[Bug c++/102548] New: gcc segmentation fault in cc1plus (with repro case)

[Bug c++/102548] New: gcc segmentation fault in cc1plus (with repro case)

[ulatekh at yahoo dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

            Bug ID: 102548
           Summary: gcc segmentation fault in cc1plus (with repro case)
           Product: gcc
           Version: 10.3.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: ulatekh at yahoo dot com
  Target Milestone: ---

Created attachment 51525
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51525&action=edit
Preprocessed source

Found this with the current MSYS2 MinGW compiler (building a bleeding-edge
version of cmake), but it also crashes on my Fedora 33 machine when running
"g++ -march=x86-64 -m32 cmTimestamp.ii".

[Bug c++/102548] gcc segmentation fault in cc1plus (with repro case)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
apinski@xeond:~/src$ ~/upstream-gcc/bin/gcc cmTimestamp.ii  -m32 -S
E:/Programming/Source/msys2/MINGW-packages/mingw-w64-cmake/src/cmake-3.21.2/Source/cmTimestamp.cxx:
In lambda function:
E:/Programming/Source/msys2/MINGW-packages/mingw-w64-cmake/src/cmake-3.21.2/Source/cmTimestamp.cxx:208:12:
internal compiler error: tree check: expected tree_list, have error_mark in
apply_identity_attributes, at cp/tree.c:1499
0x8e5b60 tree_check_failed(tree_node const*, char const*, int, char const*,
...)
        /home/apinski/src/upstream-gcc/gcc/gcc/tree.c:8689
0x7a8647 tree_check(tree_node*, char const*, int, char const*, tree_code)
        /home/apinski/src/upstream-gcc/gcc/gcc/tree.h:3427
0x7a8647 apply_identity_attributes
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/tree.c:1499
0x7a8647 strip_typedefs(tree_node*, bool*, unsigned int)
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/tree.c:1816
0xc0761d strip_typedefs(tree_node*, bool*, unsigned int)
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/tree.c:1548
0xc0761d strip_typedefs(tree_node*, bool*, unsigned int)
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/tree.c:1583
0xb70012 canonicalize_type_argument(tree_node*, int)
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/pt.c:8176
0xb70012 canonicalize_type_argument(tree_node*, int)
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/pt.c:8171
0xb9ee42 unify
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/pt.c:23817
0xb9b288 unify_one_argument
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/pt.c:22271
0xba877a type_unification_real
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/pt.c:22390
0xb7f4e0 do_auto_deduction(tree_node*, tree_node*, tree_node*, int,
auto_deduction_context, tree_node*, int)
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/pt.c:29805
0xc2454f check_return_expr(tree_node*, bool*)
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/typeck.c:10315
0xbd1eaf finish_return_stmt(tree_node*)
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/semantics.c:1193
0xb34bc5 cp_parser_jump_statement
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/parser.c:14162
0xb34bc5 cp_parser_statement
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/parser.c:12172
0xb3583d cp_parser_statement_seq_opt
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/parser.c:12713
0xb35918 cp_parser_compound_statement
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/parser.c:12662
0xb36647 cp_parser_function_body
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/parser.c:24893
0xb36647 cp_parser_lambda_body
        /home/apinski/src/upstream-gcc/gcc/gcc/cp/parser.c:11654
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug c++/102548] gcc segmentation fault in cc1plus (with repro case)

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-09-30
                 CC|                            |mpolacek at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed with

./cc1plus -quiet cmTimestamp.ii -march=x86-64 -mtune=generic  -fpermissive -m32

on x86_64-redhat-linux.

[Bug c++/102548] gcc segmentation fault in cc1plus (with repro case)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
reduced almost all the way:
typedef decltype(sizeof(0)) size_t;
struct tm;
extern "C"
size_t __attribute__((__cdecl__)) strftime(char * __restrict__ _Buf,size_t
_SizeInBytes,const char * __restrict__ _Format,const struct tm * __restrict__
_Tm);
void f(void)
{
  using T = size_t(__attribute__((__stdcall__))*)(char*, size_t, const char*,
const struct tm*);
  auto loadStrftime = [] {
    return strftime;
  };
  static T strftime = loadStrftime();
}

[Bug c++/102548] [9/10/11/12 Regression] ICE with cdecl attribute on a builtin function

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
            Summary|gcc segmentation fault in   |[9/10/11/12 Regression] ICE
                   |cc1plus (with repro case)   |with cdecl attribute on a
                   |                            |builtin function
   Target Milestone|---                         |9.5

