[PATCH][wwwdocs] Mention -freport-bug in release notes

[Yury Gribov]

Hi all,

This is a wwwdocs patch to changes.html to announce -freport-bug flag.

Ok to commit?

-Y
Index: htdocs/gcc-5/changes.html
===
RCS file: /cvs/gcc/wwwdocs/htdocs/gcc-5/changes.html,v
retrieving revision 1.65
diff -c -r1.65 changes.html
*** htdocs/gcc-5/changes.html	14 Jan 2015 11:59:44 -	1.65
--- htdocs/gcc-5/changes.html	16 Jan 2015 09:17:09 -
***
*** 571,576 
--- 571,579 
ul
  liThe codegcc-ar, gcc-nm, gcc-ranlib/code wrappers now
  	understand a code-B/code option to set the compiler to use./li
+ liNew flag code-freport-bug/code has been added.  When enabled,
+ 	the flag automatically generates developer-friendly reprocase when
+ 	internal compiler error is encountered./li
/ul
  /body
  /html

Re: [PATCH][wwwdocs] Mention -freport-bug in release notes

[Yury Gribov]

Hi Gerald,


how about the following variation (which I have not committed yet)?


The wording is good but the patch places the comment into gcc-ar section 
which is wrong. Perhaps make a separate section for driver like this?


-Y
Index: htdocs/gcc-5/changes.html
===
RCS file: /cvs/gcc/wwwdocs/htdocs/gcc-5/changes.html,v
retrieving revision 1.66
diff -u -r1.66 changes.html
--- htdocs/gcc-5/changes.html	17 Jan 2015 11:52:18 -	1.66
+++ htdocs/gcc-5/changes.html	19 Jan 2015 07:37:54 -
@@ -572,5 +572,11 @@
 liThe codegcc-ar, gcc-nm, gcc-ranlib/code wrappers now
 	understand a code-B/code option to set the compiler to use./li
   /ul
+  h3 id=driver/h3
+  ul
+liWhen the new command-line option code-freport-bug/code is
+  used, GCC automatically generates a developer-friendly reproducer
+  whenever an internal compiler error is encountered./li
+  /ul
 /body
 /html

[PATCH] Fix for PR64741 (UBSan/ASan integration)

[Yury Gribov]

Hi all,

As described in https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64741 , 
ASan may currently report false positives for UBSan internal variables 
due to their incomplete type information. This patch fixes this.


Bootstrapped and regtested on Linux x64. Ok to commit?

-Y
commit cf083510ece7b7bde1ab5a41e293b5a6a5bb4550
Author: Yury Gribov y.gri...@samsung.com
Date:   Mon Jan 26 10:19:03 2015 +0300

2015-01-26  Yury Gribov  y.gri...@samsung.com

	PR ubsan/64741

	* ubsan.c (ubsan_type_descriptor): Update type size.

diff --git a/gcc/ubsan.c b/gcc/ubsan.c
index a9df290..7031572 100644
--- a/gcc/ubsan.c
+++ b/gcc/ubsan.c
@@ -504,6 +504,14 @@ ubsan_type_descriptor (tree type, enum ubsan_print_style pstyle)
   tinfo = get_ubsan_type_info_for_type (type);
 
   /* Create a new VAR_DECL of type descriptor.  */
+  const char *tmp = pp_formatted_text (pretty_name);
+  size_t len = strlen (tmp);
+  tree str = build_string (len + 1, tmp);
+  TREE_TYPE (str) = build_array_type (char_type_node,
+  build_index_type (size_int (len)));
+  TREE_READONLY (str) = 1;
+  TREE_STATIC (str) = 1;
+
   char tmp_name[32];
   static unsigned int type_var_id_num;
   ASM_GENERATE_INTERNAL_LABEL (tmp_name, Lubsan_type, type_var_id_num++);
@@ -514,14 +522,12 @@ ubsan_type_descriptor (tree type, enum ubsan_print_style pstyle)
   DECL_ARTIFICIAL (decl) = 1;
   DECL_IGNORED_P (decl) = 1;
   DECL_EXTERNAL (decl) = 0;
+  DECL_SIZE (decl)
+= size_binop (PLUS_EXPR, DECL_SIZE (decl), TYPE_SIZE (TREE_TYPE (str)));
+  DECL_SIZE_UNIT (decl)
+= size_binop (PLUS_EXPR, DECL_SIZE_UNIT (decl),
+		  TYPE_SIZE_UNIT (TREE_TYPE (str)));
 
-  const char *tmp = pp_formatted_text (pretty_name);
-  size_t len = strlen (tmp);
-  tree str = build_string (len + 1, tmp);
-  TREE_TYPE (str) = build_array_type (char_type_node,
-  build_index_type (size_int (len)));
-  TREE_READONLY (str) = 1;
-  TREE_STATIC (str) = 1;
   tree ctor = build_constructor_va (dtype, 3, NULL_TREE,
 build_int_cst (short_unsigned_type_node,
 		   tkind), NULL_TREE,

[PATCHv2][wwwdocs] Mention -freport-bug in release notes

[Yury Gribov]

 On 01/16/2015 12:18 PM, Yury Gribov wrote:

This is a wwwdocs patch to changes.html to announce -freport-bug flag.

Ok to commit?


Hi all,

Second version of patch with updates from Gerald Pfeifer.

Ok to commit?

-Y
? the
Index: htdocs/gcc-5/changes.html
===
RCS file: /cvs/gcc/wwwdocs/htdocs/gcc-5/changes.html,v
retrieving revision 1.72
diff -u -r1.72 changes.html
--- htdocs/gcc-5/changes.html	25 Jan 2015 23:47:32 -	1.72
+++ htdocs/gcc-5/changes.html	26 Jan 2015 08:01:01 -
@@ -599,5 +599,11 @@
 liThe codegcc-ar, gcc-nm, gcc-ranlib/code wrappers now
 	understand a code-B/code option to set the compiler to use./li
   /ul
+  h3 id=driver/h3
+  ul
+liWhen the new command-line option code-freport-bug/code is
+  used, GCC automatically generates a developer-friendly reproducer
+  whenever an internal compiler error is encountered./li
+  /ul
 /body
 /html

[PATCHv2][PING][wwwdocs] Mention -freport-bug in release notes

[Yury Gribov]

On 01/26/2015 11:03 AM, Yury Gribov wrote:

  On 01/16/2015 12:18 PM, Yury Gribov wrote:

This is a wwwdocs patch to changes.html to announce -freport-bug flag.

Ok to commit?


Hi all,

Second version of patch with updates from Gerald Pfeifer.

Ok to commit?


Ping.

-Y

? the
Index: htdocs/gcc-5/changes.html
===
RCS file: /cvs/gcc/wwwdocs/htdocs/gcc-5/changes.html,v
retrieving revision 1.72
diff -u -r1.72 changes.html
--- htdocs/gcc-5/changes.html	25 Jan 2015 23:47:32 -	1.72
+++ htdocs/gcc-5/changes.html	26 Jan 2015 08:01:01 -
@@ -599,5 +599,11 @@
 liThe codegcc-ar, gcc-nm, gcc-ranlib/code wrappers now
 	understand a code-B/code option to set the compiler to use./li
   /ul
+  h3 id=driver/h3
+  ul
+liWhen the new command-line option code-freport-bug/code is
+  used, GCC automatically generates a developer-friendly reproducer
+  whenever an internal compiler error is encountered./li
+  /ul
 /body
 /html

Re: [PATCH] optionally disable global check

[Yury Gribov]

On 03/06/2015 05:23 PM, Marat Zakirov wrote:

Hi all!

Currently !ASAN_GLOBALS disables red-zones for global variables but
keeps their checks. This simple patch disables these checks too.

--Marat


Jakub,

Given that this may be considered a bugfix for --param asan-globals, 
perhaps this is ok for 5.0?



 2015-01-22  Marat Zakirov  m.zaki...@samsung.com

I think you'll want to update dates here.

* asan.c (instrument_derefs): asan-globals=0 disable instrumentation.

s/asan-globals=0 disable instrumentation/Disable instrumentation on 
asan-globals=0./g


-Y

Re: [PINGv2][PATCH] ASan phase place change

[Yury Gribov]

On 03/11/2015 10:43 AM, Marat Zakirov wrote:


On 03/03/2015 10:36 AM, Marat Zakirov wrote:


On 02/24/2015 03:49 PM, Marat Zakirov wrote:


On 02/20/2015 03:07 PM, Jakub Jelinek wrote:

On Fri, Feb 20, 2015 at 02:59:51PM +0300, Marat Zakirov wrote:

Here is simple patch that moves asan phase just behind sanopt for all
O0/O1/O2/O3 modes which gives +7% on x86 SPEC2006 (ref dataset).
Regression testing and sanitized GCC bootstrapping were
successfully done.

This isn't a regression, so I think it isn't appropriate for stage 4.

I bet the difference is mainly vectorization.  I believe the right
change is to teach the vectorizer about the ASAN_CHECK internal call
instead.

Jakub


Jakub,

I reproduced +28% for 433.milk with -fno-tree-vectorize on ref
data. Are there some other GCC vectorization options? And why do you
think that performance difference caused only by vectorization? As an
example In llvm loop hoisting suffers from early asan phase
http://lists.cs.uiuc.edu/pipermail/llvmdev/2011-December/046332.html.


I think it would help if we could analyze where performance improvements 
are coming from. You can check Max's presentation for inspiration 
(http://www.youtube.com/watch?v=qTDBHJsWDHw).


-Y

[PATCH] Skip preprocessor directives in mklog

[Yury Gribov]

Hi all,

Contrib/mklog is currently faked by preprocessor directives inside 
functions to produce invalid ChangeLog.  The attached patch fixes this.


Tested with my local mklog testsuite and http://paste.debian.net/167999/ 
.  Ok to commit?


-Y
commit 23a738d05393676e72db82cb527d5fb1b3060e2f
Author: Yury Gribov y.gri...@samsung.com
Date:   Tue Apr 21 14:17:23 2015 +0300

2015-04-21  Yury Gribov  y.gri...@samsung.com

	* mklog: Ignore preprocessor directives.

diff --git a/contrib/mklog b/contrib/mklog
index f7974a7..455614b 100755
--- a/contrib/mklog
+++ b/contrib/mklog
@@ -131,7 +131,6 @@ sub is_unified_hunk_start {
 }
 
 # Check if line is a top-level declaration.
-# TODO: ignore preprocessor directives except maybe #define ?
 sub is_top_level {
 	my ($function, $is_context_diff) = (@_);
 	if (is_unified_hunk_start ($function)
@@ -143,7 +142,7 @@ sub is_top_level {
 	} else {
 		$function =~ s/^.//;
 	}
-	return $function  $function !~ /^[\s{]/;
+	return $function  $function !~ /^[\s{#]/;
 }
 
 # Read contents of .diff file

Re: [PATCH] Optionally sanitize globals in user-defined sections

[Yury Gribov]

On 04/17/2015 08:29 PM, Andi Kleen wrote:

Yury Gribov y.gri...@samsung.com writes:

+
+static bool
+section_sanitized_p (const char *sec)
+{
+  if (!sanitized_sections)
+return false;
+  size_t len = strlen (sec);
+  const char *p = sanitized_sections;
+  while ((p = strstr (p, sec)))
+{
+  if ((p == sanitized_sections || p[-1] == ',')
+  (p[len] == 0 || p[len] == ','))
+   return true;


No wildcard support? That may be a long option in some cases.


Right. Do you think * will be enough or we also need ? and [a-f] syntax?

-Y

Re: [PATCH] 65479 - sanitizer stack trace missing frames past #0 on powerpc64

[Yury Gribov]

On 04/20/2015 09:23 PM, Jeff Law wrote:

On 04/19/2015 07:48 PM, Martin Sebor wrote:

The attached patch resolves the failures in a number of address
sanitizer tests on powerpc64*-*-*-* discussed in bug 65479 (the
failures in c-c++-common/asan/swapcontext-test-1.c reported in
pr65643 remain unresolved).

The patch has been tested on powerpc64*-*-*-* and x86_64 with
no regressions.

Is this okay for trunk? For 5.1?

Martin

gcc-65479.patch


diff --git a/gcc/testsuite/ChangeLog b/gcc/testsuite/ChangeLog
index b4052ef..18eede3 100644
--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,12 @@
+2015-04-19  Martin Sebormse...@redhat.com
+
+PR sanitizer/65479
+* gcc/testsuite/c-c++-common/asan/misalign-1.c [powerpc*-*-*-*]:
+Use -fno-omit-frame-pointer.  Adjust line numbers and expect exact
+matches.
+* gcc/testsuite/c-c++-common/asan/misalign-2.c: Ditto.
+* gcc/testsuite/c-c++-common/asan/null-deref-1.c: Ditto.

So the ChangeLog doesn't match the patch.  The changelog references
-fno-omit-frame-pointer, but in the patch you actually add
-fasynchronous-unwind-tables.

I also wonder if other targets need -fasynchronous-unwind-tables and
whether or not we should just add it unconditionally.


Perhaps enable unwind tables in GCC spec if -fsanitize=address is 
present? Sanitizer backtraces typically won't work without unwind tables 
anyway so IMHO this makes sense.


BTW why do we need asynchronous tables? Wouldn't simple -funwind-tables 
be enough?


-Y

Re: [PATCH] 65479 - sanitizer stack trace missing frames past #0 on powerpc64

[Yury Gribov]

On 04/20/2015 09:43 PM, Jakub Jelinek wrote:

On Mon, Apr 20, 2015 at 09:38:03PM +0300, Yury Gribov wrote:

--- a/gcc/testsuite/ChangeLog
+++ b/gcc/testsuite/ChangeLog
@@ -1,3 +1,12 @@
+2015-04-19  Martin Sebormse...@redhat.com
+
+PR sanitizer/65479
+* gcc/testsuite/c-c++-common/asan/misalign-1.c [powerpc*-*-*-*]:
+Use -fno-omit-frame-pointer.  Adjust line numbers and expect exact
+matches.
+* gcc/testsuite/c-c++-common/asan/misalign-2.c: Ditto.
+* gcc/testsuite/c-c++-common/asan/null-deref-1.c: Ditto.

So the ChangeLog doesn't match the patch.  The changelog references
-fno-omit-frame-pointer, but in the patch you actually add
-fasynchronous-unwind-tables.

I also wonder if other targets need -fasynchronous-unwind-tables and
whether or not we should just add it unconditionally.


PowerPC really should use the fast unwinding unconditionally, as it always
works there reliably due to the ABI requirements.
So IMHO we shouldn't change the tests this way.


Agreed, I think Martin just wanted a temp workaround until he gets to 
fix PowerPC unwinder in LLVM.



Perhaps enable unwind tables in GCC spec if -fsanitize=address is present?


No.  That is orthogonal to that, most targets enable them by default anyway
and if somebody for some reason asks for something different, we should
honor that.


Sanitizer backtraces typically won't work without unwind tables anyway so
IMHO this makes sense.

BTW why do we need asynchronous tables? Wouldn't simple -funwind-tables be
enough?


-funwind-tables enables them only for functions that can throw, while you
really want it for all functions.


Right but asynchronous tables also enable them for all instructions 
which is quite an overkill.


-Y

Re: [PATCH] Optionally sanitize globals in user-defined sections

[Yury Gribov]

On 04/19/2015 06:11 PM, Jakub Jelinek wrote:

On Sun, Apr 19, 2015 at 10:54:57AM +0300, Yury Gribov wrote:

On 04/17/2015 08:29 PM, Andi Kleen wrote:

Yury Gribov y.gri...@samsung.com writes:

+
+static bool
+section_sanitized_p (const char *sec)
+{
+  if (!sanitized_sections)
+return false;
+  size_t len = strlen (sec);
+  const char *p = sanitized_sections;
+  while ((p = strstr (p, sec)))
+{
+  if ((p == sanitized_sections || p[-1] == ',')
+  (p[len] == 0 || p[len] == ','))
+   return true;


No wildcard support? That may be a long option in some cases.


Right. Do you think * will be enough or we also need ? and [a-f] syntax?


libiberty contains and gcc build utilities already use fnmatch, so you
should just use that (with carefully chosen FNM_* options).


Hi all,

Here is an new patch which adds support for wildcards in 
-fsanitize-file:///home/ygribov/user-section-2.diff
sections.  This also adds a test which I forgot to svn-add last time 
(shame on me).


Bootstrapped and regtested on x64.  Ok to commit?

-Y

Re: [PATCH] Optionally sanitize globals in user-defined sections

[Yury Gribov]

On 04/22/2015 11:31 AM, Yury Gribov wrote:

On 04/19/2015 06:11 PM, Jakub Jelinek wrote:

On Sun, Apr 19, 2015 at 10:54:57AM +0300, Yury Gribov wrote:

On 04/17/2015 08:29 PM, Andi Kleen wrote:

Yury Gribov y.gri...@samsung.com writes:

+
+static bool
+section_sanitized_p (const char *sec)
+{
+  if (!sanitized_sections)
+return false;
+  size_t len = strlen (sec);
+  const char *p = sanitized_sections;
+  while ((p = strstr (p, sec)))
+{
+  if ((p == sanitized_sections || p[-1] == ',')
+   (p[len] == 0 || p[len] == ','))
+return true;


No wildcard support? That may be a long option in some cases.


Right. Do you think * will be enough or we also need ? and [a-f] syntax?


libiberty contains and gcc build utilities already use fnmatch, so you
should just use that (with carefully chosen FNM_* options).


Hi all,

Here is an new patch which adds support for wildcards in
-fsanitize-sections.  This also adds a test which I forgot to svn-add last time
(shame on me).

Bootstrapped and regtested on x64.  Ok to commit?


Attached the patch.

commit 0438afd83e555d1d484d2bef899125a8b9b4f10a
Author: Yury Gribov y.gri...@samsung.com
Date:   Tue Apr 21 20:47:04 2015 +0300

2015-04-22  Yury Gribov  y.gri...@samsung.com

	gcc/
	* asan.c (set_sanitized_sections): Parse incoming arg.
	(section_sanitized_p): Support wildcards.
	* doc/invoke.texi (-fsanitize-sections): Update description.

	gcc/testsuite/
	* c-c++-common/asan/user-section-1.c: New test.
	* c-c++-common/asan/user-section-2.c: New test.
	* c-c++-common/asan/user-section-3.c: New test.

diff --git a/gcc/asan.c b/gcc/asan.c
index cd6ccdc..f7c595c 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -88,6 +88,7 @@ along with GCC; see the file COPYING3.  If not see
 #include ubsan.h
 #include params.h
 #include builtins.h
+#include fnmatch.h
 
 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
with 2x slowdown on average.
@@ -272,7 +273,7 @@ along with GCC; see the file COPYING3.  If not see
 
 static unsigned HOST_WIDE_INT asan_shadow_offset_value;
 static bool asan_shadow_offset_computed;
-static const char *sanitized_sections;
+static vecchar *, va_gc *sanitized_sections;
 
 /* Sets shadow offset to value in string VAL.  */
 
@@ -298,9 +299,25 @@ set_asan_shadow_offset (const char *val)
 /* Set list of user-defined sections that need to be sanitized.  */
 
 void
-set_sanitized_sections (const char *secs)
+set_sanitized_sections (const char *sections)
 {
-  sanitized_sections = secs;
+  char *pat;
+  for (unsigned i = 0;
+   sanitized_sections  sanitized_sections-iterate (i, pat);
+   ++i)
+{
+  free (pat);
+}
+  vec_safe_truncate (sanitized_sections, 0);
+
+  for (const char *s = sections; *s; )
+{
+  const char *end;
+  for (end = s; *end  *end != ','; ++end);
+  size_t len = end - s;
+  vec_safe_push (sanitized_sections, xstrndup (s, len));
+  s = *end ? end + 1 : end;
+}
 }
 
 /* Checks whether section SEC should be sanitized.  */
@@ -308,16 +325,13 @@ set_sanitized_sections (const char *secs)
 static bool
 section_sanitized_p (const char *sec)
 {
-  if (!sanitized_sections)
-return false;
-  size_t len = strlen (sec);
-  const char *p = sanitized_sections;
-  while ((p = strstr (p, sec)))
+  char *pat;
+  for (unsigned i = 0;
+   sanitized_sections  sanitized_sections-iterate (i, pat);
+   ++i)
 {
-  if ((p == sanitized_sections || p[-1] == ',')
-	   (p[len] == 0 || p[len] == ','))
+  if (fnmatch (pat, sec, FNM_PERIOD) == 0)
 	return true;
-  ++p;
 }
   return false;
 }
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index c20dd4d..a939ff7 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -5806,7 +5806,8 @@ Kernel AddressSanitizer.
 
 @item -fsanitize-sections=@var{s1,s2,...}
 @opindex fsanitize-sections
-Sanitize global variables in selected user-defined sections.
+Sanitize global variables in selected user-defined sections.  @var{si} may
+contain wildcards.
 
 @item -fsanitize-recover@r{[}=@var{opts}@r{]}
 @opindex fsanitize-recover
diff --git a/gcc/testsuite/c-c++-common/asan/user-section-1.c b/gcc/testsuite/c-c++-common/asan/user-section-1.c
new file mode 100644
index 000..51e2b99
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/asan/user-section-1.c
@@ -0,0 +1,11 @@
+/* { dg-do compile } */
+/* { dg-options -fsanitize=address -fsanitize-sections=.xxx,.yyy -fdump-tree-sanopt } */
+/* { dg-skip-if  { *-*-* } { -flto } {  } } */
+
+int x __attribute__((section(.xxx))) = 1;
+int y __attribute__((section(.yyy))) = 1;
+int z __attribute__((section(.zzz))) = 1;
+
+/* { dg-final { scan-tree-dump __builtin___asan_unregister_globals \\(.*, 2\\); sanopt } } */
+/* { dg-final { cleanup-tree-dump sanopt } } */
+
diff --git a/gcc/testsuite/c-c++-common/asan/user-section-2.c b/gcc/testsuite/c-c++-common/asan/user-section-2.c
new file mode 100644
index 000..f602116
--- /dev/null
+++ b/gcc

Re: [PATCH] Optionally sanitize globals in user-defined sections

[Yury Gribov]

On 04/22/2015 12:00 PM, Jakub Jelinek wrote:

On Wed, Apr 22, 2015 at 11:43:53AM +0300, Yury Gribov wrote:

@@ -272,7 +273,7 @@ along with GCC; see the file COPYING3.  If not see

  static unsigned HOST_WIDE_INT asan_shadow_offset_value;
  static bool asan_shadow_offset_computed;
-static const char *sanitized_sections;
+static vecchar *, va_gc *sanitized_sections;


Why don't you use static vecchar * sanitized_section instead?


Fixed.  I thought we try to avoid creating unnecessary vectors but 
probably not that important.



-set_sanitized_sections (const char *secs)
+set_sanitized_sections (const char *sections)
  {
-  sanitized_sections = secs;
+  char *pat;
+  for (unsigned i = 0;
+   sanitized_sections  sanitized_sections-iterate (i, pat);
+   ++i)


This really should be FOR_EACH_VEC_SAFE_ELT (if you keep using va_gc
vec *) or FOR_EACH_VEC_ELT.


Done.


+{
+  free (pat);
+}


No {}s around single line body.


Done.


@@ -308,16 +325,13 @@ set_sanitized_sections (const char *secs)
  static bool
  section_sanitized_p (const char *sec)
  {
-  if (!sanitized_sections)
-return false;
-  size_t len = strlen (sec);
-  const char *p = sanitized_sections;
-  while ((p = strstr (p, sec)))
+  char *pat;
+  for (unsigned i = 0;
+   sanitized_sections  sanitized_sections-iterate (i, pat);
+   ++i)


Similarly.


Ok.


Also, wonder if won't be too expensive if people use too long
list of sections.  Perhaps we could cache positive as well as negative
answers in a hash table?  Though, perhaps it is worth that only if this
shows up to be a bottleneck.


Yeah, I thought about throwing in a hashtable but wasn't sure that added 
complexity would be justified.  So I'd rather wait and see whether this 
causes a noticeable slowdown.


-Y
commit bc33a73d9406abf5209d98aba79eee33b14aadc6
Author: Yury Gribov y.gri...@samsung.com
Date:   Tue Apr 21 20:47:04 2015 +0300

2015-04-22  Yury Gribov  y.gri...@samsung.com

	gcc/
	* asan.c (set_sanitized_sections): Parse incoming arg.
	(section_sanitized_p): Support wildcards.
	* doc/invoke.texi (-fsanitize-sections): Update description.

	gcc/testsuite/
	* c-c++-common/asan/user-section-1.c: New test.
	* c-c++-common/asan/user-section-2.c: New test.
	* c-c++-common/asan/user-section-3.c: New test.

diff --git a/gcc/asan.c b/gcc/asan.c
index cd6ccdc..479301a 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -88,6 +88,7 @@ along with GCC; see the file COPYING3.  If not see
 #include ubsan.h
 #include params.h
 #include builtins.h
+#include fnmatch.h
 
 /* AddressSanitizer finds out-of-bounds and use-after-free bugs
with 2x slowdown on average.
@@ -272,7 +273,7 @@ along with GCC; see the file COPYING3.  If not see
 
 static unsigned HOST_WIDE_INT asan_shadow_offset_value;
 static bool asan_shadow_offset_computed;
-static const char *sanitized_sections;
+static vecchar * sanitized_sections;
 
 /* Sets shadow offset to value in string VAL.  */
 
@@ -298,9 +299,22 @@ set_asan_shadow_offset (const char *val)
 /* Set list of user-defined sections that need to be sanitized.  */
 
 void
-set_sanitized_sections (const char *secs)
+set_sanitized_sections (const char *sections)
 {
-  sanitized_sections = secs;
+  char *pat;
+  unsigned i;
+  FOR_EACH_VEC_ELT (sanitized_sections, i, pat)
+free (pat);
+  sanitized_sections.truncate (0);
+
+  for (const char *s = sections; *s; )
+{
+  const char *end;
+  for (end = s; *end  *end != ','; ++end);
+  size_t len = end - s;
+  sanitized_sections.safe_push (xstrndup (s, len));
+  s = *end ? end + 1 : end;
+}
 }
 
 /* Checks whether section SEC should be sanitized.  */
@@ -308,17 +322,11 @@ set_sanitized_sections (const char *secs)
 static bool
 section_sanitized_p (const char *sec)
 {
-  if (!sanitized_sections)
-return false;
-  size_t len = strlen (sec);
-  const char *p = sanitized_sections;
-  while ((p = strstr (p, sec)))
-{
-  if ((p == sanitized_sections || p[-1] == ',')
-	   (p[len] == 0 || p[len] == ','))
-	return true;
-  ++p;
-}
+  char *pat;
+  unsigned i;
+  FOR_EACH_VEC_ELT (sanitized_sections, i, pat)
+if (fnmatch (pat, sec, FNM_PERIOD) == 0)
+  return true;
   return false;
 }
 
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index c20dd4d..a939ff7 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -5806,7 +5806,8 @@ Kernel AddressSanitizer.
 
 @item -fsanitize-sections=@var{s1,s2,...}
 @opindex fsanitize-sections
-Sanitize global variables in selected user-defined sections.
+Sanitize global variables in selected user-defined sections.  @var{si} may
+contain wildcards.
 
 @item -fsanitize-recover@r{[}=@var{opts}@r{]}
 @opindex fsanitize-recover
diff --git a/gcc/testsuite/c-c++-common/asan/user-section-1.c b/gcc/testsuite/c-c++-common/asan/user-section-1.c
new file mode 100644
index 000..51e2b99
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/asan/user-section-1.c
@@ -0,0 +1,11

[PATCH][PING] Skip preprocessor directives in mklog

[Yury Gribov]

On 04/21/2015 02:26 PM, Yury Gribov wrote:

Hi all,

Contrib/mklog is currently faked by preprocessor directives inside
functions to produce invalid ChangeLog.  The attached patch fixes this.

Tested with my local mklog testsuite and http://paste.debian.net/167999/
.  Ok to commit?

[PATCH] Backport fix for PR 64839 to GCC5 (commited)

[Yury Gribov]

On 04/13/2015 12:04 PM, Yury Gribov wrote:

On 04/13/2015 12:03 PM, Yury Gribov wrote:

Hi all,

I've submitted a libsanitizer cherry-pick from LLVM to not require xdr.h
on systems where it's not available. Pre-approved by Jakub in
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64839 .


Forgot to attach patch. Commited in r222043.


Hi all,

I've backported patch which fixes 
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64839 to gcc-5-branch 
(r223032).


-Y

Index: libsanitizer/sanitizer_common/Makefile.in
===
--- libsanitizer/sanitizer_common/Makefile.in	(revision 223031)
+++ libsanitizer/sanitizer_common/Makefile.in	(revision 223032)
@@ -129,7 +129,7 @@
 CXXDEPMODE = @CXXDEPMODE@
 CXXFLAGS = @CXXFLAGS@
 CYGPATH_W = @CYGPATH_W@
-DEFS = -D_GNU_SOURCE -D_DEBUG -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS 
+DEFS = -D_GNU_SOURCE -D_DEBUG -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS @RPC_DEFS@
 DEPDIR = @DEPDIR@
 DSYMUTIL = @DSYMUTIL@
 DUMPBIN = @DUMPBIN@
@@ -174,6 +174,7 @@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 RANLIB = @RANLIB@
+RPC_DEFS = @RPC_DEFS@
 SED = @SED@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
Index: libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc
===
--- libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc	(revision 223031)
+++ libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc	(revision 223032)
@@ -131,7 +131,11 @@
 #include netax25/ax25.h
 #include netipx/ipx.h
 #include netrom/netrom.h
-#include rpc/xdr.h
+#if HAVE_RPC_XDR_H
+# include rpc/xdr.h
+#elif HAVE_TIRPC_RPC_XDR_H
+# include tirpc/rpc/xdr.h
+#endif
 #include scsi/scsi.h
 #include sys/mtio.h
 #include sys/kd.h
@@ -1147,7 +1151,7 @@
 CHECK_SIZE_AND_OFFSET(group, gr_gid);
 CHECK_SIZE_AND_OFFSET(group, gr_mem);
 
-#if SANITIZER_LINUX  !SANITIZER_ANDROID
+#if HAVE_RPC_XDR_H || HAVE_TIRPC_RPC_XDR_H
 CHECK_TYPE_SIZE(XDR);
 CHECK_SIZE_AND_OFFSET(XDR, x_op);
 CHECK_SIZE_AND_OFFSET(XDR, x_ops);
Index: libsanitizer/sanitizer_common/sanitizer_platform.h
===
--- libsanitizer/sanitizer_common/sanitizer_platform.h	(revision 223031)
+++ libsanitizer/sanitizer_common/sanitizer_platform.h	(revision 223032)
@@ -126,4 +126,10 @@
 # define SANITIZER_POINTER_FORMAT_LENGTH FIRST_32_SECOND_64(8, 12)
 #endif
 
+// Assume obsolete RPC headers are available by default
+#if !defined(HAVE_RPC_XDR_H)  !defined(HAVE_TIRPC_RPC_XDR_H)
+# define HAVE_RPC_XDR_H (SANITIZER_LINUX  !SANITIZER_ANDROID)
+# define HAVE_TIRPC_RPC_XDR_H 0
+#endif
+
 #endif // SANITIZER_PLATFORM_H
Index: libsanitizer/sanitizer_common/Makefile.am
===
--- libsanitizer/sanitizer_common/Makefile.am	(revision 223031)
+++ libsanitizer/sanitizer_common/Makefile.am	(revision 223032)
@@ -3,7 +3,7 @@
 # May be used by toolexeclibdir.
 gcc_version := $(shell cat $(top_srcdir)/../gcc/BASE-VER)
 
-DEFS = -D_GNU_SOURCE -D_DEBUG -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS 
+DEFS = -D_GNU_SOURCE -D_DEBUG -D__STDC_CONSTANT_MACROS -D__STDC_FORMAT_MACROS -D__STDC_LIMIT_MACROS @RPC_DEFS@
 AM_CXXFLAGS = -Wall -W -Wno-unused-parameter -Wwrite-strings -pedantic -Wno-long-long  -fPIC -fno-builtin -fno-exceptions -fno-rtti -fomit-frame-pointer -funwind-tables -fvisibility=hidden -Wno-variadic-macros
 AM_CXXFLAGS += $(LIBSTDCXX_RAW_CXX_CXXFLAGS)
 AM_CXXFLAGS += -std=gnu++11
Index: libsanitizer/configure
===
--- libsanitizer/configure	(revision 223031)
+++ libsanitizer/configure	(revision 223032)
@@ -607,6 +607,7 @@
 TSAN_TARGET_DEPENDENT_OBJECTS
 LIBBACKTRACE_SUPPORTED_FALSE
 LIBBACKTRACE_SUPPORTED_TRUE
+RPC_DEFS
 BACKTRACE_SUPPORTS_THREADS
 BACKTRACE_USES_MALLOC
 ALLOC_FILE
@@ -12021,7 +12022,7 @@
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat  conftest.$ac_ext _LT_EOF
-#line 12024 configure
+#line 12025 configure
 #include confdefs.h
 
 #if HAVE_DLFCN_H
@@ -12127,7 +12128,7 @@
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat  conftest.$ac_ext _LT_EOF
-#line 12130 configure
+#line 12131 configure
 #include confdefs.h
 
 #if HAVE_DLFCN_H
@@ -16341,6 +16342,47 @@
 
 fi
 
+# Check for rpc/xdr.h
+for ac_header in rpc/xdr.h
+do :
+  ac_fn_c_check_header_mongrel $LINENO rpc/xdr.h ac_cv_header_rpc_xdr_h $ac_includes_default
+if test x$ac_cv_header_rpc_xdr_h = xyes; then :
+  cat confdefs.h _ACEOF
+#define HAVE_RPC_XDR_H 1
+_ACEOF
+
+fi
+
+done
+
+if test x$ac_cv_header_rpc_xdr_h = xyes; then
+  rpc_defs=$rpc_defs -DHAVE_RPC_XDR_H=1
+else
+  rpc_defs=$rpc_defs -DHAVE_RPC_XDR_H=0
+fi
+
+# Check for tirpc/rpc/xdr.h
+for ac_header in tirpc/rpc/xdr.h
+do

Re: [PATCH][PING^2] Skip preprocessor directives in mklog

[Yury Gribov]

On 05/12/2015 06:57 PM, Trevor Saunders wrote:

On Tue, May 12, 2015 at 06:33:28PM +0300, Yury Gribov wrote:

On 05/12/2015 06:23 PM, Diego Novillo wrote:

The patch looks fine to me.

