Compiled code crashes storing to read-only location

Compiled code crashes storing to read-only location

[Waldek Hebisch]

The following program:

typedef struct {int c, l; char ch[3];} pstr;
const pstr ao = {2, 2, "OK"};
const pstr * const a = &ao;

int main(void)
{
        if (a->ch[a->l]) {
                a->ch[a->l] = 0;
        }
        return 0;
}

segfaults when compiled using `-O' (or better optimisation). Without
optimisation the store is not executed and the program runs fine. 

I tried CVS gcc (updated DEC 14, 04:28 CET 2003) on Athlon-XP running
Debian Woody. The problem does not appear in 20031029 snapshot, 
but is present in 20031105 snapshot.

By the way, I have some doubts about corretness of the program, however
my original problem is in GNU Pascal. Constant Pascal strings are stored
in .rodata section and compiler makes sure that the string is null
terminated. On the other hand variable strings need not be null terminated.
When convering Pascal strings to C strings GPC generates code to null
terminate the strings which are not already null terminated. The C
program above tries to reproduce the code GPC produces.

 
-- 
                              Waldek Hebisch
hebisch@math.uni.wroc.pl 

Re: Compiled code crashes storing to read-only location

[Geoff Keating]

Waldek Hebisch <hebisch@math.uni.wroc.pl> writes:

> The following program:
> 
> typedef struct {int c, l; char ch[3];} pstr;
> const pstr ao = {2, 2, "OK"};
> const pstr * const a = &ao;
> 
> int main(void)
> {
>         if (a->ch[a->l]) {
>                 a->ch[a->l] = 0;
>         }
>         return 0;
> }
> 
> segfaults when compiled using `-O' (or better optimisation). Without
> optimisation the store is not executed and the program runs fine. 
> 
> I tried CVS gcc (updated DEC 14, 04:28 CET 2003) on Athlon-XP running
> Debian Woody. The problem does not appear in 20031029 snapshot, 
> but is present in 20031105 snapshot.
> 
> By the way, I have some doubts about corretness of the program, however
> my original problem is in GNU Pascal. Constant Pascal strings are stored
> in .rodata section and compiler makes sure that the string is null
> terminated. On the other hand variable strings need not be null terminated.
> When convering Pascal strings to C strings GPC generates code to null
> terminate the strings which are not already null terminated. The C
> program above tries to reproduce the code GPC produces.

This program isn't valid C, it should be 

      ((char *)a->ch)[a->l] = 0;

but with that change, it is perfectly valid.  Could you file a bug
report in bugzilla?

FYI, this doesn't happen to me on powerpc-darwin; but making the
correction *does* change the generated code (even though it should
make no difference).  Both versions still correctly execute the store
only when it's safe.

-- 
- Geoffrey Keating <geoffk@geoffk.org>

Re: Compiled code crashes storing to read-only location

[Waldek Hebisch]

Geoffrey Keating wrote:
> Waldek Hebisch <hebisch@math.uni.wroc.pl> writes:
> 
> > The following program:
> > 
> > typedef struct {int c, l; char ch[3];} pstr;
> > const pstr ao = {2, 2, "OK"};
> > const pstr * const a = &ao;
> > 
> > int main(void)
> > {
> >         if (a->ch[a->l]) {
> >                 a->ch[a->l] = 0;
> >         }
> >         return 0;
> > }
> > 
> > segfaults when compiled using `-O' (or better optimisation). Without
> > optimisation the store is not executed and the program runs fine. 
> > 
> > I tried CVS gcc (updated DEC 14, 04:28 CET 2003) on Athlon-XP running
> > Debian Woody. The problem does not appear in 20031029 snapshot, 
> > but is present in 20031105 snapshot.
> > 
> > By the way, I have some doubts about corretness of the program, however
> > my original problem is in GNU Pascal. Constant Pascal strings are stored
> > in .rodata section and compiler makes sure that the string is null
> > terminated. On the other hand variable strings need not be null terminated.
> > When convering Pascal strings to C strings GPC generates code to null
> > terminate the strings which are not already null terminated. The C
> > program above tries to reproduce the code GPC produces.
> 
> This program isn't valid C, it should be 
> 
>       ((char *)a->ch)[a->l] = 0;
> 
> but with that change, it is perfectly valid.  Could you file a bug
> report in bugzilla?
> 

Corrected version still segfaults. Reported as 'middle-end/13400':
http://gcc.gnu.org/bugzilla/show_bug.cgi?id=13400

The problem goes away when I revert the following patch:

http://gcc.gnu.org/cgi-bin/cvsweb.cgi/gcc/gcc/ifcvt.c.diff?cvsroot=gcc&r1=1.128
&r2=1.129

which is supposed to fix:

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=10817


-- 
                              Waldek Hebisch
hebisch@math.uni.wroc.pl