From patchwork Fri Jan 14 03:31:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Siddhesh Poyarekar X-Patchwork-Id: 1579876 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Authentication-Results: bilbo.ozlabs.org; dkim=pass (1024-bit key; unprotected) header.d=gotplt.org header.i=@gotplt.org header.a=rsa-sha1 header.s=gotplt.org header.b=m7Fsm8+l; dkim-atps=neutral Authentication-Results: ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=gcc.gnu.org (client-ip=8.43.85.97; helo=sourceware.org; envelope-from=gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org; receiver=) Received: from sourceware.org (server2.sourceware.org [8.43.85.97]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4JZn0B2MZlz9sP7 for ; Fri, 14 Jan 2022 14:31:36 +1100 (AEDT) Received: from server2.sourceware.org (localhost [IPv6:::1]) by sourceware.org (Postfix) with ESMTP id 8EDB9385AC30 for ; Fri, 14 Jan 2022 03:31:33 +0000 (GMT) X-Original-To: gcc-patches@gcc.gnu.org Delivered-To: gcc-patches@gcc.gnu.org Received: from aye.elm.relay.mailchannels.net (aye.elm.relay.mailchannels.net [23.83.212.6]) by sourceware.org (Postfix) with ESMTPS id BA3663858D37 for ; Fri, 14 Jan 2022 03:31:20 +0000 (GMT) DMARC-Filter: OpenDMARC Filter v1.4.1 sourceware.org BA3663858D37 Authentication-Results: sourceware.org; dmarc=none (p=none dis=none) header.from=gotplt.org Authentication-Results: sourceware.org; spf=pass smtp.mailfrom=gotplt.org X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from relay.mailchannels.net (localhost [127.0.0.1]) by relay.mailchannels.net (Postfix) with ESMTP id 26D6B1208FA; Fri, 14 Jan 2022 03:31:19 +0000 (UTC) Received: from pdx1-sub0-mail-a305.dreamhost.com (unknown [127.0.0.6]) (Authenticated sender: dreamhost) by relay.mailchannels.net (Postfix) with ESMTPA id A1F2E120777; Fri, 14 Jan 2022 03:31:18 +0000 (UTC) X-Sender-Id: dreamhost|x-authsender|siddhesh@gotplt.org Received: from pdx1-sub0-mail-a305.dreamhost.com (pop.dreamhost.com [64.90.62.162]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384) by 100.114.70.224 (trex/6.4.3); Fri, 14 Jan 2022 03:31:19 +0000 X-MC-Relay: Neutral X-MailChannels-SenderId: dreamhost|x-authsender|siddhesh@gotplt.org X-MailChannels-Auth-Id: dreamhost X-Quick-Cure: 5700050f3bc2021a_1642131078911_1832204806 X-MC-Loop-Signature: 1642131078911:440266095 X-MC-Ingress-Time: 1642131078910 Received: from rhbox.redhat.com (unknown [1.186.121.232]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (No client certificate requested) (Authenticated sender: siddhesh@gotplt.org) by pdx1-sub0-mail-a305.dreamhost.com (Postfix) with ESMTPSA id 4JZmzm72mFz31; Thu, 13 Jan 2022 19:31:16 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha1; c=relaxed/relaxed; d=gotplt.org; s=gotplt.org; t=1642131078; bh=UeDqjSnS4LQ73s5a2QTS5+WdNZk=; h=From:To:Cc:Subject:Date:Content-Transfer-Encoding; b=m7Fsm8+lCq5NlWVVdTIJFeP2a8nQFAiO5+N1o/HRtyyKjSIUPKOlDsJaM80rF0YHf H2y9qR/8Uufhb+2iuBcBQrkdkRbWBRcRta49aWSnQZTV8I+PJXDbrz6aHyta6J8qu+ ktWw3hyQF8qQ4eSBvxkDcQV1ZyLWmU37mGZIE0Q0= From: Siddhesh Poyarekar To: gcc-patches@gcc.gnu.org Subject: [PATCH] tree-optimization/104009: Conservative underflow estimate in object size Date: Fri, 14 Jan 2022 09:01:09 +0530 Message-Id: <20220114033109.286522-1-siddhesh@gotplt.