[Bug sanitizer/62141] [GCC-4.10.0][ASAN] ICE: Segmentation fault: 11

[fxcoudert at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=62141

Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
             Target|x86_64-apple-darwin11.4.2   |x86_64-apple-darwin14
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-11-10
                 CC|                            |fxcoudert at gcc dot gnu.org
            Version|unknown                     |5.0
     Ever confirmed|0                           |1

--- Comment #5 from Francois-Xavier Coudert <fxcoudert at gcc dot gnu.org> ---
Confirmed with trunk on x86_64-apple-darwin14 (with pending patches from
PR63773). Minimal reproducer:

--------------------
void f1 (void *x)
{
  char a;
  __builtin_memcpy (x, &a, 1);            
}

void f4 (void)
{
  char s[] = "";
}
--------------------

compiled with "gcc -S -fsanitize=address -m32 a.c" gives ICE. Disappears
without -m32, and also at any optimization level other than -O0 (-O1, -O2, -O3,
-Os).
The backtrace is:

Process 49629 stopped
* thread #1: tid = 0x7e1f7, 0x000000010053d2ff
cc1`df_install_ref(this_ref=0x0000000142091ff0, reg_info=0x0000000200000006,
ref_info=0x0000000141e1e930, add_to_table=false) + 15 at df-scan.c:2328, queue
= 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1,
address=0x200000006)
    frame #0: 0x000000010053d2ff
cc1`df_install_ref(this_ref=0x0000000142091ff0, reg_info=0x0000000200000006,
ref_info=0x0000000141e1e930, add_to_table=false) + 15 at df-scan.c:2328
   2325    {
   2326      unsigned int regno = DF_REF_REGNO (this_ref);
   2327      /* Add the ref to the reg_{def,use,eq_use} chain.  */
-> 2328      df_ref head = reg_info->reg_chain;
   2329    
   2330      reg_info->reg_chain = this_ref;
   2331      reg_info->n_refs++;
(lldb) bt
* thread #1: tid = 0x7e1f7, 0x000000010053d2ff
cc1`df_install_ref(this_ref=0x0000000142091ff0, reg_info=0x0000000200000006,
ref_info=0x0000000141e1e930, add_to_table=false) + 15 at df-scan.c:2328, queue
= 'com.apple.main-thread', stop reason = EXC_BAD_ACCESS (code=1,
address=0x200000006)
  * frame #0: 0x000000010053d2ff
cc1`df_install_ref(this_ref=0x0000000142091ff0, reg_info=0x0000000200000006,
ref_info=0x0000000141e1e930, add_to_table=false) + 15 at df-scan.c:2328
    frame #1: 0x0000000100540f2e cc1`df_install_refs(bb=<unavailable>,
old_vec=0x00007fff5fbff250, reg_info=0x0000000141e20410,
ref_info=0x0000000141e1e930, is_notes=<unavailable>) + 110 at df-scan.c:2413
    frame #2: 0x000000010054155a
cc1`df_refs_add_to_chains(collection_rec=0x00007fff5fbfee40,
bb=0x0000000142c0c820, insn=<unavailable>, flags=15) + 170 at df-scan.c:2466
    frame #3: 0x0000000100543910 cc1`df_bb_refs_record(bb_index=<unavailable>,
scan_insns=<unavailable>) + 672 at df-scan.c:3399
    frame #4: 0x0000000100543abd cc1`df_scan_blocks() + 253 at df-scan.c:629
    frame #5: 0x000000010052fb17 cc1`rest_of_handle_df_initialize + 311 at
df-core.c:746
    frame #6: 0x000000010089950b cc1`execute_one_pass(pass=0x0000000141e13210)
+ 395 at passes.c:2269
    frame #7: 0x0000000100899abe
cc1`execute_pass_list_1(pass=0x0000000141e13210) + 30 at passes.c:2321
    frame #8: 0x0000000100899ad0
cc1`execute_pass_list_1(pass=0x0000000141e12490) + 48 at passes.c:2322
    frame #9: 0x0000000100899b19 cc1`execute_pass_list(fn=0x0000000142d65150,
pass=0x0000000141e0f310) + 25 at passes.c:2332
    frame #10: 0x00000001004d6da4
cc1`cgraph_node::expand(this=0x0000000142c12620) + 260 at cgraphunit.c:1773
    frame #11: 0x00000001004d7ccf cc1`output_in_order(no_reorder=<unavailable>)
+ 559 at cgraphunit.c:2011
    frame #12: 0x00000001004d821a
cc1`symbol_table::compile(this=0x0000000142c05000) + 890 at cgraphunit.c:2242
    frame #13: 0x00000001004da27e
cc1`symbol_table::finalize_compilation_unit(this=0x0000000142c05000) + 110 at
cgraphunit.c:2325
    frame #14: 0x00000001000205c9 cc1`c_write_global_declarations() + 601 at
c-decl.c:10779
    frame #15: 0x00000001009745ff cc1`compile_file + 143 at toplev.c:583
    frame #16: 0x0000000100e8c014 cc1`toplev::main(this=<unavailable>, argc=20,
argv=0x00007fff5fbff8f0) + 3764 at toplev.c:2013
    frame #17: 0x0000000100e8c63c cc1`main(argc=20, argv=0x00007fff5fbff8f0) +
44 at main.c:38
    frame #18: 0x00007fff880bd5c9 libdyld.dylib`start + 1