I'm not really involved in GCC development anymore. I would suggest
that this script should be maintained by whoever's been hacking on it
the most. It's a simple script, so it shouldn't be hard to find a new
maintainer for it.


Trevor, Tom,

Does anyone want to volunteer?


I think you'd be the best choice :)

  I read about as much perl as Tom, but given you've tested it and it
  seems sane I'll say ok if you want me to.


Hm, looks like I'm the only one who perls here.  What should I do to 
become a maintainer?


-Y

Re: [PINGv6][PATCH] ASan on unaligned accesses

[Yury Gribov]

On 05/12/2015 02:16 PM, Marat Zakirov wrote:

On 04/07/2015 03:22 PM, Jakub Jelinek wrote:

How are the automatic misaligned variables different from say heap
allocated ones, or global vars etc.?

No difference you are right Jakub. Shadow memory initialization for heap
values and globals of course also should be changed but it is a task for
libsanitizer not ASan for which I am sending patch. Fix for libsanitizer
to support unaligned heaps and globals will be committed by a separate
patch.


AFAIK folks only wanted this feature in kernel ASan for now. Runtime 
support for heap and globals will be done inside kernel.


-Y

[PATCH][PING^2] Skip preprocessor directives in mklog

[Yury Gribov]

On 04/30/2015 12:03 PM, Yury Gribov wrote:

On 04/21/2015 02:26 PM, Yury Gribov wrote:

Hi all,

Contrib/mklog is currently faked by preprocessor directives inside
functions to produce invalid ChangeLog.  The attached patch fixes this.

Tested with my local mklog testsuite and http://paste.debian.net/167999/
.  Ok to commit?


Ping.

commit 23a738d05393676e72db82cb527d5fb1b3060e2f
Author: Yury Gribov y.gri...@samsung.com
Date:   Tue Apr 21 14:17:23 2015 +0300

2015-04-21  Yury Gribov  y.gri...@samsung.com

	* mklog: Ignore preprocessor directives.

diff --git a/contrib/mklog b/contrib/mklog
index f7974a7..455614b 100755
--- a/contrib/mklog
+++ b/contrib/mklog
@@ -131,7 +131,6 @@ sub is_unified_hunk_start {
 }
 
 # Check if line is a top-level declaration.
-# TODO: ignore preprocessor directives except maybe #define ?
 sub is_top_level {
 	my ($function, $is_context_diff) = (@_);
 	if (is_unified_hunk_start ($function)
@@ -143,7 +142,7 @@ sub is_top_level {
 	} else {
 		$function =~ s/^.//;
 	}
-	return $function  $function !~ /^[\s{]/;
+	return $function  $function !~ /^[\s{#]/;
 }
 
 # Read contents of .diff file

Re: [PATCH][PING^2] Skip preprocessor directives in mklog

[Yury Gribov]

On 05/12/2015 06:23 PM, Diego Novillo wrote:

The patch looks fine to me.

I'm not really involved in GCC development anymore. I would suggest
that this script should be maintained by whoever's been hacking on it
the most. It's a simple script, so it shouldn't be hard to find a new
maintainer for it.


Trevor, Tom,

Does anyone want to volunteer?

-Y

[PATCH] Optionally sanitize globals in user-defined sections

[Yury Gribov]

Hi all,

This patch adds an optional support for sanitizing user-defined 
sections.  Usually this is a bad idea because ASan changes relative 
position of variables in section thus breaking user assumptions.  But 
this is a desired feature for kernel which (ab)uses sections for various 
reasons (cache optimizations, etc.).


Bootstrapped and reg-tested on x64. Ok for trunk?

Best regards,
Yury

Re: [PATCH] Optionally sanitize globals in user-defined sections

[Yury Gribov]

On 04/17/2015 10:33 AM, Yury Gribov wrote:

Hi all,

This patch adds an optional support for sanitizing user-defined
sections.  Usually this is a bad idea because ASan changes relative
position of variables in section thus breaking user assumptions.  But
this is a desired feature for kernel which (ab)uses sections for various
reasons (cache optimizations, etc.).

Bootstrapped and reg-tested on x64. Ok for trunk?


The patch attached.

commit 97c141d9be45b29fb7e281dc2b7cd904e93c2813
Author: Yury Gribov y.gri...@samsung.com
Date:   Mon Feb 2 14:33:17 2015 +0300

2015-04-17  Yury Gribov  y.gri...@samsung.com

gcc/
	* asan.c (set_sanitized_sections): New function.
	(section_sanitized_p): Ditto.
	(asan_protect_global): Optionally sanitize user-defined
	sections.
	* asan.h (set_sanitized_sections): Declare new function.
	* common.opt (fsanitize-sections): New option.
	* doc/invoke.texi (-fsanitize-sections): Document new option.
	* opts-global.c (handle_common_deferred_options): Handle new
	option.

gcc/testsuite/
	* c-c++-common/asan/user-section-1.c: New test.

diff --git a/gcc/asan.c b/gcc/asan.c
index 9e4a629..6706af7 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -272,6 +272,7 @@ along with GCC; see the file COPYING3.  If not see
 
 static unsigned HOST_WIDE_INT asan_shadow_offset_value;
 static bool asan_shadow_offset_computed;
+static const char *sanitized_sections;
 
 /* Sets shadow offset to value in string VAL.  */
 
@@ -294,6 +295,33 @@ set_asan_shadow_offset (const char *val)
   return true;
 }
 
+/* Set list of user-defined sections that need to be sanitized.  */
+
+void
+set_sanitized_sections (const char *secs)
+{
+  sanitized_sections = secs;
+}
+
+/* Checks whether section SEC should be sanitized.  */
+
+static bool
+section_sanitized_p (const char *sec)
+{
+  if (!sanitized_sections)
+return false;
+  size_t len = strlen (sec);
+  const char *p = sanitized_sections;
+  while ((p = strstr (p, sec)))
+{
+  if ((p == sanitized_sections || p[-1] == ',')
+	   (p[len] == 0 || p[len] == ','))
+	return true;
+  ++p;
+}
+  return false;
+}
+
 /* Returns Asan shadow offset.  */
 
 static unsigned HOST_WIDE_INT
@@ -1374,7 +1402,8 @@ asan_protect_global (tree decl)
 	 to be an array of such vars, putting padding in there
 	 breaks this assumption.  */
   || (DECL_SECTION_NAME (decl) != NULL
-	   !symtab_node::get (decl)-implicit_section)
+	   !symtab_node::get (decl)-implicit_section
+	   !section_sanitized_p (DECL_SECTION_NAME (decl)))
   || DECL_SIZE (decl) == 0
   || ASAN_RED_ZONE_SIZE * BITS_PER_UNIT  MAX_OFILE_ALIGNMENT
   || !valid_constant_size_p (DECL_SIZE_UNIT (decl))
diff --git a/gcc/asan.h b/gcc/asan.h
index 51fd9cc..10ffaca 100644
--- a/gcc/asan.h
+++ b/gcc/asan.h
@@ -79,6 +79,8 @@ asan_red_zone_size (unsigned int size)
 
 extern bool set_asan_shadow_offset (const char *);
 
+extern void set_sanitized_sections (const char *);
+
 /* Return TRUE if builtin with given FCODE will be intercepted by
libasan.  */
 
diff --git a/gcc/common.opt b/gcc/common.opt
index b49ac46..380848c 100644
--- a/gcc/common.opt
+++ b/gcc/common.opt
@@ -897,6 +897,11 @@ fasan-shadow-offset=
 Common Joined RejectNegative Var(common_deferred_options) Defer
 -fasan-shadow-offset=number	Use custom shadow memory offset.
 
+fsanitize-sections=
+Common Joined RejectNegative Var(common_deferred_options) Defer
+-fsanitize-sections=sec1,sec2,...	Sanitize global variables
+in user-defined sections.
+
 fsanitize-recover=
 Common Report Joined
 After diagnosing undefined behavior attempt to continue execution
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index bb17385..f5f79b8 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -301,7 +301,8 @@ Objective-C and Objective-C++ Dialects}.
 @xref{Debugging Options,,Options for Debugging Your Program or GCC}.
 @gccoptlist{-d@var{letters}  -dumpspecs  -dumpmachine  -dumpversion @gol
 -fsanitize=@var{style} -fsanitize-recover -fsanitize-recover=@var{style} @gol
--fasan-shadow-offset=@var{number} -fsanitize-undefined-trap-on-error @gol
+-fasan-shadow-offset=@var{number} -fsanitize-sections=@var{s1,s2,...} @gol
+-fsanitize-undefined-trap-on-error @gol
 -fcheck-pointer-bounds -fchkp-check-incomplete-type @gol
 -fchkp-first-field-has-own-bounds -fchkp-narrow-bounds @gol
 -fchkp-narrow-to-innermost-array -fchkp-optimize @gol
@@ -5803,6 +5804,10 @@ This option forces GCC to use custom shadow offset in AddressSanitizer checks.
 It is useful for experimenting with different shadow memory layouts in
 Kernel AddressSanitizer.
 
+@item -fsanitize-sections=@var{s1,s2,...}
+@opindex fsanitize-sections
+Sanitize global variables in selected user-defined sections.
+
 @item -fsanitize-recover@r{[}=@var{opts}@r{]}
 @opindex fsanitize-recover
 @opindex fno-sanitize-recover
diff --git a/gcc/opts-global.c b/gcc/opts-global.c
index b61bdcf..1035b8d 100644
--- a/gcc/opts-global.c
+++ b/gcc/opts

Re: [PATCH] Fix PR64839: libsanitizer shouldn't require rpc/xdr.h (commited)

[Yury Gribov]

On 04/13/2015 12:03 PM, Yury Gribov wrote:

Hi all,

I've submitted a libsanitizer cherry-pick from LLVM to not require xdr.h
on systems where it's not available. Pre-approved by Jakub in
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64839 .


Forgot to attach patch. Commited in r222043.

commit ea7547a6a1bf9188515e973b832b44106b69ffb6
Author: Yury Gribov y.gri...@samsung.com
Date:   Fri Apr 10 08:42:56 2015 +0300

2015-04-10  Yury Gribov  y.gri...@samsung.com

	PR sanitizer/64839

	libsanitizer/
	* sanitizer_common/sanitizer_platform.h: Cherry pick
	upstream r234470.
	* sanitizer_common/sanitizer_platform_limits_posix.cc: Ditto.
	* configure.ac (RPC_DEFS): Check for precense of RPC headers.
	* sanitizer_common/Makefile.am (DEFS): Pass info to compiler.
	* Makefile.in: Regenerate.
	* asan/Makefile.in: Regenerate.
	* config.h.in: Regenerate.
	* configure: Regenerate.
	* interception/Makefile.in: Regenerate.
	* libbacktrace/Makefile.in: Regenerate.
	* lsan/Makefile.in: Regenerate.
	* sanitizer_common/Makefile.in: Regenerate.
	* tsan/Makefile.in: Regenerate.
	* ubsan/Makefile.in: Regenerate.

diff --git a/libsanitizer/Makefile.in b/libsanitizer/Makefile.in
index 79a1be6..2f5f1bd 100644
--- a/libsanitizer/Makefile.in
+++ b/libsanitizer/Makefile.in
@@ -181,6 +181,7 @@ PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 RANLIB = @RANLIB@
+RPC_DEFS = @RPC_DEFS@
 SED = @SED@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
diff --git a/libsanitizer/asan/Makefile.in b/libsanitizer/asan/Makefile.in
index e61ceda..a56c6b1 100644
--- a/libsanitizer/asan/Makefile.in
+++ b/libsanitizer/asan/Makefile.in
@@ -190,6 +190,7 @@ PACKAGE_URL = @PACKAGE_URL@
 PACKAGE_VERSION = @PACKAGE_VERSION@
 PATH_SEPARATOR = @PATH_SEPARATOR@
 RANLIB = @RANLIB@
+RPC_DEFS = @RPC_DEFS@
 SED = @SED@
 SET_MAKE = @SET_MAKE@
 SHELL = @SHELL@
diff --git a/libsanitizer/config.h.in b/libsanitizer/config.h.in
index e4b2786..7195840 100644
--- a/libsanitizer/config.h.in
+++ b/libsanitizer/config.h.in
@@ -43,6 +43,9 @@
 /* Define to 1 if you have the memory.h header file. */
 #undef HAVE_MEMORY_H
 
+/* Define to 1 if you have the rpc/xdr.h header file. */
+#undef HAVE_RPC_XDR_H
+
 /* Define to 1 if you have the stdint.h header file. */
 #undef HAVE_STDINT_H
 
@@ -67,6 +70,9 @@
 /* Define to 1 if you have the sys/types.h header file. */
 #undef HAVE_SYS_TYPES_H
 
+/* Define to 1 if you have the tirpc/rpc/xdr.h header file. */
+#undef HAVE_TIRPC_RPC_XDR_H
+
 /* Define to 1 if you have the unistd.h header file. */
 #undef HAVE_UNISTD_H
 
diff --git a/libsanitizer/configure b/libsanitizer/configure
index 9ded4cc..1efbd53 100755
--- a/libsanitizer/configure
+++ b/libsanitizer/configure
@@ -607,6 +607,7 @@ LIBOBJS
 TSAN_TARGET_DEPENDENT_OBJECTS
 LIBBACKTRACE_SUPPORTED_FALSE
 LIBBACKTRACE_SUPPORTED_TRUE
+RPC_DEFS
 BACKTRACE_SUPPORTS_THREADS
 BACKTRACE_USES_MALLOC
 ALLOC_FILE
@@ -12021,7 +12022,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat  conftest.$ac_ext _LT_EOF
-#line 12024 configure
+#line 12025 configure
 #include confdefs.h
 
 #if HAVE_DLFCN_H
@@ -12127,7 +12128,7 @@ else
   lt_dlunknown=0; lt_dlno_uscore=1; lt_dlneed_uscore=2
   lt_status=$lt_dlunknown
   cat  conftest.$ac_ext _LT_EOF
-#line 12130 configure
+#line 12131 configure
 #include confdefs.h
 
 #if HAVE_DLFCN_H
@@ -16341,6 +16342,47 @@ $as_echo #define HAVE_GETEXECNAME 1 confdefs.h
 
 fi
 
+# Check for rpc/xdr.h
+for ac_header in rpc/xdr.h
+do :
+  ac_fn_c_check_header_mongrel $LINENO rpc/xdr.h ac_cv_header_rpc_xdr_h $ac_includes_default
+if test x$ac_cv_header_rpc_xdr_h = xyes; then :
+  cat confdefs.h _ACEOF
+#define HAVE_RPC_XDR_H 1
+_ACEOF
+
+fi
+
+done
+
+if test x$ac_cv_header_rpc_xdr_h = xyes; then
+  rpc_defs=$rpc_defs -DHAVE_RPC_XDR_H=1
+else
+  rpc_defs=$rpc_defs -DHAVE_RPC_XDR_H=0
+fi
+
+# Check for tirpc/rpc/xdr.h
+for ac_header in tirpc/rpc/xdr.h
+do :
+  ac_fn_c_check_header_mongrel $LINENO tirpc/rpc/xdr.h ac_cv_header_tirpc_rpc_xdr_h $ac_includes_default
+if test x$ac_cv_header_tirpc_rpc_xdr_h = xyes; then :
+  cat confdefs.h _ACEOF
+#define HAVE_TIRPC_RPC_XDR_H 1
+_ACEOF
+
+fi
+
+done
+
+if test x$ac_cv_header_tirpc_rpc_xdr_h = xyes; then
+  rpc_defs=$rpc_defs -DHAVE_TIRPC_RPC_XDR_H=1
+else
+  rpc_defs=$rpc_defs -DHAVE_TIRPC_RPC_XDR_H=0
+fi
+
+RPC_DEFS=$rpc_defs
+
+
  if test x${BACKTRACE_SUPPORTED}x${BACKTRACE_USES_MALLOC} = x1x0; then
   LIBBACKTRACE_SUPPORTED_TRUE=
   LIBBACKTRACE_SUPPORTED_FALSE='#'
diff --git a/libsanitizer/configure.ac b/libsanitizer/configure.ac
index 031c271..11e2d99 100644
--- a/libsanitizer/configure.ac
+++ b/libsanitizer/configure.ac
@@ -312,6 +312,24 @@ if test $have_getexecname = yes; then
   AC_DEFINE(HAVE_GETEXECNAME, 1, [Define if getexecname is available.])
 fi
 
+# Check for rpc/xdr.h
+AC_CHECK_HEADERS(rpc/xdr.h)
+if test x$ac_cv_header_rpc_xdr_h = xyes; then
+  rpc_defs

[PATCH] Fix PR64839: libsanitizer shouldn't require rpc/xdr.h (commited)

[Yury Gribov]

Hi all,

I've submitted a libsanitizer cherry-pick from LLVM to not require xdr.h 
on systems where it's not available. Pre-approved by Jakub in 
https://gcc.gnu.org/bugzilla/show_bug.cgi?id=64839 .


-Y

Re: [RFC] COMDAT Safe Module Level Multi versioning

[Yury Gribov]

On 05/19/2015 09:16 AM, Sriraman Tallam wrote:

We have the following problem with selectively compiling modules with
-misa options and I have provided a solution to solve this.  I would
like to hear what you think.

Multi versioning at module granularity is done by compiling a subset
of modules with advanced ISA instructions, supported on later
generations of the target architecture, via -misa options and
invoking the functions defined in these modules with explicit checks
for the ISA support via builtin functions,  __builtin_cpu_supports.
This mechanism has the unfortunate side-effect that generated COMDAT
candidates from these modules can contain these advanced instructions
and potentially “violate” ODR assumptions.  Choosing such a COMDAT
candidate over a generic one from a different module can cause SIGILL
on platforms where the advanced ISA is not supported.

Here is a slightly contrived  example to illustrate:


matrixdouble.h

// Template (Comdat) function definition in a header:

templatetypename T
__attribute__((noinline))
void matrixDouble (T *a) {
   for (int i = 0 ; i  16; ++i)  //Vectorizable Loop
 a[i] = a[i] * 2;
}

avx.cc  (Compile with -mavx -O2)
-

#include matrixdouble.h
void getDoubleAVX(int *a) {
  matrixDouble(a);  // Instantiated with vectorized AVX instructions
}


non_avx.cc (Compile with -mno-avx -O2)
---

#include “matrixdouble.h”
void
getDouble(int *a) {
  matrixDouble(a); // Instantiated with non-AVX instructions
}


main.cc
---

void getDoubleAVX(int *a);
void getDouble(int *a);

int a[] = { 0, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15 };
int main () {
  // The AVX call is appropriately guarded.
  if (__builtin_cpu_supports(“avx”))
getDoubleAVX(a);
  else
getDouble(a);
  return a[0];
}


In the above code, function “getDoubleAVX” is only called when the
run-time CPU supports AVX instructions.  This code looks clean but
suffers from the COMDAT ODR violation.  Two copies of COMDAT function
“matrixDouble” are generated.  One copy is generated in object file
“avx.o” with AVX instructions and another copy exists in “non_avx.o”
without AVX instruction.  At link time, in a link order where object
file avx.o is seen ahead of  non_avx.o,  the COMDAT copy of function
“matrixDouble” that contains AVX instructions is kept leading to
SIGILL on unsupported platforms.  To reproduce the SIGILL,


$  g++ -c -O2 -mavx avx.cc
$ g++ -c -O2 -mno-avx non_avx.cc
$  g++ main.cc avx.o non_avx.o
$ ./a.out   # on a non-AVX machine
Illegal Instruction


To solve this, I propose introducing a new compiler option, say
-fodr-unsafe-comdats, to let the user tag objects that use specialized
options and let the linker choose the comdat candidate to be linked
wisely.  The root cause of the above problem is that comdat functions
in common headers may not be properly guarded and the linker picks the
first candidate it sees.  A link order where the object with the
specialized comdat functions appear first causes these comdats to be
picked leading to SIGILL on unsupported arches.  With the objects
tagged, the linker can be made to pick other comdat candidates when
possible.

More details:

This option is user specified when using arch specific options like
-misa.  It is an indicator to the compiler that any comdat bodies
generated are potentially unsafe for execution.  Note that the COMDAT
bodies however have to be generated as there are no guarantees that
other modules will do so.  The compiler then emits a specially named
section, like “.gnu.odr.unsafe”, in the object file.  When the linker
tries to pick a COMDAT candidate from several choices, it must avoid
COMDAT copies from objects with sections named “.gnu.odr.unsafe” when
presented with a choice to pick a candidate from an object that does
not have the “.gnu.odr.unsafe” section.  Note that it may not be
possible to do that in which case the linker must pick the unsafe
copy, it could explicitly warn when this happens.

Alternately,  the compiler can bind locally any emitted comdat version
from a specialized module, which could also be guarded by an option.
This will solve the problem but this may not be always possible
especially when addresses of any such comdat version is taken.


Can IFUNC relocations be used to properly select optimal version of code 
at runtime?


-Y

[PATCH] Fix UBSan builtin types

[Yury Gribov]

Hi all,

GCC builtins BUILT_IN_UBSAN_HANDLE_NONNULL_ARG and 
BUILT_IN_UBSAN_HANDLE_NONNULL_ARG_ABORT were using 
BT_FN_VOID_PTR_PTRMODE whereas they are really BT_FN_VOID_PTR:

  void __ubsan::__ubsan_handle_nonnull_return(NonNullReturnData *Data)

The patch fixes it.  I only tested ubsan.exp (I doubt that bootstrap + 
full testsuite will add anything to this).


Ok for trunk?

Best regards,
Yury Gribov
commit d4747c9c7f78789ec7119fce07cd4526c4168ee0
Author: Yury Gribov y.gri...@samsung.com
Date:   Thu Aug 20 19:10:30 2015 +0300

2015-08-20  Yury Gribov  y.gri...@samsung.com

gcc/
	* sanitizer.def (BUILT_IN_UBSAN_HANDLE_NONNULL_ARG,
	BUILT_IN_UBSAN_HANDLE_NONNULL_ARG): Fix builtin types.

diff --git a/gcc/sanitizer.def b/gcc/sanitizer.def
index 7d14910..123b011 100644
--- a/gcc/sanitizer.def
+++ b/gcc/sanitizer.def
@@ -485,11 +485,11 @@ DEF_SANITIZER_BUILTIN(BUILT_IN_UBSAN_HANDLE_OUT_OF_BOUNDS_ABORT,
 		  ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST)
 DEF_SANITIZER_BUILTIN(BUILT_IN_UBSAN_HANDLE_NONNULL_ARG,
 		  __ubsan_handle_nonnull_arg,
-		  BT_FN_VOID_PTR_PTRMODE,
+		  BT_FN_VOID_PTR,
 		  ATTR_COLD_NOTHROW_LEAF_LIST)
 DEF_SANITIZER_BUILTIN(BUILT_IN_UBSAN_HANDLE_NONNULL_ARG_ABORT,
 		  __ubsan_handle_nonnull_arg_abort,
-		  BT_FN_VOID_PTR_PTRMODE,
+		  BT_FN_VOID_PTR,
 		  ATTR_COLD_NORETURN_NOTHROW_LEAF_LIST)
 DEF_SANITIZER_BUILTIN(BUILT_IN_UBSAN_HANDLE_NONNULL_RETURN,
 		  __ubsan_handle_nonnull_return,

Re: [PATCH 1/7] Libsanitizer merge from upstream r249633.

[Yury Gribov]

On 10/14/2015 10:15 PM, Renato Golin wrote:

On 14 October 2015 at 20:00, Andrew Pinski  wrote:

Then until that happens I think we should disable asan and tsan for
AARCH64 for GCC.


I can't comment on that, but we'll continue running the tests on our
side on both 39 and 42 VMA configurations, to make sure we don't
regress until we actually ready to go for a final solution.

For the people that weren't directly involved (or don't want to be),
we'll be letting you know when a final solution is agreed and
validated between all parties.


Renato,

Do you have any estimation for when full AArch64 support is ready in 
LLVM? If it's still months away, I wonder if we may want to enable at 
least current (partial) support for non-Thunder users.


-Y

Re: [PATCH 1/7] Libsanitizer merge from upstream r249633.

[Yury Gribov]

On 10/14/2015 12:34 PM, Maxim Ostapenko wrote:

On 14/10/15 10:54, Jakub Jelinek wrote:

Do you plan to update the asan tests we have to reflect the changes in
upstream?


Hm, there aren't changes into instrumentation, so the only thing is new
interceptors. If it is desirable, I can migrate some tests for new
interceptors from upstream.


What about e.g. "-Improvements for ASan deactivated start were performed"?

-Y

Re: [PATCH 2/7] Libsanitizer merge from upstream r249633.

[Yury Gribov]

On 10/13/2015 02:16 PM, Maxim Ostapenko wrote:

This patch introduces required compiler changes. Now, we don't version
asan_init, we have a special __asan_version_mismatch_check_v[n] symbol
for this.

Also, asan_stack_malloc_[n] doesn't take a local stack as a second
parameter anymore, so don't pass it.


Did you compare libasan.so and libclang_rt-asan.so for other ABI 
incompatibilities e.g. via libabigail?


-Y

Re: [PATCH v2 6/6] Libsanitizer merge from upstream r250806 (was r249633).

[Yury Gribov]

On 10/20/2015 02:29 PM, Maxim Ostapenko wrote:

In this patch, I'm trying to add a general instruction how to perform
the merge. This is just a documentation patch, any suggestions and
opinions are welcome.


Thanks, this should simplify work for other maintainers in future)

Some general remarks:
1) Perhaps use standard markup format for easier reading (i.e. s/^-/*/)?
2) We should suggest to run libabigail to compare ABI of 
libclang_rt-asan and libasan?
3) Perhaps it makes sense to mention that patchset should be split in 
logical pieces?

4) You probably forgot to mention SONAME update.

+- Modify Makefile.am files into 
asan/tsan/lsan/ubsan/sanitizer_common/interception
+  directories if needed.  In particular, you may need to add new source 
files
+  and remove old ones in source files list, add new flags to {C, 
CXX}FLAGS if

+  needed and update DEFS with new defined variables.

1) Could you mention where to look for updates (CMakeLists.txt, etc.).
2) Shouldn't we rerun automake (to update Makefile.in and stuff)?
3) Also add new target platforms (if any).

+- Apply all necessary compiler changes.  Be especially careful here, 
you must

+  not break ABI between compiler and library.

Perhaps mention that for compiler changes one should check commit 
history of e.g. llvm/test/Instrumentation?


+- Remove unused (deleted by merge) files from all source and include
+  directories.

This isn't clear. Doesn't merge.sh handle this?

+- Regenerate configure script and all Makefiles by autoreconf.  You 
should use

+  exactly the same autotools version as for other GCC directories (current
+  version is 2.64, 
https://www.gnu.org/software/automake/faq/autotools-faq.html

+  for details how to install/use it).

Rather than stating explicit version of autotools, perhaps tell where to 
find the current one (e.g. it's written at start of current 
libsanitizer/{Makefile.in,configure}?


+- Run regression testing on at least three platforms (e.g. x86-linux-gnu,
+  x86_64-linux-gnu, aarch64-linux-gnu).

Perhaps ARM as well? We saw a number of platform-specific bugs there.

Best regards,
Yury Gribov

Re: [PATCH] Make ubsan tests less picky about ansi escape codes in diagnostics.

[Yury Gribov]

On 09/03/2015 07:45 PM, Jonathan Roelofs wrote:



On 9/3/15 10:17 AM, Jakub Jelinek wrote:

On Thu, Sep 03, 2015 at 10:15:02AM -0600, Jonathan Roelofs wrote:

+kcc, mrs

Ping

On 8/27/15 4:44 PM, Jonathan Roelofs wrote:

The attached patch makes the ubsan tests agnostic to ansi escape codes
in their diagnostic output.


It wouldn't hurt if you explained in detail what is the problem you are
trying to solve and why something that works for most people doesn't
work in
your case.


Hi Jakub,

AFAICT, there are two ways to suppress the emission of color codes from
ubsan's diagnostics:

   1) Set an environment variable.
   2) Make the output stream not a tty.

#1 doesn't seem to be possible in DejaGnu without hacks.


AFAIR it can't be done for remote targets due to DejaGnu design limitations.


#2 doesn't work in our environment because DejaGnu attempts to make
itself appear to the program under test as if it were a tty. This might
be an artifact of the fact that all of our testing is remote testing
(though that is just blind speculation on my part:


AFAIK that's indeed the case.

Added Max.

-Y

Re: Add fuzzing coverage support

[Yury Gribov]

On 12/04/2015 04:41 PM, Jakub Jelinek wrote:

Hi!

While this has been posted after stage1 closed and I'm not really happy
that it missed the deadline, I'm willing to grant an exception, the patch
is small enough that it is ok at this point of stage3.  That said, next time
please try to submit new features in time.

Are there any plans for GCC 7 for the other -fsanitize-coverage= options,
or are those just LLVM alternatives to GCC's gcov/-fprofile-generate etc.?

On Thu, Dec 03, 2015 at 08:17:06PM +0100, Dmitry Vyukov wrote:

+unsigned sancov_pass (function *fun)


Formatting:
unsigned
sancov_pass (function *fun)


+{
+  basic_block bb;
+  gimple_stmt_iterator gsi;
+  gimple *stmt, *f;
+  static bool inited;
+
+  if (!inited)
+{
+  inited = true;
+  initialize_sanitizer_builtins ();
+}


You can call this unconditionally, it will return as the first thing
if it is already initialized, no need for another guard.


+
+  /* Insert callback into beginning of every BB. */
+  FOR_EACH_BB_FN (bb, fun)
+{
+  gsi = gsi_after_labels (bb);
+  if (gsi_end_p (gsi))
+continue;
+  stmt = gsi_stmt (gsi);
+  f = gimple_build_call (builtin_decl_implicit (
+ BUILT_IN_SANITIZER_COV_TRACE_PC), 0);


I (personally) prefer no ( at the end of line unless really needed.
In this case you can just do:
   tree fndecl = builtin_decl_implicit (BUILT_IN_SANITIZER_COV_TRACE_PC);
   gimple *g = gimple_build_call (fndecl, 0);
which is same number of lines, but looks nicer.
Also, please move also the gsi, stmt and f (better g or gcall)
declarations to the first assignment to them, they aren't used outside of
the loop.


Also FYI clang-format config has been recently added to contrib/ 
(https://gcc.gnu.org/ml/gcc-patches/2015-11/msg02214.html).





--- testsuite/gcc.dg/sancov/asan.c  (revision 0)
+++ testsuite/gcc.dg/sancov/asan.c  (working copy)
@@ -0,0 +1,21 @@
+/* Test coverage/asan interaction:
+ - coverage instruments __asan_init ctor (thus 4 covarage callbacks)
+ - coverage does not instrument asan-emitted basic blocks
+ - asan considers coverage callback as "nonfreeing" (thus 1 asan store
+   callback.  */
+/* { dg-do compile } */
+/* { dg-options "-fsanitize-coverage=trace-pc -fsanitize=address" } */
+
+void notailcall ();
+
+void foo(volatile int *a, int *b)
+{
+  *a = 1;
+  if (*b)
+*a = 2;
+  notailcall ();
+}
+
+/* { dg-final { scan-assembler-times "call__sanitizer_cov_trace_pc" 4 
} } */
+/* { dg-final { scan-assembler-times "call__asan_report_load4" 1 } } */
+/* { dg-final { scan-assembler-times "call__asan_report_store4" 1 } } 
*/


I don't like these, we have lots of targets, and different targets have
different instructions for making calls, different whitespace in between
the insn name and called function, sometimes some extra decoration on the fn
name, (say sometimes an extra _ prefix), etc.  IMHO much better to add
-fdump-tree-optimized and scan-tree-dump-times instead for the calls in the
optimized dump.  Affects all tests.

