[Bug tree-optimization/101597] New: r12-2132-ga110855667782dac[12 Regression] ICE in evrp since

[Bug tree-optimization/101597] New: r12-2132-ga110855667782dac[12 Regression] ICE in evrp since

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

            Bug ID: 101597
           Summary: r12-2132-ga110855667782dac[12 Regression] ICE in evrp
                    since
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: msebor at gcc dot gnu.org
  Target Milestone: ---

The following fails:

$ cat unified.ii
extern "C" void *memcpy(void *, const void *, unsigned long);
template <int __v>
struct integral_constant {
  static constexpr int value = __v;
};
using false_type = integral_constant<false>;
struct PluginViewBase;
template <bool, typename, typename _Iffalse>
using conditional_t = _Iffalse;
template <typename>
constexpr bool is_const_v = false_type ::value;
namespace WTF {
template <typename ToType, typename FromType>
ToType bitwise_cast(FromType from) {
  ToType to;
  memcpy(&to, &from, sizeof(to));
  return to;
}
}  // namespace WTF
using WTF::bitwise_cast;
bool isOfType___trans_tmp_2;
namespace WTF {
template <typename, typename>
struct TypeCastTraits;
template <typename ArgType>
bool is(ArgType &source) {
  return TypeCastTraits<const int, ArgType>::isOfType(source);
}
template <typename Reference, typename T>
using match_constness_t = conditional_t<is_const_v<Reference>, T, T>;
template <typename, typename Source>
match_constness_t<Source, PluginViewBase> &downcast(Source &source) {
  return static_cast<match_constness_t<Source, PluginViewBase> &>(source);
}
}  // namespace WTF
using WTF::downcast;
using WTF::is;
class PreciseAllocation;
struct HeapCell {
  PreciseAllocation &preciseAllocation() const;
  int &vm() const;
};
struct WeakSet {
  void vm();
};
struct PreciseAllocation {
  static PreciseAllocation *fromCell(void *cell) {
    char *__trans_tmp_1 = bitwise_cast<char *>(cell);
    return bitwise_cast<PreciseAllocation *>(__trans_tmp_1 - halfAlignment);
  }
  void vm() { m_weakSet.vm(); }
  static constexpr unsigned halfAlignment = 2;
  WeakSet m_weakSet;
};
PreciseAllocation &HeapCell::preciseAllocation() const {
  return *PreciseAllocation::fromCell(const_cast<HeapCell *>(this));
}
int &HeapCell::vm() const { preciseAllocation().vm(); }
struct Node {
  virtual bool isPluginElement() { return false; }
};
struct Widget {};
namespace WTF {
template <typename ArgType>
struct TypeCastTraits<const int, ArgType> {
  static bool isOfType(ArgType &source) {
    isOfType___trans_tmp_2 = source.isPluginElement();
    return isOfType___trans_tmp_2;
  }
};
}  // namespace WTF
struct JSHTMLElement {
  Node &wrapped();
};
struct PluginViewBase : Widget {
  virtual HeapCell *scriptObject(HeapCell *);
};
HeapCell pluginScriptObjectFromPluginViewBase_globalObject;
JSHTMLElement pluginScriptObjectFromPluginViewBase_jsHTMLElement;
HeapCell *pluginScriptObjectFromPluginViewBase___trans_tmp_3;
Node &pluginScriptObjectFromPluginViewBase_element =
    pluginScriptObjectFromPluginViewBase_jsHTMLElement.wrapped();
Widget *pluginScriptObjectFromPluginViewBase_pluginWidget;
HeapCell *pluginScriptObjectFromPluginViewBase() {
  if (!is(pluginScriptObjectFromPluginViewBase_element)) return nullptr;
  pluginScriptObjectFromPluginViewBase___trans_tmp_3 =
      downcast<PluginViewBase>(
          *pluginScriptObjectFromPluginViewBase_pluginWidget)
          .scriptObject(&pluginScriptObjectFromPluginViewBase_globalObject);
  return pluginScriptObjectFromPluginViewBase___trans_tmp_3;
}
void pluginElementCustomGetCallData() {
  if (HeapCell *scriptObject = pluginScriptObjectFromPluginViewBase())
    scriptObject->vm();
}

