[Bug rtl-optimization/100311] New: UB in sel-sched.c:init_regs_for_mode with -march=armv8-m.base

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100311

            Bug ID: 100311
           Summary: UB in sel-sched.c:init_regs_for_mode with
                    -march=armv8-m.base
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: acoplan at gcc dot gnu.org
  Target Milestone: ---

For the following testcase on arm:

int a;
long long b;
long long c() { return a + b; }

building GCC with -fsanitize=undefined and invoking as:

./arm-eabi-gcc -c test.c -march=armv8-m.base -O2 -fselective-scheduling2

shows the following problems:

/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1080:35: runtime error: index 107
out of bounds for type 'char [107]'
    #0 0x1bad6bc in init_regs_for_mode
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1080
    #1 0x1bad6bc in mark_unavailable_hard_regs
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1242
    #2 0x1bad6bc in find_used_regs
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:3295
    #3 0x1bad6bc in collect_unavailable_regs_from_bnds
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1586
    #4 0x1bad6bc in find_best_reg_for_expr
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1649
    #5 0x1bad6bc in fill_vec_av_set
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:3784
    #6 0x1bb8174 in fill_ready_list
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:4014
    #7 0x1bb8174 in find_best_expr
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:4374
    #8 0x1bb8174 in fill_insns /data_sdb/toolchain/src/gcc/gcc/sel-sched.c:5535
    #9 0x1bb8174 in schedule_on_fences
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7353
    #10 0x1bb8174 in sel_sched_region_2
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7491
    #11 0x1bc2b30 in sel_sched_region_1
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7533
    #12 0x1bc4beb in sel_sched_region(int)
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7634
    #13 0x1bc966d in run_selective_scheduling()
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7720
    #14 0x1b3881c in rest_of_handle_sched2
/data_sdb/toolchain/src/gcc/gcc/sched-rgn.c:3738
    #15 0x1b3881c in execute /data_sdb/toolchain/src/gcc/gcc/sched-rgn.c:3882
    #16 0x1925050 in execute_one_pass(opt_pass*)
/data_sdb/toolchain/src/gcc/gcc/passes.c:2567
    #17 0x1927afc in execute_pass_list_1
/data_sdb/toolchain/src/gcc/gcc/passes.c:2656
    #18 0x1927aba in execute_pass_list_1
/data_sdb/toolchain/src/gcc/gcc/passes.c:2657
    #19 0x1927aba in execute_pass_list_1
/data_sdb/toolchain/src/gcc/gcc/passes.c:2657
    #20 0x1927b57 in execute_pass_list(function*, opt_pass*)
/data_sdb/toolchain/src/gcc/gcc/passes.c:2667
    #21 0xc22722 in cgraph_node::expand()
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:1828
    #22 0xc28a02 in expand_all_functions
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:1992
    #23 0xc28a02 in symbol_table::compile()
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:2356
    #24 0xc33b18 in symbol_table::finalize_compilation_unit()
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:2537
    #25 0x1cc9ceb in compile_file /data_sdb/toolchain/src/gcc/gcc/toplev.c:482
    #26 0x1cd062b in do_compile /data_sdb/toolchain/src/gcc/gcc/toplev.c:2201
    #27 0x1cd062b in toplev::main(int, char**)
/data_sdb/toolchain/src/gcc/gcc/toplev.c:2340
    #28 0x43146ce in main /data_sdb/toolchain/src/gcc/gcc/main.c:39
    #29 0x7ffff6740bf6 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #30 0x645bc9 in _start
(/data_sdb/toolchain/build-arm-eabi-armv8-m.base/install/libexec/gcc/arm-eabi/12.0.0/cc1+0x645bc9)