Please repost a patch with these changes fixed, it will be hopefully ackable
then.

Jakub

[PATCH 2/5] Fix more asymmetric comparison functions

[Yury Gribov]

Some more symmetry fixes.  These were detected manually (not via 
automatic analysis by SortChecker)

so I've put them to a separate patch.

Cc-ing
* Alexandre for sel_rank_for_schedule
* Ben for cmp_modes
* Jakub for range_entry_cmp
* Richard for sort_bbs_in_loop_postorder_cmp, 
sort_locs_in_loop_postorder_cmp, find_ref_loc_in_loop_cmp and 
dr_group_sort_cmp


/Yury
>From 5716669d0b88265ee610ad139a0dc4152d1c20f3 Mon Sep 17 00:00:00 2001
From: Yury Gribov <tetra2...@gmail.com>
Date: Sat, 12 Dec 2015 10:27:45 +0300
Subject: [PATCH 2/5] Fix more asymmetric comparison functions.

2015-12-17  Yury Gribov  <tetra2...@gmail.com>

	* genmodes.c (cmp_modes): Make symmetric.
	* sel-sched.c (sel_rank_for_schedule): Ditto.
	* tree-ssa-loop-im.c (sort_bbs_in_loop_postorder_cmp):
	(sort_locs_in_loop_postorder_cmp):
	(find_ref_loc_in_loop_cmp): Check invariant.
	* tree-ssa-reassoc.c (range_entry_cmp): Make symmetric.
	* tree-vect-data-refs (dr_group_sort_cmp): Ditto.
---
 gcc/genmodes.c|  6 --
 gcc/sel-sched.c   |  4 +++-
 gcc/tree-ssa-loop-im.c| 19 +++
 gcc/tree-ssa-reassoc.c|  8 +++-
 gcc/tree-vect-data-refs.c |  7 ---
 5 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/gcc/genmodes.c b/gcc/genmodes.c
index 15d62a0..f78a4da 100644
--- a/gcc/genmodes.c
+++ b/gcc/genmodes.c
@@ -813,8 +813,9 @@ cmp_modes (const void *a, const void *b)
 {
   if (m->counter < n->counter)
 	return -1;
-  else
+  else if (m->counter > n->counter)
 	return 1;
+  return 0;
 }
 
   if (m->component->bytesize > n->component->bytesize)
@@ -829,8 +830,9 @@ cmp_modes (const void *a, const void *b)
 
   if (m->counter < n->counter)
 return -1;
-  else
+  else if (m->counter > n->counter)
 return 1;
+  return 0;
 }
 
 static void
diff --git a/gcc/sel-sched.c b/gcc/sel-sched.c
index aebc2d9..c6efe9b 100644
--- a/gcc/sel-sched.c
+++ b/gcc/sel-sched.c
@@ -3343,7 +3343,9 @@ sel_rank_for_schedule (const void *x, const void *y)
   tmp2_insn = EXPR_INSN_RTX (tmp2);
 
   /* Schedule debug insns as early as possible.  */
-  if (DEBUG_INSN_P (tmp_insn) && !DEBUG_INSN_P (tmp2_insn))
+  if (DEBUG_INSN_P (tmp_insn) && DEBUG_INSN_P (tmp2_insn))
+return 0;
+  else if (DEBUG_INSN_P (tmp_insn))
 return -1;
   else if (DEBUG_INSN_P (tmp2_insn))
 return 1;
diff --git a/gcc/tree-ssa-loop-im.c b/gcc/tree-ssa-loop-im.c
index 9b1b815..b53a490 100644
--- a/gcc/tree-ssa-loop-im.c
+++ b/gcc/tree-ssa-loop-im.c
@@ -1504,7 +1504,11 @@ sort_bbs_in_loop_postorder_cmp (const void *bb1_, const void *bb2_)
   struct loop *loop2 = bb2->loop_father;
   if (loop1->num == loop2->num)
 return 0;
-  return bb_loop_postorder[loop1->num] < bb_loop_postorder[loop2->num] ? -1 : 1;
+  gcc_assert(bb_loop_postorder[loop1->num] != bb_loop_postorder[loop2->num]);
+  if (bb_loop_postorder[loop1->num] < bb_loop_postorder[loop2->num])
+return -1;
+  else
+return 1;
 }
 
 /* qsort sort function to sort ref locs after their loop fathers postorder.  */
@@ -1518,7 +1522,11 @@ sort_locs_in_loop_postorder_cmp (const void *loc1_, const void *loc2_)
   struct loop *loop2 = gimple_bb (loc2->stmt)->loop_father;
   if (loop1->num == loop2->num)
 return 0;
-  return bb_loop_postorder[loop1->num] < bb_loop_postorder[loop2->num] ? -1 : 1;
+  gcc_assert(bb_loop_postorder[loop1->num] != bb_loop_postorder[loop2->num]);
+  if (bb_loop_postorder[loop1->num] < bb_loop_postorder[loop2->num])
+return -1;
+  else
+return 1;
 }
 
 /* Gathers memory references in loops.  */
@@ -1625,8 +1633,11 @@ find_ref_loc_in_loop_cmp (const void *loop_, const void *loc_)
   if (loop->num  == loc_loop->num
   || flow_loop_nested_p (loop, loc_loop))
 return 0;
-  return (bb_loop_postorder[loop->num] < bb_loop_postorder[loc_loop->num]
-	  ? -1 : 1);
+  gcc_assert(bb_loop_postorder[loop->num] != bb_loop_postorder[loc_loop->num]);
+  if (bb_loop_postorder[loop->num] < bb_loop_postorder[loc_loop->num])
+return -1;
+  else
+return 1;
 }
 
 /* Iterates over all locations of REF in LOOP and its subloops calling
diff --git a/gcc/tree-ssa-reassoc.c b/gcc/tree-ssa-reassoc.c
index e54700e..472c8b1 100644
--- a/gcc/tree-ssa-reassoc.c
+++ b/gcc/tree-ssa-reassoc.c
@@ -2018,11 +2018,9 @@ range_entry_cmp (const void *a, const void *b)
 
   if (p->idx < q->idx)
 return -1;
-  else
-{
-  gcc_checking_assert (p->idx > q->idx);
-  return 1;
-}
+  else if (p->idx > q->idx)
+return 1;
+  return 0;
 }
 
 /* Helper routine of optimize_range_test.
diff --git a/gcc/tree-vect-data-refs.c b/gcc/tree-vect-data-refs.c
index 4c566c8..7755aaa 100644
--- a/gcc/tree-vect-data-refs.c
+++ b/gcc/tree-vect-data-refs.c
@@ -2643,9 +2643,10 @@ dr_group_sort_cmp (const void *dra_, const voi

[PATCH 5/5] Fix intransitive comparison in dr_group_sort_cmp

[Yury Gribov]

That's an interesting one. The original comparison function assumes that
operand_equal_p(a,b) is true iff compare_tree(a, b) == 0.
Unfortunately that's not true (functions are written by different authors).

This causes subtle violation of transitiveness.

I believe removing operand_equal_p should preserve the intended semantics
(same approach taken in another comparison function in this file - 
comp_dr_with_seg_len_pair).


Cc-ing Cong Hou and Richard who are the authours.

/Yury
From 7fb1fd8b2027a3a3e2d914f8bd000fe53bffe110 Mon Sep 17 00:00:00 2001
From: Yury Gribov <tetra2...@gmail.com>
Date: Sun, 13 Dec 2015 01:30:22 +0300
Subject: [PATCH 5/5] Fix intransitive comparison in dr_group_sort_cmp.

2012-12-17  Yury Gribov  <tetra2...@gmail.com>

	* tree-vect-data-refs.c (dr_group_sort_cmp):
	Make transitive.

Error message:
Dec 10 22:28:59 yugr-ubuntu1404 : cc1plus[23983]: qsort: comparison function is not transitive (comparison function 0xddbbf0 (/home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/cc1plus+9dbbf0), called from 0xddd233 (/home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/cc1plus+9dd233), cmdline is "/home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/testsuite/g++/../../cc1plus -quiet -nostdinc++ -I /home/yugr/build/gcc-4.9.3-patched-bootstrap/x86_64-unknown-linux-gnu/libstdc++-v3/include/x86_64-unknown-linux-gnu -I /home/yugr/build/gcc-4.9.3-patched-bootstrap/x86_64-unknown-linux-gnu/libstdc++-v3/include -I /home/yugr/src/gcc-4.9.3-patched/libstdc++-v3/libsupc++ -I /home/yugr/src/gcc-4.9.3-patched/libstdc++-v3/include/backward -I /home/yugr/src/gcc-4.9.3-patched/libstdc++-v3/testsuite/util -imultiarch x86_64-linux-gnu -iprefix /home/yugr/install/gcc-4.9.3/lib/gcc/x86_64-unknown-linux-gnu/4.9.3/ -isystem /home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/testsuite/g++/../../include -isystem /home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/testsuite/g++/../../include-fixed -D_GNU_SOURCE /home/yugr/src/gcc-4.9.3-patched/gcc/testsuite/g++.dg/vect/pr43771.cc -quiet -dumpbase pr43771.cc -msse2 -mtune=generic -march=x86-64 -auxbase-strip pr43771.s -O2 -std=c++1y -fno-diagnostics-show-caret -fdiagnostics-color=never -fmessage-length=0 -ftree-vectorize -fvect-cost-model=unlimited -fdump-tree-vect-details -o pr43771.s")
---
 gcc/tree-vect-data-refs.c | 39 +--
 1 file changed, 13 insertions(+), 26 deletions(-)

diff --git a/gcc/tree-vect-data-refs.c b/gcc/tree-vect-data-refs.c
index 7755aaa..e69875a 100644
--- a/gcc/tree-vect-data-refs.c
+++ b/gcc/tree-vect-data-refs.c
@@ -2604,42 +2604,29 @@ dr_group_sort_cmp (const void *dra_, const void *drb_)
 return loopa->num < loopb->num ? -1 : 1;
 
   /* Ordering of DRs according to base.  */
-  if (!operand_equal_p (DR_BASE_ADDRESS (dra), DR_BASE_ADDRESS (drb), 0))
-{
-  cmp = compare_tree (DR_BASE_ADDRESS (dra), DR_BASE_ADDRESS (drb));
-  if (cmp != 0)
-return cmp;
-}
+  cmp = compare_tree (DR_BASE_ADDRESS (dra), DR_BASE_ADDRESS (drb));
+  if (cmp != 0)
+return cmp;
 
   /* And according to DR_OFFSET.  */
-  if (!dr_equal_offsets_p (dra, drb))
-{
-  cmp = compare_tree (DR_OFFSET (dra), DR_OFFSET (drb));
-  if (cmp != 0)
-return cmp;
-}
+  cmp = compare_tree (DR_OFFSET (dra), DR_OFFSET (drb));
+  if (cmp != 0)
+return cmp;
 
   /* Put reads before writes.  */
   if (DR_IS_READ (dra) != DR_IS_READ (drb))
 return DR_IS_READ (dra) ? -1 : 1;
 
   /* Then sort after access size.  */
-  if (!operand_equal_p (TYPE_SIZE_UNIT (TREE_TYPE (DR_REF (dra))),
-			TYPE_SIZE_UNIT (TREE_TYPE (DR_REF (drb))), 0))
-{
-  cmp = compare_tree (TYPE_SIZE_UNIT (TREE_TYPE (DR_REF (dra))),
-  TYPE_SIZE_UNIT (TREE_TYPE (DR_REF (drb;
-  if (cmp != 0)
-return cmp;
-}
+  cmp = compare_tree (TYPE_SIZE_UNIT (TREE_TYPE (DR_REF (dra))),
+  TYPE_SIZE_UNIT (TREE_TYPE (DR_REF (drb;
+  if (cmp != 0)
+return cmp;
 
   /* And after step.  */
-  if (!operand_equal_p (DR_STEP (dra), DR_STEP (drb), 0))
-{
-  cmp = compare_tree (DR_STEP (dra), DR_STEP (drb));
-  if (cmp != 0)
-return cmp;
-}
+  cmp = compare_tree (DR_STEP (dra), DR_STEP (drb));
+  if (cmp != 0)
+return cmp;
 
   /* Then sort after DR_INIT.  In case of identical DRs sort after stmt UID.  */
   cmp = tree_int_cst_compare (DR_INIT (dra), DR_INIT (drb));
-- 
1.9.1

[PATCH 3/5] "Fix" intransitive comparison in reload_pseudo_compare_func

[Yury Gribov]

This patch fixes intransitive comparison in reload_pseudo_compare_func. 
Imagine the following

situation:
1) bitmap_bit_p is unset for A and B but set for C
2) A < B (due to early ira_reg_class_max_nregs comparison)
3) B < C (due to following regno_assign_info comparison)

It may then easily happen that A > C (due to regno_assign_info 
comparison) which violates the transitiveness requirement of total ordering.


Unfortunately I'm not sure how to properly fix this so Cc-ing Vladimir 
for help.


/Yury
From 83da5d11c4f013dd14c1ea0c1722c108d80f58ed Mon Sep 17 00:00:00 2001
From: Yury Gribov <tetra2...@gmail.com>
Date: Sat, 12 Dec 2015 10:08:45 +0300
Subject: [PATCH 3/5] "Fix" intransitive comparison in
 reload_pseudo_compare_func.

2015-12-17  Yury Gribov  <tetra2...@gmail.com>

	* lra-assigns.c (reload_pseudo_compare_func):
	Make transitive.

Error message:
Dec 10 00:33:18 yugr-ubuntu1404 : cc1plus[612]: qsort: comparison function is not transitive (comparison function 0x87bc50 (/home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/cc1plus+47bc50), called from 0x87d25c (/home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/cc1plus+47d25c), cmdline is "/home/yugr/build/gcc-4.9.3-patched-bootstrap/./gcc/cc1plus -quiet -nostdinc++ -I . -I /home/yugr/src/gcc-4.9.3-patched/libsanitizer/tsan -I .. -I /home/yugr/src/gcc-4.9.3-patched/libsanitizer -I /home/yugr/src/gcc-4.9.3-patched/libsanitizer/include -I ../../libstdc++-v3/include -I ../../libstdc++-v3/include/x86_64-unknown-linux-gnu -I /home/yugr/src/gcc-4.9.3-patched/libsanitizer/../libstdc++-v3/libsupc++ -imultiarch x86_64-linux-gnu -iprefix /home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/../lib/gcc/x86_64-unknown-linux-gnu/4.9.3/ -isystem /home/yugr/build/gcc-4.9.3-patched-bootstrap/./gcc/include -isystem /home/yugr/build/gcc-4.9.3-patched-bootstrap/./gcc/include-fixed -MD .libs/tsan_interface_atomic.d -MF .deps/tsan_interface_atomic.Tpo -MP -MT tsan_interface_atomic.lo -D_GNU_SOURCE -D _GNU_SOURCE -D _DEBUG -D __STDC_CONSTANT_MACROS -D __STDC_FORMAT_MACROS -D __STDC_LIMIT_MACROS -D _GNU_SOURCE -D PIC -isystem /home/yugr/install/gcc-4.9.3/x86_64-unknown-linux-gnu/include -isystem /home/yugr/install/gcc-4.9.3/x86_64-unknown-linux-gnu/sys-include /home/yugr/src/gcc-4.9.3-patched/libsanitizer/tsan/tsan_interface_atomic.cc -quiet -dumpbase tsan_interface_atomic.cc -mtune=generic -march=x86-64 -auxbase-strip .libs/tsan_interface_atomic.o -g -O2 -Wall -Wextra -Wno-unused-parameter -Wwrite-strings -Wpedantic -Wno-long-long -Wno-variadic-macros -fno-builtin -fno-exceptions -fno-rtti -fomit-frame-pointer -funwind-tables -fvisibility=hidden -fPIC -o /tmp/cc3IPd7A.s")
---
 gcc/lra-assigns.c | 7 +--
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/gcc/lra-assigns.c b/gcc/lra-assigns.c
index 2a9ff21..94f3e66 100644
--- a/gcc/lra-assigns.c
+++ b/gcc/lra-assigns.c
@@ -208,12 +208,7 @@ reload_pseudo_compare_func (const void *v1p, const void *v2p)
 return diff;
   if ((diff
= (ira_reg_class_max_nregs[cl2][lra_reg_info[r2].biggest_mode]
-	  - ira_reg_class_max_nregs[cl1][lra_reg_info[r1].biggest_mode])) != 0
-  /* The code below executes rarely as nregs == 1 in most cases.
-	 So we should not worry about using faster data structures to
-	 check reload pseudos.  */
-  && ! bitmap_bit_p (_reload_pseudos, r1)
-  && ! bitmap_bit_p (_reload_pseudos, r2))
+	  - ira_reg_class_max_nregs[cl1][lra_reg_info[r1].biggest_mode])) != 0)
 return diff;
   if ((diff = (regno_assign_info[regno_assign_info[r2].first].freq
 	   - regno_assign_info[regno_assign_info[r1].first].freq)) != 0)
-- 
1.9.1

[PATCH 4/5] Fix intransitive comparison in compare_access_positions

[Yury Gribov]

Another intransitive comparison in reload_pseudo_compare_func. Buggy 
scenario:

1) A and B are ints of equal presion so we return 0
2) C is REAL and thus can compare differently to A and B

Cc-ing Martin who's the original author.

/Yury
>From 6f3930ad81945f6b5d7aecfdda16089547a592d3 Mon Sep 17 00:00:00 2001
From: Yury Gribov <tetra2...@gmail.com>
Date: Sat, 12 Dec 2015 10:39:15 +0300
Subject: [PATCH 4/5] Fix intransitive comparison in compare_access_positions.

2015-12-17  Yury Gribov  <tetra2...@gmail.com>

	* tree-sra.c (compare_access_positions):
	Make transitive.

Error message:
Dec 10 23:51:43 yugr-ubuntu1404 : f951[31364]: qsort: comparison function is not transitive (comparison function 0x9aa8e0 (/home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/f951+5aa8e0), called from 0x9afeda (/home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/f951+5afeda), cmdline is "/home/yugr/build/gcc-4.9.3-patched-bootstrap/gcc/testsuite/gfortran/../../f951 /home/yugr/src/gcc-4.9.3-patched/gcc/testsuite/gfortran.fortran-torture/execute/intrinsic_set_exponent.f90 -quiet -dumpbase intrinsic_set_exponent.f90 -mtune=generic -march=x86-64 -auxbase intrinsic_set_exponent -O1 -w -fno-diagnostics-show-caret -fdiagnostics-color=never -fintrinsic-modules-path /home/yugr/install/gcc-4.9.3/lib/gcc/x86_64-unknown-linux-gnu/4.9.3/finclude -o /tmp/ccwhVAn9.s")
---
 gcc/tree-sra.c | 20 +---
 1 file changed, 13 insertions(+), 7 deletions(-)

diff --git a/gcc/tree-sra.c b/gcc/tree-sra.c
index c4fea5b..5028850 100644
--- a/gcc/tree-sra.c
+++ b/gcc/tree-sra.c
@@ -1432,6 +1432,13 @@ scan_function (void)
   return ret;
 }
 
+static int
+imprecise_int_type_p (const tree type)
+{
+  return INTEGRAL_TYPE_P (type)
+&& (TREE_INT_CST_LOW (TYPE_SIZE (type)) != TYPE_PRECISION (type));
+}
+
 /* Helper of QSORT function. There are pointers to accesses in the array.  An
access is considered smaller than another if it has smaller offset or if the
offsets are the same but is size is bigger. */
@@ -1471,16 +1478,15 @@ compare_access_positions (const void *a, const void *b)
 	return -1;
   /* Put the integral type with the bigger precision first.  */
   else if (INTEGRAL_TYPE_P (f1->type)
-	   && INTEGRAL_TYPE_P (f2->type))
+	   && INTEGRAL_TYPE_P (f2->type)
+	   && TYPE_PRECISION (f2->type) != TYPE_PRECISION (f1->type))
 	return TYPE_PRECISION (f2->type) - TYPE_PRECISION (f1->type);
   /* Put any integral type with non-full precision last.  */
-  else if (INTEGRAL_TYPE_P (f1->type)
-	   && (TREE_INT_CST_LOW (TYPE_SIZE (f1->type))
-		   != TYPE_PRECISION (f1->type)))
+  else if (imprecise_int_type_p (f1->type)
+	   && !imprecise_int_type_p (f2->type))
 	return 1;
-  else if (INTEGRAL_TYPE_P (f2->type)
-	   && (TREE_INT_CST_LOW (TYPE_SIZE (f2->type))
-		   != TYPE_PRECISION (f2->type)))
+  else if (!imprecise_int_type_p (f1->type)
+	   && imprecise_int_type_p (f2->type))
 	return -1;
   /* Stabilize the sort.  */
   return TYPE_UID (f1->type) - TYPE_UID (f2->type);
-- 
1.9.1

[PATCH 1/5] Fix asymmetric comparison functions

[Yury Gribov]

Some obvious symmetry fixes.

Cc-ing
* Andrey (Belevantsev) for bb_top_order_comparator
* Andrew (MacLeod) for compare_case_labels
* Andrew (Pinski) for resort_field_decl_cmp
* Diego for pair_cmp
* Geoff for resort_method_name_cmp
* Jakub for compare_case_labels
* Jason for method_name_cmp
* Richard for insert_phi_nodes_compare_var_infos, compare_case_labels
* Steven for cmp_v_in_regset_pool

/Yury
>From bf924dca4ccc3f8640438400e923a4c508e898e0 Mon Sep 17 00:00:00 2001
From: Yury Gribov <tetra2...@gmail.com>
Date: Sat, 12 Dec 2015 09:51:54 +0300
Subject: [PATCH 1/5] Fix asymmetric comparison functions.

Qsort requires user-defined comparison function to be
a total order. One of the requirements for this is being
symmetric i.e. return inverse results on element swap.
This patch fixes comparison functions to satisfy these
conditions.

2015-12-17  Yury Gribov  <tetra2...@gmail.com>

	* c-family/c-common.c (resort_field_decl_cmp):
	Make symmteric.
	* cp/class.c (method_name_cmp): Ditto.
	(resort_method_name_cmp): Ditto.
	* fortran/interface.c (pair_cmp): Ditto.
	* gimple.c (compare_case_labels): Ditto.
	* tree-into-ssa.c (insert_phi_nodes_compare_var_infos):
	Ditto.
	* tree-vrp.c (compare_case_labels): Ditto.
	* sel-sched-ir.c (cmp_v_in_regset_pool): Ditto.
	(bb_top_order_comparator): Ditto.
---
 gcc/c-family/c-common.c |  4 +++-
 gcc/cp/class.c  | 10 ++
 gcc/fortran/interface.c |  6 +-
 gcc/gimple.c|  4 +++-
 gcc/sel-sched-ir.c  |  5 +++--
 gcc/tree-into-ssa.c |  5 +
 gcc/tree-vrp.c  |  4 +++-
 7 files changed, 24 insertions(+), 14 deletions(-)

diff --git a/gcc/c-family/c-common.c b/gcc/c-family/c-common.c
index 9bc02fc..eecdfb5 100644
--- a/gcc/c-family/c-common.c
+++ b/gcc/c-family/c-common.c
@@ -9956,8 +9956,10 @@ resort_field_decl_cmp (const void *x_p, const void *y_p)
 resort_data.new_value (, resort_data.cookie);
 if (d1 < d2)
   return -1;
+if (d1 > d2)
+  return 1;
   }
-  return 1;
+  return 0;
 }
 
 /* Resort DECL_SORTED_FIELDS because pointers have been reordered.  */
diff --git a/gcc/cp/class.c b/gcc/cp/class.c
index 216a301..3a740d2 100644
--- a/gcc/cp/class.c
+++ b/gcc/cp/class.c
@@ -2188,9 +2188,9 @@ method_name_cmp (const void* m1_p, const void* m2_p)
 return -1;
   if (*m2 == NULL_TREE)
 return 1;
-  if (DECL_NAME (OVL_CURRENT (*m1)) < DECL_NAME (OVL_CURRENT (*m2)))
-return -1;
-  return 1;
+  tree d1 = DECL_NAME (OVL_CURRENT (*m1));
+  tree d2 = DECL_NAME (OVL_CURRENT (*m2));
+  return d1 < d2 ? -1 : d1 > d2 ? 1 : 0;
 }
 
 /* This routine compares two fields like method_name_cmp but using the
@@ -2214,8 +2214,10 @@ resort_method_name_cmp (const void* m1_p, const void* m2_p)
 resort_data.new_value (, resort_data.cookie);
 if (d1 < d2)
   return -1;
+if (d1 > d2)
+  return 1;
   }
-  return 1;
+  return 0;
 }
 
 /* Resort TYPE_METHOD_VEC because pointers have been reordered.  */
diff --git a/gcc/fortran/interface.c b/gcc/fortran/interface.c
index bfd5d36..e4b93c8 100644
--- a/gcc/fortran/interface.c
+++ b/gcc/fortran/interface.c
@@ -3109,7 +3109,11 @@ pair_cmp (const void *p1, const void *p2)
 }
   if (a2->expr->expr_type != EXPR_VARIABLE)
 return 1;
-  return a1->expr->symtree->n.sym < a2->expr->symtree->n.sym;
+  if (a1->expr->symtree->n.sym < a2->expr->symtree->n.sym)
+return 1;
+  if (a1->expr->symtree->n.sym > a2->expr->symtree->n.sym)
+return -1;
+  return 0;
 }
 
 
diff --git a/gcc/gimple.c b/gcc/gimple.c
index bf552a7..51f515e 100644
--- a/gcc/gimple.c
+++ b/gcc/gimple.c
@@ -2774,7 +2774,9 @@ compare_case_labels (const void *p1, const void *p2)
   const_tree const case2 = *(const_tree const*)p2;
 
   /* The 'default' case label always goes first.  */
-  if (!CASE_LOW (case1))
+  if (!CASE_LOW (case1) && !CASE_LOW (case2))
+return 0;
+  else if (!CASE_LOW (case1))
 return -1;
   else if (!CASE_LOW (case2))
 return 1;
diff --git a/gcc/sel-sched-ir.c b/gcc/sel-sched-ir.c
index 2a9aa10..2f53d22 100644
--- a/gcc/sel-sched-ir.c
+++ b/gcc/sel-sched-ir.c
@@ -959,7 +959,7 @@ cmp_v_in_regset_pool (const void *x, const void *xx)
 return 1;
   else if (r1 < r2)
 return -1;
-  gcc_unreachable ();
+  return 0;
 }
 
 /* Free the regset pool possibly checking for memory leaks.  */
@@ -5935,8 +5935,9 @@ bb_top_order_comparator (const void *x, const void *y)
  bbs with greater number should go earlier.  */
   if (rev_top_order_index[bb1->index] > rev_top_order_index[bb2->index])
 return -1;
-  else
+  else if (rev_top_order_index[bb1->index] < rev_top_order_index[bb2->index])
 return 1;
+  return 0;
 }
 
 /* Create a region for LOOP and return its number.  If we don't want
diff --git a/gcc/tree-into-ssa.c b/gcc/tree-into-ssa.c
index 5486d5c..f3b8c02 100644
--- a/gcc/tree-into-ssa.c
+++ b/gcc/tree-into-ssa.c
@@

[PATCH 0/5] Fix qsort comparison functions

[Yury Gribov]

Hi all,

This patchset fixes bugs in comparison functions used in qsort(3). 
Standard requires comparison functions to satisfy certain 
symmetry/transitivity axioms ("total ordering" in 
http://pubs.opengroup.org/onlinepubs/009695399/functions/qsort.html). 
Violation triggers undefined behavior which can e.g. cause qsort to 
produce invalid results (or even crash - check 
https://bugzilla.samba.org/show_bug.cgi?id=3959).


Most of the patches are pretty obvious except for no. 3 for which I was 
failed to devise a behavior-preserving fix.  I've Cc-ed the original 
authors in hope they'll be able to help.


I've verified all patches on x86_64-pc-linux-gnu (bootstrap + regression 
test).


NB: Bugs were found with SortChecker tool 
(https://github.com/yugr/sortcheck).


/Yury

[PATCHv2][PR 67425] Fix docs for -frandom-seed

[Yury Gribov]

On 12/29/2015 08:05 PM, Sandra Loosemore wrote:

On 12/29/2015 12:33 AM, Yury Gribov wrote:


Hi all,

this patch reverts invalid documentation change -frandom-seed which was
introduced by myself in r216773 a year ago.

I've checked the generated man and the only test for -frandom-seed
(gcc.dg/pr61868.c).

Ok for trunk?  I also want to backport to GCC5 branch.

[snip]

@@ -7464,7 +7464,7 @@ the first option takes effect and the subsequent
options are
 ignored. Thus only @file{vec.miss} is produced which contains
 dumps from the vectorizer about missed opportunities.

-@item -frandom-seed=@var{number}
+@item -frandom-seed=@var{string}
 @opindex frandom-seed
 This option provides a seed that GCC uses in place of
 random numbers in generating certain symbol names


As a user reading this documentation, I wouldn't understand what kind of
string to use as an argument here, or how GCC actually uses it. (Usually
a "random seed" is something that is used to generate a reproductible
sequence of "random" numbers, not something used in place of "random"
numbers.)  Can you do something to clarify the usage, instead of just
renaming the parameter?


Right, thanks.  I've only added description of input argument in this 
new patch.  I'll be able to submit a detailed description of 
functionality when I'm back from holidays in 2016)


-Y

>From 4f99bc09d1055e02df89c5fb1b4389d955ef78e5 Mon Sep 17 00:00:00 2001
From: Yury Gribov <y.gri...@samsung.com>
Date: Fri, 25 Dec 2015 13:57:28 +0300
Subject: [PATCH] Fix docs for -frandom-seed to allow string arguments.

2015-12-29  Yury Gribov  <y.gri...@samsung.com>

	PR driver/67425
	* common.opt (frandom-seed): Fix parameter name.
	* doc/invoke.texi (frandom-seed): Ditto.  Describe parameter.
---
 gcc/common.opt  |  2 +-
 gcc/doc/invoke.texi | 10 +++---
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/gcc/common.opt b/gcc/common.opt
index 23f394d..1f0daf0 100644
--- a/gcc/common.opt
+++ b/gcc/common.opt
@@ -1909,7 +1909,7 @@ Common Var(common_deferred_options) Defer
 
 frandom-seed=
 Common Joined RejectNegative Var(common_deferred_options) Defer
--frandom-seed=	Make compile reproducible using .
+-frandom-seed=	Make compile reproducible using .
 
 ; This switch causes the command line that was used to create an
 ; object file to be recorded into the object file.  The exact format
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index 4e2cf8f..112c461 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -364,7 +364,7 @@ Objective-C and Objective-C++ Dialects}.
 -fmem-report -fpre-ipa-mem-report -fpost-ipa-mem-report -fprofile-arcs @gol
 -fopt-info @gol
 -fopt-info-@var{options}@r{[}=@var{file}@r{]} @gol
--frandom-seed=@var{number} -fsched-verbose=@var{n} @gol
+-frandom-seed=@var{string} -fsched-verbose=@var{n} @gol
 -fsel-sched-verbose -fsel-sched-dump-cfg -fsel-sched-pipelining-verbose @gol
 -fstack-usage  -ftest-coverage  -ftime-report -fvar-tracking @gol
 -fvar-tracking-assignments  -fvar-tracking-assignments-toggle @gol
@@ -7464,7 +7464,7 @@ the first option takes effect and the subsequent options are
 ignored. Thus only @file{vec.miss} is produced which contains
 dumps from the vectorizer about missed opportunities.
 
-@item -frandom-seed=@var{number}
+@item -frandom-seed=@var{string}
 @opindex frandom-seed
 This option provides a seed that GCC uses in place of
 random numbers in generating certain symbol names
@@ -7473,7 +7473,11 @@ place unique stamps in coverage data files and the object files that
 produce them.  You can use the @option{-frandom-seed} option to produce
 reproducibly identical object files.
 
-The @var{number} should be different for every file you compile.
+The @var{string} can either be a number (decimal, octal or hex) or an
+arbitrary string (in which case it's converted to number by
+computing CRC32).
+
+The @var{string} should be different for every file you compile.
 
 @item -fsched-verbose=@var{n}
 @opindex fsched-verbose
-- 
1.9.1

Re: [PATCH 5/5] Fix intransitive comparison in dr_group_sort_cmp

[Yury Gribov]

On 12/19/2015 01:30 AM, Yuri Gribov wrote:

On Fri, Dec 18, 2015 at 11:20 PM, Yury Gribov <y.gri...@samsung.com> wrote:

On 12/17/2015 03:51 PM, Richard Biener wrote:


On Thu, 17 Dec 2015, Yury Gribov wrote:


On 12/17/2015 02:57 PM, Richard Biener wrote:


On Thu, 17 Dec 2015, Yury Gribov wrote:


That's an interesting one. The original comparison function assumes
that
operand_equal_p(a,b) is true iff compare_tree(a, b) == 0.
Unfortunately that's not true (functions are written by different
authors).