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Spam-Status: No, score=-3037.6 required=5.0 tests=BAYES_00, DKIM_SIGNED, DKIM_VALID, DKIM_VALID_AU, DKIM_VALID_EF, GIT_PATCH_0, RCVD_IN_BARRACUDACENTRAL, RCVD_IN_DNSWL_NONE, RCVD_IN_MSPIKE_H3, RCVD_IN_MSPIKE_WL, RCVD_IN_SBL, SPF_HELO_NONE, SPF_PASS, TXREP autolearn=ham autolearn_force=no version=3.4.4 X-Spam-Checker-Version: SpamAssassin 3.4.4 (2020-01-24) on server2.sourceware.org X-BeenThere: gcc-patches@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-patches mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: jakub@redhat.com Errors-To: gcc-patches-bounces+incoming=patchwork.ozlabs.org@gcc.gnu.org Sender: "Gcc-patches" Restrict negative offset computation only to dynamic object sizes, where size expressions are accurate and not a maximum/minimum estimate and in cases where negative offsets definitely mean an underflow, e.g. in MEM_REF of the whole object with negative ofset in addr_object_size. This ends up missing some cases where __builtin_object_size could have come up with more precise results, so tests have been adjusted to reflect that. gcc/ChangeLog: PR tree-optimization/104009 * tree-object-size.c (compute_builtin_object_size): Bail out on negative offset. (plus_stmt_object_size): Return maximum of wholesize and minimum of 0 for negative offset. gcc/testsuite/ChangeLog: PR tree-optimization/104009 * gcc.dg/builtin-object-size-1.c (test10): New test. * gcc.dg/builtin-object-size-3.c (test10): Likewise. (test9): Expect zero size for negative offsets. * gcc.dg/builtin-object-size-4.c (test8): Likewise. * gcc.dg/builtin-object-size-5.c (test7): Drop test for __builtin_object_size. Signed-off-by: Siddhesh Poyarekar --- Testing: - bootstrap build+test for x86_64 - build+test for i686 - bootstrap build --with-build-config=bootstrap-ubsan gcc/testsuite/gcc.dg/builtin-object-size-1.c | 27 ++++++++++++++++ gcc/testsuite/gcc.dg/builtin-object-size-3.c | 34 +++++++++++++++++--- gcc/testsuite/gcc.dg/builtin-object-size-4.c | 6 ++-- gcc/testsuite/gcc.dg/builtin-object-size-5.c | 2 ++ gcc/tree-object-size.c | 15 +++++++-- 5 files changed, 75 insertions(+), 9 deletions(-) diff --git a/gcc/testsuite/gcc.dg/builtin-object-size-1.c b/gcc/testsuite/gcc.dg/builtin-object-size-1.c index 161f426ec0b..b772e2da9b9 100644 --- a/gcc/testsuite/gcc.dg/builtin-object-size-1.c +++ b/gcc/testsuite/gcc.dg/builtin-object-size-1.c @@ -603,6 +603,32 @@ test9 (unsigned cond) #endif } +void +__attribute__ ((noinline)) +test10 (void) +{ + static char buf[255]; + unsigned int i, len = sizeof (buf); + char *p = buf; + + for (i = 0 ; i < sizeof (buf) ; i++) + { + if (len < 2) + { +#ifdef __builtin_object_size + if (__builtin_object_size (p - 3, 0) != sizeof (buf) - i + 3) + abort (); +#else + if (__builtin_object_size (p - 3, 0) != sizeof (buf)) + abort (); +#endif + break; + } + p++; + len--; + } +} + int main (void) { @@ -617,5 +643,6 @@ main (void) test7 (); test8 (); test9 (1); + test10 (); exit (0); } diff --git a/gcc/testsuite/gcc.dg/builtin-object-size-3.c b/gcc/testsuite/gcc.dg/builtin-object-size-3.c index db31171a8bd..44a99189776 100644 --- a/gcc/testsuite/gcc.dg/builtin-object-size-3.c +++ b/gcc/testsuite/gcc.dg/builtin-object-size-3.c @@ -581,7 +581,7 @@ test9 (unsigned cond) if (__builtin_object_size (&p[-4], 2) != (cond ? 6 : 10)) abort (); #else - if (__builtin_object_size (&p[-4], 2) != 6) + if (__builtin_object_size (&p[-4], 2) != 0) abort (); #endif @@ -592,7 +592,7 @@ test9 (unsigned cond) if (__builtin_object_size (p, 2) != ((cond ? 