[Bug tree-optimization/63288] [5 Regression] gcc.c-torture/execute/20140326-1.c FAILs with -Og -fgcse -fif-conversion2

[bernd.edlinger at hotmail dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63288

Bernd Edlinger  changed:

   What|Removed |Added

 CC||bernd.edlinger at hotmail dot 
de

--- Comment #7 from Bernd Edlinger  ---
I always wondered if it could be possible to have out-of
bounds accesses via the argument pointer too, that means
accessing an non-existent argument,
maybe a large var-arg, which is not given, like this

int f(int x, ...)
{
  if (x != 0)
  {
 va_list ap;
 va_start(ap, x);

 type z = va_arg(ap, type);
  }
}

[Bug tree-optimization/63288] [5 Regression] gcc.c-torture/execute/20140326-1.c FAILs with -Og -fgcse -fif-conversion2

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63288

Eric Botcazou  changed:

   What|Removed |Added

 Status|NEW |RESOLVED
 Resolution|--- |DUPLICATE

--- Comment #6 from Eric Botcazou  ---
Let's stop using random set of options...

*** This bug has been marked as a duplicate of bug 61047 ***

[Bug tree-optimization/63288] [5 Regression] gcc.c-torture/execute/20140326-1.c FAILs with -Og -fgcse -fif-conversion2

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63288

Jakub Jelinek  changed:

   What|Removed |Added

 CC||ebotcazou at gcc dot gnu.org,
   ||jakub at gcc dot gnu.org

--- Comment #5 from Jakub Jelinek  ---
PR60452 only taught rtx_addr_can_trap_p_1 about frame_pointer + offset,
the others are not handled right now:
  /* ??? Need to add a similar guard for nonsensical offsets.  */
  if (x == hard_frame_pointer_rtx
  || x == stack_pointer_rtx
  /* The arg pointer varies if it is not a fixed register.  */
  || (x == arg_pointer_rtx && fixed_regs[ARG_POINTER_REGNUM]))
return 0;
In this particular case it is the stack_pointer_rtx.
The question is how to derive limits on what is and what is not acceptable
around stack_pointer_rtx.  Negative range needs to include red zone range if
any, positive can be very large if the current function uses VLAs or alloca
(but then hopefully the nonsensical offsets are used against frame/hard frame
pointer, not stack pointer).

[Bug tree-optimization/63288] [5 Regression] gcc.c-torture/execute/20140326-1.c FAILs with -Og -fgcse -fif-conversion2

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63288

--- Comment #4 from Zdenek Sojka  ---
(In reply to Marek Polacek from comment #3)
> Started with r210492.

In that case the issue might be latent at least in 4_9.

[Bug tree-optimization/63288] [5 Regression] gcc.c-torture/execute/20140326-1.c FAILs with -Og -fgcse -fif-conversion2

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63288

Marek Polacek  changed:

   What|Removed |Added

 CC||mpolacek at gcc dot gnu.org

--- Comment #3 from Marek Polacek  ---
Started with r210492.

[Bug tree-optimization/63288] [5 Regression] gcc.c-torture/execute/20140326-1.c FAILs with -Og -fgcse -fif-conversion2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63288

Richard Biener  changed:

   What|Removed |Added

   Priority|P3  |P1
 Status|UNCONFIRMED |NEW
   Last reconfirmed||2014-11-24
 Ever confirmed|0   |1

--- Comment #2 from Richard Biener  ---
Confirmed.

[Bug tree-optimization/63288] [5 Regression] gcc.c-torture/execute/20140326-1.c FAILs with -Og -fgcse -fif-conversion2

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63288

--- Comment #1 from Zdenek Sojka  ---
The original testcase also fails with a very different set of flags:
$ gcc -Os -fno-if-conversion -fsched2-use-superblocks
--param=tracer-min-branch-probability=14 20140326-1.i
$ valgrind -q ./a.out 
==8525== Invalid read of size 1
==8525==at 0x40043A: main (in /home/smatz/Downloads/xx/a.out)
==8525==  Address 0xfff01f9e6 is not stack'd, malloc'd or (recently) free'd
==8525== 
==8525== 
==8525== Process terminating with default action of signal 11 (SIGSEGV)
==8525==  Access not within mapped region at address 0xFFF01F9E6
==8525==at 0x40043A: main (in /home/smatz/Downloads/xx/a.out)
==8525==  If you believe this happened as a result of a stack
==8525==  overflow in your program's main thread (unlikely but
==8525==  possible), you can try to increase the size of the
==8525==  main thread stack using the --main-stacksize= flag.
==8525==  The main thread stack size used in this run was 8388608.
Segmentation fault

[Bug tree-optimization/63288] [5 Regression] gcc.c-torture/execute/20140326-1.c FAILs with -Og -fgcse -fif-conversion2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63288

Richard Biener  changed:

   What|Removed |Added

   Target Milestone|--- |5.0