https://gcc.gnu.org/bugzilla/show_bug.cgi?id=114877
--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> --- The master branch has been updated by Jakub Jelinek <ja...@gcc.gnu.org>: https://gcc.gnu.org/g:d19b0682f18f9f5217aee8002e3d04f8ded04ae8 commit r15-7153-gd19b0682f18f9f5217aee8002e3d04f8ded04ae8 Author: Jakub Jelinek <ja...@redhat.com> Date: Thu Jan 23 11:11:23 2025 +0100 builtins: Store unspecified value to *exp for inf/nan [PR114877] The fold_builtin_frexp folding for NaN/Inf just returned the first argument with evaluating second arguments side-effects, rather than storing something to what the second argument points to. The PR argues that the C standard requires the function to store something there but what exactly is stored is unspecified, so not storing there anything can result in UB if the value isn't initialized and is read later. glibc and newlib store there 0, musl apparently doesn't store anything. The following patch stores there zero (or would you prefer storing there some other value, 42, INT_MAX, INT_MIN, etc.?; zero is cheapest to form in assembly though) and adjusts the test so that it doesn't rely on not storing there anything but instead checks for -Wmaybe-uninitialized warning to find out that something has been stored there. Unfortunately I had to disable the NaN tests for -O0, while we can fold __builtin_isnan (__builtin_nan ("")) at compile time, we can't fold __builtin_isnan ((i = 0, __builtin_nan (""))) at compile time. fold_builtin_classify uses just tree_expr_nan_p and if that isn't true (because expr is a COMPOUND_EXPR with tree_expr_nan_p on the second arg), it does arg = builtin_save_expr (arg); return fold_build2_loc (loc, UNORDERED_EXPR, type, arg, arg); and that isn't folded at -O0 further, as we wrap it into SAVE_EXPR and nothing propagates the NAN to the comparison. I think perhaps tree_expr_nan_p etc. could have case COMPOUND_EXPR: added and recurse on the second argument, but that feels like stage1 material to me if we want to do that at all. 2025-01-23 Jakub Jelinek <ja...@redhat.com> PR middle-end/114877 * builtins.cc (fold_builtin_frexp): Handle rvc_nan and rvc_inf cases like rvc_zero, return passed in arg and set *exp = 0. * gcc.dg/torture/builtin-frexp-1.c: Add -Wmaybe-uninitialized as dg-additional-options. (bar): New function. (TESTIT_FREXP2): Rework the macro so that it doesn't test whether nothing has been stored to what the second argument points to, but instead that something has been stored there, whatever it is. (main): Temporarily don't enable the nan tests for -O0.
