[Bug c/100732] New: ICE: in ao_ref_init_from_ptr_and_range, at tree-ssa-alias.c:824

[Bug c/100732] New: ICE: in ao_ref_init_from_ptr_and_range, at tree-ssa-alias.c:824

[cnsun at uwaterloo dot ca]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100732

            Bug ID: 100732
           Summary: ICE: in ao_ref_init_from_ptr_and_range, at
                    tree-ssa-alias.c:824
           Product: gcc
           Version: tree-ssa
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: cnsun at uwaterloo dot ca
  Target Milestone: ---

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/scratch/software/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /tmp/tmp.bSd6dDcXdE-gcc-builder/gcc/configure
--enable-languages=c,c++,lto --enable-checking-yes --enable-multiarch
--prefix=/scratch/software/gcc-trunk --disable-bootstrap
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20210523 (experimental) [master revision
:c92372ce3:15d30d2f20794d29ceabcfd57d230d6387284115] (GCC)

$ cat mutant.c
d4(i) { __builtin_sprintf(d4, "%s", i); }

$ gcc-trunk -O3 -Wall mutant.c
mutant.c:1:1: warning: return type defaults to ‘int’ [-Wimplicit-int]
    1 | d4(i) { __builtin_sprintf(d4, "%s", i); }
      | ^~
mutant.c: In function ‘d4’:
mutant.c:1:1: warning: type of ‘i’ defaults to ‘int’ [-Wimplicit-int]
mutant.c:1:27: warning: passing argument 1 of ‘__builtin_sprintf’ from
incompatible pointer type [-Wincompatible-pointer-types]
    1 | d4(i) { __builtin_sprintf(d4, "%s", i); }
      |                           ^~
      |                           |
      |                           int (*)()
mutant.c:1:27: note: expected ‘char *’ but argument is of type ‘int (*)()’
mutant.c:1:33: warning: format ‘%s’ expects argument of type ‘char *’, but
argument 3 has type ‘int’ [-Wformat=]
    1 | d4(i) { __builtin_sprintf(d4, "%s", i); }
      |                                ~^   ~
      |                                 |   |
      |                                 |   int
      |                                 char *
      |                                %d
mutant.c:1:41: warning: control reaches end of non-void function
[-Wreturn-type]
    1 | d4(i) { __builtin_sprintf(d4, "%s", i); }
      |                                         ^
during GIMPLE pass: uninit
mutant.c:1:1: internal compiler error: in ao_ref_init_from_ptr_and_range, at
tree-ssa-alias.c:824
    1 | d4(i) { __builtin_sprintf(d4, "%s", i); }
      | ^~
0x7750a5 ao_ref_init_from_ptr_and_range
        /tmp/tmp.bSd6dDcXdE-gcc-builder/gcc/gcc/tree-ssa-alias.c:824
0x113b3b1 maybe_warn_pass_by_reference
        /tmp/tmp.bSd6dDcXdE-gcc-builder/gcc/gcc/tree-ssa-uninit.c:545
0x113b3b1 warn_uninitialized_vars
        /tmp/tmp.bSd6dDcXdE-gcc-builder/gcc/gcc/tree-ssa-uninit.c:659
0x114056a execute
        /tmp/tmp.bSd6dDcXdE-gcc-builder/gcc/gcc/tree-ssa-uninit.c:3030
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/100732] [11/12 Regression] ICE with -Wall: in ao_ref_init_from_ptr_and_range, at tree-ssa-alias.c:824 since r11-959-gb825a22890740f34

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100732

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
            Summary|ICE with -Wall: in          |[11/12 Regression] ICE with
                   |ao_ref_init_from_ptr_and_ra |-Wall: in
                   |nge, at                     |ao_ref_init_from_ptr_and_ra
                   |tree-ssa-alias.c:824        |nge, at
                   |                            |tree-ssa-alias.c:824 since
                   |                            |r11-959-gb825a22890740f34
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |msebor at gcc dot gnu.org
   Last reconfirmed|                            |2021-05-24
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r11-959-gb825a22890740f34.