$ g++ unified.ii -fno-checking -c -Warray-bounds -O3
unified.ii: In member function ‘int& HeapCell::vm() const’:
unified.ii:58:55: warning: no return statement in function returning non-void
[-Wreturn-type]
   58 | int &HeapCell::vm() const { preciseAllocation().vm(); }
      |                                                       ^
In member function ‘void PreciseAllocation::vm()’,
    inlined from ‘int& HeapCell::vm() const’ at unified.ii:58:51,
    inlined from ‘void pluginElementCustomGetCallData()’ at unified.ii:94:21:
unified.ii:51:27: warning: array subscript -2 is outside array bounds of
‘HeapCell [9223372036854775807]’ [-Warray-bounds]
   51 |   void vm() { m_weakSet.vm(); }
      |               ~~~~~~~~~~~~^~
‘
during GIMPLE pass: vrp
In function ‘void pluginElementCustomGetCallData()’:
Segmentation fault
   92 | void pluginElementCustomGetCallData() {
      |      ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
0x11a348a crash_signal
        /home/marxin/Programming/gcc/gcc/toplev.c:328
0x7ffff786239f ???
        ../sysdeps/unix/sysv/linux/sigaction.c:10
0xa440a4 tree_check(tree_node*, char const*, int, char const*, tree_code)
        /home/marxin/Programming/gcc/gcc/tree.h:3372
0xa440a4 resolve_virtual_fun_from_obj_type_ref
        /home/marxin/Programming/gcc/gcc/cp/error.c:2153
0xa48f17 dump_expr
        /home/marxin/Programming/gcc/gcc/cp/error.c:2953
0xa4e862 expr_to_string(tree_node*)
        /home/marxin/Programming/gcc/gcc/cp/error.c:3224
0xa4f15c cp_printer
        /home/marxin/Programming/gcc/gcc/cp/error.c:4390
0x1e43257 pp_format(pretty_printer*, text_info*)
        /home/marxin/Programming/gcc/gcc/pretty-print.c:1475
0x1e27e4d diagnostic_report_diagnostic(diagnostic_context*, diagnostic_info*)
        /home/marxin/Programming/gcc/gcc/diagnostic.c:1331
0x1e283d8 diagnostic_impl
        /home/marxin/Programming/gcc/gcc/diagnostic.c:1493
0x1e2879b inform(unsigned int, char const*, ...)
        /home/marxin/Programming/gcc/gcc/diagnostic.c:1572
0xcbc6eb access_ref::inform_access(access_mode) const
        /home/marxin/Programming/gcc/gcc/builtins.c:4633
0xcbc7f6 access_ref::inform_access(access_mode) const
        /home/marxin/Programming/gcc/gcc/builtins.c:4465
0x1c36756 array_bounds_checker::check_mem_ref(unsigned int, tree_node*, bool)
        /home/marxin/Programming/gcc/gcc/gimple-array-bounds.cc:536
0x1c36a01 array_bounds_checker::check_addr_expr(unsigned int, tree_node*)
        /home/marxin/Programming/gcc/gcc/gimple-array-bounds.cc:582
0x1c36af7 array_bounds_checker::check_array_bounds(tree_node**, int*, void*)
        /home/marxin/Programming/gcc/gcc/gimple-array-bounds.cc:738
0x14b23ed walk_tree_1(tree_node**, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*,
tree_node* (*)(tree_node**, int*, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*))
        /home/marxin/Programming/gcc/gcc/tree.c:10971
0xecd7f0 walk_gimple_op(gimple*, tree_node* (*)(tree_node**, int*, void*),
walk_stmt_info*)
        /home/marxin/Programming/gcc/gcc/gimple-walk.c:202
0x1c344e8 check_array_bounds_dom_walker::before_dom_children(basic_block_def*)
        /home/marxin/Programming/gcc/gcc/gimple-array-bounds.cc:798
0x1c1faf7 dom_walker::walk(basic_block_def*)
        /home/marxin/Programming/gcc/gcc/domwalk.c:309
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/101597] [12 Regression] ICE in evrp since r12-2132-ga110855667782dac

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|r12-2132-ga110855667782dac[ |[12 Regression] ICE in evrp
                   |12 Regression] ICE in evrp  |since
                   |since                       |r12-2132-ga110855667782dac
   Target Milestone|---                         |12.0
   Last reconfirmed|                            |2021-07-23
     Ever confirmed|0                           |1
           Priority|P3                          |P1
             Status|UNCONFIRMED                 |NEW

[Bug c++/101597] [12 Regression] ICE in pretty-printer formatting an OBJ_TYPE_REF since r12-2132-ga110855667782dac

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|tree-optimization           |c++
            Summary|[12 Regression] ICE in evrp |[12 Regression] ICE in
                   |since                       |pretty-printer formatting
                   |r12-2132-ga110855667782dac  |an OBJ_TYPE_REF since
                   |                            |r12-2132-ga110855667782dac

--- Comment #1 from Martin Sebor <msebor at gcc dot gnu.org> ---
The ICE happens in a call to inform(..., "...%qE...", allocfn) with allocfn set
to the OBJ_TYPE_REF argument below.  The pretty-printer winds up passing the
argument to resolve_virtual_fun_from_obj_type_ref() in cp/error.c which
computes a null pointer that it eventually dereferences.