This causes subtle violation of transitiveness.

I believe removing operand_equal_p should preserve the intended
semantics
(same approach taken in another comparison function in this file -
comp_dr_with_seg_len_pair).

Cc-ing Cong Hou and Richard who are the authours.



I don't think the patch is good.  compare_tree really doesn't expect
equal elements (and it returning zero is bad or a bug).



Hm but that's how it's used in other comparator in this file
(comp_dr_with_seg_len_pair).



But for sure

switch (code)
  {
  /* For const values, we can just use hash values for comparisons.  */
  case INTEGER_CST:
  case REAL_CST:
  case FIXED_CST:
  case STRING_CST:
  case COMPLEX_CST:
  case VECTOR_CST:
{
  hashval_t h1 = iterative_hash_expr (t1, 0);
  hashval_t h2 = iterative_hash_expr (t2, 0);
  if (h1 != h2)
return h1 < h2 ? -1 : 1;
  break;
}

doesn't detect un-equality correctly (it assumes the hash is
collision-free).

Also note that operator== of dr_with_seg_len again also uses
operand_equal_p (plus compare_tree).

IMHO compare_tree should be cleaned up with respect to what
trees we expect here (no REAL_CSTs for example) and properly
do comparisons.


But it's also
"lazy" in that it will return 0 when it hopes a further disambiguation
inside dr_group_sort_cmp on a different field will eventually lead to
a non-zero compare_tree.

So eventually if compare_tree returns zero we have to fall back to the
final disambiguator using gimple_uid.

That said, I'd like to see the testcase where you observe an
intransitive comparison.



Let me dig my debugging logs (I'll send detailed repro tomorrow).


Added home address.


Richard,

I was doing my original testing on an older GCC (actually 4.9) and it
seems that this particular issue does not reproduce on current trunk.
But from what I can see the problem is still in the code which I'll
now try to explain.

Here's the problem that was detected by the tool:

(gdb) p dr_group_sort_cmp($dr1,$dr2)
$1 = -1
(gdb) p dr_group_sort_cmp($dr2,$dr3)
$2 = -1
(gdb) p dr_group_sort_cmp($dr1,$dr3)
$3 = 1

In other words, dr1 < dr2 and dr2 < dr3 but dr1 > dr3 (which is a
violation of transitivity axiom and will generally drive qsort mad).
Let's see why that happens.

Comparison starts at base addresses which are

(gdb) cal debug_generic_expr($ba1)
b_7(D) + (sizetype) i_69 * 4
(gdb) cal debug_generic_expr($ba2)
a_12(D) + (sizetype) ((long unsigned int) i_69 * 4)
(gdb) cal debug_generic_expr($ba3)
b_7(D) + (sizetype) ((long unsigned int) i_69 * 4)

Now here are results for operand_equals_p:

(gdb) cal operand_equal_p($ba1,$ba2,0)
$1 = 0
(gdb) cal operand_equal_p($ba2,$ba3,0)
$3 = 0

This means that to compare dr1 vs. dr2 and dr2 vs. dr3 we use compare_tree:

(gdb) cal compare_tree($ba1,$ba2)
$4 = -1
(gdb) cal compare_tree($ba2,$ba3)
$5 = -1

For dr1 vs. dr3 situation is more interesting. We continue with other checks
in dr_group_sort_cmp. Everything is equal:

(gdb) p dr_equal_offsets_p(*$dr1,*$dr3)
$7 = true
(gdb) p $dr1.is_read
$9 = false
(gdb) p $dr3.is_read
$11 = false
(gdb) cal 
operand_equal_p($dr1.ref.typed.type.type_common.size_unit,$dr3.ref.typed.type.type_common.size_unit,0)
$15 = 1
(gdb) cal operand_equal_p($dr1.innermost.step,$dr3.innermost.step,0)
$16 = 1

Until the very end where we compare initial values:

(gdb) cal tree_int_cst_compare($dr1.innermost.init,$dr3.innermost.init,0)
$18 = 1

I think the core reason is probably that pattern that's used here i.e.
   if(P(x,y))
 return cmp1(x,y);
   return cmp2(x,y);
will in general not be a valid total ordering even if cmp1 or cmp2 are.
(In our case P = operand_equals_p, cmp1 = compare_tree, cmp2 =
tree_int_cst_compare).

FTR I compiled the attached repro with 4.9.3 like this:
$ ./cc1plus -quiet -O2 -ftree-vectorize repro.i


Richard,

What's your call on this? Do you want a GCC6-relevant repro?

/Yura

[PATCH][PR 67425] Fix docs for -frandom-seed

[Yury Gribov]

Hi all,

this patch reverts invalid documentation change -frandom-seed which was 
introduced by myself in r216773 a year ago.


I've checked the generated man and the only test for -frandom-seed 
(gcc.dg/pr61868.c).


Ok for trunk?  I also want to backport to GCC5 branch.

-Yura
>From 23f8c38f593a18c5783949f7c2225b49685fedfc Mon Sep 17 00:00:00 2001
From: Yury Gribov <y.gri...@samsung.com>
Date: Fri, 25 Dec 2015 13:57:28 +0300
Subject: [PATCH] Fix docs for -frandom-seed to allow string arguments.

2015-12-25  Yury Gribov  <y.gri...@samsung.com>

	PR driver/67425
	* common.opt (frandom-seed): Fix parameter name.
	* doc/invoke.texi (frandom-seed): Ditto.
---
 gcc/common.opt  | 2 +-
 gcc/doc/invoke.texi | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/gcc/common.opt b/gcc/common.opt
index 23f394d..1f0daf0 100644
--- a/gcc/common.opt
+++ b/gcc/common.opt
@@ -1909,7 +1909,7 @@ Common Var(common_deferred_options) Defer
 
 frandom-seed=
 Common Joined RejectNegative Var(common_deferred_options) Defer
--frandom-seed=	Make compile reproducible using .
+-frandom-seed=	Make compile reproducible using .
 
 ; This switch causes the command line that was used to create an
 ; object file to be recorded into the object file.  The exact format
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index 4e2cf8f..ff14f70 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -364,7 +364,7 @@ Objective-C and Objective-C++ Dialects}.
 -fmem-report -fpre-ipa-mem-report -fpost-ipa-mem-report -fprofile-arcs @gol
 -fopt-info @gol
 -fopt-info-@var{options}@r{[}=@var{file}@r{]} @gol
--frandom-seed=@var{number} -fsched-verbose=@var{n} @gol
+-frandom-seed=@var{string} -fsched-verbose=@var{n} @gol
 -fsel-sched-verbose -fsel-sched-dump-cfg -fsel-sched-pipelining-verbose @gol
 -fstack-usage  -ftest-coverage  -ftime-report -fvar-tracking @gol
 -fvar-tracking-assignments  -fvar-tracking-assignments-toggle @gol
@@ -7464,7 +7464,7 @@ the first option takes effect and the subsequent options are
 ignored. Thus only @file{vec.miss} is produced which contains
 dumps from the vectorizer about missed opportunities.
 
-@item -frandom-seed=@var{number}
+@item -frandom-seed=@var{string}
 @opindex frandom-seed
 This option provides a seed that GCC uses in place of
 random numbers in generating certain symbol names
@@ -7473,7 +7473,7 @@ place unique stamps in coverage data files and the object files that
 produce them.  You can use the @option{-frandom-seed} option to produce
 reproducibly identical object files.
 
-The @var{number} should be different for every file you compile.
+The @var{string} should be different for every file you compile.
 
 @item -fsched-verbose=@var{n}
 @opindex fsched-verbose
-- 
1.9.1

Re: [PATCH 1/5] Fix asymmetric comparison functions

[Yury Gribov]

On 12/17/2015 03:04 PM, Yury Gribov wrote:

On 12/17/2015 02:39 PM, Jakub Jelinek wrote:

On Thu, Dec 17, 2015 at 11:58:30AM +0300, Yury Gribov wrote:

2015-12-17  Yury Gribov  <tetra2...@gmail.com>

* c-family/c-common.c (resort_field_decl_cmp):
Make symmteric.
* cp/class.c (method_name_cmp): Ditto.
(resort_method_name_cmp): Ditto.
* fortran/interface.c (pair_cmp): Ditto.


Note, c-family, cp and fortran have their own ChangeLog files, so
the entries without those prefixes need to go into each one and can't
refer to other ChangeLog through Ditto/Likewise etc.
Typo in symmteric.


Right, thanks.


That said, is this actually really a problem?  I mean, is qsort
allowed to call the comparison function with the same arguments?
I think lots of the comparison functions just assume that
for int cmpfn (const void *x, const void *y) x != y.
And if qsort can't call the comparison function with the same argument,
then perhaps the caller has some knowledge your checker does not, say
that the entries that would compare equal by the comparison function
simply can't appear in the array (so the caller knows that the comparison
function should never return 0).


Self-comparisons are certainly less dangerous than transitive ones. I
personally not aware about libc's which can compare element to itself.


Jakub,

So it seems most people generally agree that self-comparisons (cmp(x,x) 
== 0) are useless and don't need to be checked or fixed. What about 
ensuring symmetry i.e. that cmp(x, y) == -cmp(y, x) forall x, y?  One of 
the bugs (pair_cmp in fortran/interface.c) is exactly about this.



However
* comparing an element to itself still a valid thing for qsort to do
* most other comparison functions in GCC support this


--- a/gcc/tree-vrp.c
+++ b/gcc/tree-vrp.c
@@ -5882,7 +5882,9 @@ compare_case_labels (const void *p1, const void
*p2)
else if (idx1 == idx2)
  {
/* Make sure the default label is first in a group.  */
-  if (!CASE_LOW (ci1->expr))
+  if (!CASE_LOW (ci1->expr) && !CASE_LOW (ci2->expr))
+return 0;
+  else if (!CASE_LOW (ci1->expr))
  return -1;
else if (!CASE_LOW (ci2->expr))
  return 1;
--
1.9.1


Say here, we know there is at most one default label in a switch, never
more.  So, unless qsort is allowed to call compare_case_labels
with p1 == p2 (which really doesn't make sense), this case just won't
happen.

Re: [PATCH 1/5] Fix asymmetric comparison functions

[Yury Gribov]

On 12/18/2015 11:07 PM, Jakub Jelinek wrote:

On Fri, Dec 18, 2015 at 10:40:40PM +0300, Yury Gribov wrote:

So it seems most people generally agree that self-comparisons (cmp(x,x) ==
0) are useless and don't need to be checked or fixed. What about ensuring
symmetry i.e. that cmp(x, y) == -cmp(y, x) forall x, y?  One of the bugs
(pair_cmp in fortran/interface.c) is exactly about this.


Ensuring symmetry for x != y is of course very much desirable.
So, if you could change your qsort interposer so that it for each comparison
x != y calls both cmp (x, y) and cmp (y, x) and asserts that
int r = cmp (x, y);
int ir = cmp (y, x);
if (r > 0) assert (ir < 0);
else if (r < 0) assert (ir > 0);
else assert (ir == 0);
it would be greatly appreciated.  Note, the standard only talks about < 0, 0
and > 0, so it is fine if cmp (x, y) returns 231 and cmp (y, x) returns -142.


Sure, I've already bumped into this with other projects.

I'll update my checker and get back with a reduced patchset then.

/Yura

Re: [PATCH 3/5] "Fix" intransitive comparison in reload_pseudo_compare_func

[Yury Gribov]

On 12/17/2015 10:36 PM, Vladimir Makarov wrote:

On 12/17/2015 04:00 AM, Yury Gribov wrote:

This patch fixes intransitive comparison in
reload_pseudo_compare_func. Imagine the following
situation:
1) bitmap_bit_p is unset for A and B but set for C
2) A < B (due to early ira_reg_class_max_nregs comparison)
3) B < C (due to following regno_assign_info comparison)

It may then easily happen that A > C (due to regno_assign_info
comparison) which violates the transitiveness requirement of total
ordering.

Unfortunately I'm not sure how to properly fix this so Cc-ing Vladimir
for help.


   Yury, thanks for reporting this.  Yes that could be a problem but I
can not approve this patch as it might result in *significant*
performance degradation.  I remember the code.  What you propose is the
original patch (PR57878) and it was exactly modified to the current
version because of the negative performance impact.  The current code is
safe although it might result into infinite cycling for some sort
algorithms but not for used qsort.

   I'll think how to fix it better. Probably I will need two comparison
functions for different assignment iterations.  The solution will need
benchmarking as the code is critical for LRA performance.  Could you
fill a bug report in order not to forget the issue.


Thanks! Submitted https://gcc.gnu.org/bugzilla/show_bug.cgi?id=68988

Re: [PATCH 5/5] Fix intransitive comparison in dr_group_sort_cmp

[Yury Gribov]

On 12/17/2015 03:51 PM, Richard Biener wrote:

On Thu, 17 Dec 2015, Yury Gribov wrote:


On 12/17/2015 02:57 PM, Richard Biener wrote:

On Thu, 17 Dec 2015, Yury Gribov wrote:


That's an interesting one. The original comparison function assumes that
operand_equal_p(a,b) is true iff compare_tree(a, b) == 0.
Unfortunately that's not true (functions are written by different
authors).

This causes subtle violation of transitiveness.

I believe removing operand_equal_p should preserve the intended semantics
(same approach taken in another comparison function in this file -
comp_dr_with_seg_len_pair).

Cc-ing Cong Hou and Richard who are the authours.


I don't think the patch is good.  compare_tree really doesn't expect
equal elements (and it returning zero is bad or a bug).


Hm but that's how it's used in other comparator in this file
(comp_dr_with_seg_len_pair).


But for sure

   switch (code)
 {
 /* For const values, we can just use hash values for comparisons.  */
 case INTEGER_CST:
 case REAL_CST:
 case FIXED_CST:
 case STRING_CST:
 case COMPLEX_CST:
 case VECTOR_CST:
   {
 hashval_t h1 = iterative_hash_expr (t1, 0);
 hashval_t h2 = iterative_hash_expr (t2, 0);
 if (h1 != h2)
   return h1 < h2 ? -1 : 1;
 break;
   }

doesn't detect un-equality correctly (it assumes the hash is
collision-free).

Also note that operator== of dr_with_seg_len again also uses
operand_equal_p (plus compare_tree).

IMHO compare_tree should be cleaned up with respect to what
trees we expect here (no REAL_CSTs for example) and properly
do comparisons.


But it's also
"lazy" in that it will return 0 when it hopes a further disambiguation
inside dr_group_sort_cmp on a different field will eventually lead to
a non-zero compare_tree.

So eventually if compare_tree returns zero we have to fall back to the
final disambiguator using gimple_uid.

That said, I'd like to see the testcase where you observe an
intransitive comparison.


Let me dig my debugging logs (I'll send detailed repro tomorrow).


Added home address.

[PATCH][PING][PR 67425] Fix docs for -frandom-seed

[Yury Gribov]

Hi all,

this patch reverts invalid documentation change -frandom-seed which was
introduced by myself in r216773 a year ago.

I've checked the generated man and the only test for -frandom-seed
(gcc.dg/pr61868.c).

Ok for trunk?  I also want to backport to GCC5 branch.

-Yura



>From 23f8c38f593a18c5783949f7c2225b49685fedfc Mon Sep 17 00:00:00 2001
From: Yury Gribov <y.gri...@samsung.com>
Date: Fri, 25 Dec 2015 13:57:28 +0300
Subject: [PATCH] Fix docs for -frandom-seed to allow string arguments.

2015-12-25  Yury Gribov  <y.gri...@samsung.com>

	PR driver/67425
	* common.opt (frandom-seed): Fix parameter name.
	* doc/invoke.texi (frandom-seed): Ditto.
---
 gcc/common.opt  | 2 +-
 gcc/doc/invoke.texi | 6 +++---
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/gcc/common.opt b/gcc/common.opt
index 23f394d..1f0daf0 100644
--- a/gcc/common.opt
+++ b/gcc/common.opt
@@ -1909,7 +1909,7 @@ Common Var(common_deferred_options) Defer
 
 frandom-seed=
 Common Joined RejectNegative Var(common_deferred_options) Defer
--frandom-seed=	Make compile reproducible using .
+-frandom-seed=	Make compile reproducible using .
 
 ; This switch causes the command line that was used to create an
 ; object file to be recorded into the object file.  The exact format
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index 4e2cf8f..ff14f70 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -364,7 +364,7 @@ Objective-C and Objective-C++ Dialects}.
 -fmem-report -fpre-ipa-mem-report -fpost-ipa-mem-report -fprofile-arcs @gol
 -fopt-info @gol
 -fopt-info-@var{options}@r{[}=@var{file}@r{]} @gol
--frandom-seed=@var{number} -fsched-verbose=@var{n} @gol
+-frandom-seed=@var{string} -fsched-verbose=@var{n} @gol
 -fsel-sched-verbose -fsel-sched-dump-cfg -fsel-sched-pipelining-verbose @gol
 -fstack-usage  -ftest-coverage  -ftime-report -fvar-tracking @gol
 -fvar-tracking-assignments  -fvar-tracking-assignments-toggle @gol
@@ -7464,7 +7464,7 @@ the first option takes effect and the subsequent options are
 ignored. Thus only @file{vec.miss} is produced which contains
 dumps from the vectorizer about missed opportunities.
 
-@item -frandom-seed=@var{number}
+@item -frandom-seed=@var{string}
 @opindex frandom-seed
 This option provides a seed that GCC uses in place of
 random numbers in generating certain symbol names
@@ -7473,7 +7473,7 @@ place unique stamps in coverage data files and the object files that
 produce them.  You can use the @option{-frandom-seed} option to produce
 reproducibly identical object files.
 
-The @var{number} should be different for every file you compile.
+The @var{string} should be different for every file you compile.
 
 @item -fsched-verbose=@var{n}
 @opindex fsched-verbose
-- 
1.9.1

Re: [PATCH 1/5] Fix asymmetric comparison functions

[Yury Gribov]

On 12/17/2015 02:39 PM, Jakub Jelinek wrote:

On Thu, Dec 17, 2015 at 11:58:30AM +0300, Yury Gribov wrote:

2015-12-17  Yury Gribov  <tetra2...@gmail.com>

* c-family/c-common.c (resort_field_decl_cmp):
Make symmteric.
* cp/class.c (method_name_cmp): Ditto.
(resort_method_name_cmp): Ditto.
* fortran/interface.c (pair_cmp): Ditto.


Note, c-family, cp and fortran have their own ChangeLog files, so
the entries without those prefixes need to go into each one and can't
refer to other ChangeLog through Ditto/Likewise etc.
Typo in symmteric.


Right, thanks.


That said, is this actually really a problem?  I mean, is qsort
allowed to call the comparison function with the same arguments?
I think lots of the comparison functions just assume that
for int cmpfn (const void *x, const void *y) x != y.
And if qsort can't call the comparison function with the same argument,
then perhaps the caller has some knowledge your checker does not, say
that the entries that would compare equal by the comparison function
simply can't appear in the array (so the caller knows that the comparison
function should never return 0).


Self-comparisons are certainly less dangerous than transitive ones. I 
personally not aware about libc's which can compare element to itself.


However
* comparing an element to itself still a valid thing for qsort to do
* most other comparison functions in GCC support this


--- a/gcc/tree-vrp.c
+++ b/gcc/tree-vrp.c
@@ -5882,7 +5882,9 @@ compare_case_labels (const void *p1, const void *p2)
else if (idx1 == idx2)
  {
/* Make sure the default label is first in a group.  */
-  if (!CASE_LOW (ci1->expr))
+  if (!CASE_LOW (ci1->expr) && !CASE_LOW (ci2->expr))
+   return 0;
+  else if (!CASE_LOW (ci1->expr))
return -1;
else if (!CASE_LOW (ci2->expr))
return 1;
--
1.9.1


Say here, we know there is at most one default label in a switch, never
more.  So, unless qsort is allowed to call compare_case_labels
with p1 == p2 (which really doesn't make sense), this case just won't
happen.

Re: [PATCH 1/5] Fix asymmetric comparison functions

[Yury Gribov]

On 12/17/2015 02:58 PM, Andrey Belevantsev wrote:

Hello,

On 17.12.2015 11:58, Yury Gribov wrote:

Some obvious symmetry fixes.

Cc-ing
* Andrey (Belevantsev) for bb_top_order_comparator


Here, as Jakub mentioned, we assume that the argument addresses will
never be equal,


The problem is that this is not guaranteed.


thus that would always be different basic blocks (the
comparator is used for providing a custom sort over loop body bbs) and
you don't need a return 0 there.  You can put there gcc_unreachable
instead as in ...


* Andrew (MacLeod) for compare_case_labels
* Andrew (Pinski) for resort_field_decl_cmp
* Diego for pair_cmp
* Geoff for resort_method_name_cmp
* Jakub for compare_case_labels
* Jason for method_name_cmp
* Richard for insert_phi_nodes_compare_var_infos, compare_case_labels
* Steven for cmp_v_in_regset_pool


... this case -- here gcc_unreachable () marks that we're sorting pool
pointers and their values are always different.  Please do not remove it.


Same here.

/Yury

Re: [PATCH 1/5] Fix asymmetric comparison functions

[Yury Gribov]

On 12/17/2015 02:59 PM, Richard Biener wrote:

On Thu, 17 Dec 2015, Yury Gribov wrote:


On 12/17/2015 02:41 PM, Richard Biener wrote:

On Thu, 17 Dec 2015, Yury Gribov wrote:


Some obvious symmetry fixes.

Cc-ing
* Andrey (Belevantsev) for bb_top_order_comparator
* Andrew (MacLeod) for compare_case_labels
* Andrew (Pinski) for resort_field_decl_cmp
* Diego for pair_cmp
* Geoff for resort_method_name_cmp
* Jakub for compare_case_labels
* Jason for method_name_cmp
* Richard for insert_phi_nodes_compare_var_infos, compare_case_labels
* Steven for cmp_v_in_regset_pool


So for compare_case_labels we only ever have one label with
!CASE_LOW - which means you only run into the case that needs
!CASE_LOW && !CASE_LOW if comparing an element with itself, correct?

In this case (missing "same element" handling rather than symmetry
fixing) I'd prefer a

   if (case1 == case2)
 return 0;

So just to confirm - do the patches also contain same element
compare fixings?


Yes, that's a fix for same element.  How about adding if + gcc_assert that
both cases can't be NULL otherwise?


Well, does qsort require the compare function to result in zero
for same elements when the sequence to be sorted doesn't contain
duplicates?


Sure, that's part of total ordering requirement in standard.


If an assert works for you that hints at these places found via static
analysis rather than a runtime fuzzer?


Sorry, not sure I fully understood but - yes, adding assertion would 
typically allow for better checking by static analyzers.


/Yura

Re: [PATCH 5/5] Fix intransitive comparison in dr_group_sort_cmp

[Yury Gribov]

On 12/17/2015 02:57 PM, Richard Biener wrote:

On Thu, 17 Dec 2015, Yury Gribov wrote:


That's an interesting one. The original comparison function assumes that
operand_equal_p(a,b) is true iff compare_tree(a, b) == 0.
Unfortunately that's not true (functions are written by different authors).

This causes subtle violation of transitiveness.

I believe removing operand_equal_p should preserve the intended semantics
(same approach taken in another comparison function in this file -
comp_dr_with_seg_len_pair).

Cc-ing Cong Hou and Richard who are the authours.


I don't think the patch is good.  compare_tree really doesn't expect
equal elements (and it returning zero is bad or a bug).


Hm but that's how it's used in other comparator in this file 
(comp_dr_with_seg_len_pair).



But it's also
"lazy" in that it will return 0 when it hopes a further disambiguation
inside dr_group_sort_cmp on a different field will eventually lead to
a non-zero compare_tree.

So eventually if compare_tree returns zero we have to fall back to the
final disambiguator using gimple_uid.

>

That said, I'd like to see the testcase where you observe an
intransitive comparison.


Let me dig my debugging logs (I'll send detailed repro tomorrow).

/Yura

Re: [PATCH 1/5] Fix asymmetric comparison functions

[Yury Gribov]

On 12/17/2015 03:25 PM, Richard Biener wrote:

On Thu, 17 Dec 2015, Yury Gribov wrote:


On 12/17/2015 02:59 PM, Richard Biener wrote:

On Thu, 17 Dec 2015, Yury Gribov wrote:


On 12/17/2015 02:41 PM, Richard Biener wrote:

On Thu, 17 Dec 2015, Yury Gribov wrote:


Some obvious symmetry fixes.

Cc-ing
* Andrey (Belevantsev) for bb_top_order_comparator
* Andrew (MacLeod) for compare_case_labels
* Andrew (Pinski) for resort_field_decl_cmp
* Diego for pair_cmp
* Geoff for resort_method_name_cmp
* Jakub for compare_case_labels
* Jason for method_name_cmp
* Richard for insert_phi_nodes_compare_var_infos, compare_case_labels
* Steven for cmp_v_in_regset_pool


So for compare_case_labels we only ever have one label with
!CASE_LOW - which means you only run into the case that needs
!CASE_LOW && !CASE_LOW if comparing an element with itself, correct?

In this case (missing "same element" handling rather than symmetry
fixing) I'd prefer a

if (case1 == case2)
  return 0;

So just to confirm - do the patches also contain same element
compare fixings?


Yes, that's a fix for same element.  How about adding if + gcc_assert that
both cases can't be NULL otherwise?


Well, does qsort require the compare function to result in zero
for same elements when the sequence to be sorted doesn't contain
duplicates?


Sure, that's part of total ordering requirement in standard.


If an assert works for you that hints at these places found via static
analysis rather than a runtime fuzzer?


Sorry, not sure I fully understood but - yes, adding assertion would typically
allow for better checking by static analyzers.


The question was if you actually observed the case to happen with a
testcase (and whatever mungled qsort implementation) or whether
it was a theoretical outcome computed by a static analyzer.

That is, whether you could hand me a testcase where it happens
or not.


Well, this was detected by calling qsort(x, x) and checking that return 
value is zero in qsort interceptor. So I guess it's more of 
"theoretical" sort.


/Yura

Re: [PATCH 1/5] Fix asymmetric comparison functions

[Yury Gribov]

On 12/17/2015 02:41 PM, Richard Biener wrote:

On Thu, 17 Dec 2015, Yury Gribov wrote:


Some obvious symmetry fixes.

Cc-ing
* Andrey (Belevantsev) for bb_top_order_comparator
* Andrew (MacLeod) for compare_case_labels
* Andrew (Pinski) for resort_field_decl_cmp
* Diego for pair_cmp
* Geoff for resort_method_name_cmp
* Jakub for compare_case_labels
* Jason for method_name_cmp
* Richard for insert_phi_nodes_compare_var_infos, compare_case_labels
* Steven for cmp_v_in_regset_pool


So for compare_case_labels we only ever have one label with
!CASE_LOW - which means you only run into the case that needs
!CASE_LOW && !CASE_LOW if comparing an element with itself, correct?

In this case (missing "same element" handling rather than symmetry
fixing) I'd prefer a

  if (case1 == case2)
return 0;

So just to confirm - do the patches also contain same element
compare fixings?


Yes, that's a fix for same element.  How about adding if + gcc_assert 
that both cases can't be NULL otherwise?


/Yury

Re: Backport important ASan features from upstream.

[Yury Gribov]

On 11/19/2015 11:36 AM, Andrew Pinski wrote:

On Nov 19, 2015 12:19 AM, "Maxim Ostapenko" <m.ostape...@partner.samsung.com>
wrote:


Hi!

Since the last sanitizer library merge to GCC happened, some new useful

features were applied upstream. In particular, the most significant are:


* The shadow offset for ASan was unified on Aarch64 for 39 and 42 VMAs (

http://reviews.llvm.org/D13782). AFAU, this change wouldn't require any
additional support from compiler side, because the shadow offset is the
same as for 39-bit VMA (36).

Actually until 48 vma is implemented asan is useless for aarch64 and should
not be enabled at all.


Linaro has stated several times that main reason for missing 48-bit 
support is lack of HW. Could Cavium provide them with ThunderX bot?


Best regards,
Yury Gribov

Re: [PATCH 1/2] Libsanitizer merge from upstream r253555.

[Yury Gribov]

On 11/24/2015 02:55 PM, Maxim Ostapenko wrote:

On 24/11/15 14:27, Jakub Jelinek wrote:

On Tue, Nov 24, 2015 at 12:23:05PM +0100, Christophe Lyon wrote:

On 24 November 2015 at 12:12, Jakub Jelinek  wrote:

On Tue, Nov 24, 2015 at 12:08:13PM +0100, Christophe Lyon wrote:

Sure.
I had a build in progress with your proposed patch, but it didn't
complete before you committed :-)


So... it still does not work for me. I re-tried several times, made
sure I had
everything cleanup before starting new builds from scratch, hence
the delay.

I'm still seeing:
/tmp/2050111_1.tmpdir/aci-gcc-fsf/sources/gcc-fsf/gccsrc/libsanitizer/sanitizer_common/sanitizer_platform_limits_posix.cc:326:44:

error: 'ARM_VFPREGS_SIZE' was not declared in this scope
unsigned struct_user_vfpregs_struct_sz = ARM_VFPREGS_SIZE;

So cut'n'paste the sanitizer_platform_limits_posix.cc compilation
command
line and replace -c with -E -dD, then look if the wrapper
asm/ptrace.h is
included or not and why?


It pulls the one from the sysroot:
sysroot-arm-none-linux-gnueabihf/usr/include/asm/ptrace.h
(I configure GCC --with-sysroot=XXX)

Then you should figure out where the sysroot include dirs are added in
the
sanitizer_common/Makefile and make sure -isystem
$(top_srcdir)/include/system
comes before that.

Jakub



It seems that I placed new header into wrong directory, it should be
libsanitizer/include/system/asm/ptrace.h
instead of
libsanitizer/include/system/linux/asm/ptrace.h


FYI https://gcc.gnu.org/wiki/CompileFarm seems to have powerpc.

Re: [PATCH] asan: Don't check frame numbers in the testsuite

[Yury Gribov]

On 04/28/2016 06:57 PM, Segher Boessenkool wrote:

On various PowerPC configurations, the top frame is often mentioned
twice in the backtrace, making many asan tests fail.  I see no particular
reason the asan tests want to check the frame number, so this patch
makes it check for " #. " instead of " #1 ", etc., in all of the
c-c++-common/asan tests.


Why not fix libbacktrace though?


Tested on powerpc64-linux, also -m32; is this okay for trunk?


Segher


2016-04-28  Segher Boessenkool  

gcc/testsuite/
* c-c++-common/asan/global-overflow-1.c: Don't check frame numbers.
* c-c++-common/asan/heap-overflow-1.c: Ditto.
* c-c++-common/asan/memcmp-1.c: Ditto.
* c-c++-common/asan/misalign-1.c: Ditto.
* c-c++-common/asan/misalign-2.c: Ditto.
* c-c++-common/asan/null-deref-1.c: Ditto.
* c-c++-common/asan/pr64820.c: Ditto.
* c-c++-common/asan/sanity-check-pure-c-1.c: Ditto.
* c-c++-common/asan/stack-overflow-1.c: Ditto.
* c-c++-common/asan/strip-path-prefix-1.c: Ditto.
* c-c++-common/asan/strlen-overflow-1.c: Ditto.
* c-c++-common/asan/strncpy-overflow-1.c: Ditto.
* c-c++-common/asan/use-after-free-1.c: Ditto.
* c-c++-common/asan/use-after-return-1.c: Ditto.

