From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 5809B3888C57; Fri, 23 Jul 2021 10:53:00 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 5809B3888C57 From: "marxin at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug tree-optimization/101597] New: r12-2132-ga110855667782dac[12 Regression] ICE in evrp since Date: Fri, 23 Jul 2021 10:52:59 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: new X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: tree-optimization X-Bugzilla-Version: 12.0 X-Bugzilla-Keywords: ice-on-valid-code X-Bugzilla-Severity: normal X-Bugzilla-Who: marxin at gcc dot gnu.org X-Bugzilla-Status: UNCONFIRMED X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: --- X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status keywords bug_severity priority component assigned_to reporter cc target_milestone Message-ID: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 X-BeenThere: gcc-bugs@gcc.gnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: Gcc-bugs mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Fri, 23 Jul 2021 10:53:00 -0000 https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D101597 Bug ID: 101597 Summary: r12-2132-ga110855667782dac[12 Regression] ICE in evrp since Product: gcc Version: 12.0 Status: UNCONFIRMED Keywords: ice-on-valid-code Severity: normal Priority: P3 Component: tree-optimization Assignee: unassigned at gcc dot gnu.org Reporter: marxin at gcc dot gnu.org CC: msebor at gcc dot gnu.org Target Milestone: --- The following fails: $ cat unified.ii extern "C" void *memcpy(void *, const void *, unsigned long); template struct integral_constant { static constexpr int value =3D __v; }; using false_type =3D integral_constant; struct PluginViewBase; template using conditional_t =3D _Iffalse; template constexpr bool is_const_v =3D false_type ::value; namespace WTF { template ToType bitwise_cast(FromType from) { ToType to; memcpy(&to, &from, sizeof(to)); return to; } } // namespace WTF using WTF::bitwise_cast; bool isOfType___trans_tmp_2; namespace WTF { template struct TypeCastTraits; template bool is(ArgType &source) { return TypeCastTraits::isOfType(source); } template using match_constness_t =3D conditional_t, T, T>; template match_constness_t &downcast(Source &source) { return static_cast &>(source); } } // namespace WTF using WTF::downcast; using WTF::is; class PreciseAllocation; struct HeapCell { PreciseAllocation &preciseAllocation() const; int &vm() const; }; struct WeakSet { void vm(); }; struct PreciseAllocation { static PreciseAllocation *fromCell(void *cell) { char *__trans_tmp_1 =3D bitwise_cast(cell); return bitwise_cast(__trans_tmp_1 - halfAlignment); } void vm() { m_weakSet.vm(); } static constexpr unsigned halfAlignment =3D 2; WeakSet m_weakSet; }; PreciseAllocation &HeapCell::preciseAllocation() const { return *PreciseAllocation::fromCell(const_cast(this)); } int &HeapCell::vm() const { preciseAllocation().vm(); } struct Node { virtual bool isPluginElement() { return false; } }; struct Widget {}; namespace WTF { template struct TypeCastTraits { static bool isOfType(ArgType &source) { isOfType___trans_tmp_2 =3D source.isPluginElement(); return isOfType___trans_tmp_2; } }; } // namespace WTF struct JSHTMLElement { Node &wrapped(); }; struct PluginViewBase : Widget { virtual HeapCell *scriptObject(HeapCell *); }; HeapCell pluginScriptObjectFromPluginViewBase_globalObject; JSHTMLElement pluginScriptObjectFromPluginViewBase_jsHTMLElement; HeapCell *pluginScriptObjectFromPluginViewBase___trans_tmp_3; Node &pluginScriptObjectFromPluginViewBase_element =3D pluginScriptObjectFromPluginViewBase_jsHTMLElement.wrapped(); Widget *pluginScriptObjectFromPluginViewBase_pluginWidget; HeapCell *pluginScriptObjectFromPluginViewBase() { if (!is(pluginScriptObjectFromPluginViewBase_element)) return nullptr; pluginScriptObjectFromPluginViewBase___trans_tmp_3 =3D downcast( *pluginScriptObjectFromPluginViewBase_pluginWidget) .scriptObject(&pluginScriptObjectFromPluginViewBase_globalObject); return pluginScriptObjectFromPluginViewBase___trans_tmp_3; } void pluginElementCustomGetCallData() { if (HeapCell *scriptObject =3D pluginScriptObjectFromPluginViewBase()) scriptObject->vm(); } $ g++ unified.ii -fno-checking -c -Warray-bounds -O3 unified.ii: In member function =E2=80=98int& HeapCell::vm() const=E2=80=99: unified.ii:58:55: warning: no return statement in function returning non-vo= id [-Wreturn-type] 58 | int &HeapCell::vm() const { preciseAllocation().vm(); } | ^ In member function =E2=80=98void PreciseAllocation::vm()=E2=80=99, inlined from =E2=80=98int& HeapCell::vm() const=E2=80=99 at unified.ii:= 58:51, inlined from =E2=80=98void pluginElementCustomGetCallData()=E2=80=99 at= unified.ii:94:21: unified.ii:51:27: warning: array subscript -2 is outside array bounds of =E2=80=98HeapCell [9223372036854775807]=E2=80=99 [-Warray-bounds] 51 | void vm() { m_weakSet.vm(); } | ~~~~~~~~~~~~^~ =E2=80=98 during GIMPLE pass: vrp In function =E2=80=98void pluginElementCustomGetCallData()=E2=80=99: Segmentation fault 92 | void pluginElementCustomGetCallData() { | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 0x11a348a crash_signal /home/marxin/Programming/gcc/gcc/toplev.c:328 0x7ffff786239f ??? ../sysdeps/unix/sysv/linux/sigaction.c:10 0xa440a4 tree_check(tree_node*, char const*, int, char const*, tree_code) /home/marxin/Programming/gcc/gcc/tree.h:3372 0xa440a4 resolve_virtual_fun_from_obj_type_ref /home/marxin/Programming/gcc/gcc/cp/error.c:2153 0xa48f17 dump_expr /home/marxin/Programming/gcc/gcc/cp/error.c:2953 0xa4e862 expr_to_string(tree_node*) /home/marxin/Programming/gcc/gcc/cp/error.c:3224 0xa4f15c cp_printer /home/marxin/Programming/gcc/gcc/cp/error.c:4390 0x1e43257 pp_format(pretty_printer*, text_info*) /home/marxin/Programming/gcc/gcc/pretty-print.c:1475 0x1e27e4d diagnostic_report_diagnostic(diagnostic_context*, diagnostic_info= *) /home/marxin/Programming/gcc/gcc/diagnostic.c:1331 0x1e283d8 diagnostic_impl /home/marxin/Programming/gcc/gcc/diagnostic.c:1493 0x1e2879b inform(unsigned int, char const*, ...) /home/marxin/Programming/gcc/gcc/diagnostic.c:1572 0xcbc6eb access_ref::inform_access(access_mode) const /home/marxin/Programming/gcc/gcc/builtins.c:4633 0xcbc7f6 access_ref::inform_access(access_mode) const /home/marxin/Programming/gcc/gcc/builtins.c:4465 0x1c36756 array_bounds_checker::check_mem_ref(unsigned int, tree_node*, boo= l) /home/marxin/Programming/gcc/gcc/gimple-array-bounds.cc:536 0x1c36a01 array_bounds_checker::check_addr_expr(unsigned int, tree_node*) /home/marxin/Programming/gcc/gcc/gimple-array-bounds.cc:582 0x1c36af7 array_bounds_checker::check_array_bounds(tree_node**, int*, void*) /home/marxin/Programming/gcc/gcc/gimple-array-bounds.cc:738 0x14b23ed walk_tree_1(tree_node**, tree_node* (*)(tree_node**, int*, void*), void*, hash_set >*, tree_node* (*)(tree_node**, int*, tree_node* (*)(tree_node**, int*, void*), void*, hash_set >*)) /home/marxin/Programming/gcc/gcc/tree.c:10971 0xecd7f0 walk_gimple_op(gimple*, tree_node* (*)(tree_node**, int*, void*), walk_stmt_info*) /home/marxin/Programming/gcc/gcc/gimple-walk.c:202 0x1c344e8 check_array_bounds_dom_walker::before_dom_children(basic_block_de= f*) /home/marxin/Programming/gcc/gcc/gimple-array-bounds.cc:798 0x1c1faf7 dom_walker::walk(basic_block_def*) /home/marxin/Programming/gcc/gcc/domwalk.c:309 Please submit a full bug report, with preprocessed source if appropriate. Please include the complete backtrace with any bug report. See for instructions.=