Bug 1366884 - Bitwise operation on bool variable within a structure end with illegal result
Summary: Bitwise operation on bool variable within a structure end with illegal result
Keywords:
Status: CLOSED NOTABUG
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: gcc
Version: 7.0
Hardware: x86_64
OS: Linux
unspecified
high
Target Milestone: rc
: ---
Assignee: Jakub Jelinek
QA Contact: qe-baseos-tools-bugs
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-08-14 06:39 UTC by Dotan Barak
Modified: 2016-08-15 07:32 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2016-08-14 10:42:29 UTC
Target Upstream Version:
Embargoed:


Attachments (Terms of Use)

Description Dotan Barak 2016-08-14 06:39:52 UTC
Description of problem:
We compile a big code project (QEMU), and when executing this code in rare occasions we get illegal result to a bitwise operation on a bool variable type.

We have a structure, which contain a bool variable.
If this field contains a value which is higher than 1, the result of the bitwise operation on this field is illegal.

For example:
if the value of this field is 0x7fff, the result of the following bitmap operation is 0xff:
(structure->bool_variable & 0x1)

This is a bug, since only the lsb could be other value than zero (the rest of the bits are masked).

Version-Release number of selected component (if applicable):
Red Hat Enterprise Linux Server release 7.0 (Maipo)
gcc version 4.8.2 20140120 (Red Hat 4.8.2-16) (GCC)

How reproducible:
This is the structure:

typedef struct MLX5WQ {
    uint8_t wq_type;
    bool wq_signature;
    uint8_t end_padding_mode;
    bool cd_slave;

If cd_slave contains the value 0x7cff,

The following statement ends with illegal value (0xff):
(structure->bool_variable & 0x1)

However, I failed to reproduce it in a smaller program.

Steps to Reproduce:
1.
2.
3.

Actual results:
0xff

Expected results:
0x1

Additional info:
1) If I clear this field (i.e. put zero), I don't see this bug
2) If I If I change this variable type to "int", it seems that this bug disappears
3) I tried to reproduce this bug in a standalone program or in a simple flow, and it doesn't happen; this bug occurs in a specific flow within the program.

Comment 2 Jakub Jelinek 2016-08-14 10:24:06 UTC
If a bool field contains value other than 0 or 1, the behavior is undefined.
You could e.g. try -fsanitize=undefined, which would likely flag that as an error.

Comment 3 Dotan Barak 2016-08-14 10:31:05 UTC
Hi.

Thank you for the quick response.

If the variable isn't initialized, I can't control its content;
is there is any solution to this scenario?

Thanks
Dotan

Comment 4 Jakub Jelinek 2016-08-14 10:42:29 UTC
Make sure to initialize it.  Using uninitialized variables is also undefined behavior.


Note You need to log in before you can comment on or make changes to this bug.