[Bug c/101437] New: [12 Regression] ICE: Segmentation fault signal terminated program cc1

[Bug c/101437] New: [12 Regression] ICE: Segmentation fault signal terminated program cc1

[anbu1024.me at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

            Bug ID: 101437
           Summary: [12 Regression] ICE: Segmentation fault signal
                    terminated program cc1
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: anbu1024.me at gmail dot com
  Target Milestone: ---

$ cat test.c 

struct s
{
  unsigned int : 1;
};

inline static void foo(int x)
{
  struct s this_struct = {.var = x};
  *((volatile struct s *) 0x880000UL) = this_struct;
}

void bar()
{
  foo(0);
}

--------------------------------

$ gcc-sp12 --version
gcc (GCC) 12.0.0 20210711 (experimental)
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

--------------------------------

$ gcc-sp12 test.c 
test.c: In function ‘foo’:
test.c:9:28: error: ‘struct s’ has no member named ‘var’
    9 |   struct s this_struct = {.var = x};
      |                            ^~~
test.c:9:34: warning: excess elements in struct initializer
    9 |   struct s this_struct = {.var = x};
      |                                  ^
test.c:9:34: note: (near initialization for ‘this_struct’)
gcc: internal compiler error: Segmentation fault signal terminated program cc1
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://gcc.gnu.org/bugs/> for instructions.

--------------------------------

$ gcc-sp11 --version
gcc (GCC) 11.1.1 20210710
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

--------------------------------

$ gcc-sp11 test.c 
test.c: In function ‘foo’:
test.c:9:28: error: ‘struct s’ has no member named ‘var’
    9 |   struct s this_struct = {.var = x};
      |                            ^~~
test.c:9:34: warning: excess elements in struct initializer
    9 |   struct s this_struct = {.var = x};
      |                                  ^
test.c:9:34: note: (near initialization for ‘this_struct’)

[Bug c/101437] [12 Regression] ICE: Segmentation fault signal terminated program cc1

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |error-recovery,
                   |                            |ice-on-invalid-code
           Priority|P3                          |P4
   Target Milestone|---                         |12.0

[Bug c/101437] [12 Regression] ICE: Segmentation fault signal terminated program cc1

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-07-14
     Ever confirmed|0                           |1
                 CC|                            |jakub at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r12-1150-g34aae6b561871d6d8b10c810f303cb6f18b5fdd0

[Bug c/101437] [12 Regression] ICE: Segmentation fault signal terminated program cc1

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P4                          |P1
           Keywords|error-recovery,             |ice-on-valid-code
                   |ice-on-invalid-code         |

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
It ICEs also on
struct S { int : 1; };

void
foo (volatile struct S *p)
{
  struct S s = {};
  *p = s;
}
so this isn't just error recovery.

[Bug c/101437] [12 Regression] ICE: Segmentation fault signal terminated program cc1

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |pinskia at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The ICE is because since the above change when we see the empty type volatile
*p = s; store, we gimplify it as s and *p (which seems wrong for volatiles,
because that is load from *p instead of store to *p) and that *p is gimplified
as read from *p into a temporary vol.0 and hits the same case, where we when we
try to gimplify for vol.0 = *p the from_p part *p, we gimplify it as vol.1 = *p
and like that until we eat all of the stack.

The difference between the struct S {}; case that was handled like that forever
and worked fine is in:
      else if (COMPLETE_TYPE_P (TREE_TYPE (*expr_p))
               && TYPE_MODE (TREE_TYPE (*expr_p)) != BLKmode)
        {
          /* Historically, the compiler has treated a bare reference
             to a non-BLKmode volatile lvalue as forcing a load.  */
          tree type = TYPE_MAIN_VARIANT (TREE_TYPE (*expr_p));

