This is the mail archive of the gcc-patches@gcc.gnu.org mailing list for the GCC project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

Re: [PATCH] Fix various undefined behaviors in GCC discovered by -fsanitize=undefined (PR other/59545)


On 12/19/2013, 3:42 PM, Jakub Jelinek wrote:
Hi!

This patch is an attempt to fix various signed integer overflows,
invalid shifts and loads of uninialized bool value.

Bootstrapped/regtested on x86_64-linux and i686-linux, ok for trunk?

This is solely from gcc build, make check has other issues too, but I'd
prefer to do it incrementally, because otherwise there are way too many
errors everywhere.

There are also two issues I've left unfixed, Andrew/Tom and Vlad, can you
please have a look?

The first one is in java/boehm.c:

java/boehm.c:
           /* First word in object corresponds to most significant byte of
              bitmap.

              In the case of a multiple-word record, we set pointer
              bits for all words in the record. This is conservative, but the
              size_words != 1 case is impossible in regular java code. */
           for (i = 0; i < size_words; ++i)
             *mask = (*mask).set_bit (ubit - count - i - 1);

(gdb) p ubit
$1 = 64
(gdb) p count
$2 = 67
(gdb) p i
$3 = 0

*mask is double_int, so set_bit has only 0 to HOST_BITS_PER_DOUBLE_INT - 1
valid arguments, but in this case ubit - count - i - 1 is e.g. -4
(but as the value is unsigned, it is just very large number).  I have no
idea what this code is meant to do, Andrew/Tom, could you please fix this
up?

ira-color.c:
                 if (index < 0)
                   continue;
                 cost = conflict_costs [i] * mult / div;
                 if (cost == 0)
                   continue;

../../gcc/ira-color.c:1508:29: runtime error: signed integer overflow: -65535000 * 1000 cannot be represented in type 'int'
../../gcc/ira-color.c:1508:29: runtime error: signed integer overflow: -65535000 * 61 cannot be represented in type 'int'
../../gcc/ira-color.c:1508:29: runtime error: signed integer overflow: -71760825 * 976 cannot be represented in type 'int'
../../gcc/ira-color.c:1508:29: runtime error: signed integer overflow: -7659400 * 394 cannot be represented in type 'int'

(hundreds of similar messages).  I have no idea if negative and so large
conflict_costs are valid, whether overflow is ok (then perhaps it should be
unsigned rather than int multiplication) etc.  Vlad, can you please check it
out?


I've been working on this problem for another PR which was triggered by regmove removal patch. I have a patch but unfortunately it results in visible SPEC2000 rate decrease. I am trying another patch but I guess it will be ready in 2 weeks only.

In any case this problem does not affect code correctness, so it can wait 2 weeks for fixing.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]