s, traits_type::length (__s));
    }
    basic_string & assign (const _CharT * __s, size_type __n);
  };

  class Regex
  {
    std::string sub (std::string * Error);
  };

  std::string Regex::sub (std::string * Error)
  {
    *Error = "";
  }
}

^ permalink raw reply	[flat|nested] 15+ messages in thread
end of thread, other threads:[~2012-11-15 13:08 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2012-11-09 20:37 [asan] Patch - fix an ICE in asan.c Tobias Burnus
2012-11-09 22:00 ` Tobias Burnus
2012-11-10  9:17 ` Jakub Jelinek
2012-11-10 13:17   ` Tobias Burnus
2012-11-10 15:18     ` Tobias Burnus
2012-11-10 18:54       ` Tobias Burnus
2012-11-12  8:42         ` Jakub Jelinek
2012-11-12 11:52 ` Dodji Seketeli
2012-11-12 15:46   ` Tobias Burnus
2012-11-12 16:44     ` Jakub Jelinek
2012-11-12 16:51       ` Dodji Seketeli
2012-11-12 17:13         ` Markus Trippelsdorf
2012-11-12 18:03           ` Jakub Jelinek
2012-11-12 20:28             ` Markus Trippelsdorf
2012-11-15 13:08             ` Dodji Seketeli

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).