[llvm-bugs] [Bug 28054] New: MemorySanitizer false positives in optimized code

[via llvm-bugs]

https://llvm.org/bugs/show_bug.cgi?id=28054

            Bug ID: 28054
           Summary: MemorySanitizer false positives in optimized code
           Product: libraries
           Version: trunk
          Hardware: PC
                OS: Linux
            Status: NEW
          Severity: normal
          Priority: P
         Component: Loop Optimizer
          Assignee: unassignedbugs at nondot.org
          Reporter: eugeni.stepanov at gmail.com
                CC: llvm-bugs at lists.llvm.org
    Classification: Unclassified

$ cat 1.cc
#include <stdio.h>
#include <sanitizer/msan_interface.h>

struct Map {
  unsigned Small;

  long Buckets;
  long *Ptr;
  unsigned NumBuckets;

  Map() {
    Small = true;
    Buckets = 42;
    __msan_allocated_memory(&NumBuckets, sizeof(NumBuckets));
  }

  long *getBuckets() {
    return Small ? &Buckets : Ptr;
  }

  unsigned getNumBuckets() {
    return Small ? 1 : NumBuckets;
  }
};

Map M;

int main() {
  for (int i = 0; i < 1; ++i) {
    if (M.getNumBuckets() != 0) {
      if (42 == *M.getBuckets())
        return 1;
    }
  }

  if (!M.Small)
    printf("zz\n");
}

$ clang++ 1.cc  -std=c++14  -g -O3 -fsanitize=memory && ./a.out
WARNING: MemorySanitizer: use-of-uninitialized-value
    #0 0x4879c3 in main 1.cc:30:9
    #1 0x7f12aeff9f44 in __libc_start_main
    #2 0x419b11 in _start

Looking at the bitcode, the first thing the program does is compare NumBuckets
with 0 and branch on the result. That's what MSan is complaining about. The
source code reads NumBuckets only when Small == 0, which is impossible.

This happens only at -O3.

$ clang++ 1.cc  -std=c++14  -g -O3 -S -emit-llvm -o -
...
%struct.Map = type <{ i32, [4 x i8], i64, i64*, i32, [4 x i8] }>
...
define i32 @main() #0 {
entry:
  %0 = load i32, i32* getelementptr inbounds (%struct.Map, %struct.Map* @M, i64
0, i32 0), align 8
  %tobool.i20 = icmp eq i32 %0, 0
  %1 = load i32, i32* getelementptr inbounds (%struct.Map, %struct.Map* @M, i64
0, i32 4), align 8
  %cmp1 = icmp eq i32 %1, 0
  %2 = load i64*, i64** getelementptr inbounds (%struct.Map, %struct.Map* @M,
i64 0, i32 3), align 8
  br i1 %cmp1, label %entry.split.us, label %entry.split

-- 
You are receiving this mail because:
You are on the CC list for the bug.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.llvm.org/pipermail/llvm-bugs/attachments/20160608/4a8d354e/attachment.html>