Bug 109175 - error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]
Summary: error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or m...
Status: UNCONFIRMED
Alias: None
Product: gcc
Classification: Unclassified
Component: tree-optimization (show other bugs)
Version: 13.0
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords: diagnostic, needs-reduction
Depends on:
Blocks: Wstringop-overflow
  Show dependency treegraph
 
Reported: 2023-03-17 14:52 UTC by Mathieu Malaterre
Modified: 2023-09-26 11:59 UTC (History)
2 users (show)

See Also:
Host:
Target: aarch64-linux-gnu
Build:
Known to work:
Known to fail:
Last reconfirmed:


Attachments
Preprocessed source gcc-13 (588.20 KB, application/x-gzip)
2023-03-17 14:54 UTC, Mathieu Malaterre
Details
Preprocessed source gcc-12 (582.85 KB, application/x-gzip)
2023-03-17 14:55 UTC, Mathieu Malaterre
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Mathieu Malaterre 2023-03-17 14:52:04 UTC
A new warning is appearing in the highway compilation logs on aarch64:

[...]
FAILED: CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o 
/usr/lib/gcc-snapshot/bin/g++ -DHWY_SHARED_DEFINE -I"/<<PKGBUILDDIR>>" -g -O2 -ffile-prefix-map=/<<PKGBUILDDIR>>=. -fstack-protector-strong -Wformat -Werror=format-security -DHWY_BROKEN_EMU128=0 -Wdate-time -D_FORTIFY_SOURCE=2 -fPIE -fvisibility=hidden -fvisibility-inlines-hidden -Wno-builtin-macro-redefined -D__DATE__=\"redacted\" -D__TIMESTAMP__=\"redacted\" -D__TIME__=\"redacted\" -fmerge-all-constants -Wall -Wextra -Wconversion -Wsign-conversion -Wvla -Wnon-virtual-dtor -fmath-errno -fno-exceptions -Werror -DHWY_IS_TEST=1 -DGTEST_HAS_PTHREAD=1 -MD -MT CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -MF CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o.d -o CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -c '/<<PKGBUILDDIR>>/hwy/tests/convert_test.cc'
In file included from /<<PKGBUILDDIR>>/hwy/foreach_target.h:114,
                 from /<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:26:
In function 'hwy::AlignedFreeUniquePtr<float []> hwy::N_SVE2::F16TestCases(D, size_t&) [with D = Simd<float, 64, 0>]',
    inlined from 'void hwy::N_SVE2::TestF16::operator()(TF32, DF32) [with TF32 = float; DF32 = hwy::N_SVE2::Simd<float, 64, 0>]' at /<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:300:10:
/<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:288:11: error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]
  288 |     in[i] = 0.0f;
In function 'void hwy::N_SVE2::TestF16::operator()(TF32, DF32) [with TF32 = float; DF32 = hwy::N_SVE2::Simd<float, 64, 0>]':
cc1plus: note: destination object is likely at address zero
In file included from /<<PKGBUILDDIR>>/hwy/foreach_target.h:103:
In function 'hwy::AlignedFreeUniquePtr<float []> hwy::N_SVE::F16TestCases(D, size_t&) [with D = Simd<float, 64, 0>]',
    inlined from 'void hwy::N_SVE::TestF16::operator()(TF32, DF32) [with TF32 = float; DF32 = hwy::N_SVE::Simd<float, 64, 0>]' at /<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:300:10:
/<<PKGBUILDDIR>>/hwy/tests/convert_test.cc:288:11: error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]
  288 |     in[i] = 0.0f;
In function 'void hwy::N_SVE::TestF16::operator()(TF32, DF32) [with TF32 = float; DF32 = hwy::N_SVE::Simd<float, 64, 0>]':
cc1plus: note: destination object is likely at address zero
cc1plus: all warnings being treated as errors
[...]

ref:
* https://buildd.debian.org/status/fetch.php?pkg=highway&arch=arm64&ver=1.0.4%7Egit20230308.a1d7764-1&stamp=1679052435&raw=0
Comment 1 Mathieu Malaterre 2023-03-17 14:54:07 UTC
Created attachment 54694 [details]
Preprocessed source gcc-13

