llvm-gcc and clang both miscompile nedit-5.5/source/regularExp.c at -O2

[llvmbot]

Bugzilla Link	9684
Resolution	INVALID
Resolved on	Jun 10, 2011 13:32
Version	2.9
OS	MacOS X
Attachments	compressed preprocessed source for source/nedit/regularExp.c from clang 2.9, compressed assembly for source/nedit/regularExp.c from clang 2.9
Reporter	LLVM Bugzilla Contributor
CC	@d0k,@efriedma-quic,@nico

Extended Description

Both llvm-gcc 2.9 and clang 2.9 miscompile nedit-5.5/source/regularExp.c at -O2 on x86_64 darwin. The miscompilation causes nedit to crash as...

Process 3810 launched: '/opt/local/var/macports/build/_Users_howarth_ports_editors_nedit/work/nedit-5.5/source/nedit' (x86_64)
UTF8 locale not supported.
(lldb) Process 3810 stopped

• thread #​1: tid = 0x2303, 0x00007fff8381a7aa libsystem_kernel.dylib__kill + 10, stop reason = signal SIGABRT (lldb) bt thread #​1: tid = 0x2303, stop reason = signal SIGABRT frame #​0: 0x00007fff8381a7aa libsystem_kernel.dylib__kill + 10
  frame #​1: 0x00007fff826fd9ec libsystem_c.dylib__abort + 193 frame #​2: 0x00007fff826cf743 libsystem_c.dylib__chk_fail + 91
  frame #​3: 0x00007fff826cf6ba libsystem_c.dylib__memset_chk + 14 frame #​4: 0x0000000100048ca4 neditSetREDefaultWordDelimiters [inlined] makeDelimiterTable + 24 at regularExp.c:4089
  frame #​5: 0x0000000100048c8c neditSetREDefaultWordDelimiters + 12 at regularExp.c:4110 frame #​6: 0x0000000100001dc3 neditmain + 2355
  frame #​7: 0x0000000100001484 nedit`start + 52

Recompiling nedit-5.5/source/regularExp.c with -Os eliminates the crash.

[llvmbot]

How about dragonegg? Does it miscompile it too?

[llvmbot]

The problem also exists when dragonegg is used to compile regularExp.c as well as the same solution of using -Os instead. The problem also exists in llvm/clang 2.8 as well as 2.9.

[d0k]

This is a bug in nedit. It boils down to:

===
#include <string.h>
#include <limits.h>

static unsigned char Default_Delimiters[UCHAR_MAX] = {0};

int main() {
memset(Default_Delimiters, 0, 256);
}

The memset will overrun Default_Delimiters by one byte. OS X enables checking of memset bounds, in this case it only sees the size of Default_Delimiters through inlining at -O2 though.

You can either patch nedit or compile with -D_FORTIFY_SOURCE=0, which disables memset checking.

[llvmbot]

I'm confused. Why should this bug in nedit be able to ICE clang? Shouldn't this be emitting a proper error message from clang rather than just crashing the compiler. No source bug should be allow to ICE the compiler.

[d0k]

I'm confused. Why should this bug in nedit be able to ICE clang? Shouldn't this
be emitting a proper error message from clang rather than just crashing the
compiler. No source bug should be allow to ICE the compiler.

Huh? nedit crashes, not clang.

[llvmbot]

Sorry, my mistake.