2 : 6) + cond)) abort (); #else - if (__builtin_object_size (p, 2) != 2) + if (__builtin_object_size (p, 2) != 0) abort (); #endif @@ -605,12 +605,37 @@ test9 (unsigned cond) != sizeof (y) - __builtin_offsetof (struct A, c) - 8 + cond) abort (); #else - if (__builtin_object_size (p, 2) - != sizeof (y) - __builtin_offsetof (struct A, c) - 8) + if (__builtin_object_size (p, 2) != 0) abort (); #endif } +void +__attribute__ ((noinline)) +test10 (void) +{ + static char buf[255]; + unsigned int i, len = sizeof (buf); + char *p = buf; + + for (i = 0 ; i < sizeof (buf) ; i++) + { + if (len < 2) + { +#ifdef __builtin_object_size + if (__builtin_object_size (p - 3, 2) != sizeof (buf) - i + 3) + abort (); +#else + if (__builtin_object_size (p - 3, 2) != 0) + abort (); +#endif + break; + } + p++; + len--; + } +} + int main (void) { @@ -625,5 +650,6 @@ main (void) test7 (); test8 (); test9 (1); + test10 (); exit (0); } diff --git a/gcc/testsuite/gcc.dg/builtin-object-size-4.c b/gcc/testsuite/gcc.dg/builtin-object-size-4.c index f644890dd14..b9fddfed036 100644 --- a/gcc/testsuite/gcc.dg/builtin-object-size-4.c +++ b/gcc/testsuite/gcc.dg/builtin-object-size-4.c @@ -489,7 +489,7 @@ test8 (unsigned cond) if (__builtin_object_size (&p[-4], 3) != (cond ? 6 : 10)) abort (); #else - if (__builtin_object_size (&p[-4], 3) != 6) + if (__builtin_object_size (&p[-4], 3) != 0) abort (); #endif @@ -500,7 +500,7 @@ test8 (unsigned cond) if (__builtin_object_size (p, 3) != ((cond ? 2 : 6) + cond)) abort (); #else - if (__builtin_object_size (p, 3) != 2) + if (__builtin_object_size (p, 3) != 0) abort (); #endif @@ -512,7 +512,7 @@ test8 (unsigned cond) if (__builtin_object_size (p, 3) != sizeof (y.c) - 8 + cond) abort (); #else - if (__builtin_object_size (p, 3) != sizeof (y.c) - 8) + if (__builtin_object_size (p, 3) != 0) abort (); #endif } diff --git a/gcc/testsuite/gcc.dg/builtin-object-size-5.c b/gcc/testsuite/gcc.dg/builtin-object-size-5.c index cb8f753b039..d1ad761cb69 100644 --- a/gcc/testsuite/gcc.dg/builtin-object-size-5.c +++ b/gcc/testsuite/gcc.dg/builtin-object-size-5.c @@ -89,6 +89,7 @@ test6 (void) abort (); } +#ifdef __builtin_object_size void test7 (void) { @@ -97,5 +98,6 @@ test7 (void) if (__builtin_object_size (p + 2, 0) != 0) abort (); } +#endif /* { dg-final { scan-assembler-not "abort" } } */ diff --git a/gcc/tree-object-size.c b/gcc/tree-object-size.c index 3a39e6f15bb..8be0df6ba40 100644 --- a/gcc/tree-object-size.c +++ b/gcc/tree-object-size.c @@ -1054,7 +1054,8 @@ compute_builtin_object_size (tree ptr, int object_size_type, ptr = gimple_assign_rhs1 (def); if (((object_size_type & OST_DYNAMIC) - || tree_fits_shwi_p (offset)) + || (tree_fits_shwi_p (offset) + && compare_tree_int (offset, offset_limit) <= 0)) && compute_builtin_object_size (ptr, object_size_type, psize)) { @@ -1346,8 +1347,18 @@ plus_stmt_object_size (struct object_size_info *osi, tree var, gimple *stmt) /* size_for_offset doesn't make sense for -1 size, but it does for size 0 since the wholesize could be non-zero and a negative offset could give a non-zero size. */ - if (!size_unknown_p (bytes, 0)) + if (size_unknown_p (bytes, 0)) + ; + else if ((object_size_type & OST_DYNAMIC) + || compare_tree_int (op1, offset_limit) <= 0) bytes = size_for_offset (bytes, op1, wholesize); + /* In the static case, with a negative offset, the best estimate for + minimum size is size_unknown but for maximum size, the wholesize is a + better estimate than size_unknown. */ + else if (object_size_type & OST_MINIMUM) + bytes = size_unknown (object_size_type); + else + bytes = wholesize; } else bytes = wholesize = size_unknown (object_size_type);