This is the mail archive of the gcc-bugs@gcc.gnu.org mailing list for the GCC project.


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]
Other format: [Raw text]

[Bug rtl-optimization/17450] New: Use of uninitialized data in reorder_insns


thread_prologue_and_epilogue_insns does this:
          if (NOTE_P (insn) 
              && (NOTE_LINE_NUMBER (insn) > 0
                  || NOTE_LINE_NUMBER (insn) == NOTE_INSN_FUNCTION_BEG
                  || NOTE_LINE_NUMBER (insn) == NOTE_INSN_FUNCTION_END))
            reorder_insns (insn, insn, PREV_INSN (epilogue_end));
which takes us here:
      if (!BARRIER_P (from)
          && (bb2 = BLOCK_FOR_INSN (from)))
        { 
          if (BB_END (bb2) == to)
            BB_END (bb2) = prev;
          bb2->flags |= BB_DIRTY;
        }

But if the previous note was outside a basic block, its block field may point
off into garbage.  In fact, it may be garbage collected (or maybe ggc_free'd). 
This could cause a crash if the page has been released back to the system.

It also messes up debugging output:

(note:HI 116 175 154 -1515870811
("/home/drow/zone-work/gcc-updated/libmudflap/mf-hooks2.c") 414)

(gdb) p/x -1515870811
$7 = 0xa5a5a5a5

I'll attach a testcase.

-- 
           Summary: Use of uninitialized data in reorder_insns
           Product: gcc
           Version: 4.0.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P2
         Component: rtl-optimization
        AssignedTo: unassigned at gcc dot gnu dot org
        ReportedBy: drow at gcc dot gnu dot org
                CC: gcc-bugs at gcc dot gnu dot org
 GCC build triplet: i386-pc-linux-gnu
  GCC host triplet: i386-pc-linux-gnu
GCC target triplet: i386-pc-linux-gnu


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=17450


Index Nav: [Date Index] [Subject Index] [Author Index] [Thread Index]
Message Nav: [Date Prev] [Date Next] [Thread Prev] [Thread Next]