Hi!
The following testcase shows that GCC trunk mishandles DSE of __*_chk
calls. Tail trimming of the calls is fine, we want to just decrease the
third argument and keep the first two and last arguments unmodified.
But for head trimming, we currently increment the two by head_trim and
decrease the third by head_trim, so
__builtin___memcpy_chk (&a, b_2(D), 48, 32);
__builtin_memset (&a, 32, 16);
into:
_5 = b_2(D) + 16;
__builtin___memcpy_chk (&MEM <char> [(void *)&a + 16B], _5, 32, 32);
__builtin_memset (&a, 32, 16);
This is wrong, because the 32 was the determined (maximum) size of the
destination (char a[32]), but &a[16] has maximum size of 16, not 32.
The __builtin___memcpy_chk (&MEM <char> [(void *)&a + 16B], _5, 32, 32);
call is just folded later into
__builtin_memcpy (&MEM <char> [(void *)&a + 16B], _5, 32);
because it says that it copies as many bytes into destination as the
destination has. We need:
__builtin___memcpy_chk (&MEM <char> [(void *)&a + 16B], _5, 32, 16);
instead, which will terminate the program instead of letting it silently
overflow the buffer.
The patch just punts if we'd need to decrease the last argument below 0.
Bootstrapped/regtested on x86_64-linux and i686-linux, ok for trunk?
Fortunately, release branches are unaffected.
P.S. it was quite hard to make the runtime test working, in builtins.exp
neither dg-options nor dg-additional-options work and builtins.exp adds
-fno-tree-dse among several other -fno-* options. Fortunately optimize
attribute works.
2020-01-15 Jakub Jelinek <ja...@redhat.com>
PR tree-optimization/93262
* tree-ssa-dse.c (maybe_trim_memstar_call): For *_chk builtins,
perform head trimming only if the last argument is constant,
either all ones, or larger or equal to head trim, in the latter
case decrease the last argument by head_trim.
* gcc.c-torture/execute/builtins/pr93262-chk.c: New test.
* gcc.c-torture/execute/builtins/pr93262-chk-lib.c: New file.
* gcc.c-torture/execute/builtins/pr93262-chk.x: New file.
--- gcc/tree-ssa-dse.c.jj 2020-01-14 12:13:39.900589819 +0100
+++ gcc/tree-ssa-dse.c 2020-01-14 14:53:09.454382797 +0100
@@ -508,6 +508,22 @@ maybe_trim_memstar_call (ao_ref *ref, sb
/* Head trimming requires adjusting all the arguments. */
if (head_trim)
{
+ /* For __*_chk need to adjust also the last argument. */
+ if (gimple_call_num_args (stmt) == 4)
+ {
+ tree size = gimple_call_arg (stmt, 3);
+ if (!tree_fits_uhwi_p (size))
+ break;
+ if (!integer_all_onesp (size))
+ {
+ unsigned HOST_WIDE_INT sz = tree_to_uhwi (size);
+ if (sz < (unsigned) head_trim)
+ break;
+ tree arg = wide_int_to_tree (TREE_TYPE (size),
+ sz - head_trim);
+ gimple_call_set_arg (stmt, 3, arg);
+ }
+ }
tree *dst = gimple_call_arg_ptr (stmt, 0);
increment_start_addr (stmt, dst, head_trim);
tree *src = gimple_call_arg_ptr (stmt, 1);
@@ -527,6 +543,22 @@ maybe_trim_memstar_call (ao_ref *ref, sb
/* Head trimming requires adjusting all the arguments. */
if (head_trim)
{
+ /* For __*_chk need to adjust also the last argument. */
+ if (gimple_call_num_args (stmt) == 4)
+ {
+ tree size = gimple_call_arg (stmt, 3);
+ if (!tree_fits_uhwi_p (size))
+ break;
+ if (!integer_all_onesp (size))
+ {
+ unsigned HOST_WIDE_INT sz = tree_to_uhwi (size);
+ if (sz < (unsigned) head_trim)
+ break;
+ tree arg = wide_int_to_tree (TREE_TYPE (size),
+ sz - head_trim);
+ gimple_call_set_arg (stmt, 3, arg);
+ }
+ }
tree *dst = gimple_call_arg_ptr (stmt, 0);
increment_start_addr (stmt, dst, head_trim);
decrement_count (stmt, head_trim);
--- gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.c.jj
2020-01-14 14:14:35.976011862 +0100
+++ gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.c 2020-01-14
14:52:42.636785091 +0100
@@ -0,0 +1,55 @@
+/* PR tree-optimization/93262 */
+
+extern void abort (void);
+typedef __SIZE_TYPE__ size_t;
+extern void *memcpy (void *, const void *, size_t);
+extern void *memset (void *, int, size_t);
+
+#include "chk.h"
+
+char b[32] = "def";
+char a[32] = "abc";
+char c[32] = "ghi";
+int l1;
+
+__attribute__((noipa, noinline, noclone, optimize ("tree-dse"))) void
+foo (char *b)
+{
+ memcpy (a, b, 48);
+ memset (a, ' ', 16);
+}
+
+__attribute__((noipa, noinline, noclone, optimize ("tree-dse"))) void
+bar (void)
+{
+ memset (a, ' ', 48);
+ memset (a, '0', 16);
+}
+
+void
+main_test (void)
+{
+#ifndef __OPTIMIZE__
+ /* Object size checking is only intended for -O[s123]. */
+ return;
+#endif
+ __asm ("" : "=r" (l1) : "0" (l1));
+ chk_calls = 0;
+ chk_fail_allowed = 1;
+ /* Runtime checks. */
+ if (__builtin_setjmp (chk_fail_buf) == 0)
+ {
+ foo ("0123456789abcdeffedcba9876543210ghijklmnopqrstuv");
+ if (!l1)
+ abort ();
+ }
+ if (__builtin_setjmp (chk_fail_buf) == 0)
+ {
+ bar ();
+ if (!l1)
+ abort ();
+ }
+ if (chk_calls != 2)
+ abort ();
+ return 0;
+}
--- gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk-lib.c.jj
2020-01-14 14:14:32.834058806 +0100
+++ gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk-lib.c
2020-01-11 16:31:55.023293676 +0100
@@ -0,0 +1 @@
+#include "lib/chk.c"
--- gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.x.jj
2020-01-14 14:14:39.152964410 +0100
+++ gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.x 2020-01-14
14:52:17.881156443 +0100
@@ -0,0 +1,7 @@
+load_lib target-supports.exp
+
+if { ! [check_effective_target_nonlocal_goto] } {
+ return 1
+}
+
+return 0
Jakub
