[Bug middle-end/64920] New: bootstrap-ubsan [build/gengtype -r gtype.state]: libiberty/regex.c:6970:11: runtime error: left shift of negative value -1

[burnus at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64920

            Bug ID: 64920
           Summary: bootstrap-ubsan [build/gengtype -r gtype.state]:
                    libiberty/regex.c:6970:11: runtime error: left shift
                    of negative value -1
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: burnus at gcc dot gnu.org
        Depends on: 63426

Running bootstrap-ubsan on x86_64 shows the following error during stage 2 for

build/gengtype -r gtype.state

../../libiberty/regex.c:6970:11: runtime error: left shift of negative value -1
../../libiberty/regex.c:7165:4: runtime error: left shift of negative value -1


The debugger shows:

Breakpoint 3, byte_re_match_2_internal (bufp=bufp@entry=0x7fffffffda70,
string1=string1@entry=0x0, size1=size1@entry=0, string2=string2@entry=0x93773d
"../../gcc/objc/objc-next-runtime-abi-02.c", size2=size2@entry=41,
pos=pos@entry=0, regs=0x7fffffffda50, stop=41)
    at ../../libiberty/regex.c:6970
6970              EXTRACT_NUMBER_AND_INCR (mcnt, p);

(gdb) p p
$3 = (unsigned char *) 0xb80116 "\362\377\002\001/\a\002"

(gdb) p mcnt
$4 = <optimized out>

(gdb) bt
#0  byte_re_match_2_internal (bufp=bufp@entry=0x7fffffffda70,
string1=string1@entry=0x0, size1=size1@entry=0, string2=string2@entry=0x93773d
"../../gcc/objc/objc-next-runtime-abi-02.c", size2=size2@entry=41,
pos=pos@entry=0, regs=0x7fffffffda50, stop=41)
    at ../../libiberty/regex.c:6970
#1  0x0000000000439f63 in byte_re_search_2 (bufp=bufp@entry=0x7fffffffda70,
string1=string1@entry=0x0, size1=size1@entry=0, string2=string2@entry=0x93773d
"../../gcc/objc/objc-next-runtime-abi-02.c", size2=size2@entry=41,
startpos=startpos@entry=0, range=1,
    regs=0x7fffffffda50, stop=41) at ../../libiberty/regex.c:5208
#2  0x00000000004442e8 in xre_search_2 (stop=<optimized out>, regs=<optimized
out>, range=<optimized out>, startpos=0, size2=<optimized out>,
string2=0x93773d "../../gcc/objc/objc-next-runtime-abi-02.c", size1=0,
string1=0x0, bufp=<optimized out>)
    at ../../libiberty/regex.c:4961
#3  xre_search (regs=<optimized out>, range=<optimized out>, startpos=0,
size=<optimized out>, string=0x93773d
"../../gcc/objc/objc-next-runtime-abi-02.c", bufp=<optimized out>) at
../../libiberty/regex.c:4921
#4  xregexec (preg=0xb87f80, string=0x93773d
"../../gcc/objc/objc-next-runtime-abi-02.c", nmatch=10, pmatch=0x7fffffffdb30,
eflags=<optimized out>) at ../../libiberty/regex.c:8036
#5  0x0000000000413a29 in get_output_file_with_visibility (inpf=0x937730) at
../../gcc/gengtype.c:2221
#6  0x000000000041a148 in write_func_for_structure (orig_s=0x9377b0,
s=0x9377b0, wtd=0x4743e0 <ggc_wtd>) at ../../gcc/gengtype.c:3512
#7  0x000000000041b80c in write_types (output_header=<optimized out>,
structures=<optimized out>, wtd=0x4743e0 <ggc_wtd>) at
../../gcc/gengtype.c:3786
#8  0x0000000000404acd in main (argc=<optimized out>, argv=<optimized out>) at
../../gcc/gengtype.c:5368