Bug 87826 - ubsan: gimple-ssa-store-merging.c:281
Summary: ubsan: gimple-ssa-store-merging.c:281
Status: ASSIGNED
Alias: None
Product: gcc
Classification: Unclassified
Component: tree-optimization (show other bugs)
Version: 8.0
: P3 normal
Target Milestone: ---
Assignee: Jakub Jelinek
URL:
Keywords:
Depends on:
Blocks: ubsan
  Show dependency tree / graph
 
Reported: 2018-10-31 09:30 UTC by David Binderman
Modified: 2021-10-01 03:22 UTC (History)
1 user (show)

See Also:
Host:
Target:
Build:
Known to work: 9.0
Known to fail: 8.2.0
Last reconfirmed: 2018-10-31 00:00:00

Attachments
gcc9-pr87826.patch (585 bytes, patch)
2018-10-31 10:36 UTC, Jakub Jelinek 		Details | Diff
View All Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description David Binderman 2018-10-31 09:30:47 UTC 
$ ../results.265631.ubsan/bin/gcc -c -O3 bug472.c
../../trunk/gcc/gimple-ssa-store-merging.c:281:12: runtime error: shift exponent 64 is too large for 64-bit type 'long unsigned int'
$ 

For this C code:

typedef a;
*b;
c;
d() {
  a e, f = 8 + 8;
  e = 0;
  for (; e < f; ++e)
    b[e] = c >> e * 8;
}

The bug seems to be sometime before revision 264725.
Comment 1 David Binderman 2018-10-31 09:33:40 UTC 
svn blame says

254947      jakub       n->n >>= count;
Comment 2 Jakub Jelinek 2018-10-31 09:57:53 UTC 
Cleaned up:
int c;

void
foo (int *b)
{
  int e;
  for (e = 0; e < 16; ++e)
    b[e] = c >> e * 8;
}

The testcase with UB in it if the function is ever called has the loop unrolled by cunroll and we end up with out of bound shifts.  Store-merging should just punt in that case.
Comment 3 Jakub Jelinek 2018-10-31 10:36:48 UTC 
Created attachment 44935 [details]
gcc9-pr87826.patch

Untested fix.
Comment 4 Jakub Jelinek 2018-11-01 12:32:18 UTC 
Author: jakub
Date: Thu Nov  1 12:31:45 2018
New Revision: 265720

URL: https://gcc.gnu.org/viewcvs?rev=265720&root=gcc&view=rev
Log:
	PR tree-optimization/87826
	* gimple-ssa-store-merging.c (do_shift_rotate): Punt if count is
	negative or larger or equal to type's precision.

	* gcc.dg/pr87826.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/pr87826.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/gimple-ssa-store-merging.c
    trunk/gcc/testsuite/ChangeLog
Comment 5 Martin Liška 2018-11-20 08:57:08 UTC 
Jakub: Can you please update Known to work/fail?