[Bug c/100898] New: ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[Bug c/100898] New: ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[cnsun at uwaterloo dot ca]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

            Bug ID: 100898
           Summary: ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264
           Product: gcc
           Version: tree-ssa
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: cnsun at uwaterloo dot ca
  Target Milestone: ---

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/scratch/software/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/configure
--enable-languages=c,c++,lto --enable-checking-yes --enable-multiarch
--prefix=/scratch/software/gcc-trunk --disable-bootstrap
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20210603 (experimental) [master revision
:fe23f36c0:9663c744e2d0942f14eafa725a1bd9f766f02a16] (GCC)

$ cat mutant.c
a;
fn1() {
  for (; a;)
    return bar(__builtin_va_arg_pack());
}
main() { fn1(); }

$ gcc-trunk -O2 mutant.c
mutant.c:1:1: warning: data definition has no type or storage class
    1 | a;
      | ^
mutant.c:1:1: warning: type defaults to ‘int’ in declaration of ‘a’
[-Wimplicit-int]
mutant.c:2:1: warning: return type defaults to ‘int’ [-Wimplicit-int]
    2 | fn1() {
      | ^~~
mutant.c: In function ‘fn1’:
mutant.c:4:12: warning: implicit declaration of function ‘bar’
[-Wimplicit-function-declaration]
    4 |     return bar(__builtin_va_arg_pack());
      |            ^~~
mutant.c: At top level:
mutant.c:6:1: warning: return type defaults to ‘int’ [-Wimplicit-int]
    6 | main() { fn1(); }
      | ^~~~
during IPA pass: inline
In function ‘fn1’:
cc1: internal compiler error: in gimple_call_arg_ptr, at gimple.h:3264
0x758b10 gimple_call_arg_ptr
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/gimple.h:3264
0x758b10 gimple_call_arg_ptr
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/gimple.h:3262
0x758b10 copy_bb
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/tree-inline.c:2085
0xf93522 copy_cfg_body
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/tree-inline.c:3022
0xf93522 copy_body
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/tree-inline.c:3278
0xf96a56 expand_call_inline
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/tree-inline.c:5105
0xf98109 gimple_expand_calls_inline
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/tree-inline.c:5300
0xf98109 optimize_inline_calls(tree_node*)
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/tree-inline.c:5473
0xcbf76b inline_transform(cgraph_node*)
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/ipa-inline-transform.c:790
0xe19e04 execute_one_ipa_transform_pass
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/passes.c:2290
0xe19e04 execute_all_ipa_transforms(bool)
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/passes.c:2337
0xa874a9 cgraph_node::expand()
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/cgraphunit.c:1821
0xa888cf expand_all_functions
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/cgraphunit.c:1992
0xa888cf symbol_table::compile()
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/cgraphunit.c:2356
0xa8b7cb symbol_table::compile()
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/cgraphunit.c:2269
0xa8b7cb symbol_table::finalize_compilation_unit()
        /tmp/tmp.6GNjkccaVE-gcc-builder/gcc/gcc/cgraphunit.c:2537
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug middle-end/100898] [9/10/11/12 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|ICE with -O2: in            |[9/10/11/12 Regression] ICE
                   |gimple_call_arg_ptr, at     |with -O2: in
                   |gimple.h:3264               |gimple_call_arg_ptr, at
                   |                            |gimple.h:3264
           Keywords|                            |ice-checking,
                   |                            |ice-on-valid-code
          Component|c                           |middle-end
                 CC|                            |jakub at gcc dot gnu.org
            Version|tree-ssa                    |12.0
   Last reconfirmed|                            |2021-06-04
     Ever confirmed|0                           |1
   Target Milestone|---                         |9.5
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started to ICE with most likely
r0-88576-g726a989a8b74bf238a96029860bcf7ba14eff317

[Bug middle-end/100898] [9/10/11/12 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 50927
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50927&action=edit
gcc12-pr100898.patch

Untested fix.

[Bug middle-end/100898] [9/10/11/12 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:d66a703c8ba86f3ca04cc10c3071696e6d014de6

commit r12-1255-gd66a703c8ba86f3ca04cc10c3071696e6d014de6
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Mon Jun 7 09:25:37 2021 +0200

    tree-inline: Fix up __builtin_va_arg_pack handling [PR100898]

    The following testcase ICEs, because gimple_call_arg_ptr (..., 0)
    asserts that there is at least one argument, while we were using
    it even if we didn't copy anything just to get a pointer from/to which
    the zero arguments should be copied.

    Fixed by guarding the memcpy calls.  Also, the code was calling
    gimple_call_num_args too many times - 5 times instead of 2, so the patch
    adds two temporaries for those.