---
  gcc/testsuite/c-c++-common/asan/global-overflow-1.c |  2 +-
  gcc/testsuite/c-c++-common/asan/heap-overflow-1.c   |  6 +++---
  gcc/testsuite/c-c++-common/asan/memcmp-1.c  |  4 ++--
  gcc/testsuite/c-c++-common/asan/misalign-1.c|  4 ++--
  gcc/testsuite/c-c++-common/asan/misalign-2.c|  4 ++--
  gcc/testsuite/c-c++-common/asan/null-deref-1.c  |  4 ++--
  gcc/testsuite/c-c++-common/asan/pr64820.c   |  2 +-
  gcc/testsuite/c-c++-common/asan/sanity-check-pure-c-1.c |  8 
  gcc/testsuite/c-c++-common/asan/stack-overflow-1.c  |  2 +-
  gcc/testsuite/c-c++-common/asan/strip-path-prefix-1.c   |  2 +-
  gcc/testsuite/c-c++-common/asan/strlen-overflow-1.c |  2 +-
  gcc/testsuite/c-c++-common/asan/strncpy-overflow-1.c|  8 
  gcc/testsuite/c-c++-common/asan/use-after-free-1.c  | 10 +-
  gcc/testsuite/c-c++-common/asan/use-after-return-1.c|  2 +-
  14 files changed, 30 insertions(+), 30 deletions(-)

diff --git a/gcc/testsuite/c-c++-common/asan/global-overflow-1.c 
b/gcc/testsuite/c-c++-common/asan/global-overflow-1.c
index 8dd75df..6a659c8 100644
--- a/gcc/testsuite/c-c++-common/asan/global-overflow-1.c
+++ b/gcc/testsuite/c-c++-common/asan/global-overflow-1.c
@@ -23,6 +23,6 @@ int main() {
  }

  /* { dg-output "READ of size 1 at 0x\[0-9a-f\]+ thread T0.*(\n|\r\n|\r)" } */
-/* { dg-output "#0 0x\[0-9a-f\]+ +(in _*main 
(\[^\n\r]*global-overflow-1.c:20|\[^\n\r]*:0)|\[(\])\[^\n\r]*(\n|\r\n|\r).*" } */
+/* { dg-output "#. 0x\[0-9a-f\]+ +(in _*main 
(\[^\n\r]*global-overflow-1.c:20|\[^\n\r]*:0)|\[(\])\[^\n\r]*(\n|\r\n|\r).*" } */
  /* { dg-output "0x\[0-9a-f\]+ is located 0 bytes to the right of global 
variable" } */
  /* { dg-output ".*YYY\[^\n\r]* of size 10\[^\n\r]*(\n|\r\n|\r)" } */
diff --git a/gcc/testsuite/c-c++-common/asan/heap-overflow-1.c 
b/gcc/testsuite/c-c++-common/asan/heap-overflow-1.c
index 0377a6c..e7c0ba5 100644
--- a/gcc/testsuite/c-c++-common/asan/heap-overflow-1.c
+++ b/gcc/testsuite/c-c++-common/asan/heap-overflow-1.c
@@ -24,8 +24,8 @@ int main(int argc, char **argv) {
  }

  /* { dg-output "READ of size 1 at 0x\[0-9a-f\]+ thread T0.*(\n|\r\n|\r)" } */
-/* { dg-output "#0 0x\[0-9a-f\]+ +(in _*main 
(\[^\n\r]*heap-overflow-1.c:21|\[^\n\r]*:0)|\[(\]).*(\n|\r\n|\r)" } */
+/* { dg-output "#. 0x\[0-9a-f\]+ +(in _*main 
(\[^\n\r]*heap-overflow-1.c:21|\[^\n\r]*:0)|\[(\]).*(\n|\r\n|\r)" } */
  /* { dg-output "\[^\n\r]*0x\[0-9a-f\]+ is located 0 bytes to the right of 10-byte 
region\[^\n\r]*(\n|\r\n|\r)" } */
  /* { dg-output "\[^\n\r]*allocated by thread T0 here:\[^\n\r]*(\n|\r\n|\r)" } 
*/
-/* { dg-output "#0 0x\[0-9a-f\]+ +(in 
_*(interceptor_|wrap_|)malloc|\[(\])\[^\n\r]*(\n|\r\n|\r)" } */
-/* { dg-output "#1 0x\[0-9a-f\]+ +(in _*main 
(\[^\n\r]*heap-overflow-1.c:19|\[^\n\r]*:0)|\[(\])\[^\n\r]*(\n|\r\n|\r)" } */
+/* { dg-output "#. 0x\[0-9a-f\]+ +(in 
_*(interceptor_|wrap_|)malloc|\[(\])\[^\n\r]*(\n|\r\n|\r)" } */
+/* { dg-output "#. 0x\[0-9a-f\]+ +(in _*main 
(\[^\n\r]*heap-overflow-1.c:19|\[^\n\r]*:0)|\[(\])\[^\n\r]*(\n|\r\n|\r)" } */
diff --git a/gcc/testsuite/c-c++-common/asan/memcmp-1.c 
b/gcc/testsuite/c-c++-common/asan/memcmp-1.c
index 5915988..5a36353 100644
--- a/gcc/testsuite/c-c++-common/asan/memcmp-1.c
+++ b/gcc/testsuite/c-c++-common/asan/memcmp-1.c
@@ -16,5 +16,5 @@ main ()
  }

  /* { dg-output "ERROR: AddressSanitizer: stack-buffer-overflow.*(\n|\r\n|\r)" 
} */
-/* { dg-output "#0 0x\[0-9a-f\]+ +(in 
_*(interceptor_|wrap_|)memcmp|\[(\])\[^\n\r]*(\n|\r\n|\r)" } */
-/* { dg-output "#1 0x\[0-9a-f\]+ +(in _*main|\[(\])\[^\n\r]*(\n|\r\n|\r)" 
} */
+/* { 

Re: [PATCH, DOC] Document ASAN_OPTIONS="halt_on_error" env variable.

[Yury Gribov]

On 05/11/2016 05:13 PM, Martin Liška wrote:

Hello.

It's bit confusing for a use that -fsanitize-recover=address does not recover
an instrumented binary. As a default value of halt_on_error is set to 0 for 
address sanitizer,
the binary fails on a first error.


I'm the guy behind -fsanitize-recover=address so let me explain.

Error recovery requires changes both to compiler (insert calls to 
recovering __asan_report_error_X_noabort rather than noreturning 
__asan_report_error_X) and runtime (do not abort when detecting overflow 
inside intercepted API like memcpy). -fsanitize-recover controls the 
compiler side, whereas halt_on_error=0 controls the runtime side.


Unfortunately currently there is no way to inform runtime library that 
compiled code would like it to continue execution after detecting error. 
Actually it's not clear how to do that properly because different parts 
of application could be compiled with different recovery settings (e.g. 
a.c with recovery and b.c without) making it hard to understand what 
behavior user would expect from runtime library interceptors.



Following patch attempts to explain the ENV variable.

Ready for trunk?


LGTM (but I'm not a maintainer and do not have approve right).


Thanks,
Martin

Re: [PATCH, RFC] Introduce -fsanitize=use-after-scope

[Yury Gribov]

On 05/06/2016 03:38 PM, Jakub Jelinek wrote:

On Fri, May 06, 2016 at 02:48:30PM +0300, Yury Gribov wrote:

6) As the use-after-scope stuff is already included in libsanitizer, no change 
is needed for the library


Note that upstream seems to use a different cmdline interface. They don't
have a dedicated -fsanitize=use-after-scope and instead consider it to be a
part of -fsanitize=address (disabled by default, enabled via -mllvm
-asan-use-after-scope=1). I'd suggest to keep this interface (or at least
discuss with them) and use GCC's --param.


I personally think -fsanitize=use-after-scope (which implies address
sanitization in it) is better, can upstream be convinved not to change it?


Will that work with -fsanitize=kernel-address?




FTR here's the upstream work on this: http://reviews.llvm.org/D19347


Example:

int
main (void)
{
   char *ptr;
   {
 char my_char[9];
 ptr = _char[0];
   }

   *(ptr+9) = 'c';
}


Well, this testcase shows not just use after scope, but also out of bound
access.  Would be better not to combine it, at least in the majority of
testcases.

Jakub

Re: [PATCH, RFC] Introduce -fsanitize=use-after-scope

[Yury Gribov]

On 05/06/2016 02:04 PM, Martin Liška wrote:

Hello.

I've started working on the patch couple of month go, basically after
a brief discussion with Jakub on IRC.

I'm sending the initial version which can successfully run instrumented
tramp3d, postgresql server and Inkscape. It catches the basic set of
examples which are added in following patch.

The implementation is quite straightforward as works in following steps:

1) Every local variable stack slot is poisoned at the very beginning of a 
function (RTL emission)
2) In gimplifier, once we spot a DECL_EXPR, a variable is unpoisoned (by 
emitting ASAN_MARK builtin)
and the variable is marked as addressable
3) Similarly, BIND_EXPR is the place where we poison the variable (scope exit)
4) At the very end of the function, we clean up the poisoned memory
5) The builtins are expanded to call to libsanitizer run-time library 
(__asan_poison_stack_memory, __asan_unpoison_stack_memory)


Can we inline these?


6) As the use-after-scope stuff is already included in libsanitizer, no change 
is needed for the library


Note that upstream seems to use a different cmdline interface. They 
don't have a dedicated -fsanitize=use-after-scope and instead consider 
it to be a part of -fsanitize=address (disabled by default, enabled via 
-mllvm -asan-use-after-scope=1). I'd suggest to keep this interface (or 
at least discuss with them) and use GCC's --param.


FTR here's the upstream work on this: http://reviews.llvm.org/D19347


Example:

int
main (void)
{
   char *ptr;
   {
 char my_char[9];
 ptr = _char[0];
   }

   *(ptr+9) = 'c';
}

./a.out
=
==12811==ERROR: AddressSanitizer: stack-use-after-scope on address 
0x7ffec9bcff69 at pc 0x00400a73 bp 0x7ffec9bcfef0 sp 0x7ffec9bcfee8
WRITE of size 1 at 0x7ffec9bcff69 thread T0
 #0 0x400a72 in main (/tmp/a.out+0x400a72)
 #1 0x7f100824860f in __libc_start_main (/lib64/libc.so.6+0x2060f)
 #2 0x400868 in _start (/tmp/a.out+0x400868)

Address 0x7ffec9bcff69 is located in stack of thread T0 at offset 105 in frame
 #0 0x400945 in main (/tmp/a.out+0x400945)

   This frame has 2 object(s):
 [32, 40) 'ptr'
 [96, 105) 'my_char' <== Memory access at offset 105 overflows this variable
HINT: this may be a false positive if your program uses some custom stack 
unwind mechanism or swapcontext
   (longjmp and C++ exceptions *are* supported)
SUMMARY: AddressSanitizer: stack-use-after-scope (/tmp/a.out+0x400a72) in main
Shadow bytes around the buggy address:
   0x100059371f90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x100059371fa0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x100059371fb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x100059371fc0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x100059371fd0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x100059371fe0: f1 f1 f1 f1 00 f4 f4 f4 f2 f2 f2 f2 f8[f8]f4 f4
   0x100059371ff0: f3 f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
   0x100059372000: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x100059372010: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x100059372020: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   0x100059372030: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
   Addressable:   00
   Partially addressable: 01 02 03 04 05 06 07
   Heap left redzone:   fa
   Heap right redzone:  fb
   Freed heap region:   fd
   Stack left redzone:  f1
   Stack mid redzone:   f2
   Stack right redzone: f3
   Stack partial redzone:   f4
   Stack after return:  f5
   Stack use after scope:   f8
   Global redzone:  f9
   Global init order:   f6
   Poisoned by user:f7
   Container overflow:  fc
   Array cookie:ac
   Intra object redzone:bb
   ASan internal:   fe
   Left alloca redzone: ca
   Right alloca redzone:cb
==12811==ABORTING

As mentioned, it's request for comment as it still has couple of limitations:
a) VLA are not supported, which should make sense as we are unable to allocate 
a stack slot for that


Note that we plan some work on VLA sanitization later this year 
(upstream ASan now sanitizes dynamic allocas and VLAs).



b) we can possibly strip some instrumentation in situations where a variable is 
introduced in a very first BB (RTL poisoning is superfluous).
Similarly for a very last BB of a function, we can strip end of scope poisoning 
(and RTL unpoisoning). I'll do that incrementally.
c) We require -fstack-reuse=none option, maybe it worth to warn a user if 
-fsanitize=use-after-scope is provided without the option?


As a user, I'd prefer it to be automatically disabled when 
use-after-scope is on (unless it has been set explicitly in cmdline in 
which case we should probably issue error).



d) An instrumented binary is quite slow (~20x for tramp3d) as every function 

Re: [PATCH] Add patch for debugging compiler ICEs

[Yury Gribov]

 It is a driver patch, so you get something only
 when you invoke the driver,
 not when compiling with cc1 or cc1plus etc. directly.

 Just pick up any known ICE from bugzilla and try it...

Tried that with some recent ICEs:
* PR 61445 - generated expected repro
* PR 60990 and 61623 - reports The bug is not reproducible, so it is 
likely a hardware or OS problem. (I guess error messages include 
pointer values which change across runs and cause this patch to bail out)


-Y

---
From: Jakub Jelinek
Sent:  Friday, July 04, 2014 7:21PM
To: James Greenhalgh james.greenha...@arm.com
Cc: Max Ostapenko, GCC Patches, Yury Gribov, Viacheslav Garbuzov, Trevor 
Saunders, Maxim Ostapenko

Subject: Re: [PATCH] Add patch for debugging compiler ICEs

On 07/04/2014 07:21 PM, Jakub Jelinek wrote:
On Fri, Jul 04, 2014 at 04:13:31PM +0100, James Greenhalgh wrote:

On Mon, Jun 02, 2014 at 04:21:14PM +0100, Maxim Ostapenko wrote:

Hi,

A years ago there was a discussion 
(https://gcc.gnu.org/ml/gcc-patches/2004-01/msg02437.html) about debugging 
compiler ICEs that resulted in a patch from Jakub, which dumps
useful information into temporary file, but for some reasons this patch wasn't 
applied to trunk.

This is the resurrected patch with added GCC version information into generated 
repro file.



How can I test this patch?

I tried applying it and injecting a segmentation fault in to the AArch64 CPU
option parsing code, but I didn't see anything new when the ICE was triggered.

What am I doing wrong?


It is a driver patch, so you get something only when you invoke the driver,
not when compiling with cc1 or cc1plus etc. directly.

Just pick up any known ICE from bugzilla and try it...

Jakub

[PATCH] Add support for KernelAddressSanitizer

[Yury Gribov]

Hi all,

This tiny patch adds support for KernelASan. KASan brings Asan error 
detection capabilities to Linux kernel 
(https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel).


KASan works similar to normal userspace ASan but disables some options 
which are not yet supported by kernel (notably inline instrumentation, 
stack/global protection and UAR). We would prefer to hide all necessary 
tweaks under a user-friendly flag (-fsanitize=kernel-address) instead of 
forcing them directly in kernel's CFLAGS.


Kernel patches are currently under review in LKML 
(https://lkml.org/lkml/2014/7/9/990).


Bootstrapped and regtested on x64.

Ok to commit?

-Y
gcc/

2014-07-18  Yury Gribov  y.gri...@samsung.com

	* doc/invoke.texi (-fsanitize=kernel-address): Describe new option.
	* flag-types.h (SANITIZE_KERNEL_ADDRESS): New enum.
	* opts.c (common_handle_option): Handle new option.

diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index a83f6c6..70f9c2b 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -5376,6 +5376,11 @@ more details.  The run-time behavior can be influenced using the
 @url{https://code.google.com/p/address-sanitizer/wiki/Flags#Run-time_flags} for
 a list of supported options.
 
+@item -fsanitize=kernel-address
+@opindex fsanitize=kernel-address
+Enable AddressSanitizer for Linux kernel.
+See @uref{http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel} for more details.
+
 @item -fsanitize=thread
 @opindex fsanitize=thread
 Enable ThreadSanitizer, a fast data race detector.
diff --git a/gcc/flag-types.h b/gcc/flag-types.h
index 2849455..04038f6 100644
--- a/gcc/flag-types.h
+++ b/gcc/flag-types.h
@@ -231,6 +231,7 @@ enum sanitize_code {
   SANITIZE_FLOAT_DIVIDE = 1  12,
   SANITIZE_FLOAT_CAST = 1  13,
   SANITIZE_BOUNDS = 1  14,
+  SANITIZE_KERNEL_ADDRESS = 1  15,
   SANITIZE_UNDEFINED = SANITIZE_SHIFT | SANITIZE_DIVIDE | SANITIZE_UNREACHABLE
 		   | SANITIZE_VLA | SANITIZE_NULL | SANITIZE_RETURN
 		   | SANITIZE_SI_OVERFLOW | SANITIZE_BOOL | SANITIZE_ENUM
diff --git a/gcc/opts.c b/gcc/opts.c
index 419a074..42fef36 100644
--- a/gcc/opts.c
+++ b/gcc/opts.c
@@ -1475,6 +1475,7 @@ common_handle_option (struct gcc_options *opts,
 	  { float-cast-overflow, SANITIZE_FLOAT_CAST,
 		sizeof float-cast-overflow - 1 },
 	  { bounds, SANITIZE_BOUNDS, sizeof bounds - 1 },
+	  { kernel-address, SANITIZE_KERNEL_ADDRESS, sizeof kernel-address - 1 },
 	  { NULL, 0, 0 }
 	};
 	const char *comma;
@@ -1520,6 +1521,25 @@ common_handle_option (struct gcc_options *opts,
 	   the null pointer checks.  */
 	if (flag_sanitize  SANITIZE_NULL)
 	  opts-x_flag_delete_null_pointer_checks = 0;
+
+	/* Kernel ASan implies normal ASan but does not yet support
+	   all features.  */
+	if (flag_sanitize  SANITIZE_KERNEL_ADDRESS)
+	  {
+	flag_sanitize |= SANITIZE_ADDRESS;
+	maybe_set_param_value (PARAM_ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD, 0,
+   opts-x_param_values,
+   opts_set-x_param_values);
+	maybe_set_param_value (PARAM_ASAN_GLOBALS, 0,
+   opts-x_param_values,
+   opts_set-x_param_values);
+	maybe_set_param_value (PARAM_ASAN_STACK, 0,
+   opts-x_param_values,
+   opts_set-x_param_values);
+	maybe_set_param_value (PARAM_ASAN_USE_AFTER_RETURN, 0,
+   opts-x_param_values,
+   opts_set-x_param_values);
+	  }
 	break;
   }
 

Re: [PATCH] Add support for KernelAddressSanitizer

[Yury Gribov]

 Also, oring in SANITIZER_ADDRESS means you add -lasan to link flags, I'd
 guess that for -fsanitize=kernel-address you don't want to add any 
libraries

 at link time?

 I suspect that we don't pass -fsanitize=kernel-address during linking
 in kernel today. But I agree that it's better to disable any
 processing during linking for now. Later we may want to do something
 special during linking if -fsanitize=kernel-address is supplied.

AFAIK kernel is linked directly with ld so this may not be a big issue.

 Do you error out on -fsanitize=thread -fsanitize=kernel-address ?
 Perhaps -fsanitize=kernel-address -fsanitize=address should be
 invalid too?

 Yes, all these combinations are invalid.

Ok, I'll add these.

-Y

[PATCH] Move Asan instrumentation to sanopt pass

[Yury Gribov]

Hi all,

Attached patch delays generation of Asan memory checking code
until sanopt pass. This is a first step towards global static analysis
of Asan instrumentation which would allow to
* remove redundant instrumentations
* aggregate adjacent Asan checks
* move invariant checks from loops

The patch also changes the logic behind 
asan-instrumentation-with-call-threshold

parameter to more closely match LLVM.

The patch splits build_check_stmt routine to two parts. The first one
(called from asan0/asan passes) inserts calls to internal functions
ASAN_LOAD and ASAN_STORE. The second expands those to inline checks
(in asan_expand_check_ifn).

Here are some obvious disadvantages:
* passing additional info via hidden parameter of
ASAN_{LOAD,STORE} is ugly but I'm not sure how to do this better
* delayed expansion runs after all optimization passes
so inlined Asan checks will not get a chance to be
CSE-ed, etc.; this may probably be solved by moving sanopt earlier
in the pipeline. BTW I haven't experienced notable slowdowns in my 
experiments.

* passing program pointers to ASAN_{LOAD,STORE} may damage alias analysis
because all pointers will now escape; I probably could
provide fnspec with (EAF_DIRECT | EAF_NOCLOBBER | EAF_NOESCAPE) or
even EAF_UNUSED for these functions but this does not seem
to be supported in current middle-end.

The patch was bootstrapped, regtested and asan-bootstrapped on x64.

Is this ok for trunk?

-Yury
commit ec53fb00ab4a762c3c4cefa886f6cd9ee549de8d
Author: Yury Gribov y.gri...@samsung.com
Date:   Thu Jul 17 09:45:26 2014 +0400

Move inlining of Asan memory checks to sanopt pass.
Change asan-instrumentation-with-call-threshold to more closely match LLVM.

gcc/

2014-07-17  Yury Gribov  y.gri...@samsung.com

	* asan.c (asan_check_flags): New enum.
	(build_check_stmt_with_calls): Removed function.
	(build_check_stmt): Split inlining logic to
	asan_expand_check_ifn.
	(instrument_derefs): Rename parameter.
	(instrument_mem_region_access): Rename parameter.
	(instrument_strlen_call): Likewise.
	(asan_expand_check_ifn): New function.
	(asan_instrument): Remove old code.
	(pass_sanopt::execute): Change handling of
	asan-instrumentation-with-call-threshold.
	* doc/invoke.texi (asan-instrumentation-with-call-threshold):
	Update description.
	* gimple_iterator.h (gsi_start_bb): Fix uninitialized
	warnings.
	* internal-fn.c (expand_ASAN_LOAD): New function.
	(expand_ASAN_STORE): Likewise.
	* internal-fn.def (ASAN_LOAD): New internal function.
	(ASAN_STORE): Likewise.
	* params.def (PARAM_ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD):
	Update description.
	(PARAM_ASAN_USE_AFTER_RETURN): Likewise.

gcc/testsuite/

2014-07-17  Yury Gribov  y.gri...@samsung.com

	* c-c++-common/asan/inc.c: Update test.
	* c-c++-common/asan/instrument-with-calls-2.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-1.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-2.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-3.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-4.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-5.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-6.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-7.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-8.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-9.c: Likewise.

diff --git a/gcc/asan.c b/gcc/asan.c
index 0d78634..7fe079d 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -243,18 +243,15 @@ static GTY(()) tree shadow_ptr_types[2];
 /* Decl for __asan_option_detect_stack_use_after_return.  */
 static GTY(()) tree asan_detect_stack_use_after_return;
 
-/* Number of instrumentations in current function so far.  */
-
-static int asan_num_accesses;
-
-/* Check whether we should replace inline instrumentation with calls.  */
-
-static inline bool
-use_calls_p ()
+/* Various flags for Asan builtins.  */
+enum asan_check_flags
 {
-  return ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD  INT_MAX
- asan_num_accesses = ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD;
-}
+  ASAN_CHECK_NON_ZERO_LEN = 1  0,
+  ASAN_CHECK_SCALAR_ACCESS = 1  1,
+  ASAN_CHECK_START_INSTRUMENTED = 1  2,
+  ASAN_CHECK_END_INSTRUMENTED = 1  3,
+  ASAN_CHECK_LAST
+};
 
 /* Hashtable support for memory references used by gimple
statements.  */
@@ -1553,55 +1550,6 @@ maybe_create_ssa_name (location_t loc, tree base, gimple_stmt_iterator *iter,
   return gimple_assign_lhs (g);
 }
 
-/* Instrument the memory access instruction using callbacks.
-   Parameters are similar to BUILD_CHECK_STMT.  */
-
-static void
-build_check_stmt_with_calls (location_t loc, tree base, tree len,
-			 HOST_WIDE_INT size_in_bytes, gimple_stmt_iterator *iter,
-			 bool before_p, bool is_store, bool is_scalar_access

Re: [PATCH] Add support for KernelAddressSanitizer

[Yury Gribov]

Then in sanitize_spec_function supposedly for address check
SANITIZE_USER_ADDRESS bit, for kernel-address added there
SANITIZE_KERNEL_ADDRESS, add all the incompatibility diagnostics for the new
invalid combinations.


Ok.


Plus, toplev.c has e.g.:
...
Now, is the same really the case for SANITIZE_KERNEL_ADDRESS?


This is a good point, KASan does not use asan_shadow_offset
so this check is redundant.


I guess we still inline the shadow memory accesses to poison/unpoison
stack in function prologue/epilogue, right?  In that case without
asan_shadow_offset we can't do anything.  If it was a function call instead
it would be portable to all architectures.


Stack is not supported by current KASan. My local version indeed does 
replace

asan_shadow_offset with function call.

-Y

[PATCH] New check and updates in check_GNU_style script

[Yury Gribov]

Hi all,

Attached patch adds new check (all blocks of 8 spaces are replaced with 
tabs) to contrib/check_GNU_style.sh. It also changes the script to allow 
reading patches from stdin and improves the Dot, space, space, new 
sentence. check.


-Y
commit 4bc624dcd778e8317a4de620b266c05b55577aad
Author: Yury Gribov y.gri...@samsung.com
Date:   Mon Jul 21 10:12:24 2014 +0400

2014-07-21  Yury Gribov  y.gri...@samsung.com

	check_GNU_style.sh: Support patches coming from stdin,
	check that spaces are converted to tabs and make double-space
	check more precice.

diff --git a/contrib/check_GNU_style.sh b/contrib/check_GNU_style.sh
index ef8fdda..d61dc96 100755
--- a/contrib/check_GNU_style.sh
+++ b/contrib/check_GNU_style.sh
@@ -23,6 +23,8 @@ usage() {
 check_GNU_style.sh [patch]...
 
 Checks the patches for some of the GNU style formatting problems.
+When FILE is -, read standard input.
+
 Please note that these checks are not always accurate, and
 complete.  The reference documentation of the GNU Coding Standards
 can be found here: http://www.gnu.org/prep/standards_toc.html
@@ -35,19 +37,22 @@ EOF
 
 test $# -eq 0  usage
 
+inp=check_GNU_style.inp
 tmp=check_GNU_style.tmp
 
 # Remove $tmp on exit and various signals.
-trap rm -f $tmp 0
-trap rm -f $tmp ; exit 1 1 2 3 5 9 13 15
+trap rm -f $inp $tmp 0
+trap rm -f $inp $tmp ; exit 1 1 2 3 5 9 13 15
+
+grep -nH '^+' $* \
+	| grep -v ':+++' \
+	 $inp
 
 # Grep
 g (){
 msg=$1
 arg=$2
-shift 2
-grep -nH '^+' $* \
-	| grep -v ':+++' \
+cat $inp \
 	| egrep --color=always -- $arg \
 	 $tmp  printf \n$msg\n
 cat $tmp
@@ -58,9 +63,7 @@ ag (){
 msg=$1
 arg1=$2
 arg2=$3
-shift 3
-grep -nH '^+' $* \
-	| grep -v ':+++' \
+cat $inp \
 	| egrep --color=always -- $arg1 \
 	| egrep --color=always -- $arg2 \
 	 $tmp  printf \n$msg\n
@@ -72,9 +75,7 @@ vg (){
 msg=$1
 varg=$2
 arg=$3
-shift 3
-grep -nH '^+' $* \
-	| grep -v ':+++' \
+cat $inp \
 	| egrep -v -- $varg \
 	| egrep --color=always -- $arg \
 	 $tmp  printf \n$msg\n
@@ -83,9 +84,7 @@ vg (){
 
 col (){
 msg=$1
-shift 1
-grep -nH '^+' $* \
-	| grep -v ':+++' \
+cat $inp \
 	| cut -f 2 -d '+' \
 	| awk '{ if (length ($0)  80) print $0 }' \
 	 $tmp
@@ -95,30 +94,32 @@ col (){
 fi
 }
 
-col 'Lines should not exceed 80 characters.' $*
+col 'Lines should not exceed 80 characters.'
+
+g 'Blocks of 8 spaces should be replaced with tabs.' \
+' {8}'
 
 g 'Trailing whitespace.' \
-'[[:space:]]$' $*
+'[[:space:]]$'
 
 g 'Space before dot.' \
-'[[:alnum:]][[:blank:]]+\.' $*
+'[[:alnum:]][[:blank:]]+\.'
 
 g 'Dot, space, space, new sentence.' \
-'[[:alnum:]]\.([[:blank:]]|[[:blank:]]{3,})[[:alnum:]]' $*
+'[[:alnum:]]\.([[:blank:]]|[[:blank:]]{3,})[A-Z0-9]'
 
 g 'Dot, space, space, end of comment.' \
-'[[:alnum:]]\.([[:blank:]]{0,1}|[[:blank:]]{3,})\*/' $*
+'[[:alnum:]]\.([[:blank:]]{0,1}|[[:blank:]]{3,})\*/'
 
 g 'Sentences should end with a dot.  Dot, space, space, end of the comment.' \
-'[[:alnum:]][[:blank:]]*\*/' $*
+'[[:alnum:]][[:blank:]]*\*/'
 
 vg 'There should be exactly one space between function name and parentheses.' \
-'\#define' '[[:alnum:]]([^[:blank:]]|[[:blank:]]{2,})\(' $*
+'\#define' '[[:alnum:]]([^[:blank:]]|[[:blank:]]{2,})\('
 
 g 'There should be no space before closing parentheses.' \
-'[[:graph:]][[:blank:]]+\)' $*
+'[[:graph:]][[:blank:]]+\)'
 
 ag 'Braces should be on a separate line.' \
-'\{' 'if[[:blank:]]\(|while[[:blank:]]\(|switch[[:blank:]]\(' $*
-
+'\{' 'if[[:blank:]]\(|while[[:blank:]]\(|switch[[:blank:]]\('
 

Re: [PATCH 2/2] allow running mklog as a filter

[Yury Gribov]

On 05/09/2014 07:09 PM, Diego Novillo wrote:
 I slightly prefer the semantics that gets me just the ChangeLog.
 The workflow I'm envisioning is:

I've commited both patches in r212883 and r12884. Mklog now runs as a 
filter and prints generated ChangeLog to stdout instead of modifying the 
patchfile.


 OK with Yuri's suggestion of assuming '-' when ARGV is empty.

I didn't change this because currently empty ARGV is used for printing 
help message (similar to some other scripts in contrib/ folder).


-Y

[PATCH] Fix mklog to support running from arbitrary folder

[Yury Gribov]

Hi all,

Current mklog works only if run from GCC top-level folder. The patch 
allows running from arbitrary directory.


I've used Linux directory separators which is probably ok because script 
already expects Linux environment (dirname, basename, etc.).


Ok to commit?

-Y
commit aa8d7cd3db1f1eba8ee77b902cff1b2ab2a3f83a
Author: Yury Gribov y.gri...@samsung.com
Date:   Mon Jul 21 12:05:10 2014 +0400

2014-07-21  Yury Gribov  y.gri...@samsung.com

	* mklog: Allow running from arbitrary folder.

diff --git a/contrib/mklog b/contrib/mklog
index cdc6455..3d17dc5 100755
--- a/contrib/mklog
+++ b/contrib/mklog
@@ -30,16 +30,15 @@
 $username = $ENV{'USER'};
 $name = `finger $username | grep -o 'Name: .*'`;
 @n = split(/: /, $name);
-$name = @n[1]; chop($name);
+$name = $n[1]; chop($name);
 $addr = $username . \@my.domain.org;
 $date = `date +%Y-%m-%d`; chop ($date);
 
 $gcc_root = $0;
 $gcc_root =~ s/[^\\\/]+$/../;
-chdir $gcc_root;
 
 # if this is a git tree then take name and email from the git configuration
-if (-d .git) {
+if (-d $gcc_root/.git) {
   $gitname = `git config user.name`;
   chomp($gitname);
   if ($gitname) {
@@ -80,7 +79,7 @@ sub get_clname ($) {
 	my $dirname = $_[0];
 	while ($dirname) {
 		my $clname = $dirname/ChangeLog;
-		if (-f $clname) {
+		if (-f $gcc_root/$clname) {
 			my $relname = substr ($_[0], length ($dirname) + 1);
 			return ($clname, $relname);
 		} else {

Re: [PATCH] Support asan-fixed-shadow-offset in GCC

[Yury Gribov]

On 07/21/2014 11:00 PM, Alexey Preobrazhensky wrote:

This patch adds support for non-fixed shadow in asan stack instrumentation.


We probably also need to support non-fixed shadow in the middle-end
(the patch only implements it for RTL stack poisoner).

-Y

Re: [PATCH] New check and updates in check_GNU_style script

[Yury Gribov]

On 07/22/2014 02:24 AM, Sebastian Pop wrote:

What about getting clang-format to GNU format instead of improving
this ad-hoc script?


Well, GNU support in clang-format seems to be at it's early days
so improving diagnostic in check_GNU_style does not seem to be totally 
useless.


In general clang-format is probably more capable than simple regexes 
that we have.

BTW can it format patches (i.e. incomplete pieces of code)?

-Y

Re: [PATCH] Move Asan instrumentation to sanopt pass

[Yury Gribov]

 Attached patch delays generation of Asan memory checking
 code until sanopt pass.

Here is an updated patch based on Jakub's review. Bootstrapped and 
regtested on x64.


