From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (qmail 8864 invoked by alias); 30 Sep 2014 09:01:21 -0000 Mailing-List: contact gcc-patches-help@gcc.gnu.org; run by ezmlm Precedence: bulk List-Id: List-Archive: List-Post: List-Help: Sender: gcc-patches-owner@gcc.gnu.org Received: (qmail 8844 invoked by uid 89); 30 Sep 2014 09:01:19 -0000 Authentication-Results: sourceware.org; auth=none X-Virus-Found: No X-Spam-SWARE-Status: No, score=-1.0 required=5.0 tests=AWL,BAYES_00,FREEMAIL_FROM,RCVD_IN_DNSWL_NONE,SPF_PASS autolearn=ham version=3.3.2 X-HELO: DUB004-OMC3S25.hotmail.com Received: from dub004-omc3s25.hotmail.com (HELO DUB004-OMC3S25.hotmail.com) (157.55.2.34) by sourceware.org (qpsmtpd/0.93/v0.84-503-g423c35a) with (AES256-SHA256 encrypted) ESMTPS; Tue, 30 Sep 2014 09:01:17 +0000 Received: from DUB118-W45 ([157.55.2.9]) by DUB004-OMC3S25.hotmail.com with Microsoft SMTPSVC(7.5.7601.22724); Tue, 30 Sep 2014 02:01:14 -0700 X-TMN: [OIC0Mf8mI6CaacHtsg1jnmiRSykYgI77] Message-ID: From: Bernd Edlinger To: Jeff Law , "gcc-patches@gcc.gnu.org" Subject: RE: [PATCH] Fix PR preprocessor/58893 access to uninitialized memory Date: Tue, 30 Sep 2014 09:01:00 -0000 In-Reply-To: <542A345A.2070003@redhat.com> References: ,,<5425B50C.6060008@redhat.com>, ,<542A345A.2070003@redhat.com> Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 X-SW-Source: 2014-09/txt/msg02617.txt.bz2 Hi Jeff, On Mon, 29 Sep 2014 22:40:58, Jeff Law wrote: > > On 09/27/14 03:53, Bernd Edlinger wrote: >>>> Comment before this change. Someone not familiar with this code is >>>> going to have no idea why these two lines exist. >>>> >>> >>> Ok, I added a comment now, do you like it? > Yes. > > >>> >>>> Please try to include a testcase. If you're having trouble reproducing >>>> on the trunk, you could use MALLOC_PERTURB per c#8 in the bug report. >>>> If there's a way to set environment variables in our testing framework >>>> that may be a reasonable way to test (if you need to do that, limit >>>> testing to linux targets as we'll have a dependency on glibc features). >>>> >>> >>> For whatever reason, the first -include must end with a pragma >>> as in the PR, and MALLOC_PERTURB_ must be set to something. >>> Then we get an ICE, otherwise we get an error message without line numb= er. >>> I tried to make this a valid test case, but that might be less trivial = than >>> it looks at first sight. > >>> >>> I tried to set MALLOC_PERTURB_=3D123 globally, like this: >>> >>> MALLOC_PERTURB_=3D123 make -k check >>> >>> but then this happened: > Sigh. Yea, I guess if we're hitting the allocator insanely hard, > scrubbing memory might turn out to slow things down in a significant > way. Or it may simply be the case that we're using free'd memory in > some way and with the MALLOC_PERTURB changes we're in an infinite loop > in the dumping code or something similar. > Yeah, that is an interesting thing. I debugged that, and it turns out, that this is just incredibly slow. It seems to be in the macro expansion of this construct: #define t16(x) x x x x x x x x x x x x x x x x #define M (sizeof (t16(t16(t16(t16(t16(" ")))))) - 1) libcpp is calling realloc 1.000.000 times for this, resizing the memory by just one byte at a time. And the worst case of realloc is O(n), so in the worst case realloc would have to copy 1/2 * 1.000.000^2 bytes =3D 500 GB of memory. With this little change in libcpp, the test suite passed, without any further regressions: --- libcpp/charset.c.jj=A0=A0=A0 2014-08-19 07:34:31.000000000 +0200 +++ libcpp/charset.c=A0=A0=A0 2014-09-30 10:45:26.676954120 +0200 @@ -537,6 +537,7 @@ convert_no_conversion (iconv_t cd ATTRIB =A0=A0 if (to->len + flen> to->asize) =A0=A0=A0=A0 { =A0=A0=A0=A0=A0=A0 to->asize =3D to->len + flen; +=A0=A0=A0=A0=A0 to->asize *=3D 2; =A0=A0=A0=A0=A0=A0 to->text =3D XRESIZEVEC (uchar, to->text, to->asize); =A0=A0=A0=A0 } =A0=A0 memcpy (to->text + to->len, from, flen); I will prepare a patch for that later. Interestingly, if I define MALLOC_CHECK_=3D3 _and_ MALLOC_PERTURB_ this test passes, even without the above change, but the test case=20 gfortran.dg/realloc_on_assign_5.f03 fails in this configuration, which is a known bug: PR 47674. However it passes when only MALLOC_PERTURB_ is defined. Weird... > >>> >>> >>> Well, I added a test case, but it does not reliably fail without the >>> patch, because setting >>> MALLOC_PERTURB_ causes too much trouble at this time. >>> >>> I would propose to set MALLOC_PERTURB_ globally at a later time. > Sorry, just to be clear, I wasn't suggesting to set it globally, but > just for the duration of this test as a potentially easier way to > trigger the failure. > > However, it may make sense to do that at some point. I also think that > Jakub bootstraps and runs the regression suite with valgrind late in the > release cycle, which would catch this problem if it raises its head again. > >>> >>> Boot-Strapped & Regression-Tested on x86_64-linux-gnu. >>> Ok for trunk? > Yes, this is OK for the trunk. > Thanks! Bernd. > jeff > =20=09=09=20=09=20=20=20=09=09=20=20