http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54795
--- Comment #13 from H.J. Lu <hjl.tools at gmail dot com> 2012-11-19 21:04:12 UTC --- On hjl/asan branch, I got (gdb) r Starting program: /export/build/gnu/gcc-lto-asan/build-x86_64-linux/prev-gcc/cc1 -fpreprocessed /tmp/x.i -quiet -dumpbase x.i -mtune=generic -march=x86-64 -auxbase x -version -flto -o x.s [Thread debugging using libthread_db enabled] Using host libthread_db library "/lib64/libthread_db.so.1". GNU C (GCC) version 4.8.0 20121117 (experimental) (x86_64-unknown-linux-gnu) compiled by GNU C version 4.8.0 20121117 (experimental), GMP version 5.0.2, MPFR version 3.1.0, MPC version 0.9 GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096 GNU C (GCC) version 4.8.0 20121117 (experimental) (x86_64-unknown-linux-gnu) compiled by GNU C version 4.8.0 20121117 (experimental), GMP version 5.0.2, MPFR version 3.1.0, MPC version 0.9 GGC heuristics: --param ggc-min-expand=30 --param ggc-min-heapsize=4096 Compiler executable checksum: 0e1eacd90672aa3f29692f9d3d99b1be ================================================================= Breakpoint 5, __asan_report_error (pc=25644090, bp=140737488345632, sp=140737488345624, addr=34167900, is_write=<optimized out>, access_size=4) at /export/gnu/import/git/gcc/libsanitizer/asan/asan_report.cc:464 464 bug_descr, (void*)addr, pc, bp, sp); (gdb) bt #0 __asan_report_error (pc=25644090, bp=140737488345632, sp=140737488345624, addr=34167900, is_write=<optimized out>, access_size=4) at /export/gnu/import/git/gcc/libsanitizer/asan/asan_report.cc:464 #1 0x0000000001f6bc04 in __asan::__asan_report_load4 (addr=<optimized out>) at /export/gnu/import/git/gcc/libsanitizer/asan/asan_rtl.cc:194 #2 0x0000000001874c3a in lto_write_options () at /export/gnu/import/git/gcc/gcc/lto-opts.c:92 #3 0x000000000135e932 in produce_asm_for_decls () at /export/gnu/import/git/gcc/gcc/lto-streamer-out.c:1407 #4 0x00000000012a3458 in ipa_write_summaries_2(opt_pass*, lto_out_decl_state*) [clone .565573] (pass=0x2689880 <pass_ipa_lto_finish_out>, state=0x7ffff18cce40) at /export/gnu/import/git/gcc/gcc/passes.c:2430 #5 0x000000000135b2a0 in ipa_write_summaries_1 (encoder=0x7ffff7d6c5c0) at /export/gnu/import/git/gcc/gcc/passes.c:2460 #6 ipa_write_summaries () at /export/gnu/import/git/gcc/gcc/passes.c:2514 #7 0x0000000000b16399 in ipa_passes () at /export/gnu/import/git/gcc/gcc/cgraphunit.c:1908 #8 compile () at /export/gnu/import/git/gcc/gcc/cgraphunit.c:1994 #9 0x0000000000b16d2a in finalize_compilation_unit () at /export/gnu/import/git/gcc/gcc/cgraphunit.c:2122 #10 0x0000000000b17271 in c_write_global_declarations () at /export/gnu/import/git/gcc/gcc/c/c-decl.c:10128 #11 0x0000000000b2c258 in compile_file () ---Type <return> to continue, or q <return> to quit--- at /export/gnu/import/git/gcc/gcc/toplev.c:559 #12 0x0000000000b2e4b0 in do_compile () at /export/gnu/import/git/gcc/gcc/toplev.c:1881 #13 toplev_main (argc=14, argv=0x7fffffffe108) at /export/gnu/import/git/gcc/gcc/toplev.c:1957 #14 0x00000038f3a21675 in __libc_start_main () from /lib64/libc.so.6 #15 0x000000000056df51 in _start () (gdb) c Continuing. ==1834== ERROR: AddressSanitizer global-buffer-overflow on address 0x000002095c5c at pc 0x1874c3a bp 0x7fffffffda20 sp 0x7fffffffda18 READ of size 4 at 0x000002095c5c thread T0 #0 0x1874c39 (/export/build/gnu/gcc-lto-asan/build-x86_64-linux/prev-gcc/cc1+0x1874c39) 0x000002095c5c is located 4 bytes to the left of global variable '__FUNCTION__ (/tmp/ccHvMX0o.ltrans5.o)' (0x2095c60) of size 22 '__FUNCTION__ (/tmp/ccHvMX0o.ltrans5.o)' is ascii string 'c_parser_if_statement' 0x000002095c5c is located 30 bytes to the right of global variable '__FUNCTION__ (/tmp/ccHvMX0o.ltrans5.o)' (0x2095c20) of size 30 '__FUNCTION__ (/tmp/ccHvMX0o.ltrans5.o)' is ascii string 'c_parser_declaration_or_fndef' Shadow byte and word: 0x100000412b8b: f9 0x100000412b88: f9 f9 f9 f9 00 00 06 f9 More shadow bytes: 0x100000412b68: f9 f9 f9 f9 00 00 03 f9 0x100000412b70: f9 f9 f9 f9 00 00 06 f9 0x100000412b78: f9 f9 f9 f9 00 00 03 f9 0x100000412b80: f9 f9 f9 f9 00 00 00 06 =>0x100000412b88: f9 f9 f9 f9 00 00 06 f9 0x100000412b90: f9 f9 f9 f9 00 00 00 02 0x100000412b98: f9 f9 f9 f9 00 00 00 01 0x100000412ba0: f9 f9 f9 f9 00 00 06 f9 0x100000412ba8: f9 f9 f9 f9 00 00 04 f9 Stats: 2M malloced (2M for red zones) by 3332 calls Stats: 0M realloced by 285 calls Stats: 1M freed by 1187 calls Stats: 0M really freed by 0 calls Stats: 8M (2059 full pages) mmaped in 16 calls mmaps by size class: 7:4095; 8:2047; 9:1023; 10:511; 11:255; 12:128; 13:64; 14:32; 15:16; 16:8; 17:20; 18:2; mallocs by size class: 7:2075; 8:747; 9:65; 10:95; 11:226; 12:52; 13:44; 14:1; 15:5; 16:1; 17:20; 18:1; frees by size class: 7:457; 8:359; 9:46; 10:80; 11:154; 12:46; 13:20; 14:1; 15:4; 17:20; rfrees by size class: Stats: malloc large: 27 small slow: 54 ==1834== ABORTING [Inferior 1 (process 1834) exited with code 01] (gdb)