The inform() call looks valid to me so the bug is most likely in the C++ frond
end's pretty-printer.

 <obj_type_ref 0x7fffea9d3630
    type <pointer_type 0x7fffea987f18
        type <method_type 0x7fffea987bd0 type <pointer_type 0x7fffea981348>
            QI
            size <integer_cst 0x7fffea7f6fd8 constant 8>
            unit-size <integer_cst 0x7fffea816000 constant 1>
            align:8 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffea987bd0 method basetype <record_type 0x7fffea96b690 PluginViewBase>
            arg-types <tree_list 0x7fffea9881e0 value <pointer_type
0x7fffea9879d8>
                chain <tree_list 0x7fffea9881b8 value <pointer_type
0x7fffea981348>
                    chain <tree_list 0x7fffea80a8e8 value <void_type
0x7fffea814f18 void>>>>
            pointer_to_this <pointer_type 0x7fffea987f18>>
        public unsigned DI
        size <integer_cst 0x7fffea7f6ee8 constant 64>
        unit-size <integer_cst 0x7fffea7f6f00 constant 8>
        align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7fffea987f18>

    arg:0 <ssa_name 0x7fffea9cc630
        type <pointer_type 0x7fffea952498 __vtbl_ptr_type type <function_type
0x7fffea9523f0>
            public unsigned type_6 DI size <integer_cst 0x7fffea7f6ee8 64>
unit-size <integer_cst 0x7fffea7f6f00 8>
            align:64 warn_if_not_align:0 symtab:0 alias-set 5 canonical-type
0x7fffea952498
            pointer_to_this <pointer_type 0x7fffea952690>>
        visited
        def_stmt _12 = *_11;
        version:12
        ptr-info 0x7fffea9d5f30>
    arg:1 <ssa_name 0x7fffea9cc558
        type <pointer_type 0x7fffea98f000 type <record_type 0x7fffea981540
Widget>
            public unsigned DI size <integer_cst 0x7fffea7f6ee8 64> unit-size
<integer_cst 0x7fffea7f6f00 8>
            align:64 warn_if_not_align:0 symtab:0 alias-set 7 canonical-type
0x7fffea98f000
            pointer_to_this <pointer_type 0x7fffea9a43f0>>

        def_stmt pluginScriptObjectFromPluginViewBase_pluginWidget.2_9 =
ASSERT_EXPR <pluginScriptObjectFromPluginViewBase_pluginWidget.2_10,
pluginScriptObjectFromPluginViewBase_pluginWidget.2_10 != 0B>;
        version:9
        ptr-info 0x7fffea9d9000>
    arg:2 <integer_cst 0x7fffea816288 type <integer_type 0x7fffea8145e8 int>
constant 0>>

[Bug c++/101597] [12 Regression] ICE in pretty-printer formatting an OBJ_TYPE_REF since r12-2132-ga110855667782dac

[philip.herron at embecosm dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

Philip Herron <philip.herron at embecosm dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |philip.herron at embecosm dot com

--- Comment #2 from Philip Herron <philip.herron at embecosm dot com> ---
I tested this bug out again on git-sha commit
e87789f197e47259c94349821d3446f7d959e08f (HEAD -> master, gcc/trunk, gcc/master

./gcc/cc1plus test.cc -fdump-tree-original -fdump-tree-gimple -fno-checking
-Warray-bounds -O3

Seems to be working for me.

[Bug c++/101597] [12 Regression] ICE in pretty-printer formatting an OBJ_TYPE_REF since r12-2132-ga110855667782dac

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Indeed, the ICE is gone with r12-3124-g820f0940d7ace1306430a9dcf1bd9577508a7a7e
on this testcase, but I bet it just went latent.