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
sometime between GCC 6 and GCC 7, the ICE was introduced before this was
rejected:
<source>: In function 'void f()':
<source>:12:35: error: invalid conversion from 'size_t
(__attribute__((__cdecl__)) *)(char*, size_t, const char*, const tm*) {aka
unsigned int (__attribute__((__cdecl__)) *)(char*, unsigned int, const char*,
const tm*)}' to 'T {aka unsigned int (__attribute__((__stdcall__)) *)(char*,
unsigned int, const char*, const tm*)}' [-fpermissive]
   static T strftime = loadStrftime();
                       ~~~~~~~~~~~~^~


Note using auto instead of the type T, the ICE shows up still:

typedef decltype(sizeof(0)) size_t;
struct tm;
extern "C"
size_t __attribute__((__cdecl__)) strftime(char *  _Buf,size_t
_SizeInBytes,const char *  _Format,const struct tm *  _Tm);
void f(void)
{
  auto g = strftime;
}

And was accepted in GCC 6.
So this is a regression from GCC6.

Looks like it has to do with builtin functions too.

[Bug c++/102548] [9/10/11/12 Regression] ICE with cdecl attribute on a builtin function

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug c++/102548] [9/10/11/12 Regression] ICE with cdecl attribute on a builtin function since r7-4737-g48330c9355e32a41

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |edlinger at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org
            Summary|[9/10/11/12 Regression] ICE |[9/10/11/12 Regression] ICE
                   |with cdecl attribute on a   |with cdecl attribute on a
                   |builtin function            |builtin function since
                   |                            |r7-4737-g48330c9355e32a41

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Then it started with r7-4737-g48330c9355e32a41.

[Bug c++/102548] [9/10/11/12 Regression] ICE with cdecl attribute on a builtin function since r7-4737-g48330c9355e32a41

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 51548
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51548&action=edit
gcc12-pr102548.patch

Untested fix.

[Bug c++/102548] [9/10/11/12 Regression] ICE with cdecl attribute on a builtin function since r7-4737-g48330c9355e32a41

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:737f95bab557584d876f02779ab79fe3cfaacacf

commit r12-4198-g737f95bab557584d876f02779ab79fe3cfaacacf
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Oct 5 22:28:38 2021 +0200

    c++: Fix apply_identity_attributes [PR102548]

    The following testcase ICEs on x86_64-linux with -m32 due to a bug in
    apply_identity_attributes.  The function is being smart and attempts not
    to duplicate the chain unnecessarily, if either there are no attributes
    that affect type identity or there is possibly empty set of attributes
    that do not affect type identity in the chain followed by attributes
    that do affect type identity, it reuses that attribute chain.

    The function mishandles the cases where in the chain an attribute affects
    type identity and is followed by one or more attributes that don't
    affect type identity (and then perhaps some further ones that do).

    There are two bugs.  One is that when we notice first attribute that
    doesn't affect type identity after first attribute that does affect type
    identity (with perhaps some further such attributes in the chain after it),
    we want to put into the new chain just attributes starting from
    (inclusive) first_ident and up to (exclusive) the current attribute a,
    but the code puts into the chain all attributes starting with first_ident,
    including the ones that do not affect type identity and if e.g. we have
    doesn't0 affects1 doesn't2 affects3 affects4 sequence of attributes, the
    resulting sequence would have
    affects1 doesn't2 affects3 affects4 affects3 affects4
    attributes, i.e. one attribute that shouldn't be there and two attributes
    duplicated.  That is fixed by the a2 -> a2 != a change.

    The second one is that we ICE once we see second attribute that doesn't
    affect type identity after an attribute that affects it.  That is because
    first_ident is set to error_mark_node after handling the first attribute
    that doesn't affect type identity (i.e. after we've copied the
    [first_ident, a) set of attributes to the new chain) to denote that from
    that time on, each attribute that affects type identity should be copied
    whenever it is seen (the if (as && as->affects_type_identity) code does
    that correctly).  But that condition is false and first_ident is
    error_mark_node, we enter else if (first_ident) and use TREE_PURPOSE
    /TREE_VALUE/TREE_CHAIN on error_mark_node, which ICEs.  When
    first_ident is error_mark_node and a doesn't affect type identity,
    we want to do nothing.  So that is the && first_ident != error_mark_node
    chunk.

    2021-10-05  Jakub Jelinek  <jakub@redhat.com>

            PR c++/102548
            * tree.c (apply_identity_attributes): Fix handling of the
            case where an attribute in the list doesn't affect type
            identity but some attribute before it does.

            * g++.target/i386/pr102548.C: New test.