% /usr/lib/gcc-snapshot/bin/g++  -save-temps=obj -DHWY_SHARED_DEFINE -I"/home/malat/highway-1.0.4~git20230308.a1d7764" -g -O2 -ffile-prefix-map=/home/malat/highway-1.0.4~git20230308.a1d7764=. -fstack-protector-strong -Wformat -Werror=format-security -DHWY_BROKEN_EMU128=0 -Wdate-time -D_FORTIFY_SOURCE=2 -fPIE -fvisibility=hidden -fvisibility-inlines-hidden -Wno-builtin-macro-redefined -D__DATE__=\"redacted\" -D__TIMESTAMP__=\"redacted\" -D__TIME__=\"redacted\" -fmerge-all-constants -Wall -Wextra -Wconversion -Wsign-conversion -Wvla -Wnon-virtual-dtor -fmath-errno -fno-exceptions -Werror -DHWY_IS_TEST=1 -DGTEST_HAS_PTHREAD=1 -MD -MT CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -MF CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o.d -o CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -c '/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc'
Comment 2 Mathieu Malaterre 2023-03-17 14:55:50 UTC
Created attachment 54695 [details]
Preprocessed source gcc-12

g++  -save-temps=obj -DHWY_SHARED_DEFINE -I"/home/malat/highway-1.0.4~git20230308.a1d7764" -g -O2 -ffile-prefix-map=/home/malat/highway-1.0.4~git20230308.a1d7764=. -fstack-protector-strong -Wformat -Werror=format-security -DHWY_BROKEN_EMU128=0 -Wdate-time -D_FORTIFY_SOURCE=2 -fPIE -fvisibility=hidden -fvisibility-inlines-hidden -Wno-builtin-macro-redefined -D__DATE__=\"redacted\" -D__TIMESTAMP__=\"redacted\" -D__TIME__=\"redacted\" -fmerge-all-constants -Wall -Wextra -Wconversion -Wsign-conversion -Wvla -Wnon-virtual-dtor -fmath-errno -fno-exceptions -Werror -DHWY_IS_TEST=1 -DGTEST_HAS_PTHREAD=1 -MD -MT CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -MF CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o.d -o CMakeFiles/convert_test.dir/hwy/tests/convert_test.cc.o -c '/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc'
Comment 3 Mathieu Malaterre 2023-03-17 15:04:02 UTC
Compiling the preprocessed source:

% /usr/lib/gcc-snapshot/bin/g++ --verbose -g  -fstack-protector-strong -Wformat -Werror=format-security -DHWY_BROKEN_EMU128=0 -Wdate-time -D_FORTIFY_SOURCE=2 -fPIE -fvisibility=hidden -fvisibility-inlines-hid
den -Wno-builtin-macro-redefined -fmerge-all-constants -Wall -Wextra -Wconversion -Wsign-conversion -Wvla -Wnon-virtual-dtor -fmath-errno -fno-exceptions -Werror -DHWY_IS_TEST=1 -O2 -c 13/convert_test.cc.ii
Using built-in specs.
COLLECT_GCC=/usr/lib/gcc-snapshot/bin/g++
Target: aarch64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Debian 20230315-1' --with-bugurl=file:///usr/share/doc/gcc-snapshot/README.Bugs --enable-languages=c,ada,c++,go,d,fortran,objc,obj-c++,m2,rust --prefix=/usr/lib/gcc-snapshot --with-gcc-major-version-only --program-prefix= --enable-shared --enable-linker-build-id --disable-nls --enable-bootstrap --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-libquadmath --disable-libquadmath-support --enable-plugin --with-system-zlib --enable-libphobos-checking=release --with-target-system-zlib=auto --enable-objc-gc=auto --enable-multiarch --enable-fix-cortex-a53-843419 --disable-werror --enable-checking=yes,extra,rtl --build=aarch64-linux-gnu --host=aarch64-linux-gnu --target=aarch64-linux-gnu --with-build-config=bootstrap-lto-lean --enable-link-serialization=2
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.0.1 20230315 (experimental) [master r13-6680-ga9ae16db8cb] (Debian 20230315-1)
COLLECT_GCC_OPTIONS='-v' '-g' '-fstack-protector-strong' '-Wformat=1' '-Werror=format-security' '-D' 'HWY_BROKEN_EMU128=0' '-Wdate-time' '-D' '_FORTIFY_SOURCE=2' '-fPIE' '-fvisibility=hidden' '-fvisibility-inlines-hidden' '-Wno-builtin-macro-redefined' '-fmerge-all-constants' '-Wall' '-Wextra' '-Wconversion' '-Wsign-conversion' '-Wvla' '-Wnon-virtual-dtor' '-fmath-errno' '-fno-exceptions' '-Werror' '-D' 'HWY_IS_TEST=1' '-O2' '-c' '-shared-libgcc' '-mlittle-endian' '-mabi=lp64'
 /usr/lib/gcc-snapshot/libexec/gcc/aarch64-linux-gnu/13/cc1plus -fpreprocessed 13/convert_test.cc.ii -quiet -dumpbase convert_test.cc.ii -dumpbase-ext .ii -mlittle-endian -mabi=lp64 -g -O2 -Wformat=1 -Werror=format-security -Wdate-time -Wno-builtin-macro-redefined -Wall -Wextra -Wconversion -Wsign-conversion -Wvla -Wnon-virtual-dtor -Werror -version -fstack-protector-strong -fPIE -fvisibility=hidden -fvisibility-inlines-hidden -fmerge-all-constants -fmath-errno -fno-exceptions -o /tmp/ccjFMyE5.s
GNU C++17 (Debian 20230315-1) version 13.0.1 20230315 (experimental) [master r13-6680-ga9ae16db8cb] (aarch64-linux-gnu)
        compiled by GNU C version 13.0.1 20230315 (experimental) [master r13-6680-ga9ae16db8cb], GMP version 6.2.1, MPFR version 4.2.0, MPC version 1.3.1, isl version isl-0.25-GMP

GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: 4bc54a683351612d262139a66d85dce2
In file included from /home/malat/highway-1.0.4~git20230308.a1d7764/hwy/foreach_target.h:114,
                 from /home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:26:
In function 'hwy::AlignedFreeUniquePtr<float []> hwy::N_SVE2::F16TestCases(D, size_t&) [with D = Simd<float, 64, 0>]',
    inlined from 'void hwy::N_SVE2::TestF16::operator()(TF32, DF32) [with TF32 = float; DF32 = hwy::N_SVE2::Simd<float, 64, 0>]' at /home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:300:10:
/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:288:11: error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]
  288 |     in[i] = 0.0f;
In function 'void hwy::N_SVE2::TestF16::operator()(TF32, DF32) [with TF32 = float; DF32 = hwy::N_SVE2::Simd<float, 64, 0>]':
cc1plus: note: destination object is likely at address zero
In file included from /home/malat/highway-1.0.4~git20230308.a1d7764/hwy/foreach_target.h:103:
In function 'hwy::AlignedFreeUniquePtr<float []> hwy::N_SVE::F16TestCases(D, size_t&) [with D = Simd<float, 64, 0>]',
    inlined from 'void hwy::N_SVE::TestF16::operator()(TF32, DF32) [with TF32 = float; DF32 = hwy::N_SVE::Simd<float, 64, 0>]' at /home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:300:10:
/home/malat/highway-1.0.4~git20230308.a1d7764/hwy/tests/convert_test.cc:288:11: error: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Werror=stringop-overflow=]
  288 |     in[i] = 0.0f;
In function 'void hwy::N_SVE::TestF16::operator()(TF32, DF32) [with TF32 = float; DF32 = hwy::N_SVE::Simd<float, 64, 0>]':
cc1plus: note: destination object is likely at address zero
Comment 4 Andrew Pinski 2023-03-20 19:50:49 UTC
  auto in = AllocateAligned<float>(padded);


The pointer returned here could be a nullptr ....

The warning is due to jump threading though.