-Y
commit 7c371a6f462e166d3f2ad89afbe2e61b1a0b799b
Author: Yury Gribov y.gri...@samsung.com
Date:   Thu Jul 17 09:45:26 2014 +0400

Move inlining of Asan memory checks to sanopt pass.
Change asan-instrumentation-with-call-threshold to more closely match LLVM.

gcc/

2014-07-21  Yury Gribov  y.gri...@samsung.com

	* asan.c (asan_check_flags): New enum.
	(build_check_stmt_with_calls): Removed function.
	(build_check_stmt): Split inlining logic to
	asan_expand_check_ifn.
	(instrument_derefs): Rename parameter.
	(instrument_mem_region_access): Rename parameter.
	(instrument_strlen_call): Likewise.
	(asan_expand_check_ifn): New function.
	(asan_instrument): Remove old code.
	(pass_sanopt::execute): Change handling of
	asan-instrumentation-with-call-threshold.
	(asan_clear_shadow): Fix formatting.
	(asan_function_start): Likewise.
	(asan_emit_stack_protection): Likewise.
	* doc/invoke.texi (asan-instrumentation-with-call-threshold):
	Update description.
	* internal-fn.c (expand_ASAN_CHECK): New function.
	* internal-fn.def (ASAN_CHECK): New internal function.
	* params.def (PARAM_ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD):
	Update description.
	(PARAM_ASAN_USE_AFTER_RETURN): Likewise.

gcc/testsuite/

2014-07-21  Yury Gribov  y.gri...@samsung.com

	* c-c++-common/asan/inc.c: Update test.
	* c-c++-common/asan/instrument-with-calls-2.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-1.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-2.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-3.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-4.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-5.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-6.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-7.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-8.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-9.c: Likewise.

diff --git a/gcc/asan.c b/gcc/asan.c
index 0d78634..57d2ade 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -243,18 +243,16 @@ static GTY(()) tree shadow_ptr_types[2];
 /* Decl for __asan_option_detect_stack_use_after_return.  */
 static GTY(()) tree asan_detect_stack_use_after_return;
 
-/* Number of instrumentations in current function so far.  */
-
-static int asan_num_accesses;
-
-/* Check whether we should replace inline instrumentation with calls.  */
-
-static inline bool
-use_calls_p ()
+/* Various flags for Asan builtins.  */
+enum asan_check_flags
 {
-  return ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD  INT_MAX
- asan_num_accesses = ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD;
-}
+  ASAN_CHECK_STORE = 1  0,
+  ASAN_CHECK_SCALAR_ACCESS = 1  1,
+  ASAN_CHECK_NON_ZERO_LEN = 1  2,
+  ASAN_CHECK_START_INSTRUMENTED = 1  3,
+  ASAN_CHECK_END_INSTRUMENTED = 1  4,
+  ASAN_CHECK_LAST
+};
 
 /* Hashtable support for memory references used by gimple
statements.  */
@@ -943,7 +941,7 @@ asan_clear_shadow (rtx shadow_mem, HOST_WIDE_INT len)
 
   emit_move_insn (shadow_mem, const0_rtx);
   tmp = expand_simple_binop (Pmode, PLUS, addr, gen_int_mode (4, Pmode), addr,
- true, OPTAB_LIB_WIDEN);
+			 true, OPTAB_LIB_WIDEN);
   if (tmp != addr)
 emit_move_insn (addr, tmp);
   emit_cmp_and_jump_insns (addr, end, LT, NULL_RTX, Pmode, true, top_label);
@@ -958,7 +956,7 @@ asan_function_start (void)
   section *fnsec = function_section (current_function_decl);
   switch_to_section (fnsec);
   ASM_OUTPUT_DEBUG_LABEL (asm_out_file, LASANPC,
- current_function_funcdef_no);
+			 current_function_funcdef_no);
 }
 
 /* Insert code to protect stack vars.  The prologue sequence should be emitted
@@ -1023,7 +1021,7 @@ asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
 {
   use_after_return_class = floor_log2 (asan_frame_size - 1) - 5;
   /* __asan_stack_malloc_N guarantees alignment
- N  6 ? (64  N) : 4096 bytes.  */
+	 N  6 ? (64  N) : 4096 bytes.  */
   if (alignb  (use_after_return_class  6
 		? (64U  use_after_return_class) : 4096U))
 	use_after_return_class = -1;
@@ -1096,7 +1094,7 @@ asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
   ASM_GENERATE_INTERNAL_LABEL (buf, LASANPC, current_function_funcdef_no);
   id = get_identifier (buf);
   decl = build_decl (DECL_SOURCE_LOCATION (current_function_decl),
-VAR_DECL, id, char_type_node);
+		VAR_DECL, id, char_type_node);
   SET_DECL_ASSEMBLER_NAME (decl, id);
   TREE_ADDRESSABLE (decl) = 1;
   TREE_READONLY (decl) = 1;
@@ -1553,55 +1551,6 @@ maybe_create_ssa_name (location_t loc

Re: [PATCH] Support asan-fixed-shadow-offset in GCC

[Yury Gribov]

It is required for Kernel AddressSanitizer, as the shadow offset is
not known at the compile time,


To get shadow offset this patch uses function __asan_get_shadow_ptr.
Wouldn't be more effective just to read variable instead of function call?


Depends on how much logic you want to hide there. If it's just return 
something than sure
but if you need some synchronization or complex calculations, accessing 
global would not be enough.


-Y

Re: [PATCH] Support asan-fixed-shadow-offset in GCC

[Yury Gribov]

 This function just returns some global variable,

and I don't think we will need something more complex in future.


For kernel probably yes but what about userspace?

-Y

Re: [PATCH] Move Asan instrumentation to sanopt pass

[Yury Gribov]

On 07/22/2014 05:57 PM, Richard Biener wrote:

I probably could
provide fnspec with (EAF_DIRECT | EAF_NOCLOBBER | EAF_NOESCAPE) or
even EAF_UNUSED for these functions but this does not seem
to be supported in current middle-end.


Simply add the fn spec attribute to the functions?


Problem is that internal functions don't seem to support this
(gimple_statement_call::fntype and gimple_statement_call::internal_fn
occupy the same field). I wasn't sure about the reasons for this
so decided change them in original patch. Do you think we should we allow
fntype for internal functions?

-Y

Re: [PATCH] Add support for KernelAddressSanitizer

[Yury Gribov]

On 07/18/2014 05:38 PM, Jakub Jelinek wrote:

Do you error out on -fsanitize=thread -fsanitize=kernel-address ?
Perhaps -fsanitize=kernel-address -fsanitize=address should be invalid too?


Yes, all these combinations are invalid.


But you don't error out on that.


Ok, fixed.


Then in sanitize_spec_function supposedly for address check
SANITIZE_USER_ADDRESS bit, for kernel-address added there
SANITIZE_KERNEL_ADDRESS, add all the incompatibility diagnostics for the new
invalid combinations.


This delayed detection until link phase (and even then was disabled if 
-nostdlib was on)
so I decided to perform this check in finish_options (after passing 
cmdline options).



Plus, toplev.c has e.g.:


Fixed as well.

-Y

commit bd51cdb807c2cf5ada0101ca7db89076b54ed18e
Author: Yury Gribov y.gri...@samsung.com
Date:   Tue Jul 22 11:02:03 2014 +0400

2014-07-23  Yury Gribov  y.gri...@samsung.com

	* doc/cpp.texi (__SANITIZE_ADDRESS__): Updated description.
	* doc/invoke.texi (-fsanitize=kernel-address): Describe new option.
	* flag-types.h (SANITIZE_USER_ADDRESS, SANITIZE_KERNEL_ADDRESS):
	New enums.
	* gcc.c (sanitize_spec_function): Support new option.
	(SANITIZER_SPEC): Remove now redundant check.
	* opts.c (common_handle_option): Support new option.
	(finish_options): Check for incompatibilities.
	* toplev.c (process_options): Split userspace-specific checks.

diff --git a/gcc/doc/cpp.texi b/gcc/doc/cpp.texi
index aaed739..0a6e50c 100644
--- a/gcc/doc/cpp.texi
+++ b/gcc/doc/cpp.texi
@@ -2354,8 +2354,8 @@ This macro is defined, with value 3, when @option{-fstack-protector-strong} is
 in use.
 
 @item __SANITIZE_ADDRESS__
-This macro is defined, with value 1, when @option{-fsanitize=address} is
-in use.
+This macro is defined, with value 1, when @option{-fsanitize=address}
+or @option{-fsanitize=kernel-address} are in use.
 
 @item __TIMESTAMP__
 This macro expands to a string constant that describes the date and time
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index b5e8d98..391daf8 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -5405,6 +5405,11 @@ more details.  The run-time behavior can be influenced using the
 @url{https://code.google.com/p/address-sanitizer/wiki/Flags#Run-time_flags} for
 a list of supported options.
 
+@item -fsanitize=kernel-address
+@opindex fsanitize=kernel-address
+Enable AddressSanitizer for Linux kernel.
+See @uref{http://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel} for more details.
+
 @item -fsanitize=thread
 @opindex fsanitize=thread
 Enable ThreadSanitizer, a fast data race detector.
diff --git a/gcc/flag-types.h b/gcc/flag-types.h
index 2849455..bf813b6 100644
--- a/gcc/flag-types.h
+++ b/gcc/flag-types.h
@@ -214,23 +214,25 @@ enum vect_cost_model {
 enum sanitize_code {
   /* AddressSanitizer.  */
   SANITIZE_ADDRESS = 1  0,
+  SANITIZE_USER_ADDRESS = 1  1,
+  SANITIZE_KERNEL_ADDRESS = 1  2,
   /* ThreadSanitizer.  */
-  SANITIZE_THREAD = 1  1,
+  SANITIZE_THREAD = 1  3,
   /* LeakSanitizer.  */
-  SANITIZE_LEAK = 1  2,
+  SANITIZE_LEAK = 1  4,
   /* UndefinedBehaviorSanitizer.  */
-  SANITIZE_SHIFT = 1  3,
-  SANITIZE_DIVIDE = 1  4,
-  SANITIZE_UNREACHABLE = 1  5,
-  SANITIZE_VLA = 1  6,
-  SANITIZE_NULL = 1  7,
-  SANITIZE_RETURN = 1  8,
-  SANITIZE_SI_OVERFLOW = 1  9,
-  SANITIZE_BOOL = 1  10,
-  SANITIZE_ENUM = 1  11,
-  SANITIZE_FLOAT_DIVIDE = 1  12,
-  SANITIZE_FLOAT_CAST = 1  13,
-  SANITIZE_BOUNDS = 1  14,
+  SANITIZE_SHIFT = 1  5,
+  SANITIZE_DIVIDE = 1  6,
+  SANITIZE_UNREACHABLE = 1  7,
+  SANITIZE_VLA = 1  8,
+  SANITIZE_NULL = 1  9,
+  SANITIZE_RETURN = 1  10,
+  SANITIZE_SI_OVERFLOW = 1  11,
+  SANITIZE_BOOL = 1  12,
+  SANITIZE_ENUM = 1  13,
+  SANITIZE_FLOAT_DIVIDE = 1  14,
+  SANITIZE_FLOAT_CAST = 1  15,
+  SANITIZE_BOUNDS = 1  16,
   SANITIZE_UNDEFINED = SANITIZE_SHIFT | SANITIZE_DIVIDE | SANITIZE_UNREACHABLE
 		   | SANITIZE_VLA | SANITIZE_NULL | SANITIZE_RETURN
 		   | SANITIZE_SI_OVERFLOW | SANITIZE_BOOL | SANITIZE_ENUM
diff --git a/gcc/gcc.c b/gcc/gcc.c
index 6cd08ea..c0fde8c 100644
--- a/gcc/gcc.c
+++ b/gcc/gcc.c
@@ -779,8 +779,7 @@ proper position among the other output files.  */
 #ifndef SANITIZER_SPEC
 #define SANITIZER_SPEC \
 %{!nostdlib:%{!nodefaultlibs:%{%:sanitize(address): LIBASAN_SPEC \
-%{static:%ecannot specify -static with -fsanitize=address}\
-%{%:sanitize(thread):%e-fsanitize=address is incompatible with -fsanitize=thread}}\
+%{static:%ecannot specify -static with -fsanitize=address}}\
 %{%:sanitize(thread): LIBTSAN_SPEC \
 %{!pie:%{!shared:%e-fsanitize=thread linking must be done with -pie or -shared}}}\
 %{%:sanitize(undefined): LIBUBSAN_SPEC }\
@@ -8224,7 +8223,9 @@ sanitize_spec_function (int argc, const char **argv)
 return NULL;
 
   if (strcmp (argv[0], address) == 0)
-return (flag_sanitize  SANITIZE_ADDRESS) ?  : NULL;
+return (flag_sanitize  SANITIZE_USER_ADDRESS) ?  : NULL;
+  if (strcmp

Re: [PATCH] Move Asan instrumentation to sanopt pass

[Yury Gribov]

On 07/22/2014 12:27 PM, Yury Gribov wrote:

Attached patch delays generation of Asan memory checking
code until sanopt pass.


Here is an updated patch based on Jakub's review.
Bootstrapped and regtested on x64.


Yet another version with ASAN_CHECK changed to builtin function
(instead of internal-fn) per Richard's advice.

-Y



commit 18aaa0e370a09fc3a226e0d79503fc58bd770703
Author: Yury Gribov y.gri...@samsung.com
Date:   Thu Jul 17 09:45:26 2014 +0400

Move inlining of Asan memory checks to sanopt pass.
Change asan-instrumentation-with-call-threshold to more closely match LLVM.

gcc/

2014-07-23  Yury Gribov  y.gri...@samsung.com

	* asan.c (asan_check_flags): New enum.
	(asan_clear_shadow): Fix formatting.
	(asan_function_start): Likewise.
	(asan_emit_stack_protection): Likewise.
	(build_check_stmt_with_calls): Removed function.
	(build_check_stmt): Split inlining logic to
	asan_expand_check_ifn.
	(instrument_derefs): Rename parameter.
	(instrument_mem_region_access): Rename parameter.
	(instrument_strlen_call): Likewise.
	(asan_expand_check): New function.
	(asan_instrument): Remove old code.
	(pass_sanopt::execute): Change handling of
	asan-instrumentation-with-call-threshold.
	* builtin-types.def (BT_FN_VOID_PTR_PTRMODE_INT): New type.
	* builtins.def: Fix comment.
	* doc/invoke.texi (asan-instrumentation-with-call-threshold):
	Update description.
	* params.def (PARAM_ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD):
	Update description.
	(PARAM_ASAN_USE_AFTER_RETURN): Likewise.
	* sanitizer.def (BUILT_IN_ASAN_CHECK): New builtin.

gcc/testsuite/

2014-07-23  Yury Gribov  y.gri...@samsung.com

	* c-c++-common/asan/inc.c: Update test.
	* c-c++-common/asan/instrument-with-calls-2.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-1.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-2.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-3.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-4.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-5.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-6.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-7.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-8.c: Likewise.
	* c-c++-common/asan/no-redundant-instrumentation-9.c: Likewise.

diff --git a/gcc/asan.c b/gcc/asan.c
index 0d78634..6f0aa2d 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -243,18 +243,16 @@ static GTY(()) tree shadow_ptr_types[2];
 /* Decl for __asan_option_detect_stack_use_after_return.  */
 static GTY(()) tree asan_detect_stack_use_after_return;
 
-/* Number of instrumentations in current function so far.  */
-
-static int asan_num_accesses;
-
-/* Check whether we should replace inline instrumentation with calls.  */
-
-static inline bool
-use_calls_p ()
+/* Various flags for Asan builtins.  */
+enum asan_check_flags
 {
-  return ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD  INT_MAX
- asan_num_accesses = ASAN_INSTRUMENTATION_WITH_CALL_THRESHOLD;
-}
+  ASAN_CHECK_STORE = 1  0,
+  ASAN_CHECK_SCALAR_ACCESS = 1  1,
+  ASAN_CHECK_NON_ZERO_LEN = 1  2,
+  ASAN_CHECK_START_INSTRUMENTED = 1  3,
+  ASAN_CHECK_END_INSTRUMENTED = 1  4,
+  ASAN_CHECK_LAST
+};
 
 /* Hashtable support for memory references used by gimple
statements.  */
@@ -943,7 +941,7 @@ asan_clear_shadow (rtx shadow_mem, HOST_WIDE_INT len)
 
   emit_move_insn (shadow_mem, const0_rtx);
   tmp = expand_simple_binop (Pmode, PLUS, addr, gen_int_mode (4, Pmode), addr,
- true, OPTAB_LIB_WIDEN);
+			 true, OPTAB_LIB_WIDEN);
   if (tmp != addr)
 emit_move_insn (addr, tmp);
   emit_cmp_and_jump_insns (addr, end, LT, NULL_RTX, Pmode, true, top_label);
@@ -958,7 +956,7 @@ asan_function_start (void)
   section *fnsec = function_section (current_function_decl);
   switch_to_section (fnsec);
   ASM_OUTPUT_DEBUG_LABEL (asm_out_file, LASANPC,
- current_function_funcdef_no);
+			 current_function_funcdef_no);
 }
 
 /* Insert code to protect stack vars.  The prologue sequence should be emitted
@@ -1023,7 +1021,7 @@ asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
 {
   use_after_return_class = floor_log2 (asan_frame_size - 1) - 5;
   /* __asan_stack_malloc_N guarantees alignment
- N  6 ? (64  N) : 4096 bytes.  */
+	 N  6 ? (64  N) : 4096 bytes.  */
   if (alignb  (use_after_return_class  6
 		? (64U  use_after_return_class) : 4096U))
 	use_after_return_class = -1;
@@ -1096,7 +1094,7 @@ asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
   ASM_GENERATE_INTERNAL_LABEL (buf, LASANPC, current_function_funcdef_no);
   id = get_identifier (buf);
   decl = build_decl (DECL_SOURCE_LOCATION (current_function_decl),
-VAR_DECL, id, char_type_node

Re: [PATCH] Move Asan instrumentation to sanopt pass

[Yury Gribov]

On 07/24/2014 12:09 AM, Jakub Jelinek wrote:

Ah internal fns.  Those cannot have attributes indeed (technical
limitation).
Martin was working on putting those flags elsewhere (cgraph, though internal
functions don't have cgraph nodes either ...).  Maybe it was a bad idea to use
internal functions for ASAN.


For internal-fn, we already support ECF* constants, guess either we could
add support for EAF* too, through internal-fn.def,


Just hack in EAFs or support full-featured declarations in internals?
The latter looks more appropriate but would increase size of
internal function calls by one word (namely 
gimple_statement_call::internal_fn).



or we need support for
normal builtins that are inaccessible to users (but using . or space
in names is too ugly IMHO for that).


We could be just another flag in DEF_BUILTIN.
Although my understanding was that we already have
user-inaccessible builtins and these are internal functions.

-Y

[PATCH][PING] Fix mklog to support running from arbitrary folder

[Yury Gribov]

 Forwarded Message 
Subject: [PATCH] Fix mklog to support running from arbitrary folder
Date: Mon, 21 Jul 2014 12:32:45 +0400
From: Yury Gribov y.gri...@samsung.com
To: GCC Patches gcc-patches@gcc.gnu.org
CC: Diego Novillo dnovi...@google.com, Trevor Saunders 
tsaund...@mozilla.com


Hi all,

Current mklog works only if run from GCC top-level folder. The patch
allows running from arbitrary directory.

I've used Linux directory separators which is probably ok because script
already expects Linux environment (dirname, basename, etc.).

Ok to commit?

-Y



commit aa8d7cd3db1f1eba8ee77b902cff1b2ab2a3f83a
Author: Yury Gribov y.gri...@samsung.com
Date:   Mon Jul 21 12:05:10 2014 +0400

2014-07-21  Yury Gribov  y.gri...@samsung.com

	* mklog: Allow running from arbitrary folder.

diff --git a/contrib/mklog b/contrib/mklog
index cdc6455..3d17dc5 100755
--- a/contrib/mklog
+++ b/contrib/mklog
@@ -30,16 +30,15 @@
 $username = $ENV{'USER'};
 $name = `finger $username | grep -o 'Name: .*'`;
 @n = split(/: /, $name);
-$name = @n[1]; chop($name);
+$name = $n[1]; chop($name);
 $addr = $username . \@my.domain.org;
 $date = `date +%Y-%m-%d`; chop ($date);
 
 $gcc_root = $0;
 $gcc_root =~ s/[^\\\/]+$/../;
-chdir $gcc_root;
 
 # if this is a git tree then take name and email from the git configuration
-if (-d .git) {
+if (-d $gcc_root/.git) {
   $gitname = `git config user.name`;
   chomp($gitname);
   if ($gitname) {
@@ -80,7 +79,7 @@ sub get_clname ($) {
 	my $dirname = $_[0];
 	while ($dirname) {
 		my $clname = $dirname/ChangeLog;
-		if (-f $clname) {
+		if (-f $gcc_root/$clname) {
 			my $relname = substr ($_[0], length ($dirname) + 1);
 			return ($clname, $relname);
 		} else {

Re: [PATCH 2/2] allow running mklog as a filter

[Yury Gribov]

On 07/21/2014 12:55 PM, Trevor Saunders wrote:

I'm not really sure which is the better UI,
but I'd rather time be spent
on better automatic change log generation.


Yeah. Do you have some particular complaints btw?


I may or may not hope we'll
eventually have a mklog that can autogenerate most ChangeLogs and then
people will have a hard time arguing they're useful.


I wonder how many GCC developers actually use the script (our team does).

-Y

Re: [PATCH] Move Asan instrumentation to sanopt pass

[Yury Gribov]

On 07/24/2014 11:48 AM, Jakub Jelinek wrote:
 So, either support for just EAF*, or perhaps support for DECL_ATTRIBUTES
 for internal-fns, say by having some tree array where you'd store 
what you

 stick into DECL_ATTRIBUTES normally.

I'd prefer to avoid attributes. Would something like this be enough?
(not yet fully tested, just ran asan.exp tests).


-Y
diff --git a/gcc/gimple.c b/gcc/gimple.c
index 4a9d379..aa0caab 100644
--- a/gcc/gimple.c
+++ b/gcc/gimple.c
@@ -1348,6 +1348,9 @@ gimple_call_fnspec (const_gimple stmt)
 int
 gimple_call_arg_flags (const_gimple stmt, unsigned arg)
 {
+  if (gimple_call_internal_p (stmt))
+return internal_fn_arg_flags (gimple_call_internal_fn (stmt), arg);
+
   tree attr = gimple_call_fnspec (stmt);
 
   if (!attr || 1 + arg = (unsigned) TREE_STRING_LENGTH (attr))
diff --git a/gcc/internal-fn.c b/gcc/internal-fn.c
index 7fb54ea..3f9b448 100644
--- a/gcc/internal-fn.c
+++ b/gcc/internal-fn.c
@@ -40,7 +40,7 @@ along with GCC; see the file COPYING3.  If not see
 
 /* The names of each internal function, indexed by function number.  */
 const char *const internal_fn_name_array[] = {
-#define DEF_INTERNAL_FN(CODE, FLAGS) #CODE,
+#define DEF_INTERNAL_FN(CODE, FLAGS, NARGS, ARG_FLAGS) #CODE,
 #include internal-fn.def
 #undef DEF_INTERNAL_FN
   invalid-fn
@@ -48,12 +48,63 @@ const char *const internal_fn_name_array[] = {
 
 /* The ECF_* flags of each internal function, indexed by function number.  */
 const int internal_fn_flags_array[] = {
-#define DEF_INTERNAL_FN(CODE, FLAGS) FLAGS,
+#define DEF_INTERNAL_FN(CODE, FLAGS, NARGS, ARG_FLAGS) FLAGS,
 #include internal-fn.def
 #undef DEF_INTERNAL_FN
   0
 };
 
+/* The EAF_* flags for arguments of internal functions,
+   indexed indirectly via INTERNAL_FN_ARG_FLAGS_ARRAY.  */
+static GTY(()) int *internal_fn_arg_flags_array;
+
+/* Maps internal function to offset in internal_fn_arg_flags_array.  */
+static size_t internal_fn_arg_flags_offsets[IFN_LAST];
+static size_t max_arg_offset;
+
+void
+init_internal_fns ()
+{
+  max_arg_offset = 0;
+#define DEF_INTERNAL_FN(CODE, FLAGS, NARGS, ARG_FLAGS) max_arg_offset += NARGS;
+#include internal-fn.def
+#undef DEF_INTERNAL_FN
+  internal_fn_arg_flags_array
+= (int *) xmalloc (max_arg_offset * sizeof (internal_fn_arg_flags_array[0]));
+
+  size_t offset = 0;
+#define APPEND_ARG_FLAGS0() ;
+#define APPEND_ARG_FLAGS1(F1) \
+  internal_fn_arg_flags_array[offset++] = F1;
+#define APPEND_ARG_FLAGS2(F1, F2) \
+  internal_fn_arg_flags_array[offset++] = F1; \
+  internal_fn_arg_flags_array[offset++] = F2;
+#define APPEND_ARG_FLAGS3(F1, F2, F3) \
+  internal_fn_arg_flags_array[offset++] = F1; \
+  internal_fn_arg_flags_array[offset++] = F2; \
+  internal_fn_arg_flags_array[offset++] = F3;
+#define APPEND_ARG_FLAGS4(F1, F2, F3, F4) \
+  internal_fn_arg_flags_array[offset++] = F1; \
+  internal_fn_arg_flags_array[offset++] = F2; \
+  internal_fn_arg_flags_array[offset++] = F3; \
+  internal_fn_arg_flags_array[offset++] = F4;
+#define DEF_INTERNAL_FN(CODE, FLAGS, NARGS, ARG_FLAGS)  \
+  internal_fn_arg_flags_offsets[(int) IFN_##CODE] = offset; \
+  APPEND_ARG_FLAGS##NARGS ARG_FLAGS
+#include internal-fn.def
+#undef DEF_INTERNAL_FN
+}
+
+/* Return the EAF_* flags for N-th argument of function FN.  */
+
+int
+internal_fn_arg_flags (enum internal_fn fn, int arg)
+{
+  size_t offset = internal_fn_arg_flags_offsets[(int) fn] + arg;
+  gcc_assert (offset  max_arg_offset);
+  return internal_fn_arg_flags_array[offset];
+}
+
 /* ARRAY_TYPE is an array of vector modes.  Return the associated insn
for load-lanes-style optab OPTAB.  The insn must exist.  */
 
@@ -905,7 +956,7 @@ expand_BUILTIN_EXPECT (gimple stmt)
 
where STMT is the statement that performs the call. */
 static void (*const internal_fn_expanders[]) (gimple) = {
-#define DEF_INTERNAL_FN(CODE, FLAGS) expand_##CODE,
+#define DEF_INTERNAL_FN(CODE, FLAGS, NARGS, ARG_FLAGS) expand_##CODE,
 #include internal-fn.def
 #undef DEF_INTERNAL_FN
   0
diff --git a/gcc/internal-fn.def b/gcc/internal-fn.def
index f0aa1b4..a2861a6 100644
--- a/gcc/internal-fn.def
+++ b/gcc/internal-fn.def
@@ -28,30 +28,34 @@ along with GCC; see the file COPYING3.  If not see
 
Each entry in this file has the form:
 
- DEF_INTERNAL_FN (NAME, FLAGS)
+ DEF_INTERNAL_FN (NAME, FLAGS, NARGS, ARG_FLAGS)
 
-   where NAME is the name of the function and FLAGS is a set of
-   ECF_* flags.  Each entry must have a corresponding expander
-   of the form:
+   where NAME is the name of the function, FLAGS is a set of
+   ECF_* flags and ARG_FLAGS holds comma-separated list of sets
+   of EAF_* flags.
+   
+   Each entry must have a corresponding expander of the form:
 
  void expand_NAME (gimple stmt)
 
where STMT is the statement that performs the call.  */
 
-DEF_INTERNAL_FN (LOAD_LANES, ECF_CONST | ECF_LEAF)
-DEF_INTERNAL_FN (STORE_LANES, ECF_CONST | ECF_LEAF)
-DEF_INTERNAL_FN (GOMP_SIMD_LANE, ECF_NOVOPS | ECF_LEAF 

Re: [PATCH 2/2] allow running mklog as a filter

[Yury Gribov]

On 07/28/2014 03:01 PM, Trevor Saunders wrote:

Yeah. Do you have some particular complaints btw?


I haven't actually used it in a while, but istr there's an issue where
if you change the prototype of a function mklog makes an entry for the
previous function.


I think this is because mklog relies on markers generated by diff -p
(like @@ -96,20 +108,22 @@ bitmap_descriptor (const char *file, int 
line, const char *function)).

Diff will indeed report old name instead of the new one.


Automatically inserting likewise where it would be appropriate would be
nice, but fairly hard I suspect.


This depends on the actual use-case. For tests and deleted files this
should be relatively straightforward but probably not very useful.

-Y

Re: [RFC PATCH] Optimize ASAN_CHECK checks

[Yury Gribov]

On 11/11/2014 08:42 PM, Jakub Jelinek wrote:

On Wed, Nov 05, 2014 at 11:50:20AM +0100, Jakub Jelinek wrote:

On Wed, Nov 05, 2014 at 11:29:19AM +0100, Marek Polacek wrote:

On Wed, Nov 05, 2014 at 12:54:37PM +0300, Yury Gribov wrote:

Are you going to work on ASan soon?  I could rebase my patches on top of
Marek's infrastructure.


I'm not going to work on ASan today or tomorrow, but it'd be nice to
get this ASan opt in in this stage1.

So if you can rebase your patch, I think that will be appreciated.


Note, the algorithm we were discussing with Honza for the
is there any possibility of a freeing call on the path between a dominating
and dominated ASAN_CHECK
problem was to compute it lazily; have flags for asan per-bb:
1) bb might contain a !nonfreeing_call_p
2) there is a bb with flag 1) set in some path between imm(bb) and bb
3) flag whether 2) has been computed already
4) some temporary being visited flag
and the algorithm:
1) when walking a bb, if you encounter a !nonfreeing_call_p call, either
immediately nuke recorded earlier ASAN_CHECKs from the current bb,
or use gimple_uids for lazily doing that; but in any case, record
the flag 1) for the current bb
2) if you are considering ASAN_CHECK in a different bb than ASAN_CHECK
it is dominating, check the 2) flag on the current bb, then on
get_immediate_dominator (bb) etc. until you reach the bb with the
dominating bb, if the 2) flag is set on any of them, don't optimize;
if the 2) flag is not computed on any of these (i.e. flag 3) unset),
then compute it recursively; set the 4) flag on a bb, for incoming
edges if the src bb is not the imm(bb) of the original bb, and does
not have 4) flag set: if it has 1) set, use 1, if it has 3) flag set,
use 2), otherwise recurse (and or the result); unset 4) flag before
returning; or so.


Here is a patch (partly written by Marek) implementing that algorithm,
only very lightly tested beyond
make -j16 -k check RUNTESTFLAGS=--target_board=\{-m32,-m64\} asan.exp ubsan.exp 
tsan.exp


Yeah, would be interesting to see how many checks it removes from 
Asan-bootstrapped GCC.



Honza, do you think you could look over the algorithm if it is sane?
I couldn't decide if it is ok to cache negative results for the
imm_dom_path_with_freeing_call_p flag (i.e. set
imm_dom_path_with_freeing_call_computed_p and keep
imm_dom_path_with_freeing_call_p cleared) for basic blocks encountered
during the recursion, if they have different immediate dominator than
the bb I've called the recursive function for originally, and during
the search some being_visited_p flag has been encountered.

I've been playing with testcase like:

int b[64], b2[128];
void bar (void);

int
foo (int *p, int *q, int x, int y)
{
   int v = *(char *) p;
   __builtin_memcpy (b, b2, 17);
   int w = (*p)++;
   if (x)
 *p = 6;
   int z = *q;
   if (y)
 bar ();
   *q = 8;
   return v + w + z;
}

int
baz (int *p, int x)
{
   int v = *p;
   int i, j = 0;
   for (i = 0; i  64; i++)
 if (b[i]++  20)
   b2[i] += i  76 ? ({asm ( : +r (j)); 0;}) : i * 4;
   v += *p;
   for (i = 0; i  64; i++)
 if (b[i]++  20)
   b2[i] += i  76 ? ({asm ( : +r (j)); 0;}) : i * 4;
 else if (b2[i]  17)
   bar ();
   v += *p;
   return v;
}

but guess that isn't sufficient for proper test coverage.

--- gcc/asan.c.jj   2014-11-11 00:06:18.0 +0100
+++ gcc/asan.c  2014-11-11 11:42:29.327583317 +0100
@@ -299,15 +299,6 @@ static GTY(()) tree shadow_ptr_types[2];
  /* Decl for __asan_option_detect_stack_use_after_return.  */
  static GTY(()) tree asan_detect_stack_use_after_return;

-/* Various flags for Asan builtins.  */
-enum asan_check_flags
-{
-  ASAN_CHECK_STORE = 1  0,
-  ASAN_CHECK_SCALAR_ACCESS = 1  1,
-  ASAN_CHECK_NON_ZERO_LEN = 1  2,
-  ASAN_CHECK_LAST = 1  3
-};
-
  /* Hashtable support for memory references used by gimple
 statements.  */

--- gcc/asan.h.jj   2014-11-11 00:06:18.0 +0100
+++ gcc/asan.h  2014-11-11 11:43:24.999578043 +0100
@@ -59,6 +59,15 @@ extern alias_set_type asan_shadow_set;
  #define ASAN_STACK_FRAME_MAGIC0x41b58ab3
  #define ASAN_STACK_RETIRED_MAGIC  0x45e0360e

+/* Various flags for Asan builtins.  */
+enum asan_check_flags
+{
+  ASAN_CHECK_STORE = 1  0,
+  ASAN_CHECK_SCALAR_ACCESS = 1  1,
+  ASAN_CHECK_NON_ZERO_LEN = 1  2,
+  ASAN_CHECK_LAST = 1  3
+};
+
  /* Return true if DECL should be guarded on the stack.  */

  static inline bool
--- gcc/gimple.c.jj 2014-11-11 00:06:21.0 +0100
+++ gcc/gimple.c2014-11-11 10:02:17.385736225 +0100
@@ -2538,6 +2538,9 @@ nonfreeing_call_p (gimple call)
default:
  return true;
}
+  else if (gimple_call_internal_p (call)
+   gimple_call_flags (call)  ECF_LEAF)
+return true;


Nice.



return false;
  }
--- gcc/sanopt.c.jj 2014-11-11 09:13:36.698280115 +0100
+++ gcc/sanopt.c2014-11-11 18:07:17.913539517 +0100
@@ -49,6 +49,7 @@ along

Re: PATCH: PR testsuite/63830: c-c++-common/asan/strlen-overflow-1.c fails on x32

[Yury Gribov]

On 11/12/2014 04:52 AM, H.J. Lu wrote:

Hi,

This patch updates c-c++-common/asan/strlen-overflow-1.c to avoid tail
call on x32.  Tested on Linux/x86-64/ia32/x32.  OK to install?

