<html>
<head>
<base href="http://llvm.org/bugs/" />
</head>
<body><table border="1" cellspacing="0" cellpadding="8">
<tr>
<th>Bug ID</th>
<td><a class="bz_bug_link
bz_status_NEW "
title="NEW --- - clang: inconsistent behaviour of alloca"
href="http://llvm.org/bugs/show_bug.cgi?id=20404">20404</a>
</td>
</tr>
<tr>
<th>Summary</th>
<td>clang: inconsistent behaviour of alloca
</td>
</tr>
<tr>
<th>Product</th>
<td>new-bugs
</td>
</tr>
<tr>
<th>Version</th>
<td>trunk
</td>
</tr>
<tr>
<th>Hardware</th>
<td>PC
</td>
</tr>
<tr>
<th>OS</th>
<td>Linux
</td>
</tr>
<tr>
<th>Status</th>
<td>NEW
</td>
</tr>
<tr>
<th>Severity</th>
<td>normal
</td>
</tr>
<tr>
<th>Priority</th>
<td>P
</td>
</tr>
<tr>
<th>Component</th>
<td>new bugs
</td>
</tr>
<tr>
<th>Assignee</th>
<td>unassignedbugs@nondot.org
</td>
</tr>
<tr>
<th>Reporter</th>
<td>dbrazdil@google.com
</td>
</tr>
<tr>
<th>CC</th>
<td>llvmbugs@cs.uiuc.edu
</td>
</tr>
<tr>
<th>Classification</th>
<td>Unclassified
</td>
</tr></table>
<p>
<div>
<pre>Created <span class=""><a href="attachment.cgi?id=12809" name="attach_12809" title="Source code">attachment 12809</a> <a href="attachment.cgi?id=12809&action=edit" title="Source code">[details]</a></span>
Source code
Compiling the following piece of code with the trunk version of LLVM/Clang
yields different results with/without optimization turned on and also with
Debug/Release builds.
#include <sys/types.h>
#include <stdlib.h>
int main() {
return (int) alloca((int32_t) -1);
}
With -O0, the intermediate representation sign-extends the alloca argument to
i64 negative one:
define i32 @main() #0 {
%1 = alloca i32, align 4
store i32 0, i32* %1
%2 = alloca i8, i64 -1
%3 = ptrtoint i8* %2 to i32
ret i32 %3
}
With the debug build, the code generator hits the
'!isDeadObjectIndex(ObjectIdx)' assertion inside
MachineFrameInfo::getObjectOffset and fails. However, with the release build it
produces the following code where the offset in LEAQ overflowed and wrapped
around:
pushq %rbp
movq %rsp, %rbp
leaq 16(%rbp), %rax
movl $0, -4(%rbp)
movl %eax, %ecx
movl %ecx, %eax
popq %rbp
retq
Turning on optimizations modifies the type of the alloca to an i8 array, but
its size gets interpreted as an unsigned integer and becomes (2^64 - 1):
define i32 @main() #0 {
%1 = alloca [18446744073709551615 x i8], align 1
%2 = ptrtoint [18446744073709551615 x i8]* %1 to i64
%3 = trunc i64 %2 to i32
ret i32 %3
}
Both the debug and release build then enter the while loop inside
X86FrameLowering::emitSPUpdate and keep producing ADD instructions which push
the stack pointer by ((1<<31)-1) until the machine runs out of memory.</pre>
</div>
</p>
<hr>
<span>You are receiving this mail because:</span>
<ul>
<li>You are on the CC list for the bug.</li>
</ul>
</body>
</html>