Bug 88239 - ./gcc.dg/torture/pr84929.c with -O3 -march=native causes ubsan error
Summary: ./gcc.dg/torture/pr84929.c with -O3 -march=native causes ubsan error
Status: NEW
Alias: None
Product: gcc
Classification: Unclassified
Component: tree-optimization (show other bugs)
Version: 8.0
: P3 normal
Target Milestone: ---
Assignee: Not yet assigned to anyone
URL:
Keywords: ice-on-valid-code
Depends on:
Blocks: ubsan
  Show dependency treegraph
 
Reported: 2018-11-28 10:22 UTC by David Binderman
Modified: 2021-12-12 12:50 UTC (History)
2 users (show)

See Also:
Host:
Target:
Build:
Known to work:
Known to fail:
Last reconfirmed: 2018-11-28 00:00:00


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description David Binderman 2018-11-28 10:22:18 UTC
From the gcc testsuite, file ./gcc.dg/torture/pr84929.c,
compiled with a ubsan version of recent gcc trunk, and
compiler flags -c -O3 -march=native, does this:

$ ~/gcc/results/bin/gcc -c -O3 -march=native ./gcc.dg/torture/pr84929.c
../../trunk/gcc/poly-int.h:753:21: runtime error: signed integer overflow: -5621332293356458048 * 8 cannot be represented in type 'long int'
../../trunk/gcc/tree-ssa-loop-prefetch.c:468:14: runtime error: signed integer overflow: 7818038963515661296 * 4 cannot be represented in type 'long int'
$ 

The error about poly-int.h occurs in many source code files
and should be ignored. It is the second runtime error I noticed.

This bug seems to have existed since sometime before revision 265631.

/proc/cpuinfo says

vendor_id	: AuthenticAMD
cpu family	: 21
model		: 2
model name	: AMD FX(tm)-8350 Eight-Core Processor
Comment 1 David Binderman 2018-11-28 10:44:01 UTC
svn blame says

110965    rakdver       idelta *= imult;

It might be time to add some code to deal with overflow of
user provided array index.
Comment 2 Richard Biener 2018-11-28 12:35:13 UTC
So probably happens with -fprefetch-loop-arrays -O3 as well.  wide-int to the rescue.
Comment 3 David Binderman 2019-04-24 11:17:50 UTC
Still going wrong at revision 270500. Here is a stack backtrace:

../../trunk/gcc/tree-ssa-loop-prefetch.c:468:14: runtime error: signed integer o
verflow: 7818038963515661296 * 4 cannot be represented in type 'long int'
    #0 0x30177c3 in idx_analyze_ref ../../trunk/gcc/tree-ssa-loop-prefetch.c:468
    #1 0x303b6d8 in for_each_index(tree_node**, bool (*)(tree_node*, tree_node**
, void*), void*) ../../trunk/gcc/tree-ssa-loop.c:622
    #2 0x30147d3 in analyze_ref ../../trunk/gcc/tree-ssa-loop-prefetch.c:530
    #3 0x30147d3 in gather_memory_references_ref ../../trunk/gcc/tree-ssa-loop-p
refetch.c:548
    #4 0x3018fec in gather_memory_references ../../trunk/gcc/tree-ssa-loop-prefe
tch.c:651