unsigned-shift-base sanitizer shouldn't report the behavior of unsigned left-shifting as "undefined" if it shifts 1 bits out
- Dominant language
- LLVM
- Stars
- 40.5k
- Forks
- 18.7k
- PR merge metrics
- PR metrics pending
Description
When run with `-fsanitize=integer`, code that shifts an unsigned 32-bit value left by enough bits that some 1 bits are shifted out reports errors such as
```
sourcefile.c:NNN:27: runtime error: left shift of 4294967295 by 4 places cannot be represented in type 'XXX' (aka 'unsigned int')
SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior sourcefile.c:NNN:27
```
That's not undefined behavior; C99 says, in 6.5.7 "Bitwise shift operators":
> The integer promotions are performed on each of the operands. The type of the result is
that of the promoted left operand. ...
>
> ...
>
> The result of **E1 << E2** is **E1** left-shifted **E2** bit positions; vacated bits are filled with
zeros. If **E1** has an unsigned type, the value of the result is **E1×(2^E2)**, reduced modulo
one more than the maximum value representable in the result type.
The "integer promotions" are the way C deals with types shorter than `int`/`unsigned int`, but those aren't involved here - the left-hand operand of the shift is `unsigned int` and the right-hand operand of the shift is `int`.
So "left shift of 4294967295 by 8 places" is 4294967295*256 = 1099511627520, and "one more than the maximum value representable in the result type" is 4294967296. 1099511627520 modulo 4294967296 is 4294967040, which is 0xFFFFFF00.
The SUMMARY line should report something that avoids using "undefined" followed by "behavior" to the maximum extent possible. It may be *unexpected* behavior, and it might even be *undesired* behavior, but C99 and successors explicitly define what happens.
Contributor guide
Research direction
No source file or test is named. Reproduce the `-fsanitize=integer` diagnostic for an unsigned 32-bit left shift, then trace the sanitizer's shift diagnostic and SUMMARY generation. Done means this defined modulo result is not reported as undefined behavior and the SUMMARY wording avoids calling it undefined behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 55/100