Thanks.

H.J.
---
2014-11-11  H.J. Lu  hongjiu...@intel.com

PR testsuite/63830
* c-c++-common/asan/strlen-overflow-1.c (main): Avoid tail call.

diff --git a/gcc/testsuite/c-c++-common/asan/strlen-overflow-1.c 
b/gcc/testsuite/c-c++-common/asan/strlen-overflow-1.c
index 0f49286..33696ed 100644
--- a/gcc/testsuite/c-c++-common/asan/strlen-overflow-1.c
+++ b/gcc/testsuite/c-c++-common/asan/strlen-overflow-1.c
@@ -16,7 +16,7 @@ int main () {
char *p = a[0];
asm ( : +r(p));
__asan_poison_memory_region ((char *)a[1], 1);
-  return __builtin_strlen (a);
+  return __builtin_strlen (a) + 1;
  }

  /* { dg-output READ of size 2 at 0x\[0-9a-f\]+ thread T0.*(\n|\r\n|\r) } */



Cc Jakub.

The patch looks sane but I wonder whether we should drop the test 
completely now that we don't inline instrument builtins anymore.


-Y

Re: [RFC PATCH] Optimize ASAN_CHECK checks

[Yury Gribov]

On 11/12/2014 01:34 PM, Jakub Jelinek wrote:

On Wed, Nov 12, 2014 at 12:18:31PM +0300, Yury Gribov wrote:

--- gcc/sanopt.c.jj 2014-11-11 09:13:36.698280115 +0100
+++ gcc/sanopt.c2014-11-11 18:07:17.913539517 +0100
@@ -49,6 +49,7 @@ along with GCC; see the file COPYING3.
  #include langhooks.h
  #include ubsan.h
  #include params.h
+#include tree-ssa-operands.h


  /* This is used to carry information about basic blocks.  It is
@@ -56,7 +57,29 @@ along with GCC; see the file COPYING3.

  struct sanopt_info
  {
-  /* True if this BB has been visited.  */
+  /* True if this BB might call (directly or indirectly) free/munmap
+ or similar operation.  */


Frankly I think this is more about memory poisoned status then free.


For ASAN about anything that might make ASAN_CHECK non-redundant, that
certainly is free as the most common thing (bet munmap doesn't poison
the memory being unmapped) and also the asan_*poison* calls.


It's all about names, freeing is just subset of what really goes on 
(poisoning).  We can keep current freeing/nonfreeing stuff but 
IMHO it doesn't properly express what we really bother about.



@@ -69,11 +92,307 @@ struct sanopt_ctx
   a vector of UBSAN_NULL call statements that check this pointer.  */
hash_maptree, auto_vecgimple  null_check_map;

+  /* This map maps a pointer (the second argument of ASAN_CHECK) to
+ a vector of ASAN_CHECK call statements that check the access.  */
+  hash_maptree, auto_vecgimple  asan_check_map;


How about using traits class like the one below for both maps?


Well, for null_check_map, it is only SSA_NAMEs that matter (perhaps the
code doesn't return early if it is not, maybe should), address of
decls is always non-NULL and alignment should be known too.
Or, Marek, can you see if we can get there e.g. decls for alignments,
extern char a[];
long long int
foo (void)
{
   *(long long int *) a[0] = 5;
}
?


See below for maybe_get_single_definition discussion.


struct tree_map_traits : default_hashmap_traits
{
   static inline hashval_t hash (const_tree ref)
 {
   return iterative_hash_expr (ref, 0);
 }

   static inline bool equal_keys (const_tree ref1, const_tree ref2)
 {
   return operand_equal_p (ref1, ref2, 0);
 }
};

Also the hash_map probably deserves a typedef.


For asan you're right, we can have addresses of decls there etc.
If you have spare cycles, feel free to take over the patch and adjust it.


I guess I'd wait when this gets to trunk?


+  tree glen = gimple_call_arg (g, 2);
+  /* If glen is not integer, we'd have added it to the vector only if
+ASAN_CHECK_NON_ZERO_LEN flag is set, so treat it as length 1.  */


Frankly I don't think we use ASAN_CHECK_NON_ZERO_LEN anymore (it's only set
for trivial cases now).  Perhaps we should just nuke it from asan.c and
sanopt.c alltogether?


I thought that for the builtins libasan doesn't instrument (which includes
very often used functions like __memcpy_chk etc.) we still use it.


We could only emit non-trivial ASAN_CHECK_NON_ZERO_LEN in rare cases 
e.g. checking buffer length _after_ strlen call but I don't think we 
have anything like this left.



+  bool asan_check_optimize
+= (flag_sanitize  SANITIZE_ADDRESS)
+   ((flag_sanitize  flag_sanitize_recover
+   SANITIZE_KERNEL_ADDRESS) == 0);


Why do we disable check optimizations for KASan?


Only for -fno-sanitize-recover=kernel-address too.  The thing is,
if you do recover from failed asan checks, supposedly you want to
see all errors reported, not just the first one.


Hm, that's questionable.  The error is already reported so why bother 
user with duplicates (also hurting performance)?



  case IFN_ASAN_CHECK:
-   ctx-asan_num_accesses++;
+   if (asan_check_optimize)
+ remove = maybe_optimize_asan_check_ifn (ctx, stmt);


It may be useful to also store base address in check-table:

static tree
maybe_get_single_definition (tree t)
{
   if (TREE_CODE (t) == SSA_NAME)
 {
   gimple g = SSA_NAME_DEF_STMT (t);
   if (gimple_assign_single_p (g))
 return gimple_assign_rhs1 (g);
 }
   return NULL_TREE;
}


Why?  forwprop etc. should have propagated it into the ASAN_CHECK if
it is is_gimple_val.  Or do you have specific examples which you have in
mind?


Yes, non-gimple cases (struct field addresses, etc.) are not propagated 
but still seem ok to optimize.  So for each SSA name we'll store both it 
and it's base definition in table.  This way different SSA with same 
base can optimize each other out.


-Y

[PATCH] Fix minimal alignment calculation for user-aligned types (PR63802)

[Yury Gribov]

Hi all,

This patch fixes https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63802 by 
only limiting minimal type alignment with BIGGEST_ALIGNMENT for types 
with no __attribute__((aligned)).


Bootstrapped and regtested on x64.  Ok for trunk?

-Y
From 7e5d09453dcff22f591162e1b5c5a115b17b0014 Mon Sep 17 00:00:00 2001
From: Yury Gribov y.gri...@samsung.com
Date: Thu, 13 Nov 2014 21:29:51 +0300
Subject: [PATCH] 2014-11-14  Yury Gribov  y.gri...@samsung.com

	PR sanitizer/63802

gcc/
	* stor-layout.c (min_align_of_type): Respect user alignment
	more.

gcc/testsuite/
	* c-c++-common/ubsan/pr63802.c: New test.
---
 gcc/stor-layout.c  |2 +-
 gcc/testsuite/c-c++-common/ubsan/pr63802.c |   23 +++
 2 files changed, 24 insertions(+), 1 deletion(-)
 create mode 100644 gcc/testsuite/c-c++-common/ubsan/pr63802.c

diff --git a/gcc/stor-layout.c b/gcc/stor-layout.c
index 431b207..db09855 100644
--- a/gcc/stor-layout.c
+++ b/gcc/stor-layout.c
@@ -2430,9 +2430,9 @@ unsigned int
 min_align_of_type (tree type)
 {
   unsigned int align = TYPE_ALIGN (type);
-  align = MIN (align, BIGGEST_ALIGNMENT);
   if (!TYPE_USER_ALIGN (type))
 {
+  align = MIN (align, BIGGEST_ALIGNMENT);
 #ifdef BIGGEST_FIELD_ALIGNMENT
   align = MIN (align, BIGGEST_FIELD_ALIGNMENT);
 #endif
diff --git a/gcc/testsuite/c-c++-common/ubsan/pr63802.c b/gcc/testsuite/c-c++-common/ubsan/pr63802.c
new file mode 100644
index 000..454c098
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/ubsan/pr63802.c
@@ -0,0 +1,23 @@
+/* Limit this to known non-strict alignment targets.  */
+/* { dg-do run { target { i?86-*-linux* x86_64-*-linux* } } } */
+/* { dg-options -fsanitize=alignment } */
+
+#define __round_mask(x, y) ((__typeof__(x))((y)-1))
+#define round_up(x, y) x)-1) | __round_mask(x, y))+1)
+
+struct test_struct {
+  unsigned long a;
+  int b;
+} __attribute__((__aligned__(64)));
+
+char a[200];
+
+int main ()
+{
+  volatile int x = ((struct test_struct*)(round_up((unsigned long)a, 64) + 16))-b;
+  volatile int y = ((struct test_struct*)(round_up((unsigned long)a, 64) + 15))-b;
+
+  return 0;
+}
+
+/* { dg-output \.c:18:\[0-9]*: \[^\n\r]*member access within misaligned address 0x\[0-9a-fA-F]* for type 'struct test_struct', which requires 64 byte alignment.* } */
-- 
1.7.9.5

Re: [PATCH] Fix minimal alignment calculation for user-aligned types (PR63802)

[Yury Gribov]

On 11/14/2014 10:02 AM, Jakub Jelinek wrote:

On Fri, Nov 14, 2014 at 09:46:14AM +0300, Yury Gribov wrote:

Hi all,

This patch fixes https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63802 by only
limiting minimal type alignment with BIGGEST_ALIGNMENT for types with no
__attribute__((aligned)).

Bootstrapped and regtested on x64.  Ok for trunk?


The function is primarily used by the C FE for _Alignas, and I have no idea
if such a change is desirable for that very much user visible case.  Joseph?

Alternatively, you can just change ubsan.c caller of min_align_of_type,
use TYPE_USER_ALIGN (type) ? TYPE_ALIGN_UNIT (type) : min_align_of_type (type)
there instead.


That's what I planned to do initially but change seemed so natural that 
I gave it a try.  Let's wait for Joseph's comment.


-Y

Re: PATCH: PR bootstrap/63888: [5 Regression] bootstrap failed when configured with -with-build-config=bootstrap-asan --disable-werror

[Yury Gribov]

On 11/15/2014 09:34 PM, H.J. Lu wrote:

GCC uses xstrndup/xstrdup throughout the source tree and those memory
may not be freed explicitly before exut.  LeakSanitizer isn't very
useful here.  This patch suppresses LeakSanitizer in bootstrap.  OK
for trunk?


Right, I think until now everyone just did the same manually.  I wonder 
if it makes sense to also enable more aggressive checking e.g. 
detect_stack_use_after_return and check_initialization_order.


-Y

[PATCHv2] Fix minimal alignment calculation for user-aligned types (PR63802)

[Yury Gribov]

On 11/17/2014 10:20 AM, Jakub Jelinek wrote:

On Fri, Nov 14, 2014 at 06:15:16PM +, Joseph Myers wrote:

On Fri, 14 Nov 2014, Jakub Jelinek wrote:


On Fri, Nov 14, 2014 at 09:46:14AM +0300, Yury Gribov wrote:

Hi all,

This patch fixes https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63802 by only
limiting minimal type alignment with BIGGEST_ALIGNMENT for types with no
__attribute__((aligned)).

Bootstrapped and regtested on x64.  Ok for trunk?


The function is primarily used by the C FE for _Alignas, and I have no idea
if such a change is desirable for that very much user visible case.  Joseph?


If it is true that a type satisfying TYPE_USER_ALIGN will never be
allocated at an address less-aligned than its TYPE_ALIGN, even if that's
greater than BIGGEST_ALIGNMENT, then the change seems correct for C11
_Alignof.


I think it depends on which target and where.
In structs (unless packed) the user aligned fields should be properly
aligned with respect to start of struct and the struct should have user
alignment in that case, automatic vars these days use alloca with
realignment if not handled better by the target, so should be fine too.
For data section vars and for common vars I think it really depends on the
target.  Perhaps for TYPE_USER_ALIGN use minimum of the TYPE_ALIGN and
MAX_OFILE_ALIGNMENT ?
For heap objects, it really depends on how it has been allocated, but if
allocated through malloc, the extra alignment is never guaranteed.
So, it really depends in malloc counts or not.


It looks like min_align_of_type is just too C11-specific to be usable in 
other contexts.  Here is a patch which does what Jakub originally 
proposed (use TYPE_ALIGN_UNIT for user-aligned types, fallback to 
min_align_of_type otherwise).


Again, bootstrapped and regtested on x64.

-Y
commit 1dc89eb74cceeb2c7f6021a40bf65fdf5f706909
Author: Yury Gribov y.gri...@samsung.com
Date:   Mon Nov 17 12:40:02 2014 +0300

2014-11-17  Yury Gribov  y.gri...@samsung.com

	PR sanitizer/63802

gcc/
	* ubsan.h (ubsan_align_of_type): Declare new function.
	* ubsan.c (ubsan_align_of_type): New function.
	(instrument_mem_ref): Call new function.

gcc/c-family/
	* c-ubsan.c (ubsan_maybe_instrument_reference_or_call):
	Call new function.

gcc/testsuite/
	* c-c++-common/ubsan/pr63802.c: New test.

diff --git a/gcc/c-family/c-ubsan.c b/gcc/c-family/c-ubsan.c
index ab16799..00b68e5 100644
--- a/gcc/c-family/c-ubsan.c
+++ b/gcc/c-family/c-ubsan.c
@@ -397,7 +397,7 @@ ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree type,
 
   if (flag_sanitize  SANITIZE_ALIGNMENT)
 {
-  mina = min_align_of_type (type);
+  mina = ubsan_align_of_type (type);
   if (mina = 1)
 	mina = 0;
 }
@@ -408,7 +408,7 @@ ubsan_maybe_instrument_reference_or_call (location_t loc, tree op, tree type,
   if (TREE_CODE (op) == NOP_EXPR
TREE_CODE (TREE_TYPE (op)) == REFERENCE_TYPE)
 {
-  if (mina  mina  min_align_of_type (TREE_TYPE (TREE_TYPE (op
+  if (mina  mina  ubsan_align_of_type (TREE_TYPE (TREE_TYPE (op
 	instrument = true;
 }
   else
diff --git a/gcc/testsuite/c-c++-common/ubsan/pr63802.c b/gcc/testsuite/c-c++-common/ubsan/pr63802.c
new file mode 100644
index 000..454c098
--- /dev/null
+++ b/gcc/testsuite/c-c++-common/ubsan/pr63802.c
@@ -0,0 +1,23 @@
+/* Limit this to known non-strict alignment targets.  */
+/* { dg-do run { target { i?86-*-linux* x86_64-*-linux* } } } */
+/* { dg-options -fsanitize=alignment } */
+
+#define __round_mask(x, y) ((__typeof__(x))((y)-1))
+#define round_up(x, y) x)-1) | __round_mask(x, y))+1)
+
+struct test_struct {
+  unsigned long a;
+  int b;
+} __attribute__((__aligned__(64)));
+
+char a[200];
+
+int main ()
+{
+  volatile int x = ((struct test_struct*)(round_up((unsigned long)a, 64) + 16))-b;
+  volatile int y = ((struct test_struct*)(round_up((unsigned long)a, 64) + 15))-b;
+
+  return 0;
+}
+
+/* { dg-output \.c:18:\[0-9]*: \[^\n\r]*member access within misaligned address 0x\[0-9a-fA-F]* for type 'struct test_struct', which requires 64 byte alignment.* } */
diff --git a/gcc/ubsan.c b/gcc/ubsan.c
index b5b1b92..0f1ba9a 100644
--- a/gcc/ubsan.c
+++ b/gcc/ubsan.c
@@ -78,6 +78,15 @@ struct GTY(()) tree_type_map {
 #define tree_type_map_eq tree_map_base_eq
 #define tree_type_map_marked_p tree_map_base_marked_p
 
+/* Type alignment in bytes to be checked by UBSan.  */
+
+unsigned int
+ubsan_align_of_type (tree type)
+{
+  return TYPE_USER_ALIGN (type) ? TYPE_ALIGN_UNIT (type)
+: min_align_of_type (type);
+}
+
 /* Hash from a tree in a tree_type_map.  */
 
 unsigned int
@@ -938,7 +947,7 @@ instrument_mem_ref (tree mem, tree base, gimple_stmt_iterator *iter,
   unsigned int align = 0;
   if (flag_sanitize  SANITIZE_ALIGNMENT)
 {
-  align = min_align_of_type (TREE_TYPE (base));
+  align = ubsan_align_of_type (TREE_TYPE (base));
   if (align = 1)
 	align = 0;
 }
diff --git a/gcc/ubsan.h

Re: [PATCH] -fsanitize-recover=list

[Yury Gribov]

As for the generated code, I'm at the stage where I can implement the
following: if a single UBSan hander is used to report multiple error
kinds (__ubsan_handle_type_mismatch is used for
-fsanitize=null,alignment,object-size), and these kinds have different
recoverability, then we emit two handler calls like this:


Nice, I think we do not yet have this in gcc.

-Y

[PATCH] Enhance ASAN_CHECK optimization

[Yury Gribov]

Hi all,

This patch improves current optimization of ASAN_CHECKS performed by 
sanopt pass.  In addition to searching the sanitized pointer in 
asan_check_map, it also tries to search for definition of this pointer. 
 This allows more checks to be dropped when definition is not a gimple 
value (e.g. load from struct field) and thus cannot be propagated by 
forwprop.


In my experiments this rarely managed to remove more than 0.5% of 
ASAN_CHECKs but some files got as much as 1% improvement e.g.

* gimple.c: 49 (out of 5293)
* varasm.c: 42 (out of 3678)

For a total it was able to remove 2657 checks in Asan-bootstrapped GCC 
(out of ~500K).


I've Asan-bootstrapped, bootstrapped and regtested on x64.

Is this ok for stage3?

Best regards,
Yury

From 85f65c403f132245e9efcc8a420269f8d631fae6 Mon Sep 17 00:00:00 2001
From: Yury Gribov y.gri...@samsung.com
Date: Tue, 25 Nov 2014 11:49:11 +0300
Subject: [PATCH] 2014-11-25  Yury Gribov  y.gri...@samsung.com

gcc/
	* sanopt.c (maybe_get_single_definition): New function.
	(struct tree_map_traits): New struct.
	(struct sanopt_ctx): Use custom traits for asan_check_map.
	(maybe_get_dominating_check): New function.
	(maybe_optimize_ubsan_null_ifn): Move code to
	maybe_get_dominating_check.
	(maybe_optimize_asan_check_ifn): Ditto. Take non-SSA expressions
	into account when optimizing.
	(sanopt_optimize_walker): Do not treat recoverable sanitization
	specially.
---
 gcc/sanopt.c |  194 +++---
 1 file changed, 116 insertions(+), 78 deletions(-)

diff --git a/gcc/sanopt.c b/gcc/sanopt.c
index e1d11e0..9fe87de 100644
--- a/gcc/sanopt.c
+++ b/gcc/sanopt.c
@@ -84,6 +84,35 @@ struct sanopt_info
   bool visited_p;
 };
 
+/* If T has a single definition of form T = T2, return T2.  */
+
+static tree
+maybe_get_single_definition (tree t)
+{
+  if (TREE_CODE (t) == SSA_NAME)
+{
+  gimple g = SSA_NAME_DEF_STMT (t);
+  if (gimple_assign_single_p (g))
+	return gimple_assign_rhs1 (g);
+}
+  return NULL_TREE;
+}
+
+/* Traits class for tree hash maps below.  */
+
+struct tree_map_traits : default_hashmap_traits
+{
+  static inline hashval_t hash (const_tree ref)
+{
+  return iterative_hash_expr (ref, 0);
+}
+
+  static inline bool equal_keys (const_tree ref1, const_tree ref2)
+{
+  return operand_equal_p (ref1, ref2, 0);
+}
+}; 
+
 /* This is used to carry various hash maps and variables used
in sanopt_optimize_walker.  */
 
@@ -95,7 +124,7 @@ struct sanopt_ctx
 
   /* This map maps a pointer (the second argument of ASAN_CHECK) to
  a vector of ASAN_CHECK call statements that check the access.  */
-  hash_maptree, auto_vecgimple  asan_check_map;
+  hash_maptree, auto_vecgimple, tree_map_traits asan_check_map;
 
   /* Number of IFN_ASAN_CHECK statements.  */
   int asan_num_accesses;
@@ -197,6 +226,24 @@ imm_dom_path_with_freeing_call (basic_block bb, basic_block dom)
   return false;
 }
 
+/* Get the first dominating check from the list of stored checks.
+   Non-dominating checks are silently dropped.  */
+
+static gimple
+maybe_get_dominating_check (auto_vecgimple v)
+{
+  for (; !v.is_empty (); v.pop ())
+{
+  gimple g = v.last ();
+  sanopt_info *si = (sanopt_info *) gimple_bb (g)-aux;
+  if (!si-visited_p)
+	/* At this point we shouldn't have any statements
+	   that aren't dominating the current BB.  */
+	return g;
+}
+  return NULL;
+}
+
 /* Optimize away redundant UBSAN_NULL calls.  */
 
 static bool
@@ -209,7 +256,8 @@ maybe_optimize_ubsan_null_ifn (struct sanopt_ctx *ctx, gimple stmt)
   bool remove = false;
 
   auto_vecgimple v = ctx-null_check_map.get_or_insert (ptr);
-  if (v.is_empty ())
+  gimple g = maybe_get_dominating_check (v);
+  if (!g)
 {
   /* For this PTR we don't have any UBSAN_NULL stmts recorded, so there's
 	 nothing to optimize yet.  */
@@ -220,43 +268,30 @@ maybe_optimize_ubsan_null_ifn (struct sanopt_ctx *ctx, gimple stmt)
   /* We already have recorded a UBSAN_NULL check for this pointer. Perhaps we
  can drop this one.  But only if this check doesn't specify stricter
  alignment.  */
-  while (!v.is_empty ())
-{
-  gimple g = v.last ();
-  /* Remove statements for BBs that have been already processed.  */
-  sanopt_info *si = (sanopt_info *) gimple_bb (g)-aux;
-  if (si-visited_p)
-	{
-	  v.pop ();
-	  continue;
-	}
 
-  /* At this point we shouldn't have any statements that aren't dominating
-	 the current BB.  */
-  tree align = gimple_call_arg (g, 2);
-  int kind = tree_to_shwi (gimple_call_arg (g, 1));
-  /* If this is a NULL pointer check where we had segv anyway, we can
-	 remove it.  */
-  if (integer_zerop (align)
-	   (kind == UBSAN_LOAD_OF
-	  || kind == UBSAN_STORE_OF
-	  || kind == UBSAN_MEMBER_ACCESS))
-	remove = true;
-  /* Otherwise remove the check in non-recovering mode, or if the
-	 stmts have same location.  */
-  else if (integer_zerop (align

[PATCHv3][PING] Enable -fsanitize-recover for KASan

[Yury Gribov]

Hi all,


This patch enables -fsanitize-recover for KASan by default. This causes
KASan to continue execution after error in case of inline
instrumentation. This feature is needed because
- reports during early bootstrap won't even be printed
- needed to run all tests w/o rebooting machine for every test
- needed for interactive work on desktop


This is the third version of patch which renames -fsanitize-recover to 
-fubsan-recover and introduces -fasan-recover (enabled by default for 
KASan). It also moves flag handling to finish_options per Jakub's request.


Bootstrapped and regtested on x64.

-Y
commit a9451a79bcdcab69856a38d228bec8986c0b0b2a
Author: Yury Gribov y.gri...@samsung.com
Date:   Fri Aug 29 16:43:42 2014 +0400

2014-09-29  Yury Gribov  y.gri...@samsung.com

gcc/
	* asan.c (report_error_func): Optionally call recoverable
	routines.
	(asan_expand_check_ifn): Ditto.
	(check_func): Fix formatting.
	* common.opt (fasan-recover): New option.
	(fubsan-recover): Rename.
	* doc/invoke.texi (-fasan-recover): Document new option.
	* sanitizer.def: New builtins.
	* opts.c (common_handle_option): Move default initialization to
	(finish_options): Here. Also initialize flag_asan_recover.
	* flag-types.h (SANITIZE_UNDEFINED_NONDEFAULT): Rename.
	* builtins.def: Ditto.
	* gcc.c (sanitize_spec_function): Ditto.
	* opts.c (common_handle_option): Ditto.
	* ubsan.c (ubsan_expand_bounds_ifn): Rename flag.
	(ubsan_expand_null_ifn): Ditto.
	(ubsan_build_overflow_builtin): Ditto.
	(instrument_bool_enum_load): Ditto.
	(ubsan_instrument_float_cast): Ditto.
	(instrument_nonnull_arg): Ditto.
	(instrument_nonnull_return): Ditto.

gcc/c-family/

	* c-ubsan.c (ubsan_instrument_division): Rename flag_sanitize_recover
	to flag_ubsan_recover.
	(ubsan_instrument_shift): Ditto.
	(ubsan_instrument_vla): Ditto.

gcc/testsuite/
	* c-c++-common/asan/recovery-1.c: New test.
	* c-c++-common/ubsan/align-1.c: Rename flag.
	* c-c++-common/ubsan/align-3.c: Ditto.
	* c-c++-common/ubsan/bounds-1.c: Ditto.
	* c-c++-common/ubsan/div-by-zero-7.c: Ditto.
	* c-c++-common/ubsan/float-cast-overflow-10.c: Ditto.
	* c-c++-common/ubsan/float-cast-overflow-7.c: Ditto.
	* c-c++-common/ubsan/float-cast-overflow-8.c: Ditto.
	* c-c++-common/ubsan/float-cast-overflow-9.c: Ditto.
	* c-c++-common/ubsan/nonnull-2.c: Ditto.
	* c-c++-common/ubsan/nonnull-3.c: Ditto.
	* c-c++-common/ubsan/overflow-1.c: Ditto.
	* c-c++-common/ubsan/overflow-add-1.c: Ditto.
	* c-c++-common/ubsan/overflow-add-3.c: Ditto.
	* c-c++-common/ubsan/overflow-mul-1.c: Ditto.
	* c-c++-common/ubsan/overflow-mul-3.c: Ditto.
	* c-c++-common/ubsan/overflow-negate-2.c: Ditto.
	* c-c++-common/ubsan/overflow-sub-1.c: Ditto.
	* c-c++-common/ubsan/pr59503.c: Ditto.
	* c-c++-common/ubsan/pr60613-1.c: Ditto.
	* c-c++-common/ubsan/save-expr-1.c: Ditto.
	* c-c++-common/ubsan/shift-3.c: Ditto.
	* c-c++-common/ubsan/shift-6.c: Ditto.
	* c-c++-common/ubsan/undefined-1.c: Ditto.
	* c-c++-common/ubsan/vla-2.c: Ditto.
	* c-c++-common/ubsan/vla-3.c: Ditto.
	* c-c++-common/ubsan/vla-4.c: Ditto.
	* g++.dg/ubsan/cxx11-shift-1.C: Ditto.
	* g++.dg/ubsan/return-2.C: Ditto.

Conflicts:

	gcc/doc/invoke.texi

diff --git a/gcc/asan.c b/gcc/asan.c
index 63f99f5..fb7a660 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -1376,22 +1376,36 @@ asan_protect_global (tree decl)
IS_STORE is either 1 (for a store) or 0 (for a load).  */
 
 static tree
-report_error_func (bool is_store, HOST_WIDE_INT size_in_bytes, int *nargs)
-{
-  static enum built_in_function report[2][6]
-= { { BUILT_IN_ASAN_REPORT_LOAD1, BUILT_IN_ASAN_REPORT_LOAD2,
-	  BUILT_IN_ASAN_REPORT_LOAD4, BUILT_IN_ASAN_REPORT_LOAD8,
-	  BUILT_IN_ASAN_REPORT_LOAD16, BUILT_IN_ASAN_REPORT_LOAD_N },
-	{ BUILT_IN_ASAN_REPORT_STORE1, BUILT_IN_ASAN_REPORT_STORE2,
-	  BUILT_IN_ASAN_REPORT_STORE4, BUILT_IN_ASAN_REPORT_STORE8,
-	  BUILT_IN_ASAN_REPORT_STORE16, BUILT_IN_ASAN_REPORT_STORE_N } };
+report_error_func (bool is_store, bool recover_p, HOST_WIDE_INT size_in_bytes,
+		   int *nargs)
+{
+  static enum built_in_function report[2][2][6]
+= { { { BUILT_IN_ASAN_REPORT_LOAD1, BUILT_IN_ASAN_REPORT_LOAD2,
+	BUILT_IN_ASAN_REPORT_LOAD4, BUILT_IN_ASAN_REPORT_LOAD8,
+	BUILT_IN_ASAN_REPORT_LOAD16, BUILT_IN_ASAN_REPORT_LOAD_N },
+	  { BUILT_IN_ASAN_REPORT_STORE1, BUILT_IN_ASAN_REPORT_STORE2,
+	BUILT_IN_ASAN_REPORT_STORE4, BUILT_IN_ASAN_REPORT_STORE8,
+	BUILT_IN_ASAN_REPORT_STORE16, BUILT_IN_ASAN_REPORT_STORE_N } },
+	{ { BUILT_IN_ASAN_REPORT_RECOVER_LOAD1,
+	BUILT_IN_ASAN_REPORT_RECOVER_LOAD2,
+	BUILT_IN_ASAN_REPORT_RECOVER_LOAD4,
+	BUILT_IN_ASAN_REPORT_RECOVER_LOAD8,
+	BUILT_IN_ASAN_REPORT_RECOVER_LOAD16,
+	BUILT_IN_ASAN_REPORT_RECOVER_LOAD_N

[PATCHv3][Kasan][PING] Allow to override Asan shadow offset from command line

[Yury Gribov]

Hi all,


Kasan developers has asked for an option to override offset of Asan
shadow memory region. This should simplify experimenting with memory
layouts on 64-bit architectures.


New patch which checks that -fasan-shadow-offset is only enabled for 
-fsanitize=kernel-address. I (unfortunately) can't make this --param 
because this can be a 64-bit value.


Bootstrapped and regtested on x64.

-Y
commit 05829f7922915b075c0f4275d3613947aa793a9c
Author: Yury Gribov y.gri...@samsung.com
Date:   Fri Aug 29 11:58:03 2014 +0400

Allow to override Asan shadow offset.

