Re: [PATCH] avoid calling memset et al. with excessively large sizes (PR 79095)

[Jeff Law <law@redhat.com>]

On 01/20/2017 04:34 PM, Jakub Jelinek wrote:
> On Fri, Jan 20, 2017 at 04:32:19PM -0700, Jeff Law wrote:
>>> then the loop does the same thing as will memset (p, 6, 3U * 1024 * 1024 * 1024);
>>> do.  On such large objects some operations may not work properly, e.g.
>>> &p[i] - &p[0] might be negative etc., but that is not something the above
>>> loop does or memset will do internally.  If the loop doesn't use just 3/4 of
>>> the address space, but much more, e.g. more than whole address space minus
>>> one page, which is what happens in the testcase, it is indeed quite sure it
>>> will crash if invoked, but the problem with the warning is the same with
>>> many other late warnings or warnings excessively using VRP etc.
>> Not in my mind, it's different.  It's not triggered by path isolation. It's
>> standard const propagation + simplification.
>
> So where does the constant -1 length appear there?  The test clearly just
> attempts to clear some variable length - 1.  I admit I haven't looked at the
> dumps in detail, I should...
At least in Martin's simplified test it's just a series of standard 
constant propagations and obvious simplifications.  No threading, no 
path isolation.

;;   basic block 2, loop depth 0, count 0, freq 10000, maybe hot
;;    prev block 0, next block 3, flags: (NEW, REACHABLE, VISITED)
;;    pred:       ENTRY [100.0%]  (FALLTHRU,EXECUTABLE)
   _7 = MEM[(int * *)s_5(D)];
   _8 = MEM[(int * *)s_5(D) + 8B];
   _9 = (long int) _8;
   _10 = (long int) _7;
   _11 = _9 - _10;
   _12 = _11 /[ex] 4;
   _13 = (long unsigned int) _12;
   _1 = _13 + 18446744073709551614;
   if (_1 <= 2)
     goto <bb 3>; [36.64%]
   else
     goto <bb 8>; [63.36%]
;;    succ:       3 [36.6%]  (TRUE_VALUE,EXECUTABLE)
;;                8 [63.4%]  (FALSE_VALUE,EXECUTABLE)

;;   basic block 3, loop depth 0, count 0, freq 3664, maybe hot
;;    prev block 2, next block 4, flags: (NEW, REACHABLE, VISITED)
;;    pred:       2 [36.6%]  (TRUE_VALUE,EXECUTABLE)
   _2 = _13 + 18446744073709551615;
   _14 = MEM[(int * *)s_5(D)];
   _15 = MEM[(int * *)s_5(D) + 8B];
   _16 = (long int) _15;
   _17 = (long int) _14;
   _18 = _16 - _17;
   _19 = _18 /[ex] 4;
   _20 = (long unsigned int) _19;
   if (_2 > _20)
     goto <bb 4>; [50.00%]
   else
     goto <bb 6>; [50.00%]
;;    succ:       4 [50.0%]  (TRUE_VALUE,EXECUTABLE)
;;                6 [50.0%]  (FALSE_VALUE,EXECUTABLE)

;;   basic block 4, loop depth 0, count 0, freq 1832, maybe hot
;;    prev block 3, next block 5, flags: (NEW, REACHABLE, VISITED)
;;    pred:       3 [50.0%]  (TRUE_VALUE,EXECUTABLE)
   _21 = _2 - _20;
   _22 = MEM[(int * *)s_5(D) + 16B];
   _23 = (long int) _22;
   _24 = _23 - _16;
   _25 = _24 /[ex] 4;
   left_26 = (size_t) _25;
   if (_21 <= left_26)
     goto <bb 5>; [33.00%]
   else
     goto <bb 8>; [67.00%]
;;    succ:       5 [33.0%]  (TRUE_VALUE,EXECUTABLE)
;;                8 [67.0%]  (FALSE_VALUE,EXECUTABLE)

;;   basic block 5, loop depth 0, count 0, freq 605, maybe hot
;;    prev block 4, next block 6, flags: (NEW, REACHABLE, VISITED)
;;    pred:       4 [33.0%]  (TRUE_VALUE,EXECUTABLE)
   _27 = _21 * 4;
   __builtin_memset (_22, 0, _27);
   goto <bb 8>; [100.00%]
;;    succ:       8 [100.0%]  (FALLTHRU,EXECUTABLE)


In particular look at _27, which is _21 * 4.

_21 is _2 - _20

If you follow things though the use-def chains and simplify you'll see 
that _2 - 20 is always -1.


Jeff