[Bug c++/102548] [9/10/11/12 Regression] ICE with cdecl attribute on a builtin function since r7-4737-g48330c9355e32a41

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:e1edbce89a93dde8653666eaf402d58dda43e3b0

commit r11-9075-ge1edbce89a93dde8653666eaf402d58dda43e3b0
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Oct 5 22:28:38 2021 +0200

    c++: Fix apply_identity_attributes [PR102548]

    The following testcase ICEs on x86_64-linux with -m32 due to a bug in
    apply_identity_attributes.  The function is being smart and attempts not
    to duplicate the chain unnecessarily, if either there are no attributes
    that affect type identity or there is possibly empty set of attributes
    that do not affect type identity in the chain followed by attributes
    that do affect type identity, it reuses that attribute chain.

    The function mishandles the cases where in the chain an attribute affects
    type identity and is followed by one or more attributes that don't
    affect type identity (and then perhaps some further ones that do).

    There are two bugs.  One is that when we notice first attribute that
    doesn't affect type identity after first attribute that does affect type
    identity (with perhaps some further such attributes in the chain after it),
    we want to put into the new chain just attributes starting from
    (inclusive) first_ident and up to (exclusive) the current attribute a,
    but the code puts into the chain all attributes starting with first_ident,
    including the ones that do not affect type identity and if e.g. we have
    doesn't0 affects1 doesn't2 affects3 affects4 sequence of attributes, the
    resulting sequence would have
    affects1 doesn't2 affects3 affects4 affects3 affects4
    attributes, i.e. one attribute that shouldn't be there and two attributes
    duplicated.  That is fixed by the a2 -> a2 != a change.

    The second one is that we ICE once we see second attribute that doesn't
    affect type identity after an attribute that affects it.  That is because
    first_ident is set to error_mark_node after handling the first attribute
    that doesn't affect type identity (i.e. after we've copied the
    [first_ident, a) set of attributes to the new chain) to denote that from
    that time on, each attribute that affects type identity should be copied
    whenever it is seen (the if (as && as->affects_type_identity) code does
    that correctly).  But that condition is false and first_ident is
    error_mark_node, we enter else if (first_ident) and use TREE_PURPOSE
    /TREE_VALUE/TREE_CHAIN on error_mark_node, which ICEs.  When
    first_ident is error_mark_node and a doesn't affect type identity,
    we want to do nothing.  So that is the && first_ident != error_mark_node
    chunk.

    2021-10-05  Jakub Jelinek  <jakub@redhat.com>

            PR c++/102548
            * tree.c (apply_identity_attributes): Fix handling of the
            case where an attribute in the list doesn't affect type
            identity but some attribute before it does.

            * g++.target/i386/pr102548.C: New test.

    (cherry picked from commit 737f95bab557584d876f02779ab79fe3cfaacacf)

[Bug c++/102548] [9/10 Regression] ICE with cdecl attribute on a builtin function since r7-4737-g48330c9355e32a41

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[9/10/11/12 Regression] ICE |[9/10 Regression] ICE with
                   |with cdecl attribute on a   |cdecl attribute on a
                   |builtin function since      |builtin function since
                   |r7-4737-g48330c9355e32a41   |r7-4737-g48330c9355e32a41

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 11.3+ and 12.1+ for now.

[Bug c++/102548] [9/10 Regression] ICE with cdecl attribute on a builtin function since r7-4737-g48330c9355e32a41

[ulatekh at yahoo dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

--- Comment #10 from Steven Boswell II <ulatekh at yahoo dot com> ---
Great work! Thanks!

The patch seems to apply to gcc 10 also, but I haven't built the result yet.

[Bug c++/102548] [9/10 Regression] ICE with cdecl attribute on a builtin function since r7-4737-g48330c9355e32a41

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:8a4f93b2b0b91aa7ebee9ae89471a7623aca7508

commit r10-10647-g8a4f93b2b0b91aa7ebee9ae89471a7623aca7508
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Oct 5 22:28:38 2021 +0200

    c++: Fix apply_identity_attributes [PR102548]

    The following testcase ICEs on x86_64-linux with -m32 due to a bug in
    apply_identity_attributes.  The function is being smart and attempts not
    to duplicate the chain unnecessarily, if either there are no attributes
    that affect type identity or there is possibly empty set of attributes
    that do not affect type identity in the chain followed by attributes
    that do affect type identity, it reuses that attribute chain.

    The function mishandles the cases where in the chain an attribute affects
    type identity and is followed by one or more attributes that don't
    affect type identity (and then perhaps some further ones that do).