/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1081:43: runtime error: index 107
out of bounds for type 'char [107]'
    #0 0x1bad6e0 in init_regs_for_mode
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1081
    #1 0x1bad6e0 in mark_unavailable_hard_regs
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1242
    #2 0x1bad6e0 in find_used_regs
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:3295
    #3 0x1bad6e0 in collect_unavailable_regs_from_bnds
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1586
    #4 0x1bad6e0 in find_best_reg_for_expr
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1649
    #5 0x1bad6e0 in fill_vec_av_set
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:3784
    #6 0x1bb8174 in fill_ready_list
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:4014
    #7 0x1bb8174 in find_best_expr
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:4374
    #8 0x1bb8174 in fill_insns /data_sdb/toolchain/src/gcc/gcc/sel-sched.c:5535
    #9 0x1bb8174 in schedule_on_fences
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7353
    #10 0x1bb8174 in sel_sched_region_2
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7491
    #11 0x1bc2b30 in sel_sched_region_1
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7533
    #12 0x1bc4beb in sel_sched_region(int)
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7634
    #13 0x1bc966d in run_selective_scheduling()
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7720
    #14 0x1b3881c in rest_of_handle_sched2
/data_sdb/toolchain/src/gcc/gcc/sched-rgn.c:3738
    #15 0x1b3881c in execute /data_sdb/toolchain/src/gcc/gcc/sched-rgn.c:3882
    #16 0x1925050 in execute_one_pass(opt_pass*)
/data_sdb/toolchain/src/gcc/gcc/passes.c:2567
    #17 0x1927afc in execute_pass_list_1
/data_sdb/toolchain/src/gcc/gcc/passes.c:2656
    #18 0x1927aba in execute_pass_list_1
/data_sdb/toolchain/src/gcc/gcc/passes.c:2657
    #19 0x1927aba in execute_pass_list_1
/data_sdb/toolchain/src/gcc/gcc/passes.c:2657
    #20 0x1927b57 in execute_pass_list(function*, opt_pass*)
/data_sdb/toolchain/src/gcc/gcc/passes.c:2667
    #21 0xc22722 in cgraph_node::expand()
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:1828
    #22 0xc28a02 in expand_all_functions
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:1992
    #23 0xc28a02 in symbol_table::compile()
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:2356
    #24 0xc33b18 in symbol_table::finalize_compilation_unit()
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:2537
    #25 0x1cc9ceb in compile_file /data_sdb/toolchain/src/gcc/gcc/toplev.c:482
    #26 0x1cd062b in do_compile /data_sdb/toolchain/src/gcc/gcc/toplev.c:2201
    #27 0x1cd062b in toplev::main(int, char**)
/data_sdb/toolchain/src/gcc/gcc/toplev.c:2340
    #28 0x43146ce in main /data_sdb/toolchain/src/gcc/gcc/main.c:39
    #29 0x7ffff6740bf6 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #30 0x645bc9 in _start
(/data_sdb/toolchain/build-arm-eabi-armv8-m.base/install/libexec/gcc/arm-eabi/12.0.0/cc1+0x645bc9)

/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1081:43: runtime error: load of
address 0x000009688beb with insufficient space for an object of type 'char'
0x000009688beb: note: pointer points here
 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00 
00 00 01 01 01 01 01
              ^
    #0 0x1bad6f8 in init_regs_for_mode
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1081
    #1 0x1bad6f8 in mark_unavailable_hard_regs
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1242
    #2 0x1bad6f8 in find_used_regs
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:3295
    #3 0x1bad6f8 in collect_unavailable_regs_from_bnds
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1586
    #4 0x1bad6f8 in find_best_reg_for_expr
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:1649
    #5 0x1bad6f8 in fill_vec_av_set
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:3784
    #6 0x1bb8174 in fill_ready_list
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:4014
    #7 0x1bb8174 in find_best_expr
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:4374
    #8 0x1bb8174 in fill_insns /data_sdb/toolchain/src/gcc/gcc/sel-sched.c:5535
    #9 0x1bb8174 in schedule_on_fences
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7353
    #10 0x1bb8174 in sel_sched_region_2
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7491
    #11 0x1bc2b30 in sel_sched_region_1
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7533
    #12 0x1bc4beb in sel_sched_region(int)
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7634
    #13 0x1bc966d in run_selective_scheduling()
/data_sdb/toolchain/src/gcc/gcc/sel-sched.c:7720
    #14 0x1b3881c in rest_of_handle_sched2
/data_sdb/toolchain/src/gcc/gcc/sched-rgn.c:3738
    #15 0x1b3881c in execute /data_sdb/toolchain/src/gcc/gcc/sched-rgn.c:3882
    #16 0x1925050 in execute_one_pass(opt_pass*)
/data_sdb/toolchain/src/gcc/gcc/passes.c:2567
    #17 0x1927afc in execute_pass_list_1
/data_sdb/toolchain/src/gcc/gcc/passes.c:2656
    #18 0x1927aba in execute_pass_list_1
/data_sdb/toolchain/src/gcc/gcc/passes.c:2657
    #19 0x1927aba in execute_pass_list_1
/data_sdb/toolchain/src/gcc/gcc/passes.c:2657
    #20 0x1927b57 in execute_pass_list(function*, opt_pass*)
/data_sdb/toolchain/src/gcc/gcc/passes.c:2667
    #21 0xc22722 in cgraph_node::expand()
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:1828
    #22 0xc28a02 in expand_all_functions
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:1992
    #23 0xc28a02 in symbol_table::compile()
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:2356
    #24 0xc33b18 in symbol_table::finalize_compilation_unit()
/data_sdb/toolchain/src/gcc/gcc/cgraphunit.c:2537
    #25 0x1cc9ceb in compile_file /data_sdb/toolchain/src/gcc/gcc/toplev.c:482
    #26 0x1cd062b in do_compile /data_sdb/toolchain/src/gcc/gcc/toplev.c:2201
    #27 0x1cd062b in toplev::main(int, char**)
/data_sdb/toolchain/src/gcc/gcc/toplev.c:2340
    #28 0x43146ce in main /data_sdb/toolchain/src/gcc/gcc/main.c:39
    #29 0x7ffff6740bf6 in __libc_start_main
(/lib/x86_64-linux-gnu/libc.so.6+0x21bf6)
    #30 0x645bc9 in _start
(/data_sdb/toolchain/build-arm-eabi-armv8-m.base/install/libexec/gcc/arm-eabi/12.0.0/cc1+0x645bc9)