https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104009
Bug ID: 104009
Summary: r12-6030-g422f9eb7011b76c1 breaks kernel build
Product: gcc
Version: 12.0
Status: UNCONFIRMED
Severity: normal
Priority: P3
Component: tree-optimization
Assignee: unassigned at gcc dot gnu.org
Reporter: siddhesh at gcc dot gnu.org
Target Milestone: ---
Reproducer gleaned from the kernel:
const char *
nlmdbg_cookie2a(unsigned n, char **data)
{
static char buf[255];
unsigned int i, len = sizeof(buf);
char *p = buf;
len--; /* allow for trailing \0 */
for (i = 0 ; i < n ; i++)
{
if (len < 2)
{
__builtin___strcpy_chk(p-3, "...", __builtin_object_size (p-3, 1));
break;
}
p += 2;
len -= 2;
}
*p = '\0';
return buf;
}
$ cat repr.c.031t.early_objsz
;; Function nlmdbg_cookie2a (nlmdbg_cookie2a, funcdef_no=0, decl_uid=1980,
cgraph_uid=1, symbol_order=0)
Computing maximum subobject size for _1:
Visiting use-def links for _1
Visiting use-def links for p_6
Visiting use-def links for p_9
Visiting use-def links for p_14
Found a dependency loop at p_6
Need to reexamine p_14
Need to reexamine p_6
Need to reexamine _1
Visiting use-def links for _1
Need to reexamine _1
Reexamining _1
Visiting use-def links for p_6
Need to reexamine p_6
Reexamining p_6
Visiting use-def links for p_14
Need to reexamine p_14
Reexamining p_14
_1: maximum subobject size 0
p_6: maximum subobject size 255
p_9: maximum subobject size 255
p_14: maximum subobject size 253
const char * nlmdbg_cookie2a (unsigned int n, char * * data)
{
char * p;
unsigned int len;
unsigned int i;
static char buf[255];
char * _1;
long unsigned int _2;
char * _3;
const char * _19;
long unsigned int _20;
<bb 2> :
len_8 = 255;
p_9 = &buf;
len_10 = len_8 + 4294967295;
i_11 = 0;
goto <bb 6>; [INV]
<bb 3> :
if (len_5 <= 1)
goto <bb 4>; [INV]
else
goto <bb 5>; [INV]
<bb 4> :
_1 = p_6 + 18446744073709551613;
_20 = __builtin_object_size (_1, 1);
_2 = MIN_EXPR <_20, 0>;
_3 = p_6 + 18446744073709551613;
__builtin___memcpy_chk (_3, "...", 4, _2);
goto <bb 7>; [INV]
<bb 5> :
p_14 = p_6 + 2;
len_15 = len_5 + 4294967294;
i_16 = i_4 + 1;
<bb 6> :
# i_4 = PHI <i_11(2), i_16(5)>
# len_5 = PHI <len_10(2), len_15(5)>
# p_6 = PHI <p_9(2), p_14(5)>
if (i_4 < n_12(D))
goto <bb 3>; [INV]
else
goto <bb 7>; [INV]
<bb 7> :
*p_6 = 0;
_19 = &buf;
return _19;
}
Basically since p_6 is an estimate (i.e. the wholesize) and not a precise
value, negative offsets don't quite work. I need to figure out a way to punt
on negative offsets if we're using size estimates instead of precise sizes.
This means that it'll work for dynamic object sizes (because at the moment
they're always precise expressions) but not always for static sizes.
Right now it breaks for dynamic object sizes too, but that's only because
early_objsz treats __builtin_dynamic_object_size as __builtin_object_size to
get an upper bound and ends up zeroing it. So punting should fix that too.
