[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [csmith-bugs] 2.0.0: read from and write to the same location within two sequence points

I haven't looked at the original example, but it sounds to me like Xuejun's analysis is correct.

Pascal, could we ask you to upgrade to the latest version of Csmith on github? Xuejun has fixed several problems since the 2.0.0 release and hopefully the newer version will work better for you.


On 5/18/11 8:33 PM, Xuejun Yang wrote:
In essence, line 61 is doing something like:

*p = func_10(g_2, g_2)

where p points to g_2 and func_10 modifies g_2.

I think the accesses to g_2 constitute no ambiguity: firstly function
parameters are evaluated before the function; secondly a function are
evaluated before its return value is used. In other words, the accesses to
g_2 follow the sequence:

read g_2
read g_2
sequence point
write g_2 (in func_10)
sequence point
write g_2 (through *p)

The first two reads can be re-arranged. But that doesn't introduce



Csmith 2.0.0 generated the attached program.

If instrumented with a printf() statement before and after line 61, a
on a 64-bit little-endian platform shows that line 61 is reached, and the
functions called there all terminate.
It only takes a cursory glance at func_10() to see that if it terminates,
terminates having modified g_2.
Therefore it seems to me that line 61 contains undefined behavior, as
g_2 is accessed there multiple times for reading and for writing in
addition to
the modification by func_10().