Bug 80348 - [6 Regression] UBSAN: compile time crash in ubsan_instrument_division
Summary: [6 Regression] UBSAN: compile time crash in ubsan_instrument_division
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: sanitizer (show other bugs)
Version: 7.0
: P2 normal
Target Milestone: 6.4
Assignee: Marek Polacek
URL:
Keywords:
: 80347 (view as bug list)
Depends on:
Blocks: yarpgen
  Show dependency treegraph
 
Reported: 2017-04-06 23:16 UTC by Dmitry Babokin
Modified: 2021-11-01 23:07 UTC (History)
4 users (show)

See Also:
Host:
Target:
Build:
Known to work: 5.4.1
Known to fail: 6.3.1, 7.0.1
Last reconfirmed: 2017-04-07 00:00:00


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Dmitry Babokin 2017-04-06 23:16:29 UTC
Top of the trunk gcc on x86_64

> cat f.cpp
void foo() {
  if (0)
    unsigned((0 != 60806) > (0 != 0)) / 0;
}

> g++ -fsanitize=undefined -w -O0 -c f.cpp
f.cpp: In function ‘void foo()’:
f.cpp:3:41: internal compiler error: in ubsan_instrument_division, at c-family/c-ubsan.c:46
     unsigned((0 != 60806) > (0 != 0)) / 0;
                                         ^
0x8d5ffb ubsan_instrument_division(unsigned int, tree_node*, tree_node*)
	../../gcc/gcc/c-family/c-ubsan.c:45
0x76d95a cp_build_binary_op(unsigned int, tree_code, tree_node*, tree_node*, int)
	../../gcc/gcc/cp/typeck.c:5226
0x6158b4 build_new_op_1
	../../gcc/gcc/cp/call.c:5982
0x61635e build_new_op(unsigned int, tree_code, int, tree_node*, tree_node*, tree_node*, tree_node**, int)
	../../gcc/gcc/cp/call.c:6026
0x75e622 build_x_binary_op(unsigned int, tree_code, tree_node*, tree_code, tree_node*, tree_code, tree_node**, int)
	../../gcc/gcc/cp/typeck.c:3928
<...>
Comment 1 Dmitry Babokin 2017-04-07 00:39:04 UTC
*** Bug 80347 has been marked as a duplicate of this bug. ***
Comment 2 Richard Biener 2017-04-07 08:25:33 UTC
Confirmed.
Comment 3 Martin Liška 2017-04-07 08:34:26 UTC
Started with r230365 (Merge C++ delayed folding branch.).
Comment 4 Marek Polacek 2017-04-07 09:44:34 UTC
Mine.
Comment 5 Marek Polacek 2017-04-07 17:52:27 UTC
Author: mpolacek
Date: Fri Apr  7 17:51:55 2017
New Revision: 246770

URL: https://gcc.gnu.org/viewcvs?rev=246770&root=gcc&view=rev
Log:
	PR sanitizer/80348
	* typeck.c (cp_build_binary_op): Convert COP[01] to ORIG_TYPE.

	* g++.dg/ubsan/div-by-zero-2.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/ubsan/div-by-zero-2.C
Modified:
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/typeck.c
    trunk/gcc/testsuite/ChangeLog
Comment 6 Marek Polacek 2017-04-07 17:57:55 UTC
Fixed on trunk so far.
Comment 7 Dmitry Babokin 2017-04-07 22:40:12 UTC
These tests are still failing:
> cat f1.cpp
void foo() { 0 / unsigned(!(0 - 3) >= (0 > 0)); }
> cat f2.cpp
extern long long int var_58;
void foo() { (0 >= 10253361740180 >= long(0 >= 0)) % var_58; }
> cat f3.cpp
void foo() { (0 < 0 >= (0 < 0 < 0)) % (unsigned(2) << 0); }

gcc revision 246776
Comment 8 Marek Polacek 2017-04-08 10:00:38 UTC
Ouch.  I'll have a look.
Comment 9 Marek Polacek 2017-04-10 17:18:47 UTC
Author: mpolacek
Date: Mon Apr 10 17:18:15 2017
New Revision: 246812

URL: https://gcc.gnu.org/viewcvs?rev=246812&root=gcc&view=rev
Log:
	PR sanitizer/80348
	* typeck.c (cp_build_binary_op): Use NULL_TREE instead of NULL.  Set
	ORIG_TYPE earlier and not only when shortening.

	* g++.dg/ubsan/div-by-zero-3.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/ubsan/div-by-zero-3.C
Modified:
    trunk/gcc/cp/ChangeLog
    trunk/gcc/cp/typeck.c
    trunk/gcc/testsuite/ChangeLog
Comment 10 Marek Polacek 2017-04-10 17:19:09 UTC
Fixed on trunk so far.
Comment 11 Marek Polacek 2017-06-24 10:57:33 UTC
Author: mpolacek
Date: Sat Jun 24 10:57:01 2017
New Revision: 249623

URL: https://gcc.gnu.org/viewcvs?rev=249623&root=gcc&view=rev
Log:
	PR sanitizer/80348
	* typeck.c (cp_build_binary_op): Convert COP[01] to ORIG_TYPE.

	* g++.dg/ubsan/div-by-zero-2.C: New test.

Added:
    branches/gcc-6-branch/gcc/testsuite/g++.dg/ubsan/div-by-zero-2.C
Modified:
    branches/gcc-6-branch/gcc/cp/ChangeLog
    branches/gcc-6-branch/gcc/cp/typeck.c
    branches/gcc-6-branch/gcc/testsuite/ChangeLog
Comment 12 Marek Polacek 2017-06-24 10:59:31 UTC
Author: mpolacek
Date: Sat Jun 24 10:59:00 2017
New Revision: 249624

URL: https://gcc.gnu.org/viewcvs?rev=249624&root=gcc&view=rev
Log:
	PR sanitizer/80348
	* typeck.c (cp_build_binary_op): Use NULL_TREE instead of NULL.  Set
	ORIG_TYPE earlier and not only when shortening.

	* g++.dg/ubsan/div-by-zero-3.C: New test.

Added:
    branches/gcc-6-branch/gcc/testsuite/g++.dg/ubsan/div-by-zero-3.C
Modified:
    branches/gcc-6-branch/gcc/cp/ChangeLog
    branches/gcc-6-branch/gcc/cp/typeck.c
    branches/gcc-6-branch/gcc/testsuite/ChangeLog
Comment 13 Marek Polacek 2017-06-24 11:01:37 UTC
Fixed.