http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54795
--- Comment #13 from H.J. Lu <hjl.tools at gmail dot com> 2012-11-19 21:04:12
UTC ---
On hjl/asan branch, I got
(gdb) r
Starting program:
/export/build/gnu/gcc-lto-asan/build-x86_64-linux/prev-gcc/cc1 -fpreprocessed
/tmp/x.i -quiet -dumpbase x.i -mtune=generic -march=x86-64 -auxbase x -version
-flto -o x.s
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib64/libthread_db.so.1".
GNU C (GCC) version 4.8.0 20121117 (experimental) (x86_64-unknown-linux-gnu)
compiled by GNU C version 4.8.0 20121117 (experimental), GMP version 5.0.2,
MPFR version 3.1.0, MPC version 0.9
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
GNU C (GCC) version 4.8.0 20121117 (experimental) (x86_64-unknown-linux-gnu)
compiled by GNU C version 4.8.0 20121117 (experimental), GMP version 5.0.2,
MPFR version 3.1.0, MPC version 0.9
GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096
Compiler executable checksum: 0e1eacd90672aa3f29692f9d3d99b1be
=================================================================
Breakpoint 5, __asan_report_error (pc=25644090, bp=140737488345632,
sp=140737488345624, addr=34167900, is_write=<optimized out>, access_size=4)
at /export/gnu/import/git/gcc/libsanitizer/asan/asan_report.cc:464
464 bug_descr, (void*)addr, pc, bp, sp);
(gdb) bt
#0 __asan_report_error (pc=25644090, bp=140737488345632, sp=140737488345624,
addr=34167900, is_write=<optimized out>, access_size=4)
at /export/gnu/import/git/gcc/libsanitizer/asan/asan_report.cc:464
#1 0x0000000001f6bc04 in __asan::__asan_report_load4 (addr=<optimized out>)
at /export/gnu/import/git/gcc/libsanitizer/asan/asan_rtl.cc:194
#2 0x0000000001874c3a in lto_write_options ()
at /export/gnu/import/git/gcc/gcc/lto-opts.c:92
#3 0x000000000135e932 in produce_asm_for_decls ()
at /export/gnu/import/git/gcc/gcc/lto-streamer-out.c:1407
#4 0x00000000012a3458 in ipa_write_summaries_2(opt_pass*, lto_out_decl_state*)
[clone .565573] (pass=0x2689880 <pass_ipa_lto_finish_out>,
state=0x7ffff18cce40) at /export/gnu/import/git/gcc/gcc/passes.c:2430
#5 0x000000000135b2a0 in ipa_write_summaries_1 (encoder=0x7ffff7d6c5c0)
at /export/gnu/import/git/gcc/gcc/passes.c:2460
#6 ipa_write_summaries () at /export/gnu/import/git/gcc/gcc/passes.c:2514
#7 0x0000000000b16399 in ipa_passes ()
at /export/gnu/import/git/gcc/gcc/cgraphunit.c:1908
#8 compile () at /export/gnu/import/git/gcc/gcc/cgraphunit.c:1994
#9 0x0000000000b16d2a in finalize_compilation_unit ()
at /export/gnu/import/git/gcc/gcc/cgraphunit.c:2122
#10 0x0000000000b17271 in c_write_global_declarations ()
at /export/gnu/import/git/gcc/gcc/c/c-decl.c:10128
#11 0x0000000000b2c258 in compile_file ()
---Type <return> to continue, or q <return> to quit---
at /export/gnu/import/git/gcc/gcc/toplev.c:559
#12 0x0000000000b2e4b0 in do_compile ()
at /export/gnu/import/git/gcc/gcc/toplev.c:1881
#13 toplev_main (argc=14, argv=0x7fffffffe108)
at /export/gnu/import/git/gcc/gcc/toplev.c:1957
#14 0x00000038f3a21675 in __libc_start_main () from /lib64/libc.so.6
#15 0x000000000056df51 in _start ()
(gdb) c
Continuing.
==1834== ERROR: AddressSanitizer global-buffer-overflow on address
0x000002095c5c at pc 0x1874c3a bp 0x7fffffffda20 sp 0x7fffffffda18
READ of size 4 at 0x000002095c5c thread T0
#0 0x1874c39
(/export/build/gnu/gcc-lto-asan/build-x86_64-linux/prev-gcc/cc1+0x1874c39)
0x000002095c5c is located 4 bytes to the left of global variable '__FUNCTION__
(/tmp/ccHvMX0o.ltrans5.o)' (0x2095c60) of size 22
'__FUNCTION__ (/tmp/ccHvMX0o.ltrans5.o)' is ascii string
'c_parser_if_statement'
0x000002095c5c is located 30 bytes to the right of global variable
'__FUNCTION__ (/tmp/ccHvMX0o.ltrans5.o)' (0x2095c20) of size 30
'__FUNCTION__ (/tmp/ccHvMX0o.ltrans5.o)' is ascii string
'c_parser_declaration_or_fndef'
Shadow byte and word:
0x100000412b8b: f9
0x100000412b88: f9 f9 f9 f9 00 00 06 f9
More shadow bytes:
0x100000412b68: f9 f9 f9 f9 00 00 03 f9
0x100000412b70: f9 f9 f9 f9 00 00 06 f9
0x100000412b78: f9 f9 f9 f9 00 00 03 f9
0x100000412b80: f9 f9 f9 f9 00 00 00 06
=>0x100000412b88: f9 f9 f9 f9 00 00 06 f9
0x100000412b90: f9 f9 f9 f9 00 00 00 02
0x100000412b98: f9 f9 f9 f9 00 00 00 01
0x100000412ba0: f9 f9 f9 f9 00 00 06 f9
0x100000412ba8: f9 f9 f9 f9 00 00 04 f9
Stats: 2M malloced (2M for red zones) by 3332 calls
Stats: 0M realloced by 285 calls
Stats: 1M freed by 1187 calls
Stats: 0M really freed by 0 calls
Stats: 8M (2059 full pages) mmaped in 16 calls
mmaps by size class: 7:4095; 8:2047; 9:1023; 10:511; 11:255; 12:128; 13:64;
14:32; 15:16; 16:8; 17:20; 18:2;
mallocs by size class: 7:2075; 8:747; 9:65; 10:95; 11:226; 12:52; 13:44;
14:1; 15:5; 16:1; 17:20; 18:1;
frees by size class: 7:457; 8:359; 9:46; 10:80; 11:154; 12:46; 13:20; 14:1;
15:4; 17:20;
rfrees by size class:
Stats: malloc large: 27 small slow: 54
==1834== ABORTING
[Inferior 1 (process 1834) exited with code 01]
(gdb)