          /* Normally, we do not want to create a temporary for a
             TREE_ADDRESSABLE type because such a type should not be
             copied by bitwise-assignment.  However, we make an
             exception here, as all we are doing here is ensuring that
             we read the bytes that make up the type.  We use
             create_tmp_var_raw because create_tmp_var will abort when
             given a TREE_ADDRESSABLE type.  */
          tree tmp = create_tmp_var_raw (type, "vol");
          gimple_add_tmp_var (tmp);
          gimplify_assign (tmp, *expr_p, pre_p);
          *expr_p = NULL;
        }
      else
        /* We can't do anything useful with a volatile reference to
           an incomplete type, so just throw it away.  Likewise for
           a BLKmode type, since any implicit inner load should
           already have been turned into an explicit one by the
           gimplification process.  */
        *expr_p = NULL;

The empty struct has BLKmode and so is thrown away, while the struct with
unsigned int : 1; has QImode or so and goes through the "vol" handling.
I guess we should figure out what a volatile load or store of empty non-zero
size type means, if it can be optimized away or not, and depending on that
either add && !is_empty_type (TREE_TYPE (*expr_p)) to the "vol" handling
condition, or stop doing the gimplify_modify_expr optimization if lhs or rhs is
volatile (and either isn't a zero size type or always).

[Bug c/101437] [12 Regression] ICE: Segmentation fault signal terminated program cc1

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
struct S { int : 1; };

void
bar (volatile struct S *p)
{
  *p;
}

ICEs too.

[Bug c/101437] [12 Regression] ICE: Segmentation fault signal terminated program cc1

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 51149
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51149&action=edit
gcc12-pr101437.patch

Untested fix.

[Bug middle-end/101437] [12 Regression] ICE: Segmentation fault signal terminated program cc1

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|c                           |middle-end

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Jakub Jelinek from comment #3)
> The ICE is because since the above change when we see the empty type
> volatile *p = s; store, we gimplify it as s and *p (which seems wrong for
> volatiles, because that is load from *p instead of store to *p) and that *p
> is gimplified as read from *p into a temporary vol.0 and hits the same case,
> where we when we try to gimplify for vol.0 = *p the from_p part *p, we
> gimplify it as vol.1 = *p and like that until we eat all of the stack.

At first I was trying to understand why a change from zero-sized to empty check
would cause a problem but this make sense now.  Basically before it was not a
zero-sized struct but still empty. And now with the change we go in circles.

[Bug middle-end/101437] [12 Regression] ICE: Segmentation fault signal terminated program cc1

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:f6dde32b9d487dd6e343d0a1e1d1f60783f5e735

commit r12-2320-gf6dde32b9d487dd6e343d0a1e1d1f60783f5e735
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu Jul 15 10:17:06 2021 +0200

    gimplify: Fix endless recursion on volatile empty type reads/writes
[PR101437]

    Andrew's recent change to optimize away during gimplification not just
    assignments of zero sized types, but also assignments of empty types,
    caused infinite recursion in the gimplifier.
    If such assignment is optimized away, we gimplify separately the to_p
    and from_p operands and throw away the result.  When gimplifying the
    operand that is volatile, we run into the gimplifier code below, which has
    different handling for types with non-BLKmode mode, tries to gimplify
    those as vol.N = expr, and for BLKmode just throws those away.
    Zero sized types will always have BLKmode and so are fine, but for the
    non-BLKmode ones like struct S in the testcase, the vol.N = expr
    gimplification will reach again the gimplify_modify_expr code, see it is
    assignment of empty type and will gimplify again vol.N separately
    (non-volatile, so ok) and expr, on which it will recurse again.

    The following patch breaks that infinite recursion by ignoring bare
    volatile loads from empty types.
    If a volatile load or store for aggregates are supposed to be member-wise
    loads or stores, then there are no non-padding members in the empty types
that
    should be copied and so it is probably ok.

    2021-07-15  Jakub Jelinek  <jakub@redhat.com>

            PR middle-end/101437
            * gimplify.c (gimplify_expr): Throw away volatile reads from empty
            types even if they have non-BLKmode TYPE_MODE.

            * gcc.c-torture/compile/pr101437.c: New test.

[Bug middle-end/101437] [12 Regression] ICE: Segmentation fault signal terminated program cc1

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101437

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.