    There are two bugs.  One is that when we notice first attribute that
    doesn't affect type identity after first attribute that does affect type
    identity (with perhaps some further such attributes in the chain after it),
    we want to put into the new chain just attributes starting from
    (inclusive) first_ident and up to (exclusive) the current attribute a,
    but the code puts into the chain all attributes starting with first_ident,
    including the ones that do not affect type identity and if e.g. we have
    doesn't0 affects1 doesn't2 affects3 affects4 sequence of attributes, the
    resulting sequence would have
    affects1 doesn't2 affects3 affects4 affects3 affects4
    attributes, i.e. one attribute that shouldn't be there and two attributes
    duplicated.  That is fixed by the a2 -> a2 != a change.

    The second one is that we ICE once we see second attribute that doesn't
    affect type identity after an attribute that affects it.  That is because
    first_ident is set to error_mark_node after handling the first attribute
    that doesn't affect type identity (i.e. after we've copied the
    [first_ident, a) set of attributes to the new chain) to denote that from
    that time on, each attribute that affects type identity should be copied
    whenever it is seen (the if (as && as->affects_type_identity) code does
    that correctly).  But that condition is false and first_ident is
    error_mark_node, we enter else if (first_ident) and use TREE_PURPOSE
    /TREE_VALUE/TREE_CHAIN on error_mark_node, which ICEs.  When
    first_ident is error_mark_node and a doesn't affect type identity,
    we want to do nothing.  So that is the && first_ident != error_mark_node
    chunk.

    2021-10-05  Jakub Jelinek  <jakub@redhat.com>

            PR c++/102548
            * tree.c (apply_identity_attributes): Fix handling of the
            case where an attribute in the list doesn't affect type
            identity but some attribute before it does.

            * g++.target/i386/pr102548.C: New test.

    (cherry picked from commit 737f95bab557584d876f02779ab79fe3cfaacacf)

[Bug c++/102548] [9/10 Regression] ICE with cdecl attribute on a builtin function since r7-4737-g48330c9355e32a41

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

--- Comment #12 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:ee221ea5cc02d628d0b967c007c52e7cac83c008

commit r9-10104-gee221ea5cc02d628d0b967c007c52e7cac83c008
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Oct 5 22:28:38 2021 +0200

    c++: Fix apply_identity_attributes [PR102548]

    The following testcase ICEs on x86_64-linux with -m32 due to a bug in
    apply_identity_attributes.  The function is being smart and attempts not
    to duplicate the chain unnecessarily, if either there are no attributes
    that affect type identity or there is possibly empty set of attributes
    that do not affect type identity in the chain followed by attributes
    that do affect type identity, it reuses that attribute chain.

    The function mishandles the cases where in the chain an attribute affects
    type identity and is followed by one or more attributes that don't
    affect type identity (and then perhaps some further ones that do).

    There are two bugs.  One is that when we notice first attribute that
    doesn't affect type identity after first attribute that does affect type
    identity (with perhaps some further such attributes in the chain after it),
    we want to put into the new chain just attributes starting from
    (inclusive) first_ident and up to (exclusive) the current attribute a,
    but the code puts into the chain all attributes starting with first_ident,
    including the ones that do not affect type identity and if e.g. we have
    doesn't0 affects1 doesn't2 affects3 affects4 sequence of attributes, the
    resulting sequence would have
    affects1 doesn't2 affects3 affects4 affects3 affects4
    attributes, i.e. one attribute that shouldn't be there and two attributes
    duplicated.  That is fixed by the a2 -> a2 != a change.

    The second one is that we ICE once we see second attribute that doesn't
    affect type identity after an attribute that affects it.  That is because
    first_ident is set to error_mark_node after handling the first attribute
    that doesn't affect type identity (i.e. after we've copied the
    [first_ident, a) set of attributes to the new chain) to denote that from
    that time on, each attribute that affects type identity should be copied
    whenever it is seen (the if (as && as->affects_type_identity) code does
    that correctly).  But that condition is false and first_ident is
    error_mark_node, we enter else if (first_ident) and use TREE_PURPOSE
    /TREE_VALUE/TREE_CHAIN on error_mark_node, which ICEs.  When
    first_ident is error_mark_node and a doesn't affect type identity,
    we want to do nothing.  So that is the && first_ident != error_mark_node
    chunk.

    2021-10-05  Jakub Jelinek  <jakub@redhat.com>

            PR c++/102548
            * tree.c (apply_identity_attributes): Fix handling of the
            case where an attribute in the list doesn't affect type
            identity but some attribute before it does.

            * g++.target/i386/pr102548.C: New test.

    (cherry picked from commit 737f95bab557584d876f02779ab79fe3cfaacacf)

[Bug c++/102548] [9/10 Regression] ICE with cdecl attribute on a builtin function since r7-4737-g48330c9355e32a41

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102548

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.