Bug 220412 - Possible compiler bug in gcc
Possible compiler bug in gcc
Product: Fedora
Classification: Fedora
Component: gcc (Show other bugs)
x86_64 Linux
medium Severity urgent
: ---
: ---
Assigned To: Jakub Jelinek
Depends On:
  Show dependency treegraph
Reported: 2006-12-20 21:32 EST by Mukund Sivaraman
Modified: 2007-11-30 17:11 EST (History)
0 users

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Last Closed: 2006-12-21 05:35:21 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)
Correct behaviour program (9.96 KB, text/x-csrc)
2006-12-20 21:32 EST, Mukund Sivaraman
no flags Details
Program which results in faulty output (9.69 KB, text/x-csrc)
2006-12-20 21:33 EST, Mukund Sivaraman
no flags Details

  None (edit)
Description Mukund Sivaraman 2006-12-20 21:32:51 EST
Description of problem:
Different/incorrect results with programs when print statements (with no side
effects) are embedded.

Version-Release number of selected component (if applicable):

[mukund@jurassic ~]$ gcc -v
Using built-in specs.
Target: x86_64-redhat-linux
Configured with: ../configure --prefix=/usr --mandir=/usr/share/man
--infodir=/usr/share/info --enable-shared --enable-threads=posix
--enable-checking=release --with-system-zlib --enable-__cxa_atexit
--disable-libunwind-exceptions --enable-libgcj-multifile
--enable-languages=c,c++,objc,obj-c++,java,fortran,ada --enable-java-awt=gtk
--disable-dssi --enable-plugin
--with-java-home=/usr/lib/jvm/java-1.4.2-gcj- --with-cpu=generic
Thread model: posix
gcc version 4.1.1 20061011 (Red Hat 4.1.1-30)
[mukund@jurassic ~]$ 

How reproducible:

Steps to Reproduce:
1. Download the bcrops.c and bcrops2.c programs (which are attached).
2. Do a diff between them (to see that the differences are just the GTK+ print
3. Compile them as GTK+ programs:

gcc --std=c99 -O0 -Wall `pkg-config gtk+-2.0 --cflags` -o bcrops bcrops.c
`pkg-config gtk+-2.0 --libs`
gcc --std=c99 -O0 -Wall `pkg-config gtk+-2.0 --cflags` -o bcrops2 bcrops2.c
`pkg-config gtk+-2.0 --libs`

4. Run them with the following parameters:

$ ./bcrops -12.360752 390.102567 287.037454 409.095041 312.360752 9.897433
12.962546 -9.095041 0.000000
$ ./bcrops2 -12.360752 390.102567 287.037454 409.095041 312.360752 9.897433
12.962546 -9.095041 0.000000

Actual results:
Only crops.c displays the green rectangle. crops2.c doesn't.
bcrops.c: Result is (13, 9) - (288, 391)
bcrops2.c: Result is (14, -8) - (-2147483648, -7)

Expected results:
Both should display green rectangles with the following output:
Result is (13, 9) - (288, 391)

Additional info:
Setting this as urgent as this may be a bug in the C compiler.
Comment 1 Mukund Sivaraman 2006-12-20 21:32:52 EST
Created attachment 144155 [details]
Correct behaviour program
Comment 2 Mukund Sivaraman 2006-12-20 21:33:49 EST
Created attachment 144156 [details]
Program which results in faulty output
Comment 3 Mukund Sivaraman 2006-12-20 21:35:52 EST
Some developers in #gtk have confirmed that both programs work fine on their
distros. So this is more likely a compiler issue with the gcc in FC6.

Comment 4 Jakub Jelinek 2006-12-21 05:35:21 EST
No, it is just buggy application.
--- bcrops.c    2006-12-21 11:06:06.000000000 +0100
+++ bcrops.c   2006-12-21 11:31:35.000000000 +0100
@@ -199,6 +199,7 @@ gimp_transform_resize_crop (gdouble  dx1
                   gint     height, width, fixed_width;
                   gint     area;
+if (ylo < 0) abort ();
                   xlo = xint[ylo].x;
                   xhi = xint[yhi].x;
and you'll see that it accesses memory before the xint array.
The difference between the version with g_printerr and without that is just
in what happens to be in the memory before &xint[0].
Comment 5 Mukund Sivaraman 2006-12-21 05:43:13 EST
Hi Jakub

Thanks for catching it.. another developer just asked me to run it under
Valgrind and it reported the invalid reads:

==7803== Invalid read of size 8
==7803==    at 0x401D01: gimp_transform_resize_crop (crops.c:203)
==7803==    by 0x402682: main (crops.c:370)
==7803==  Address 0x5737448 is 16 bytes before a block of size 7,120 alloc'd

I logged in now to close the bug report, but you beat me to it. I should have
checked this under Valgrind before reporting it.

Thanks again and sorry for wasting your time!

Note You need to log in before you can comment on or make changes to this bug.