[Bug tree-optimization/100732] [11/12 Regression] ICE with -Wall: in ao_ref_init_from_ptr_and_range, at tree-ssa-alias.c:824 since r11-959-gb825a22890740f34

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100732

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
   Target Milestone|---                         |11.2

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
#3  0x0000000001649007 in maybe_warn_pass_by_reference (stmt=0x7ffff7ff5cf0, 
    wlims=...) at /home/rguenther/src/gcc3/gcc/tree-ssa-uninit.c:545
545           ao_ref_init_from_ptr_and_size (&ref, arg, access_size);
(gdb) p arg
$2 = <ssa_name 0x7ffff6575d80 2>
(gdb) p debug_tree (arg)
 <ssa_name 0x7ffff6575d80
    type <integer_type 0x7ffff65835e8 int public SI
        size <integer_cst 0x7ffff656af18 constant 32>
        unit-size <integer_cst 0x7ffff656af30 constant 4>
        align:32 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff65835e8 precision:32 min <integer_cst 0x7ffff656aed0 -2147483648> max
<integer_cst 0x7ffff656aee8 2147483647>
        pointer_to_this <pointer_type 0x7ffff658b9d8>>
    visited var <parm_decl 0x7ffff66c4000 i>
    def_stmt GIMPLE_NOP
    version:2>

that's not a pointer.  Looks like the code blindly works on call arguments
w/o double-checking their type.

[Bug tree-optimization/100732] [11/12 Regression] ICE with -Wall: in ao_ref_init_from_ptr_and_range, at tree-ssa-alias.c:824 since r11-959-gb825a22890740f34

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100732

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org
           Keywords|                            |patch
             Status|NEW                         |ASSIGNED
      Known to fail|                            |11.1.0, 12.0

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2021-May/571346.html

[Bug tree-optimization/100732] [11/12 Regression] ICE with -Wall: in ao_ref_init_from_ptr_and_range, at tree-ssa-alias.c:824 since r11-959-gb825a22890740f34

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100732

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:9816f509db4966fcb90ed3baab72cc6cd901f06c

commit r12-1219-g9816f509db4966fcb90ed3baab72cc6cd901f06c
Author: Martin Sebor <msebor@redhat.com>
Date:   Fri Jun 4 10:49:06 2021 -0600

    PR middle-end/100732 - ICE on sprintf %s with integer argument

    gcc/ChangeLog:

            PR middle-end/100732
            * gimple-fold.c (gimple_fold_builtin_sprintf): Avoid folding calls
            with either source or destination argument of invalid type.
            * tree-ssa-uninit.c (maybe_warn_pass_by_reference): Avoid checking
            calls with arguments of invalid type.

    gcc/testsuite/ChangeLog:

            PR middle-end/100732
            * gcc.dg/tree-ssa/builtin-snprintf-11.c: New test.
            * gcc.dg/tree-ssa/builtin-snprintf-12.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-28.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-29.c: New test.
            * gcc.dg/uninit-pr100732.c: New test.

[Bug tree-optimization/100732] [11 Regression] ICE on sprintf %s with integer argument

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100732

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[11/12 Regression] ICE with |[11 Regression] ICE on
                   |-Wall: in                   |sprintf %s with integer
                   |ao_ref_init_from_ptr_and_ra |argument
                   |nge, at                     |
                   |tree-ssa-alias.c:824 since  |
                   |r11-959-gb825a22890740f34   |
      Known to fail|12.0                        |

--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fixed in GCC 12.0.

[Bug tree-optimization/100732] [11 Regression] ICE on sprintf %s with integer argument

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100732

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Martin Sebor
<msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:b9edb8fb8202dc6907f69094a8b2a621840174e1

commit r11-8604-gb9edb8fb8202dc6907f69094a8b2a621840174e1
Author: Martin Sebor <msebor@redhat.com>
Date:   Thu Jun 17 12:08:15 2021 -0600

    Backported from trunk:

    PR middle-end/100732 - ICE on sprintf %s with integer argument

    gcc/ChangeLog:

            PR middle-end/100732
            * gimple-fold.c (gimple_fold_builtin_sprintf): Avoid folding calls
            with either source or destination argument of invalid type.
            * tree-ssa-uninit.c (maybe_warn_pass_by_reference): Avoid checking
            calls with arguments of invalid type.

    gcc/testsuite/ChangeLog:

            PR middle-end/100732
            * gcc.dg/tree-ssa/builtin-snprintf-11.c: New test.
            * gcc.dg/tree-ssa/builtin-snprintf-12.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-28.c: New test.
            * gcc.dg/tree-ssa/builtin-sprintf-29.c: New test.
            * gcc.dg/uninit-pr100732.c: New test.

[Bug tree-optimization/100732] [11 Regression] ICE on sprintf %s with integer argument

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100732

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Martin Sebor <msebor at gcc dot gnu.org> ---
Backported to GCC 11.2.