    2021-06-07  Jakub Jelinek  <jakub@redhat.com>

            PR middle-end/100898
            * tree-inline.c (copy_bb): Only use gimple_call_arg_ptr if memcpy
            should copy any arguments.  Don't call gimple_call_num_args
            on id->call_stmt or call_stmt more than once.

            * g++.dg/ext/va-arg-pack-3.C: New test.

[Bug middle-end/100898] [9/10/11 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[9/10/11/12 Regression] ICE |[9/10/11 Regression] ICE
                   |with -O2: in                |with -O2: in
                   |gimple_call_arg_ptr, at     |gimple_call_arg_ptr, at
                   |gimple.h:3264               |gimple.h:3264

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk so far.  Less important on release branches, since they
aren't checking by default, but still worth fixing there.

[Bug middle-end/100898] [9/10/11 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug middle-end/100898] [9/10/11 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:d9f75e8a73b1b69b8f709b56296b4a9751c50ef0

commit r11-8589-gd9f75e8a73b1b69b8f709b56296b4a9751c50ef0
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Mon Jun 7 09:25:37 2021 +0200

    tree-inline: Fix up __builtin_va_arg_pack handling [PR100898]

    The following testcase ICEs, because gimple_call_arg_ptr (..., 0)
    asserts that there is at least one argument, while we were using
    it even if we didn't copy anything just to get a pointer from/to which
    the zero arguments should be copied.

    Fixed by guarding the memcpy calls.  Also, the code was calling
    gimple_call_num_args too many times - 5 times instead of 2, so the patch
    adds two temporaries for those.

    2021-06-07  Jakub Jelinek  <jakub@redhat.com>

            PR middle-end/100898
            * tree-inline.c (copy_bb): Only use gimple_call_arg_ptr if memcpy
            should copy any arguments.  Don't call gimple_call_num_args
            on id->call_stmt or call_stmt more than once.

            * g++.dg/ext/va-arg-pack-3.C: New test.

    (cherry picked from commit d66a703c8ba86f3ca04cc10c3071696e6d014de6)

[Bug middle-end/100898] [9/10 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[9/10/11 Regression] ICE    |[9/10 Regression] ICE with
                   |with -O2: in                |-O2: in
                   |gimple_call_arg_ptr, at     |gimple_call_arg_ptr, at
                   |gimple.h:3264               |gimple.h:3264

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 11.2 too.

[Bug middle-end/100898] [9/10 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:fb6579667cd87bc41afbd81b876e8e571712d289

commit r10-10616-gfb6579667cd87bc41afbd81b876e8e571712d289
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Mon Jun 7 09:25:37 2021 +0200

    tree-inline: Fix up __builtin_va_arg_pack handling [PR100898]

    The following testcase ICEs, because gimple_call_arg_ptr (..., 0)
    asserts that there is at least one argument, while we were using
    it even if we didn't copy anything just to get a pointer from/to which
    the zero arguments should be copied.

    Fixed by guarding the memcpy calls.  Also, the code was calling
    gimple_call_num_args too many times - 5 times instead of 2, so the patch
    adds two temporaries for those.

    2021-06-07  Jakub Jelinek  <jakub@redhat.com>

            PR middle-end/100898
            * tree-inline.c (copy_bb): Only use gimple_call_arg_ptr if memcpy
            should copy any arguments.  Don't call gimple_call_num_args
            on id->call_stmt or call_stmt more than once.

            * g++.dg/ext/va-arg-pack-3.C: New test.

    (cherry picked from commit d66a703c8ba86f3ca04cc10c3071696e6d014de6)

[Bug middle-end/100898] [9/10 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:97785bcbc66b11f41030a459f7b170f1e2ed5e50

commit r9-10075-g97785bcbc66b11f41030a459f7b170f1e2ed5e50
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Mon Jun 7 09:25:37 2021 +0200

    tree-inline: Fix up __builtin_va_arg_pack handling [PR100898]

    The following testcase ICEs, because gimple_call_arg_ptr (..., 0)
    asserts that there is at least one argument, while we were using
    it even if we didn't copy anything just to get a pointer from/to which
    the zero arguments should be copied.

    Fixed by guarding the memcpy calls.  Also, the code was calling
    gimple_call_num_args too many times - 5 times instead of 2, so the patch
    adds two temporaries for those.

    2021-06-07  Jakub Jelinek  <jakub@redhat.com>

            PR middle-end/100898
            * tree-inline.c (copy_bb): Only use gimple_call_arg_ptr if memcpy
            should copy any arguments.  Don't call gimple_call_num_args
            on id->call_stmt or call_stmt more than once.

            * g++.dg/ext/va-arg-pack-3.C: New test.

    (cherry picked from commit d66a703c8ba86f3ca04cc10c3071696e6d014de6)

[Bug middle-end/100898] [9/10 Regression] ICE with -O2: in gimple_call_arg_ptr, at gimple.h:3264

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100898

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.