[Bug tree-optimization/42821] [4.5 Regression] TCL is miscompiled

["rguenth at gcc dot gnu dot org" <gcc-bugzilla at gcc dot gnu dot org>]

------- Comment #2 from rguenth at gcc dot gnu dot org  2010-01-21 11:31 -------
We seem to test for this "feature" in gcc.dg/builtin-object-size-6.c

struct D
{
  int i;
  struct D1
  {
    char b;
    char a[10];
  } j;
};

void
__attribute__ ((noinline))
test6 (struct D *d)
{
  if (__builtin_object_size (&d->j.a[3], 0) != (size_t) -1)
    abort ();
  if (__builtin_object_size (&d->j.a[3], 1) != sizeof (d->j.a) - 3)
    abort ();
  if (__builtin_object_size (&d->j.a[3], 2) != 0)
    abort ();
  if (__builtin_object_size (&d->j.a[3], 3) != sizeof (d->j.a) - 3)
    abort ();
}

But this is confused by for example changing the testcase to

struct X {
    void *p;
    struct Y {
        char s[4];
    } y;
};

void * __attribute__((noinline,noclone))
myalloc (unsigned int sz)
{
  return __builtin_malloc (sz);
}

int main()
{
  struct X *p = myalloc (sizeof (struct X)
                         + sizeof ("Hello World") + 1 - sizeof (p->y.s));
  struct Y *q = &p->y;
  __builtin___strcpy_chk (q->s, "Hello World",
                          __builtin_object_size (q->s, 1));
  return 0;
}

where clearly nothing tells you that we allocate an object of type struct X
and the strcpy uses struct Y - still as we propagate around the pointers
we'll end up with exactly the same IL as before and miscompute the object size.


-- 


http://gcc.gnu.org/bugzilla/show_bug.cgi?id=42821