[Bug testsuite/92955] [10 regression] gcc.dg/vect/pr60505.c fails starting with r279392

2020-01-17 Thread msc at linux dot ibm.com 
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92955

Matheus Castanho  changed:

   What|Removed |Added

 CC||msc at linux dot ibm.com

--- Comment #3 from Matheus Castanho  ---
A very similar issue is affecting glibc builds with GCC 10 on powerpc64le. But
it's only failing with -O3 (-O2 is fine). Here's another reproducer in case it
helps (derived from code from iconv):

$ cat overflow-reproducer.c
#include 
typedef struct state {
int count;
char bytes[4];
} state_t;
void foo (
  state_t *state,
  const unsigned char **inptrp,
  const unsigned char *inend)
{
  const unsigned char *inptr = *inptrp;
  size_t inlen;
  for (inlen = 0; inlen < (size_t) (state->count & 7); ++inlen)
/* do something */;
  if (inptr + (4 - inlen) > inend)
{
  while (inptr < inend)
state->bytes[inlen++] = *inptr++;
}
}

$ gcc -O3 -Wall -c overflow-reproducer.c
overflow-reproducer.c: In function ‘foo’:
overflow-reproducer.c:22:31: warning: writing 1 byte into a region of size 0
[-Wstringop-overflow=]
   22 | state->bytes[inlen++] = *inptr++;
  | ~~^~
overflow-reproducer.c:5:10: note: at offset [4, 11] to object ‘bytes’ with size
4 declared here
5 | char bytes[4];
  |  ^

[Bug testsuite/92955] [10 regression] gcc.dg/vect/pr60505.c fails starting with r279392

2020-01-17 Thread rguenth at gcc dot gnu.org 
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92955

Richard Biener  changed:

   What|Removed |Added

 Status|NEW |WAITING

--- Comment #2 from Richard Biener  ---
Can you attach preprocessed source?

[Bug testsuite/92955] [10 regression] gcc.dg/vect/pr60505.c fails starting with r279392

2020-01-08 Thread rguenth at gcc dot gnu.org 
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92955

Richard Biener  changed:

   What|Removed |Added

   Target Milestone|--- |10.0

[Bug testsuite/92955] [10 regression] gcc.dg/vect/pr60505.c fails starting with r279392

2019-12-16 Thread msebor at gcc dot gnu.org 
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=92955

Martin Sebor  changed:

   What|Removed |Added

   Keywords||diagnostic
 Status|UNCONFIRMED |NEW
   Last reconfirmed||2019-12-16
 Ever confirmed|0   |1

--- Comment #1 from Martin Sebor  ---
I cannot reproduce the warnings with my powerpc64le cross compiler, either at
-O2 or -O3 when the loop is fully unrolled, or with any other options I tried
(e.g., -mcpu=power8 and -mcpu=power9), but I did manage to reproduce it with a
powerpc64-linux cross.  The -maltivec option makes a difference.

Below are parts of the dump of the function the warning sees and that cause the
some of the warnings.  The warning is working correctly -- the out-of-bounds
accesses are in the IL.  It looks like they are introduced by jump threading.

Suppressing the new warning by -Wno-stringop-truncation doesn't seem
appropriate because the test was added to verify no warning (originally
-Warray-bounds) is issued for such accesses.  I don't know why they only show
up with the powerpc64 back end and not others.

foo (char * in, char * out, int num)
{
  ...
  char ovec[16];
  ...
   [local count: 118111600]:
  ovec = "\x00";
  if (num_13(D) > 0)
goto ; [89.00%]
  else
goto ; [11.00%]

   [local count: 105119324]:
  _10 = (unsigned int) num_13(D);
  _9 = _10 + 4294967295;
  addr2int0_27 = (signed long) out_14(D);
  andmask_21 = addr2int0_27 & 15;
  _26 = _9 > 14;
  _22 = andmask_21 == 0;
  _30 = in_17(D) + 1;
  _31 = out_14(D) - _30;
  _32 = (sizetype) _31;
  _33 = _32 > 14;
  _76 = _33 & _22;
  _34 = _76 & _26;
  if (_34 != 0)
goto ; [80.00%]
  else
goto ; [20.00%]

   [local count: 84095460]:
  bnd.6_56 = _10 >> 4;
  in_60 = in_17(D) & -16B;
  vect__3.9_61 = MEM  [(char *)in_60];
  vect__3.12_62 = __builtin_altivec_mask_for_load (in_17(D));
  vectp_in.15_64 = in_17(D) + 15;
  vectp_in.14_67 = vectp_in.15_64 & -16B;
  vect__3.16_68 = MEM  [(char *)vectp_in.14_67];
  vect__3.17_69 = REALIGN_LOAD ;
  MEM  [(char *)] = vect__3.17_69;
  MEM  [(char *)out_14(D)] = vect__3.17_69;
  vectp_in.14_66 = vectp_in.15_64 + 16;
  vectp_out.20_74 = out_14(D) + 16;
  niters_vector_mult_vf.7_57 = bnd.6_56 << 4;
  tmp.8_58 = (int) niters_vector_mult_vf.7_57;
  if (_10 == niters_vector_mult_vf.7_57)
goto ; [6.25%]
  else
goto ; [93.75%]

   [local count: 78839493]:
  _205 = (sizetype) tmp.8_58;
  _206 = in_17(D) + 16;
  _207 = *_206;
  ovec[tmp.8_58] = _207;
  _209 = vectp_out.20_74;
  MEM[(char *)vectp_out.20_74] = _207;
  i_211 = tmp.8_58 + 1;
  if (num_13(D) > 17)
goto ; [89.00%]
  else
goto ; [11.00%]

   [local count: 70167152]:
  _214 = 17;
  _215 = in_17(D) + 17;
  _216 = *_215;
  ovec[17] = _216;   <<< index value 17 is out of the bounds of char[16]
  _218 = out_14(D) + 17;
  *_218 = _216;
  i_220 = 18;
  if (num_13(D) > 18)
goto ; [89.00%]
  else
goto ; [11.00%]
  ...
   [local count: 15424248]:
  _48 = 30;
  _49 = in_17(D) + 30;
  _50 = *_49;
  ovec[30] = _50;   <<< index value 30 is out of the bounds of char[16]
  _52 = out_14(D) + 30;
  *_52 = _50;
  i_54 = 31;
  goto ; [100.00%]
  ...