UBSan CHECK failed at -O0 but reports invalid bool value at -O2/-O3
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
I found a difference in Clang trunk when compiling the following C program with -fsanitize=bool,enum on x86-64.
Reproducer: https://godbolt.org/z/9q5b5xYsT
```c
#define bool _Bool
enum A { B = -3, C = 2 } a;
bool b;
enum A foo (bool *p)
{
*p = b;
return a;
}
int main ()
{
char c = 4;
int d = 9;
__builtin_memcpy (&b, &c, -1);
bool e;
foo (&e);
return 0;
}
```
With -O2/3, the program runs successfully :
```
:15:3: warning: 'memcpy' reading 18446744073709551615 bytes from a region of size 1 [-Wstringop-overread]
15 | __builtin_memcpy (&b, &c, -1);
| ^
:15:3: warning: 'memcpy' will always overflow; destination buffer has size 1, but size argument is 18446744073709551615 [-Wfortify-source]
2 warnings generated.
ASM generation compiler returned: 0
:15:3: warning: 'memcpy' reading 18446744073709551615 bytes from a region of size 1 [-Wstringop-overread]
15 | __builtin_memcpy (&b, &c, -1);
| ^
:15:3: warning: 'memcpy' will always overflow; destination buffer has size 1, but size argument is 18446744073709551615 [-Wfortify-source]
2 warnings generated.
Execution build compiler returned: 0
Program returned: 0
/app/example.c:7:8: runtime error: load of value 4, which is not a valid value for type 'bool'
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior /app/example.c:7:8
```
However, without optimization (-O0) :
```
:15:3: warning: 'memcpy' reading 18446744073709551615 bytes from a region of size 1 [-Wstringop-overread]
15 | __builtin_memcpy (&b, &c, -1);
| ^
:15:3: warning: 'memcpy' will always overflow; destination buffer has size 1, but size argument is 18446744073709551615 [-Wfortify-source]
2 warnings generated.
ASM generation compiler returned: 0
:15:3: warning: 'memcpy' reading 18446744073709551615 bytes from a region of size 1 [-Wstringop-overread]
15 | __builtin_memcpy (&b, &c, -1);
| ^
:15:3: warning: 'memcpy' will always overflow; destination buffer has size 1, but size argument is 18446744073709551615 [-Wfortify-source]
2 warnings generated.
Execution build compiler returned: 0
Program returned: 1
UndefinedBehaviorSanitizer: CHECK failed: ubsan_diag.cpp:424 "((nullptr)) == ((suppression_ctx))" (0x0, 0x55783d62bdc0) (tid=1)
```
This testcase was generated by a fuzzer.
Contributor guide
Research direction
Start with the Godbolt reproducer and run it with -fsanitize=bool,enum at -O0 and -O2/-O3. Compare the invalid-bool diagnostic at foo and the UBSan CHECK failure reported from ubsan_diag.cpp:424; done means the sanitizer handles this testcase without an internal CHECK failure and reports the invalid value consistently.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100