Bug 56330 - ICE: verify_gimple failed: gimple_bb (stmt) is set to a wrong basic block with -fsanitize=address
Summary: ICE: verify_gimple failed: gimple_bb (stmt) is set to a wrong basic block wit...
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: sanitizer (show other bugs)
Version: 4.8.0
: P3 normal
Target Milestone: 4.8.0
Assignee: Dodji Seketeli
URL:
Keywords: ice-on-valid-code
Depends on:
Blocks:
 
Reported: 2013-02-14 21:50 UTC by Zdenek Sojka
Modified: 2013-02-16 09:58 UTC (History)
4 users (show)

See Also:
Host: x86_64-pc-linux-gnu
Target: x86_64-pc-linux-gnu
Build:
Known to work:
Known to fail: 4.8.0
Last reconfirmed: 2013-02-14 00:00:00


Attachments
autoreduced testcase (116 bytes, text/x-csrc)
2013-02-14 21:50 UTC, Zdenek Sojka
Details
gcc48-pr56330.patch (2.06 KB, patch)
2013-02-15 09:09 UTC, Jakub Jelinek
Details | Diff
Updated patch with cleanups explained in the ChangeLog (2.87 KB, patch)
2013-02-15 19:46 UTC, Dodji Seketeli
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Zdenek Sojka 2013-02-14 21:50:48 UTC
Created attachment 29456 [details]
autoreduced testcase

I am not sure if this should be marked as a regression - the code doesn't compile in 4.7, but used to older revisions of 4.8.

Compiler output:
$ gcc -fsanitize=address testcase.c         
testcase.c: In function 'foo':
testcase.c:10:1: error: gimple_bb (stmt) is set to a wrong basic block
 foo (void)
 ^
__builtin_memcmp (&s.a, &empty, 200);

testcase.c:10:1: error: gimple_bb (stmt) is set to a wrong basic block
return;

testcase.c:10:1: internal compiler error: verify_gimple failed
0xa528bc verify_gimple_in_cfg(function*)
        /mnt/svn/gcc-trunk/gcc/tree-cfg.c:4727
0x93f177 execute_function_todo
        /mnt/svn/gcc-trunk/gcc/passes.c:1970
0x93fa97 execute_todo
        /mnt/svn/gcc-trunk/gcc/passes.c:1999
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.

Tested revisions:
r196044 - crash
r195931 - OK
Comment 1 Marek Polacek 2013-02-14 22:03:06 UTC
Confirmed.
Comment 2 Steven Bosscher 2013-02-14 22:22:57 UTC
A regression is when something worked in an older GCC release but
does not work anymore. ASAN is new in GCC 4.8 so this bug is not
a regression.
Comment 3 Jakub Jelinek 2013-02-14 22:34:01 UTC
Started with http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=196008
Comment 4 Jakub Jelinek 2013-02-15 09:09:28 UTC
Created attachment 29462 [details]
gcc48-pr56330.patch

Lightly tested fix.  Better testsuite coverage is desirable.
Comment 5 Dodji Seketeli 2013-02-15 19:46:44 UTC
Created attachment 29477 [details]
Updated patch with cleanups explained in the ChangeLog

Thanks!

I have updated the patch to simplify the logic in instrument_mem_region_access somewhat, especially the part that does the statement iterator decrementing dance.

I have also added more regression tests.

What do you think?
Comment 6 Jakub Jelinek 2013-02-15 19:57:39 UTC
This is ok for trunk if it passes bootstrap/regtest.  Please post it to gcc-patches anyway though.
Comment 7 Dodji Seketeli 2013-02-16 09:30:10 UTC
FWIW, I have posted the patch for this to http://gcc.gnu.org/ml/gcc-patches/2013-02/msg00795.html
Comment 8 Dodji Seketeli 2013-02-16 09:33:01 UTC
Author: dodji
Date: Sat Feb 16 09:32:56 2013
New Revision: 196102

URL: http://gcc.gnu.org/viewcvs?root=gcc&view=rev&rev=196102
Log:
[asan] Fix for PR asan/56330

gcc/
	* asan.c (get_mem_refs_of_builtin_call): White space and style
	cleanup.
	(instrument_mem_region_access): Do not forget to always put
	instrumentation of the of 'base' and 'base + len' in a "if (len !=
	0) statement, even for cases where either 'base' or 'base + len'
	are not instrumented -- because they have been previously
	instrumented.  Simplify the logic by putting all the statements
	instrument 'base + len' inside a sequence, and then insert that
	sequence right before the current insertion point.  Then, to
	instrument 'base + len', just get an iterator on that statement.
	And do not forget to update the pointer to iterator the function
	received as argument.

gcc/testsuite/

	* c-c++-common/asan/no-redundant-instrumentation-4.c: New test file.
	* c-c++-common/asan/no-redundant-instrumentation-5.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-6.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-7.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-8.c: Likewise.
	* c-c++-common/asan/pr56330.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-1.c (test1):
	Ensure the size argument of __builtin_memcpy is a constant.

Added:
    trunk/gcc/testsuite/c-c++-common/asan/no-redundant-instrumentation-4.c
    trunk/gcc/testsuite/c-c++-common/asan/no-redundant-instrumentation-5.c
    trunk/gcc/testsuite/c-c++-common/asan/no-redundant-instrumentation-6.c
    trunk/gcc/testsuite/c-c++-common/asan/no-redundant-instrumentation-7.c
    trunk/gcc/testsuite/c-c++-common/asan/no-redundant-instrumentation-8.c
    trunk/gcc/testsuite/c-c++-common/asan/pr56330.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/asan.c
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/testsuite/c-c++-common/asan/no-redundant-instrumentation-1.c
Comment 9 Dodji Seketeli 2013-02-16 09:58:22 UTC
This should now be fixed in trunk (4.8).