Bug 80403 - UBSAN: compile time crash with "type mismatch in binary expression" message in / and % expr
Summary: UBSAN: compile time crash with "type mismatch in binary expression" message i...
Status: RESOLVED FIXED
Alias: None
Product: gcc
Classification: Unclassified
Component: sanitizer (show other bugs)
Version: 7.0
: P3 normal
Target Milestone: ---
Assignee: Jakub Jelinek
URL:
Keywords:
: 80404 80405 (view as bug list)
Depends on:
Blocks: yarpgen
  Show dependency treegraph
 
Reported: 2017-04-11 23:36 UTC by Dmitry Babokin
Modified: 2021-11-01 23:07 UTC (History)
3 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2017-04-12 00:00:00


Attachments
gcc7-pr80403.patch (945 bytes, patch)
2017-04-12 07:00 UTC, Jakub Jelinek
Details | Diff
gcc7-pr80403.patch (1.06 KB, patch)
2017-04-12 07:10 UTC, Jakub Jelinek
Details | Diff
gcc7-pr80403-2.patch (702 bytes, patch)
2017-04-13 14:17 UTC, Jakub Jelinek
Details | Diff

Note You need to log in before you can comment on or make changes to this bug.
Description Dmitry Babokin 2017-04-11 23:36:42 UTC
gcc x86_64, top of the trunk with patch from 80349. This seems related, but different.

> cat f.cpp
unsigned foo() {
   unsigned a = unsigned(!(6044238 >> 0) >= (0 < 0)) % 0;
   unsigned b = unsigned(!(6044238 >> 0) >= (0 < 0)) / 0;
   return a+b;
}

> g++ -fsanitize=undefined -w -O0 -c f.cpp
f.cpp: In function ‘unsigned int foo()’:
f.cpp:1:10: error: type mismatch in binary expression
 unsigned foo() {
          ^~~
unsigned int

int

unsigned int

a = 1 % 0;
f.cpp:1:10: error: type mismatch in binary expression
unsigned int

int

unsigned int

b = 1 / 0;
f.cpp:1:10: internal compiler error: verify_gimple failed
Comment 1 Jakub Jelinek 2017-04-12 07:00:08 UTC
Created attachment 41183 [details]
gcc7-pr80403.patch

Untested fix.
Comment 2 Jakub Jelinek 2017-04-12 07:10:52 UTC
Created attachment 41184 [details]
gcc7-pr80403.patch

The other two PRs are dups of this, added those testcases to this patch.
Comment 3 Jakub Jelinek 2017-04-12 07:11:24 UTC
*** Bug 80404 has been marked as a duplicate of this bug. ***
Comment 4 Jakub Jelinek 2017-04-12 07:11:29 UTC
*** Bug 80405 has been marked as a duplicate of this bug. ***
Comment 5 Jakub Jelinek 2017-04-12 18:09:06 UTC
Author: jakub
Date: Wed Apr 12 18:08:29 2017
New Revision: 246881

URL: https://gcc.gnu.org/viewcvs?rev=246881&root=gcc&view=rev
Log:
	PR sanitizer/80403
	PR sanitizer/80404
	PR sanitizer/80405
	* fold-const.c (fold_ternary_loc): Use op1 instead of arg1 as argument
	to fold_build2_loc.  Convert TREE_OPERAND (tem, 0) to type.  Use
	op0 instead of fold_convert_loc (loc, type, arg0).

	* g++.dg/ubsan/pr80403.C: New test.
	* g++.dg/ubsan/pr80404.C: New test.
	* g++.dg/ubsan/pr80405.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/ubsan/pr80403.C
    trunk/gcc/testsuite/g++.dg/ubsan/pr80404.C
    trunk/gcc/testsuite/g++.dg/ubsan/pr80405.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/fold-const.c
    trunk/gcc/testsuite/ChangeLog
Comment 6 Jakub Jelinek 2017-04-12 18:11:14 UTC
Fixed.
Comment 7 Dmitry Babokin 2017-04-12 20:53:46 UTC
80404 and 80405 seemed similar, but different to me, so I decided to report them separately. Anyway, after the latest fixes I still see 2 compile crashes. I'm reducing them and will report here.
Comment 8 Dmitry Babokin 2017-04-12 21:38:10 UTC
Three errors in one test case. GCC r246882.

> cat f.cpp
extern const long long int var_7;
extern unsigned long int var_59;
int foo() {
  int a = (0 - 40U <= (0 == 8)) << !var_59 << (0 < var_7) == 0;
  int b = ((0 ^ 0) < long(1066066618772207110 <= 0)) / 0 << 0;
  return a+b;
}

> g++ -w -fsanitize=undefined -O0 -c f.cpp
f.cpp: In function ‘int foo()’:
f.cpp:3:5: error: mismatching comparison operand types
 int foo() {
     ^~~
unsigned int
int
_4 = D.2761 < 0;
f.cpp:3:5: error: type mismatch in shift expression
int
unsigned int
int
_19 = D.2761 << _18;
f.cpp:3:5: error: type mismatch in binary expression
int

long int

int

D.2772 = 0 / 0;
f.cpp:3:5: internal compiler error: verify_gimple failed
Comment 9 Jakub Jelinek 2017-04-13 14:17:14 UTC
Created attachment 41195 [details]
gcc7-pr80403-2.patch

Oops, thinko in the committed patch.  COND_EXPR/VEC_COND_EXPR op0's type doesn't have to be the same as the result type (which needs to be equal to op1 and op2's type).  Will test this and commit as obvious if it passes.
Comment 10 Jakub Jelinek 2017-04-13 19:53:30 UTC
Author: jakub
Date: Thu Apr 13 19:52:58 2017
New Revision: 246917

URL: https://gcc.gnu.org/viewcvs?rev=246917&root=gcc&view=rev
Log:
	PR sanitizer/80403
	* fold-const.c (fold_ternary_loc): Revert
	use op0 instead of fold_convert_loc (loc, type, arg0) part of
	2017-04-12 change.

	* g++.dg/ubsan/pr80403-2.C: New test.

Added:
    trunk/gcc/testsuite/g++.dg/ubsan/pr80403-2.C
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/fold-const.c
    trunk/gcc/testsuite/ChangeLog
Comment 11 Dmitry Babokin 2017-04-13 21:44:24 UTC
I confirm that the latest patch fixes all UBSAN compile time problems that I have. Thanks!

Though correctness issues remain - PR80386.