From 81a68b9e3774401a99719ea29640d13125745b41 Mon Sep 17 00:00:00 2001 From: Jakub Jelinek Date: Wed, 15 Jan 2020 01:31:20 +0100 Subject: [PATCH] tree-optimization: Fix tree dse of __*_chk PR93262 The following testcase shows that GCC trunk mishandles DSE of __*_chk calls. Tail trimming of the calls is fine, we want to just decrease the third argument and keep the first two and last arguments unmodified. But for head trimming, we currently increment the two by head_trim and decrease the third by head_trim, so __builtin___memcpy_chk (&a, b_2(D), 48, 32); __builtin_memset (&a, 32, 16); into: _5 = b_2(D) + 16; __builtin___memcpy_chk (&MEM [(void *)&a + 16B], _5, 32, 32); __builtin_memset (&a, 32, 16); This is wrong, because the 32 was the determined (maximum) size of the destination (char a[32]), but &a[16] has maximum size of 16, not 32. The __builtin___memcpy_chk (&MEM [(void *)&a + 16B], _5, 32, 32); call is just folded later into __builtin_memcpy (&MEM [(void *)&a + 16B], _5, 32); because it says that it copies as many bytes into destination as the destination has. We need: __builtin___memcpy_chk (&MEM [(void *)&a + 16B], _5, 32, 16); instead, which will terminate the program instead of letting it silently overflow the buffer. The patch just punts if we'd need to decrease the last argument below 0. Fortunately, release branches are unaffected. P.S. it was quite hard to make the runtime test working, in builtins.exp neither dg-options nor dg-additional-options work and builtins.exp adds -fno-tree-dse among several other -fno-* options. Fortunately optimize attribute works. 2020-01-15 Jakub Jelinek PR tree-optimization/93262 * tree-ssa-dse.c (maybe_trim_memstar_call): For *_chk builtins, perform head trimming only if the last argument is constant, either all ones, or larger or equal to head trim, in the latter case decrease the last argument by head_trim. * gcc.c-torture/execute/builtins/pr93262-chk.c: New test. * gcc.c-torture/execute/builtins/pr93262-chk-lib.c: New file. * gcc.c-torture/execute/builtins/pr93262-chk.x: New file. --- gcc/ChangeLog | 6 ++ gcc/testsuite/ChangeLog | 5 ++ .../execute/builtins/pr93262-chk-lib.c | 1 + .../execute/builtins/pr93262-chk.c | 55 +++++++++++++++++++ .../execute/builtins/pr93262-chk.x | 7 +++ gcc/tree-ssa-dse.c | 32 +++++++++++ 6 files changed, 106 insertions(+) create mode 100644 gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk-lib.c create mode 100644 gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.c create mode 100644 gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.x diff --git a/gcc/ChangeLog b/gcc/ChangeLog index 8f4382030b9..56e7995305e 100644 --- a/gcc/ChangeLog +++ b/gcc/ChangeLog @@ -1,5 +1,11 @@ 2020-01-15 Jakub Jelinek + PR tree-optimization/93262 + * tree-ssa-dse.c (maybe_trim_memstar_call): For *_chk builtins, + perform head trimming only if the last argument is constant, + either all ones, or larger or equal to head trim, in the latter + case decrease the last argument by head_trim. + PR tree-optimization/93249 * tree-ssa-dse.c: Include builtins.h and gimple-fold.h. (maybe_trim_memstar_call): Move head_trim and tail_trim vars to diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog index 77d573fed28..2e59f2861c8 100644 --- a/gcc/testsuite/ChangeLog +++ b/gcc/testsuite/ChangeLog @@ -1,5 +1,10 @@ 2020-01-15 Jakub Jelinek + PR tree-optimization/93262 + * gcc.c-torture/execute/builtins/pr93262-chk.c: New test. + * gcc.c-torture/execute/builtins/pr93262-chk-lib.c: New file. + * gcc.c-torture/execute/builtins/pr93262-chk.x: New file. + PR tree-optimization/93249 * gcc.c-torture/execute/pr93249.c: New test. diff --git a/gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk-lib.c b/gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk-lib.c new file mode 100644 index 00000000000..9daf13e827b --- /dev/null +++ b/gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk-lib.c @@ -0,0 +1 @@ +#include "lib/chk.c" diff --git a/gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.c b/gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.c new file mode 100644 index 00000000000..66d86b44b58 --- /dev/null +++ b/gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.c @@ -0,0 +1,55 @@ +/* PR tree-optimization/93262 */ + +extern void abort (void); +typedef __SIZE_TYPE__ size_t; +extern void *memcpy (void *, const void *, size_t); +extern void *memset (void *, int, size_t); + +#include "chk.h" + +char b[32] = "def"; +char a[32] = "abc"; +char c[32] = "ghi"; +int l1; + +__attribute__((noipa, noinline, noclone, optimize ("tree-dse"))) void +foo (char *b) +{ + memcpy (a, b, 48); + memset (a, ' ', 16); +} + +__attribute__((noipa, noinline, noclone, optimize ("tree-dse"))) void +bar (void) +{ + memset (a, ' ', 48); + memset (a, '0', 16); +} + +void +main_test (void) +{ +#ifndef __OPTIMIZE__ + /* Object size checking is only intended for -O[s123]. */ + return; +#endif + __asm ("" : "=r" (l1) : "0" (l1)); + chk_calls = 0; + chk_fail_allowed = 1; + /* Runtime checks. */ + if (__builtin_setjmp (chk_fail_buf) == 0) + { + foo ("0123456789abcdeffedcba9876543210ghijklmnopqrstuv"); + if (!l1) + abort (); + } + if (__builtin_setjmp (chk_fail_buf) == 0) + { + bar (); + if (!l1) + abort (); + } + if (chk_calls != 2) + abort (); + return 0; +} diff --git a/gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.x b/gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.x new file mode 100644 index 00000000000..6f4746d43fb --- /dev/null +++ b/gcc/testsuite/gcc.c-torture/execute/builtins/pr93262-chk.x @@ -0,0 +1,7 @@ +load_lib target-supports.exp + +if { ! [check_effective_target_nonlocal_goto] } { + return 1 +} + +return 0 diff --git a/gcc/tree-ssa-dse.c b/gcc/tree-ssa-dse.c index cb64d6fe83a..374143e5785 100644 --- a/gcc/tree-ssa-dse.c +++ b/gcc/tree-ssa-dse.c @@ -508,6 +508,22 @@ maybe_trim_memstar_call (ao_ref *ref, sbitmap live, gimple *stmt) /* Head trimming requires adjusting all the arguments. */ if (head_trim) { + /* For __*_chk need to adjust also the last argument. */ + if (gimple_call_num_args (stmt) == 4) + { + tree size = gimple_call_arg (stmt, 3); + if (!tree_fits_uhwi_p (size)) + break; + if (!integer_all_onesp (size)) + { + unsigned HOST_WIDE_INT sz = tree_to_uhwi (size); + if (sz < (unsigned) head_trim) + break; + tree arg = wide_int_to_tree (TREE_TYPE (size), + sz - head_trim); + gimple_call_set_arg (stmt, 3, arg); + } + } tree *dst = gimple_call_arg_ptr (stmt, 0); increment_start_addr (stmt, dst, head_trim); tree *src = gimple_call_arg_ptr (stmt, 1); @@ -527,6 +543,22 @@ maybe_trim_memstar_call (ao_ref *ref, sbitmap live, gimple *stmt) /* Head trimming requires adjusting all the arguments. */ if (head_trim) { + /* For __*_chk need to adjust also the last argument. */ + if (gimple_call_num_args (stmt) == 4) + { + tree size = gimple_call_arg (stmt, 3); + if (!tree_fits_uhwi_p (size)) + break; + if (!integer_all_onesp (size)) + { + unsigned HOST_WIDE_INT sz = tree_to_uhwi (size); + if (sz < (unsigned) head_trim) + break; + tree arg = wide_int_to_tree (TREE_TYPE (size), + sz - head_trim); + gimple_call_set_arg (stmt, 3, arg); + } + } tree *dst = gimple_call_arg_ptr (stmt, 0); increment_start_addr (stmt, dst, head_trim); decrement_count (stmt, head_trim); -- 2.30.2