AllocateAligned calls AllocateAlignedItems

Which could return nullptr:
  if (check != items) {
    return nullptr;
  }

That is checking to make sure there was no wrap around for items*size really.
Comment 5 Mathieu Malaterre 2023-03-24 18:20:39 UTC
c-reduce(d) ugly version:

% cat demo3.cc
struct d {
  using b = float &;
};
template <typename> using c = d::b;
struct e {
  using b = c<float>;
};
template <long, typename> struct j;
template <long f, typename g> using h = typename j<f, g>::b;
template <long, typename...> struct p;
template <typename k, typename... l> struct p<0, k, l...> { using b = k; };
template <typename...> class m;
template <typename n> struct aa {
  aa(n t) : o(t) {}
  static n ab(aa t) { return t.o; }
  n o;
};
template <long, typename...> struct q;
template <long r, typename n, typename... s>
struct q<r, n, s...> : q<1, s...>, aa<n> {
  q(n t, s... ac) : q<1, s...>(ac...), aa<n>(t) {}
};
template <long r, typename n> struct q<r, n> : aa<n> {
  q(n t) : aa<n>(t) {}
};
template <typename ad, typename ae> class m<ad, ae> : public q<0, ad, ae> {
public:
  m(ad t, ae ac) : q<0, ad, ae>(t, ac) {}
};
template <long f, typename... af> struct j<f, m<af...>> {
  using b = typename p<f, af...>::b;
};
template <long f, typename n, typename... s> n ag(q<f, n, s...> t) {
  return q<f, n>::ab(t);
}
template <int f, typename... ah> h<f, m<ah...>> ai(m<ah...> t) { return ag(t); }
class u {
  struct aj {
    using b = float *;
  };

public:
  using ak = aj::b;
  u(ak t, int) : al(t, long()) {}
  ak w() { return ai<0>(al); }
  m<ak, int> al;
};
struct x : u {
  using u::u;
};
class y {
  x al;

public:
  using ak = u::ak;
  using am = int;
  template <typename an> y(an t, am ac) : al(t, ac) {}
  e::b operator[](long t) { return z()[t]; }
  ak z() { return al.w(); }
};
void *ao();
template <typename ap> ap *aq(long t) {
  if (t)
    return nullptr;
  return static_cast<ap *>(ao());
}
template <typename> using ar = y;
template <typename ap> ar<ap> as(long t, void *) {
  return ar<ap>(aq<ap>(t), int());
}
template <typename ap> ar<ap> as(long t) { return as<ap>(t, nullptr); }
float v;
void at(long t) {
  long a = sizeof(0), i = 0;
  auto b = as<float>(t);
  for (; i < a; ++i)
    b[i] = v;
  for (; i < t; ++i)
    b[i] = 0.0f;
}

 % /usr/lib/gcc-snapshot/bin/g++ -Wall -O2 -o t.o -c demo3.cc
demo3.cc: In function 'void at(long int)':
demo3.cc:79:10: warning: 'void* __builtin_memset(void*, int, long unsigned int)' writing 4 or more bytes into a region of size 0 overflows the destination [-Wstringop-overflow=]
   79 |     b[i] = 0.0f;
cc1plus: note: destination object is likely at address zero
Comment 6 Andrew Pinski 2023-03-24 18:46:49 UTC
Reduced all the way removing all of the classes showing exactly what I thought it was:
```
void *ao();
float *aq(long t) {
  if (t)
    return nullptr;
  return static_cast<float *>(ao());
}
float v;
void at(long t) {
  long a = sizeof(0), i = 0;
  auto b = aq(t);
  for (; i < a; ++i)
    b[i] = v;
  for (; i < t; ++i)
    b[i] = 0.0f;
}
```

Notice how there is no check for null on aq.
Comment 7 Jan Wassenberg 2023-03-24 19:44:46 UTC
Thanks, I will be changing the code to add a nullptr check.
Comment 8 Mathieu Malaterre 2023-09-26 11:59:09 UTC
(In reply to Andrew Pinski from comment #6)
> Notice how there is no check for null on aq.

Do you want to keep this one open or should we close it as invalid ?