Re: [PATCH] Fix -fsanitize=undefined ubsan_encode_value ICE (PR sanitizer/81111)

[Richard Biener <rguenther@suse.de>]

On Mon, 19 Jun 2017, Jakub Jelinek wrote:

> Hi!
> 
> Martin's recent patch that introduced sanitize_flags_p causes us to
> instrument operations even when current_function_decl is NULL.  If it
> is valid constant expression it will be folded away soon, otherwise
> usually we emit a runtime initializer in the static ctors function for
> it.  In any case, neither gimple_add_tmp_var that create_tmp_var calls
> normark_addressable actually work in that case, fixed thusly,
> bootstrapped/regtested on x86_64-linux and i686-linux plus
> bootstrapped/regtested with bootstrap-ubsan, ok for trunk?

Ok.

Richard.

> 2017-06-19  Jakub Jelinek  <jakub@redhat.com>
> 
> 	PR sanitizer/81111
> 	* ubsan.c (ubsan_encode_value): If current_function_decl is NULL,
> 	use create_tmp_var_raw instead of create_tmp_var, mark it addressable
> 	just by setting TREE_ADDRESSABLE on the result and use a TARGET_EXPR.
> 
> 	* g++.dg/ubsan/pr81111.C: New test.
> 
> --- gcc/ubsan.c.jj	2017-06-16 13:27:48.000000000 +0200
> +++ gcc/ubsan.c	2017-06-16 16:28:29.099155949 +0200
> @@ -145,9 +145,17 @@ ubsan_encode_value (tree t, bool in_expa
>  	{
>  	  /* The reason for this is that we don't want to pessimize
>  	     code by making vars unnecessarily addressable.  */
> -	  tree var = create_tmp_var (type);
> -	  tree tem = build2 (MODIFY_EXPR, void_type_node, var, t);
> -	  mark_addressable (var);
> +	  tree var;
> +	  if (current_function_decl)
> +	    {
> +	      var = create_tmp_var (type);
> +	      mark_addressable (var);
> +	    }
> +	  else
> +	    {
> +	      var = create_tmp_var_raw (type);
> +	      TREE_ADDRESSABLE (var) = 1;
> +	    }
>  	  if (in_expand_p)
>  	    {
>  	      rtx mem
> @@ -158,8 +166,17 @@ ubsan_encode_value (tree t, bool in_expa
>  	      expand_assignment (var, t, false);
>  	      return build_fold_addr_expr (var);
>  	    }
> -	  t = build_fold_addr_expr (var);
> -	  return build2 (COMPOUND_EXPR, TREE_TYPE (t), tem, t);
> +	  if (current_function_decl)
> +	    {
> +	      tree tem = build2 (MODIFY_EXPR, void_type_node, var, t);
> +	      t = build_fold_addr_expr (var);
> +	      return build2 (COMPOUND_EXPR, TREE_TYPE (t), tem, t);
> +	    }
> +	  else
> +	    {
> +	      var = build4 (TARGET_EXPR, type, var, t, NULL_TREE, NULL_TREE);
> +	      return build_fold_addr_expr (var);
> +	    }
>  	}
>        else
>  	return build_fold_addr_expr (t);
> --- gcc/testsuite/g++.dg/ubsan/pr81111.C.jj	2017-06-16 15:39:57.752886010 +0200
> +++ gcc/testsuite/g++.dg/ubsan/pr81111.C	2017-06-16 15:39:37.000000000 +0200
> @@ -0,0 +1,45 @@
> +// PR sanitizer/81111
> +// { dg-do compile }
> +// { dg-options "-fsanitize=shift" }
> +
> +template <typename V>
> +struct N
> +{
> +  static const V m = (((V)(-1) < 0)
> +		      ? (V)1 << (sizeof(V) * __CHAR_BIT__ - ((V)(-1) < 0))
> +		      : (V) 0);
> +};
> +
> +template<typename V>
> +const V N<V>::m;
> +
> +template <typename V>
> +struct O
> +{
> +  static const V m = (V)1 << sizeof(V) * __CHAR_BIT__;
> +};
> +
> +template<typename V>
> +const V O<V>::m;
> +
> +void
> +foo ()
> +{
> +  N<long long>::m;
> +  N<unsigned long long>::m;
> +#ifdef __SIZEOF_INT128__
> +  N<__int128>::m;
> +  N<unsigned __int128>::m;
> +#endif
> +}
> +
> +void
> +bar ()
> +{
> +  O<long long>::m;
> +  O<unsigned long long>::m;
> +#ifdef __SIZEOF_INT128__
> +  O<__int128>::m;
> +  O<unsigned __int128>::m;
> +#endif
> +}
> 
> 	Jakub
> 
> 

-- 
Richard Biener <rguenther@suse.de>
SUSE LINUX GmbH, GF: Felix Imendoerffer, Jane Smithard, Graham Norton, HRB 21284 (AG Nuernberg)