[Bug c/102200] New: ice in put_ref, at pointer-query.cc:1351

[Bug c/102200] New: ice in put_ref, at pointer-query.cc:1351

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102200

            Bug ID: 102200
           Summary: ice in put_ref, at pointer-query.cc:1351
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

For this C source code:

long try_extension_len;
void try_extension_str() {
  char *curr = try_extension_str;
  char end = sizeof try_extension_str;
  while (try_extension_len) {
    if (curr < end)
      *curr = ';';
    if (curr > &end)
      curr = &end;
  }
}

compiled with recent gcc trunk and compiler flag -O2, does this:

during GIMPLE pass: strlen
bug754.c: In function ‘try_extension_str’:
bug754.c:2:6: internal compiler error: in put_ref, at pointer-query.cc:1351
    2 | void try_extension_str() {
      |      ^~~~~~~~~~~~~~~~~
0xc7696c pointer_query::put_ref(tree_node*, access_ref const&, int)
        ../../trunk.git/gcc/pointer-query.cc:1351

The bug first seems to occur sometime between git hash 7a6f40d0452ec76e
and 9695e1c23be5b5c5. Only 21 commits.

[Bug tree-optimization/102200] [12 Regression] ice in put_ref, at pointer-query.cc:1351

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102200

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
   Target Milestone|---                         |12.0
          Component|c                           |tree-optimization
            Summary|ice in put_ref, at          |[12 Regression] ice in
                   |pointer-query.cc:1351       |put_ref, at
                   |                            |pointer-query.cc:1351

[Bug tree-optimization/102200] [12 Regression] ice in put_ref, at pointer-query.cc:1351

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102200

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-09-04

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to David Binderman from comment #0)
> The bug first seems to occur sometime between git hash 7a6f40d0452ec76e
> and 9695e1c23be5b5c5. Only 21 commits.

Most likely r12-3300-ece28da924dd

Confirmed.

[Bug tree-optimization/102200] [12 Regression] ice in put_ref, at pointer-query.cc:1351 since r12-3300-gece28da924ddda8b

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102200

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |msebor at gcc dot gnu.org
            Summary|[12 Regression] ice in      |[12 Regression] ice in
                   |put_ref, at                 |put_ref, at
                   |pointer-query.cc:1351       |pointer-query.cc:1351 since
                   |                            |r12-3300-gece28da924ddda8b

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started really with r12-3300-gece28da924ddda8b.

[Bug tree-optimization/102200] [12 Regression] ice in put_ref, at pointer-query.cc:1351 since r12-3300-gece28da924ddda8b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102200

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug tree-optimization/102200] [12 Regression] ice in put_ref, at pointer-query.cc:1351 since r12-3300-gece28da924ddda8b

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102200

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
The pointer_query code assumes that both pointer operands of a MIN_EXPR and
MAX_EXPR refer to the same object as required by the language.  The test case
violates that assumption by setting curr to point to the function first and
then comparing it to the address of the local variable end.  pointer_query
simply needs to avoid making this assumption (ideally while also arranging for
the invalid pointer relational expressions to be diagnosed).

[Bug middle-end/102200] [12 Regression] ice in put_ref, at pointer-query.cc:1351 since r12-3300-gece28da924ddda8b

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102200

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Blocks|                            |88443
           Keywords|                            |patch
          Component|tree-optimization           |middle-end

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2021-September/579629.html


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=88443
[Bug 88443] [meta-bug] bogus/missing -Wstringop-overflow warnings

[Bug middle-end/102200] [12 Regression] ice in put_ref, at pointer-query.cc:1351 since r12-3300-gece28da924ddda8b

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102200

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:31e924c52f430d81f030a2fa9f60b73a5a0d2126

commit r12-3629-g31e924c52f430d81f030a2fa9f60b73a5a0d2126
Author: Martin Sebor <msebor@redhat.com>
Date:   Fri Sep 17 10:36:54 2021 -0600

    Better handle MIN/MAX_EXPR of unrelated objects [PR102200].

    Resolves:
    PR middle-end/102200 - ICE on a min of a decl and pointer in a loop

    gcc/ChangeLog:

            PR middle-end/102200
            * pointer-query.cc (access_ref::inform_access): Handle
MIN/MAX_EXPR.
            (handle_min_max_size): Change argument.  Store original SSA_NAME
for
            operands to potentially distinct (sub)objects.
            (compute_objsize_r): Adjust call to the above.

    gcc/testsuite/ChangeLog:

            PR middle-end/102200
            * gcc.dg/Wstringop-overflow-62.c: Adjust text of an expected note.
            * gcc.dg/Warray-bounds-89.c: New test.
            * gcc.dg/Wstringop-overflow-74.c: New test.
            * gcc.dg/Wstringop-overflow-75.c: New test.
            * gcc.dg/Wstringop-overflow-76.c: New test.

[Bug middle-end/102200] [12 Regression] ICE on a min of a decl and pointer in a loop

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102200

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED
            Summary|[12 Regression] ice in      |[12 Regression] ICE on a
                   |put_ref, at                 |min of a decl and pointer
                   |pointer-query.cc:1351 since |in a loop
                   |r12-3300-gece28da924ddda8b  |

--- Comment #6 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fixed.