[Bug c++/101597] [12 Regression] ICE in pretty-printer formatting an OBJ_TYPE_REF since r12-2132-ga110855667782dac

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I guess the problem is that for the middle-end, pointer conversions are
considered useless (with the small exceptions or different address spaces and
function/method vs. object pointers or if the pointers have different
TYPE_MODE),
so trying to figure out something from the type of OBJ_TYPE_REF's
OBJ_TYPE_REF_OBJECT operand is wrong.
So, either we want to print something ugly, e.g. with obj_type_ref in it
somewhere, if !virtual_method_call_p (t, true), or perhaps could change aall
the spots that create OBJ_TYPE_REFs such that the OBJ_TYPE_REF_TOKEN which I
think must be INTEGER_CST wouldn't have integer_type_node type, but would
actually have
the original type of the second argument of OBJ_TYPE_REF.
E.g. in build_vfn_ref instead of doing
  aref = build3 (OBJ_TYPE_REF, TREE_TYPE (aref), aref, instance_ptr, idx);
do
  aref = build3 (OBJ_TYPE_REF, TREE_TYPE (aref), aref, instance_ptr,
                 fold_convert (TREE_TYPE (instance_ptr), idx));
or so and use that for resolve_virtual_fun_from_obj_type_ref purposes.
It would be similar to what we do e.g. with MEM_REFs.
Devirtualization and constexpr virtual call handling would need to be verified
for that change of course.

[Bug c++/101597] [12 Regression] ICE in pretty-printer formatting an OBJ_TYPE_REF since r12-2132-ga110855667782dac

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Testcase that reproduces even with current trunk (started also with r12-2132):

// PR c++/101597
// { dg-do compile }
// { dg-options "-O2 -Warray-bounds" }

typedef __SIZE_TYPE__ size_t;
struct S { virtual void *foo (size_t) __attribute__((alloc_size (2))); };

int
foo (void *p)
{
  char *q = static_cast<char *> (static_cast<S *> (p)->foo (32));
  return q[64];         // { dg-warning "array subscript 64 is outside array
bounds of" }
}

[Bug c++/101597] [12 Regression] ICE in pretty-printer formatting an OBJ_TYPE_REF since r12-2132-ga110855667782dac

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 52093
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52093&action=edit
gcc12-pr101597.patch

Untested fix.

[Bug c++/101597] [12 Regression] ICE in pretty-printer formatting an OBJ_TYPE_REF since r12-2132-ga110855667782dac

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:ef9462581076218d2370fabb09c39d2c83814b9a

commit r12-6487-gef9462581076218d2370fabb09c39d2c83814b9a
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Jan 11 19:21:30 2022 +0100

    c++: Fix ICEs with OBJ_TYPE_REF pretty printing [PR101597]

    The following testcase ICEs, because middle-end uses the C++ FE pretty
    printing code through langhooks in the diagnostics.
    The FE expects OBJ_TYPE_REF_OBJECT's type to be useful (pointer to the
    class type it is called on), but in the middle-end conversions between
    pointer types are useless, so the actual type can be some random
    unrelated pointer type (in the testcase void * pointer).  The pretty
    printing code then ICEs on it.

    The following patch fixes that by sticking the original
    OBJ_TYPE_REF_OBJECT's also as type of OBJ_TYPE_REF_TOKEN operand.
    That one must be an INTEGER_CST, all the current uses of
    OBJ_TYPE_REF_TOKEN just use tree_to_uhwi or tree_to_shwi on it,
    and because it is constant, there is no risk of the middle-end propagating
    into it some other pointer type.  So, approach similar to how MEM_REF
    treats its second operand or a couple of internal functions (e.g.
    IFN_VA_ARG) some of its parameters.

    2022-01-11  Jakub Jelinek  <jakub@redhat.com>

            PR c++/101597
    gcc/
            * tree.def (OBJ_TYPE_REF): Document type of OBJ_TYPE_REF_TOKEN.
    gcc/cp/
            * class.c (build_vfn_ref): Build OBJ_TYPE_REF with INTEGER_CST
            OBJ_TYPE_REF_TOKEN with type equal to OBJ_TYPE_REF_OBJECT type.
            * error.c (resolve_virtual_fun_from_obj_type_ref): Use type of
            OBJ_TYPE_REF_TOKEN rather than type of OBJ_TYPE_REF_OBJECT as
            obj_type.
    gcc/objc/
            * objc-act.c (objc_rewrite_function_call): Build OBJ_TYPE_REF
            with INTEGER_CST OBJ_TYPE_REF_TOKEN with type equal to
            OBJ_TYPE_REF_OBJECT type.
            * objc-next-runtime-abi-01.c (build_objc_method_call): Likewise.
            * objc-gnu-runtime-abi-01.c (build_objc_method_call): Likewise.
            * objc-next-runtime-abi-02.c (build_v2_objc_method_fixup_call,
            build_v2_build_objc_method_call): Likewise.
    gcc/testsuite/
            * g++.dg/opt/pr101597.C: New test.

[Bug c++/101597] [12 Regression] ICE in pretty-printer formatting an OBJ_TYPE_REF since r12-2132-ga110855667782dac

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101597

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.