2014-09-26  Yury Gribov  y.gri...@samsung.com

gcc/
	* asan.c (set_asan_shadow_offset): New function.
	(asan_shadow_offset): Likewise.
	(asan_emit_stack_protection): Call asan_shadow_offset.
	(build_shadow_mem_access): Likewise.
	* asan.h (set_asan_shadow_offset): Declare.
	* common.opt (fasan-shadow-offset): New option.
	* doc/invoke.texi (fasan-shadow-offset): Describe new option.
	* opts-global.c (handle_common_deferred_options): Handle
	-fasan-shadow-offset.
	* opts.c (common_handle_option): Likewise.

gcc/testsuite/
	* c-c++-common/asan/shadow-offset-1.c: New test.

diff --git a/gcc/asan.c b/gcc/asan.c
index f520eab..63f99f5 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -238,6 +238,39 @@ along with GCC; see the file COPYING3.  If not see
A destructor function that calls the runtime asan library function
_asan_unregister_globals is also installed.  */
 
+static unsigned HOST_WIDE_INT asan_shadow_offset_value;
+static bool asan_shadow_offset_computed;
+
+/* Sets shadow offset to value in string VAL.  */
+
+bool
+set_asan_shadow_offset (const char *val)
+{
+  char *endp;
+  
+  errno = 0;
+  asan_shadow_offset_value = strtoul (val, endp, 0);
+  if (!(*val != '\0'  *endp == '\0'  errno == 0))
+return false;
+
+  asan_shadow_offset_computed = true;
+
+  return true;
+}
+
+/* Returns Asan shadow offset.  */
+
+static unsigned HOST_WIDE_INT
+asan_shadow_offset ()
+{
+  if (!asan_shadow_offset_computed)
+{
+  asan_shadow_offset_computed = true;
+  asan_shadow_offset_value = targetm.asan_shadow_offset ();
+}
+  return asan_shadow_offset_value;
+}
+
 alias_set_type asan_shadow_set = -1;
 
 /* Pointer types to 1 resp. 2 byte integers in shadow memory.  A separate
@@ -1124,7 +1157,7 @@ asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
 			  NULL_RTX, 1, OPTAB_DIRECT);
   shadow_base
 = plus_constant (Pmode, shadow_base,
-		 targetm.asan_shadow_offset ()
+		 asan_shadow_offset ()
 		 + (base_align_bias  ASAN_SHADOW_SHIFT));
   gcc_assert (asan_shadow_set != -1
 	   (ASAN_RED_ZONE_SIZE  ASAN_SHADOW_SHIFT) == 4);
@@ -1502,7 +1535,7 @@ insert_if_then_before_iter (gimple cond,
 }
 
 /* Build
-   (base_addr  ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset ().  */
+   (base_addr  ASAN_SHADOW_SHIFT) + asan_shadow_offset ().  */
 
 static tree
 build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
@@ -1519,7 +1552,7 @@ build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
   gimple_set_location (g, location);
   gsi_insert_after (gsi, g, GSI_NEW_STMT);
 
-  t = build_int_cst (uintptr_type, targetm.asan_shadow_offset ());
+  t = build_int_cst (uintptr_type, asan_shadow_offset ());
   g = gimple_build_assign_with_ops (PLUS_EXPR,
 make_ssa_name (uintptr_type, NULL),
 gimple_assign_lhs (g), t);
diff --git a/gcc/asan.h b/gcc/asan.h
index 198433f..eadf029 100644
--- a/gcc/asan.h
+++ b/gcc/asan.h
@@ -36,7 +36,7 @@ extern gimple_stmt_iterator create_cond_insert_point
 extern alias_set_type asan_shadow_set;
 
 /* Shadow memory is found at
-   (address  ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset ().  */
+   (address  ASAN_SHADOW_SHIFT) + asan_shadow_offset ().  */
 #define ASAN_SHADOW_SHIFT	3
 
 /* Red zone size, stack and global variables are padded by ASAN_RED_ZONE_SIZE
@@ -76,4 +76,6 @@ asan_red_zone_size (unsigned int size)
   return c ? 2 * ASAN_RED_ZONE_SIZE - c : ASAN_RED_ZONE_SIZE;
 }
 
+extern bool set_asan_shadow_offset (const char *);
+
 #endif /* TREE_ASAN */
diff --git a/gcc/common.opt b/gcc/common.opt
index b4f0ed4..90f6bd4 100644
--- a/gcc/common.opt
+++ b/gcc/common.opt
@@ -879,6 +879,10 @@ fsanitize=
 Common Driver Report Joined
 Select what to sanitize
 
+fasan-shadow-offset=
+Common Joined RejectNegative Var(common_deferred_options) Defer
+-fasan-shadow-offset=string	Use custom shadow memory offset.
+
 fsanitize-recover
 Common Report Var(flag_sanitize_recover) Init(1)
 After diagnosing undefined behavior attempt to continue execution
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index f6c3b42..d9bd1f7 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -297,7 +297,7 @@ Objective-C and Objective-C++ Dialects}.
 @xref{Debugging Options,,Options for Debugging Your Program or GCC}.
 @gccoptlist{-d@var{letters}  -dumpspecs  -dumpmachine

Re: [PATCHv3][PING] Enable -fsanitize-recover for KASan

[Yury Gribov]

On 09/30/2014 04:24 AM, Konstantin Serebryany wrote:

On Mon, Sep 29, 2014 at 4:26 PM, Alexey Samsonov samso...@google.com wrote:

I don't think we ever going to support recovery for regular ASan
(Kostya, correct me if I'm wrong).


I hope so too.
Another point is that with asan-instrumentation-with-call-threshold=0
(instrumentation with callbacks)
we can and probably will allow to recover from errors (glibc demands that),
but that does not require any compile-time flag.


I don't know details but are you absolutely sure that you won't want to 
do inline instrumentation of glibc in the future? This would then 
require -fasan-recover.


-Y

Re: [PATCHv3][PING] Enable -fsanitize-recover for KASan

[Yury Gribov]

On 09/30/2014 09:40 AM, Jakub Jelinek wrote:

On Mon, Sep 29, 2014 at 05:24:02PM -0700, Konstantin Serebryany wrote:

I don't think we ever going to support recovery for regular ASan
(Kostya, correct me if I'm wrong).


I hope so too.
Another point is that with asan-instrumentation-with-call-threshold=0
(instrumentation with callbacks)


The normal (non-recovery) callbacks are __attribute__((noreturn)) for
performance reasons, and you do need different callbacks and different
generated code if you want to recover (after the callback you need jump
back to a basic block after the conditional jump).
So, in that case you would need -fsanitize-recover=address.


I see no problem in enabling -fsanitize-recover by default for
-fsanitize=undefined and


This becomes more interesting when we use asan and ubsan together.


That is fairly common case.


I think we can summarize:
* the current option -fsanitize-recover is misleading; it's really 
-fubsan-recover
* we need a way to selectively enable/disable recovery for different 
sanitizers


The most promininet solution seems to be
* allow -fsanitize-recover=tgt1,tgt2 syntax
* -fsanitize-recover wo options would still mean UBSan recovery

The question is what to do with -fno-sanitize-recover then.

-Y

Re: [PATCHv3][PING] Enable -fsanitize-recover for KASan

[Yury Gribov]

On 09/30/2014 10:56 AM, Yury Gribov wrote:

On 09/30/2014 04:24 AM, Konstantin Serebryany wrote:

On Mon, Sep 29, 2014 at 4:26 PM, Alexey Samsonov samso...@google.com
wrote:

I don't think we ever going to support recovery for regular ASan
(Kostya, correct me if I'm wrong).


I hope so too.
Another point is that with asan-instrumentation-with-call-threshold=0
(instrumentation with callbacks)
we can and probably will allow to recover from errors (glibc demands
that),
but that does not require any compile-time flag.


I don't know details but are you absolutely sure that you won't want to
do inline instrumentation of glibc in the future? This would then
require -fasan-recover.


FYI in kernel we had exactly this situation: outline instrumentation 
allowed us to hide recovery inside callbacks but then turned out to be 
too slow so we are now switching back to inline instrumentation (which 
requires -fasan-recovery).


-Y

[PATCHv5] Vimrc config with GNU formatting

[Yury Gribov]

On 09/17/2014 09:08 PM, Yury Gribov wrote:
 On 09/16/2014 08:38 PM, Yury Gribov wrote:
 Hi all,

 This is the third version of the patch. A list of changes since last
 version:
 * move config to contrib so that it's _not_ enabled by default (current
 score is 2/1 in favor of no Vim config by default)
 * update Makefile.in to make .local.vimrc if developer asks for it
 * disable autoformatting for flex files
 * fix filtering of non-GNU sources (libsanitizer)
 * added some small fixes in cinoptions based on feedback from community

 As noted by Richard, the config does not do a good job of formatting
 unbound {} blocks e.g.
 void
 foo ()
 {
int x;
  {
// I'm an example of bad bad formatting
  }
 }
 but it seems to be the best we can get with Vim's cindent
 (and I don't think anyone seriously considers writing a custom
 indentexpr).

 Ok to commit?

 New vesion with support for another popular local .vimrc plugin.

Hi all,

Here is a new vesion of vimrc patch. Hope I got email settings right 
this time.


Changes since v4:
* fixed and enhanced docs
* added support for .lvimrc in Makefile
* minor fixes in cinoptions and formatoptions (reported by Segher)
* removed shiftwidth settings (as it does not really relate to code 
formatting)


-Y

commit 3f560e9dd16a5e914b6f2ba82edffe13dfde944c
Author: Yury Gribov y.gri...@samsung.com
Date:   Thu Oct 2 15:50:52 2014 +0400

2014-10-02  Laurynas Biveinis  laurynas.bivei...@gmail.com
	Yury Gribov  y.gri...@samsung.com

Vim config with GNU formatting.

contrib/
	* vimrc: New file.

/
	* .gitignore: Added .local.vimrc and .lvimrc.
	* Makefile.tpl (vimrc, .lvimrc, .local.vimrc): New targets.
	* Makefile.in: Regenerate.

diff --git a/.gitignore b/.gitignore
index e9b56be..ab97ac6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,6 +32,9 @@ POTFILES
 TAGS
 TAGS.sub
 
+.local.vimrc
+.lvimrc
+
 .gdbinit
 .gdb_history
 
diff --git a/Makefile.in b/Makefile.in
index d6105b3..f3a34af 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -2384,6 +2384,18 @@ mail-report-with-warnings.log: warning.log
 	chmod +x $@
 	echo If you really want to send e-mail, run ./$@ now
 
+# Local Vim config
+
+$(srcdir)/.local.vimrc:
+	$(LN_S) $(srcdir)/contrib/vimrc $@
+
+$(srcdir)/.lvimrc:
+	$(LN_S) $(srcdir)/contrib/vimrc $@
+
+vimrc: $(srcdir)/.local.vimrc $(srcdir)/.lvimrc
+
+.PHONY: vimrc
+
 # Installation targets.
 
 .PHONY: install uninstall
diff --git a/Makefile.tpl b/Makefile.tpl
index f7c7e38..b98930c 100644
--- a/Makefile.tpl
+++ b/Makefile.tpl
@@ -867,6 +867,18 @@ mail-report-with-warnings.log: warning.log
 	chmod +x $@
 	echo If you really want to send e-mail, run ./$@ now
 
+# Local Vim config
+
+$(srcdir)/.local.vimrc:
+	$(LN_S) $(srcdir)/contrib/vimrc $@
+
+$(srcdir)/.lvimrc:
+	$(LN_S) $(srcdir)/contrib/vimrc $@
+
+vimrc: $(srcdir)/.local.vimrc $(srcdir)/.lvimrc
+
+.PHONY: vimrc
+
 # Installation targets.
 
 .PHONY: install uninstall
diff --git a/contrib/vimrc b/contrib/vimrc
new file mode 100644
index 000..34e8f35
--- /dev/null
+++ b/contrib/vimrc
@@ -0,0 +1,45 @@
+ Code formatting settings for Vim.
+
+ To enable this for GCC files by default, you can either source this file
+ in your .vimrc via autocmd:
+   :au BufNewFile,BufReadPost path/to/gcc/* :so path/to/gcc/contrib/vimrc
+ or source the script manually for each newly opened file:
+   :so contrib/vimrc
+ You could also use numerous plugins that enable local vimrc e.g.
+ mbr's localvimrc or thinca's vim-localrc (but note that the latter
+ is much less secure). To install local vimrc config, run
+   $ make vimrc
+ from GCC build folder.
+ 
+ Copyright (C) 2014 Free Software Foundation, Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program.  If not, see http://www.gnu.org/licenses/.
+
+function! SetStyle()
+  let l:fname = expand(%:p)
+  if stridx(l:fname, 'libsanitizer') != -1
+return
+  endif
+  let l:ext = fnamemodify(l:fname, :e)
+  let l:c_exts = ['c', 'h', 'cpp', 'cc', 'C', 'H', 'def', 'java']
+  if index(l:c_exts, l:ext) != -1
+setlocal cindent
+setlocal softtabstop=2
+setlocal cinoptions=4,n-2,{2,^-2,:2,=2,g0,f0,h2,p4,t0,+2,(0,u0,w1,m0
+setlocal textwidth=80
+setlocal formatoptions-=ro formatoptions+=cqlt
+  endif
+endfunction
+
+call SetStyle()

[PATCH] Disable __asan_init for KASan

[Yury Gribov]

Hi all,

This patch disables generation of asan_init calls for KASan as discussed 
in https://lkml.org/lkml/2014/9/26/711


Bootstrapped and regtested no x64. Ok to commit?

-Y
commit 91c015e54687666f4abf6745f33c2eee8e569d17
Author: Yury Gribov y.gri...@samsung.com
Date:   Fri Oct 3 11:53:38 2014 +0400

2014-10-03  Yury Gribov  y.gri...@samsung.com

gcc/
	* asan.c (asan_finish_file): Disable __asan_init calls for KASan;
	don't emit empty ctors.

diff --git a/gcc/asan.c b/gcc/asan.c
index f520eab..247661a 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -2400,8 +2400,11 @@ asan_finish_file (void)
  nor after .LASAN* array.  */
   flag_sanitize = ~SANITIZE_ADDRESS;
 
-  tree fn = builtin_decl_implicit (BUILT_IN_ASAN_INIT);
-  append_to_statement_list (build_call_expr (fn, 0), asan_ctor_statements);
+  if (flag_sanitize  SANITIZE_USER_ADDRESS)
+{
+  tree fn = builtin_decl_implicit (BUILT_IN_ASAN_INIT);
+  append_to_statement_list (build_call_expr (fn, 0), asan_ctor_statements);
+}
   FOR_EACH_DEFINED_VARIABLE (vnode)
 if (TREE_ASM_WRITTEN (vnode-decl)
 	 asan_protect_global (vnode-decl))
@@ -2438,7 +2441,7 @@ asan_finish_file (void)
   DECL_INITIAL (var) = ctor;
   varpool_node::finalize_decl (var);
 
-  fn = builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS);
+  tree fn = builtin_decl_implicit (BUILT_IN_ASAN_REGISTER_GLOBALS);
   tree gcount_tree = build_int_cst (pointer_sized_int_node, gcount);
   append_to_statement_list (build_call_expr (fn, 2,
 		 build_fold_addr_expr (var),
@@ -2453,8 +2456,9 @@ asan_finish_file (void)
   cgraph_build_static_cdtor ('D', dtor_statements,
  MAX_RESERVED_INIT_PRIORITY - 1);
 }
-  cgraph_build_static_cdtor ('I', asan_ctor_statements,
-			 MAX_RESERVED_INIT_PRIORITY - 1);
+  if (asan_ctor_statements)
+cgraph_build_static_cdtor ('I', asan_ctor_statements,
+			   MAX_RESERVED_INIT_PRIORITY - 1);
   flag_sanitize |= SANITIZE_ADDRESS;
 }
 

[PATCHv3][Kasan][PING^2] Allow to override Asan shadow offset from command line

[Yury Gribov]

On 09/29/2014 09:21 PM, Yury Gribov wrote:

Hi all,


Kasan developers has asked for an option to override offset of Asan
shadow memory region. This should simplify experimenting with memory
layouts on 64-bit architectures.


New patch which checks that -fasan-shadow-offset is only enabled for
-fsanitize=kernel-address. I (unfortunately) can't make this --param
because this can be a 64-bit value.

Bootstrapped and regtested on x64.

-Y


commit 05829f7922915b075c0f4275d3613947aa793a9c
Author: Yury Gribov y.gri...@samsung.com
Date:   Fri Aug 29 11:58:03 2014 +0400

Allow to override Asan shadow offset.

2014-09-26  Yury Gribov  y.gri...@samsung.com

gcc/
	* asan.c (set_asan_shadow_offset): New function.
	(asan_shadow_offset): Likewise.
	(asan_emit_stack_protection): Call asan_shadow_offset.
	(build_shadow_mem_access): Likewise.
	* asan.h (set_asan_shadow_offset): Declare.
	* common.opt (fasan-shadow-offset): New option.
	* doc/invoke.texi (fasan-shadow-offset): Describe new option.
	* opts-global.c (handle_common_deferred_options): Handle
	-fasan-shadow-offset.
	* opts.c (common_handle_option): Likewise.

gcc/testsuite/
	* c-c++-common/asan/shadow-offset-1.c: New test.

diff --git a/gcc/asan.c b/gcc/asan.c
index f520eab..63f99f5 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -238,6 +238,39 @@ along with GCC; see the file COPYING3.  If not see
A destructor function that calls the runtime asan library function
_asan_unregister_globals is also installed.  */
 
+static unsigned HOST_WIDE_INT asan_shadow_offset_value;
+static bool asan_shadow_offset_computed;
+
+/* Sets shadow offset to value in string VAL.  */
+
+bool
+set_asan_shadow_offset (const char *val)
+{
+  char *endp;
+  
+  errno = 0;
+  asan_shadow_offset_value = strtoul (val, endp, 0);
+  if (!(*val != '\0'  *endp == '\0'  errno == 0))
+return false;
+
+  asan_shadow_offset_computed = true;
+
+  return true;
+}
+
+/* Returns Asan shadow offset.  */
+
+static unsigned HOST_WIDE_INT
+asan_shadow_offset ()
+{
+  if (!asan_shadow_offset_computed)
+{
+  asan_shadow_offset_computed = true;
+  asan_shadow_offset_value = targetm.asan_shadow_offset ();
+}
+  return asan_shadow_offset_value;
+}
+
 alias_set_type asan_shadow_set = -1;
 
 /* Pointer types to 1 resp. 2 byte integers in shadow memory.  A separate
@@ -1124,7 +1157,7 @@ asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
 			  NULL_RTX, 1, OPTAB_DIRECT);
   shadow_base
 = plus_constant (Pmode, shadow_base,
-		 targetm.asan_shadow_offset ()
+		 asan_shadow_offset ()
 		 + (base_align_bias  ASAN_SHADOW_SHIFT));
   gcc_assert (asan_shadow_set != -1
 	   (ASAN_RED_ZONE_SIZE  ASAN_SHADOW_SHIFT) == 4);
@@ -1502,7 +1535,7 @@ insert_if_then_before_iter (gimple cond,
 }
 
 /* Build
-   (base_addr  ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset ().  */
+   (base_addr  ASAN_SHADOW_SHIFT) + asan_shadow_offset ().  */
 
 static tree
 build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
@@ -1519,7 +1552,7 @@ build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
   gimple_set_location (g, location);
   gsi_insert_after (gsi, g, GSI_NEW_STMT);
 
-  t = build_int_cst (uintptr_type, targetm.asan_shadow_offset ());
+  t = build_int_cst (uintptr_type, asan_shadow_offset ());
   g = gimple_build_assign_with_ops (PLUS_EXPR,
 make_ssa_name (uintptr_type, NULL),
 gimple_assign_lhs (g), t);
diff --git a/gcc/asan.h b/gcc/asan.h
index 198433f..eadf029 100644
--- a/gcc/asan.h
+++ b/gcc/asan.h
@@ -36,7 +36,7 @@ extern gimple_stmt_iterator create_cond_insert_point
 extern alias_set_type asan_shadow_set;
 
 /* Shadow memory is found at
-   (address  ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset ().  */
+   (address  ASAN_SHADOW_SHIFT) + asan_shadow_offset ().  */
 #define ASAN_SHADOW_SHIFT	3
 
 /* Red zone size, stack and global variables are padded by ASAN_RED_ZONE_SIZE
@@ -76,4 +76,6 @@ asan_red_zone_size (unsigned int size)
   return c ? 2 * ASAN_RED_ZONE_SIZE - c : ASAN_RED_ZONE_SIZE;
 }
 
+extern bool set_asan_shadow_offset (const char *);
+
 #endif /* TREE_ASAN */
diff --git a/gcc/common.opt b/gcc/common.opt
index b4f0ed4..90f6bd4 100644
--- a/gcc/common.opt
+++ b/gcc/common.opt
@@ -879,6 +879,10 @@ fsanitize=
 Common Driver Report Joined
 Select what to sanitize
 
+fasan-shadow-offset=
+Common Joined RejectNegative Var(common_deferred_options) Defer
+-fasan-shadow-offset=string	Use custom shadow memory offset.
+
 fsanitize-recover
 Common Report Var(flag_sanitize_recover) Init(1)
 After diagnosing undefined behavior attempt to continue execution
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index f6c3b42..d9bd1f7 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -297,7 +297,7 @@ Objective-C and Objective-C++ Dialects}.
 @xref{Debugging Options,,Options for Debugging Your Program or GCC}.
 @gccoptlist{-d

Re: [PATCHv3][Kasan][PING^2] Allow to override Asan shadow offset from command line

[Yury Gribov]

On 10/06/2014 03:06 PM, Yury Gribov wrote:

On 09/29/2014 09:21 PM, Yury Gribov wrote:

Hi all,


Kasan developers has asked for an option to override offset of Asan
shadow memory region. This should simplify experimenting with memory
layouts on 64-bit architectures.


New patch which checks that -fasan-shadow-offset is only enabled for
-fsanitize=kernel-address. I (unfortunately) can't make this --param
because this can be a 64-bit value.

Bootstrapped and regtested on x64.

-Y


Added Jakub.

[PATCHv5][PING] Vimrc config with GNU formatting

[Yury Gribov]

On 10/02/2014 09:14 PM, Yury Gribov wrote:

On 09/17/2014 09:08 PM, Yury Gribov wrote:
  On 09/16/2014 08:38 PM, Yury Gribov wrote:
  Hi all,
 
  This is the third version of the patch. A list of changes since last
  version:
  * move config to contrib so that it's _not_ enabled by default (current
  score is 2/1 in favor of no Vim config by default)
  * update Makefile.in to make .local.vimrc if developer asks for it
  * disable autoformatting for flex files
  * fix filtering of non-GNU sources (libsanitizer)
  * added some small fixes in cinoptions based on feedback from community
 
  As noted by Richard, the config does not do a good job of formatting
  unbound {} blocks e.g.
  void
  foo ()
  {
 int x;
   {
 // I'm an example of bad bad formatting
   }
  }
  but it seems to be the best we can get with Vim's cindent
  (and I don't think anyone seriously considers writing a custom
  indentexpr).
 
  Ok to commit?
 
  New vesion with support for another popular local .vimrc plugin.

Hi all,

Here is a new vesion of vimrc patch. Hope I got email settings right
this time.

Changes since v4:
* fixed and enhanced docs
* added support for .lvimrc in Makefile
* minor fixes in cinoptions and formatoptions (reported by Segher)
* removed shiftwidth settings (as it does not really relate to code
formatting)

-Y



commit 3f560e9dd16a5e914b6f2ba82edffe13dfde944c
Author: Yury Gribov y.gri...@samsung.com
Date:   Thu Oct 2 15:50:52 2014 +0400

2014-10-02  Laurynas Biveinis  laurynas.bivei...@gmail.com
	Yury Gribov  y.gri...@samsung.com

Vim config with GNU formatting.

contrib/
	* vimrc: New file.

/
	* .gitignore: Added .local.vimrc and .lvimrc.
	* Makefile.tpl (vimrc, .lvimrc, .local.vimrc): New targets.
	* Makefile.in: Regenerate.

diff --git a/.gitignore b/.gitignore
index e9b56be..ab97ac6 100644
--- a/.gitignore
+++ b/.gitignore
@@ -32,6 +32,9 @@ POTFILES
 TAGS
 TAGS.sub
 
+.local.vimrc
+.lvimrc
+
 .gdbinit
 .gdb_history
 
diff --git a/Makefile.in b/Makefile.in
index d6105b3..f3a34af 100644
--- a/Makefile.in
+++ b/Makefile.in
@@ -2384,6 +2384,18 @@ mail-report-with-warnings.log: warning.log
 	chmod +x $@
 	echo If you really want to send e-mail, run ./$@ now
 
+# Local Vim config
+
+$(srcdir)/.local.vimrc:
+	$(LN_S) $(srcdir)/contrib/vimrc $@
+
+$(srcdir)/.lvimrc:
+	$(LN_S) $(srcdir)/contrib/vimrc $@
+
+vimrc: $(srcdir)/.local.vimrc $(srcdir)/.lvimrc
+
+.PHONY: vimrc
+
 # Installation targets.
 
 .PHONY: install uninstall
diff --git a/Makefile.tpl b/Makefile.tpl
index f7c7e38..b98930c 100644
--- a/Makefile.tpl
+++ b/Makefile.tpl
@@ -867,6 +867,18 @@ mail-report-with-warnings.log: warning.log
 	chmod +x $@
 	echo If you really want to send e-mail, run ./$@ now
 
+# Local Vim config
+
+$(srcdir)/.local.vimrc:
+	$(LN_S) $(srcdir)/contrib/vimrc $@
+
+$(srcdir)/.lvimrc:
+	$(LN_S) $(srcdir)/contrib/vimrc $@
+
+vimrc: $(srcdir)/.local.vimrc $(srcdir)/.lvimrc
+
+.PHONY: vimrc
+
 # Installation targets.
 
 .PHONY: install uninstall
diff --git a/contrib/vimrc b/contrib/vimrc
new file mode 100644
index 000..34e8f35
--- /dev/null
+++ b/contrib/vimrc
@@ -0,0 +1,45 @@
+ Code formatting settings for Vim.
+
+ To enable this for GCC files by default, you can either source this file
+ in your .vimrc via autocmd:
+   :au BufNewFile,BufReadPost path/to/gcc/* :so path/to/gcc/contrib/vimrc
+ or source the script manually for each newly opened file:
+   :so contrib/vimrc
+ You could also use numerous plugins that enable local vimrc e.g.
+ mbr's localvimrc or thinca's vim-localrc (but note that the latter
+ is much less secure). To install local vimrc config, run
+   $ make vimrc
+ from GCC build folder.
+ 
+ Copyright (C) 2014 Free Software Foundation, Inc.
+
+ This program is free software; you can redistribute it and/or modify
+ it under the terms of the GNU General Public License as published by
+ the Free Software Foundation; either version 3 of the License, or
+ (at your option) any later version.
+
+ This program is distributed in the hope that it will be useful,
+ but WITHOUT ANY WARRANTY; without even the implied warranty of
+ MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ GNU General Public License for more details.
+
+ You should have received a copy of the GNU General Public License
+ along with this program.  If not, see http://www.gnu.org/licenses/.
+
+function! SetStyle()
+  let l:fname = expand(%:p)
+  if stridx(l:fname, 'libsanitizer') != -1
+return
+  endif
+  let l:ext = fnamemodify(l:fname, :e)
+  let l:c_exts = ['c', 'h', 'cpp', 'cc', 'C', 'H', 'def', 'java']
+  if index(l:c_exts, l:ext) != -1
+setlocal cindent
+setlocal softtabstop=2
+setlocal cinoptions=4,n-2,{2,^-2,:2,=2,g0,f0,h2,p4,t0,+2,(0,u0,w1,m0
+setlocal textwidth=80
+setlocal formatoptions-=ro formatoptions+=cqlt
+  endif
+endfunction
+
+call SetStyle()

[PATCHv3][Kasan][PING^3] Allow to override Asan shadow offset from command line

[Yury Gribov]

On 10/06/2014 03:17 PM, Yury Gribov wrote:

On 10/06/2014 03:06 PM, Yury Gribov wrote:

On 09/29/2014 09:21 PM, Yury Gribov wrote:

Hi all,


Kasan developers has asked for an option to override offset of Asan
shadow memory region. This should simplify experimenting with memory
layouts on 64-bit architectures.


New patch which checks that -fasan-shadow-offset is only enabled for
-fsanitize=kernel-address. I (unfortunately) can't make this --param
because this can be a 64-bit value.

Bootstrapped and regtested on x64.

-Y


Added Jakub.




commit 05829f7922915b075c0f4275d3613947aa793a9c
Author: Yury Gribov y.gri...@samsung.com
Date:   Fri Aug 29 11:58:03 2014 +0400

Allow to override Asan shadow offset.

2014-09-26  Yury Gribov  y.gri...@samsung.com

gcc/
	* asan.c (set_asan_shadow_offset): New function.
	(asan_shadow_offset): Likewise.
	(asan_emit_stack_protection): Call asan_shadow_offset.
	(build_shadow_mem_access): Likewise.
	* asan.h (set_asan_shadow_offset): Declare.
	* common.opt (fasan-shadow-offset): New option.
	* doc/invoke.texi (fasan-shadow-offset): Describe new option.
	* opts-global.c (handle_common_deferred_options): Handle
	-fasan-shadow-offset.
	* opts.c (common_handle_option): Likewise.

gcc/testsuite/
	* c-c++-common/asan/shadow-offset-1.c: New test.

diff --git a/gcc/asan.c b/gcc/asan.c
index f520eab..63f99f5 100644
--- a/gcc/asan.c
+++ b/gcc/asan.c
@@ -238,6 +238,39 @@ along with GCC; see the file COPYING3.  If not see
A destructor function that calls the runtime asan library function
_asan_unregister_globals is also installed.  */
 
+static unsigned HOST_WIDE_INT asan_shadow_offset_value;
+static bool asan_shadow_offset_computed;
+
+/* Sets shadow offset to value in string VAL.  */
+
+bool
+set_asan_shadow_offset (const char *val)
+{
+  char *endp;
+  
+  errno = 0;
+  asan_shadow_offset_value = strtoul (val, endp, 0);
+  if (!(*val != '\0'  *endp == '\0'  errno == 0))
+return false;
+
+  asan_shadow_offset_computed = true;
+
+  return true;
+}
+
+/* Returns Asan shadow offset.  */
+
+static unsigned HOST_WIDE_INT
+asan_shadow_offset ()
+{
+  if (!asan_shadow_offset_computed)
+{
+  asan_shadow_offset_computed = true;
+  asan_shadow_offset_value = targetm.asan_shadow_offset ();
+}
+  return asan_shadow_offset_value;
+}
+
 alias_set_type asan_shadow_set = -1;
 
 /* Pointer types to 1 resp. 2 byte integers in shadow memory.  A separate
@@ -1124,7 +1157,7 @@ asan_emit_stack_protection (rtx base, rtx pbase, unsigned int alignb,
 			  NULL_RTX, 1, OPTAB_DIRECT);
   shadow_base
 = plus_constant (Pmode, shadow_base,
-		 targetm.asan_shadow_offset ()
+		 asan_shadow_offset ()
 		 + (base_align_bias  ASAN_SHADOW_SHIFT));
   gcc_assert (asan_shadow_set != -1
 	   (ASAN_RED_ZONE_SIZE  ASAN_SHADOW_SHIFT) == 4);
@@ -1502,7 +1535,7 @@ insert_if_then_before_iter (gimple cond,
 }
 
 /* Build
-   (base_addr  ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset ().  */
+   (base_addr  ASAN_SHADOW_SHIFT) + asan_shadow_offset ().  */
 
 static tree
 build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
@@ -1519,7 +1552,7 @@ build_shadow_mem_access (gimple_stmt_iterator *gsi, location_t location,
   gimple_set_location (g, location);
   gsi_insert_after (gsi, g, GSI_NEW_STMT);
 
-  t = build_int_cst (uintptr_type, targetm.asan_shadow_offset ());
+  t = build_int_cst (uintptr_type, asan_shadow_offset ());
   g = gimple_build_assign_with_ops (PLUS_EXPR,
 make_ssa_name (uintptr_type, NULL),
 gimple_assign_lhs (g), t);
diff --git a/gcc/asan.h b/gcc/asan.h
index 198433f..eadf029 100644
--- a/gcc/asan.h
+++ b/gcc/asan.h
@@ -36,7 +36,7 @@ extern gimple_stmt_iterator create_cond_insert_point
 extern alias_set_type asan_shadow_set;
 
 /* Shadow memory is found at
-   (address  ASAN_SHADOW_SHIFT) + targetm.asan_shadow_offset ().  */
+   (address  ASAN_SHADOW_SHIFT) + asan_shadow_offset ().  */
 #define ASAN_SHADOW_SHIFT	3
 
 /* Red zone size, stack and global variables are padded by ASAN_RED_ZONE_SIZE
@@ -76,4 +76,6 @@ asan_red_zone_size (unsigned int size)
   return c ? 2 * ASAN_RED_ZONE_SIZE - c : ASAN_RED_ZONE_SIZE;
 }
 
+extern bool set_asan_shadow_offset (const char *);
+
 #endif /* TREE_ASAN */
diff --git a/gcc/common.opt b/gcc/common.opt
index b4f0ed4..90f6bd4 100644
--- a/gcc/common.opt
+++ b/gcc/common.opt
@@ -879,6 +879,10 @@ fsanitize=
 Common Driver Report Joined
 Select what to sanitize
 
+fasan-shadow-offset=
+Common Joined RejectNegative Var(common_deferred_options) Defer
+-fasan-shadow-offset=string	Use custom shadow memory offset.
+
 fsanitize-recover
 Common Report Var(flag_sanitize_recover) Init(1)
 After diagnosing undefined behavior attempt to continue execution
diff --git a/gcc/doc/invoke.texi b/gcc/doc/invoke.texi
index f6c3b42..d9bd1f7 100644
--- a/gcc/doc/invoke.texi
+++ b/gcc/doc/invoke.texi
@@ -297,7 +297,7 @@ Objective-C

[PATCH 0/17] KASan 4.9 backport

[Yury Gribov]

Hi all,

As discussed in https://gcc.gnu.org/ml/gcc/2014-09/msg00234.html , this 
patchset backports mainline patches necessary for Kernel ASan in GCC 4.9 
(gcc-4_9-branch). The patcheset consists of

* Asan headers installation (1 patch)
* __asan_loadN/__asan_storeN support (3 patches)
* instrumentation with calls support (1 patch)
* optimization of strlen instrumentation (1 patch)
* Kasan support (3 patches)
* move inlining to sanopt (1 patches)
* bugfixes (7 patches)

To my knowledge it does not contain any changes that would influence ABI 
of generated code.


The code was bootstrapped and regtested on x64 (I only tested the net 
result, not each patch in isolation).


-Y