PR profile/28015 (invalid checksum wrt random seed)

[Ulrich Weigand]

Jan Hubicka wrote:

> 2005-10-30  Jan Hubicka  <jh@suse.cz>
> 	PR profile/20815
> 	* coverage.c (coverage_checksum_string): Fix code to stip random seeds
> 	from symbol names while computing checkup.

I'm seeing a compiler crash on a complex test case involving profile-
directed feedback on ppc due to this.  The problem appears to be that

> +      /* C++ namespaces do have scheme:
> +         _GLOBAL__N_<filename>_<wrongmagicnumber>_<magicnumber>functionname
> +       since filename might contain extra underscores there seems
> +       to be no better chance then walk all possible offsets looking
> +       for magicnuber.  */
> +      if (offset)
> +        for (;string[offset]; offset++)
> +        for (i = i + offset; string[i]; i++)

this may access memory beyond the end of the string.  On the first iteration
of the innermost loop, i gets incremented until it points to the end of
"string".  On the next pass of the outer loop, offset gets incremented
and then re-added to i, pointing now somewhere beyond the end of "string".

> +          if (string[i]=='_')
> +            {
> +              int y;
> +
> +              for (y = 1; y < 9; y++)
> +                if (!(string[i + y] >= '0' && string[i + y] <= '9')
> +                    && !(string[i + y] >= 'A' && string[i + y] <= 'F'))
> +                  break;
> +              if (y != 9 || string[i + 9] != '_')
> +                continue;
> +              for (y = 10; y < 18; y++)
> +                if (!(string[i + y] >= '0' && string[i + y] <= '9')
> +                    && !(string[i + y] >= 'A' && string[i + y] <= 'F'))
> +                  break;
> +              if (y != 18)
> +                continue;
> +              if (!dup)
> +                string = dup = xstrdup (string);
> +              for (y = 10; y < 18; y++)
> +                dup[i + y] = '0';
> +            }
> +        break;

I'm not sure I quite understand this whole nested loop construct -- 
this "break" appears to always terminate the very outermost loop,
so what is it for?  Something is wrong here, but I'm not sure
exactly what was intended ...

Bye,
Ulrich

-- 
  Dr. Ulrich Weigand
  Linux on zSeries Development
  Ulrich.Weigand@de.ibm.com