[Bug c/102762] New: ICE with -O2: Segmentation fault, memcpy, copy_bb

[Bug c/102762] New: ICE with -O2: Segmentation fault, memcpy, copy_bb

[cnsun at uwaterloo dot ca]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102762

            Bug ID: 102762
           Summary: ICE with -O2: Segmentation fault, memcpy, copy_bb
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: cnsun at uwaterloo dot ca
  Target Milestone: ---

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/scratch/software/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/configure
--enable-languages=c,c++,lto --enable-checking-yes --enable-multiarch
--prefix=/scratch/software/gcc-trunk --disable-bootstrap
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20211014 (experimental) [master -gee9fa8a57] (GCC)

$ cat mutant.c
foo(a, b) {
  log_bad_request(0, __builtin_va_arg_pack());
  foo(0);
}

$ gcc-trunk -w -O2 mutant.c
during IPA pass: inline
mutant.c: In function ‘foo’:
mutant.c:3:3: internal compiler error: Segmentation fault
    3 |   foo(0);
      |   ^~~~~~
0xf8c8d3 crash_signal
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/toplev.c:326
0x101972c memcpy
        /usr/include/x86_64-linux-gnu/bits/string_fortified.h:34
0x101972c copy_bb
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/tree-inline.c:2130
0x101aac2 copy_cfg_body
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/tree-inline.c:3070
0x101aac2 copy_body
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/tree-inline.c:3323
0x101dc06 expand_call_inline
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/tree-inline.c:5108
0x101f591 gimple_expand_calls_inline
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/tree-inline.c:5303
0x101f591 optimize_inline_calls(tree_node*)
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/tree-inline.c:5476
0xd2eddb inline_transform(cgraph_node*)
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/ipa-inline-transform.c:790
0xe93b34 execute_one_ipa_transform_pass
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/passes.c:2290
0xe93b34 execute_all_ipa_transforms(bool)
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/passes.c:2337
0xae3d29 cgraph_node::expand()
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/cgraphunit.c:1821
0xae514f expand_all_functions
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/cgraphunit.c:1992
0xae514f symbol_table::compile()
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/cgraphunit.c:2356
0xae802b symbol_table::compile()
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/cgraphunit.c:2269
0xae802b symbol_table::finalize_compilation_unit()
        /tmp/tmp.gzh6IUhxke-gcc-builder/gcc/gcc/cgraphunit.c:2537
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug ipa/102762] [10/11/12 Regression] ICE with -O2: Segmentation fault, memcpy, copy_bb

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102762

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |9.4.0
   Target Milestone|---                         |10.4
            Summary|ICE with -O2: Segmentation  |[10/11/12 Regression] ICE
                   |fault, memcpy, copy_bb      |with -O2: Segmentation
                   |                            |fault, memcpy, copy_bb
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-10-15
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed, this is invalid code since there is no varargs and foo is never
inlined.

[Bug ipa/102762] [10/11/12 Regression] ICE with -O2: Segmentation fault, memcpy, copy_bb

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102762

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |12.0
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixing the ICE is reasonably easy.

[Bug ipa/102762] [10/11/12 Regression] ICE with -O2: Segmentation fault, memcpy, copy_bb

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102762

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:11a4714860d2df6ba496d55379e7dc702d5fc425

commit r12-4430-g11a4714860d2df6ba496d55379e7dc702d5fc425
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Oct 15 08:41:57 2021 +0200

    ipa/102762 - fix ICE with invalid __builtin_va_arg_pack () use

    We have to be careful to not break the argument space calculation.
    If there's not enough arguments just do not append any.

    2021-10-15  Richard Biener  <rguenther@suse.de>

            PR ipa/102762
            * tree-inline.c (copy_bb): Avoid underflowing nargs.

            * gcc.dg/torture/pr102762.c: New testcase.

[Bug ipa/102762] [10/11 Regression] ICE with -O2: Segmentation fault, memcpy, copy_bb

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102762

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |12.0
            Summary|[10/11/12 Regression] ICE   |[10/11 Regression] ICE with
                   |with -O2: Segmentation      |-O2: Segmentation fault,
                   |fault, memcpy, copy_bb      |memcpy, copy_bb

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug ipa/102762] [10/11 Regression] ICE with -O2: Segmentation fault, memcpy, copy_bb

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102762

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:30c18bbfed2fae5ff89841172553951a74125f8e

commit r11-9226-g30c18bbfed2fae5ff89841172553951a74125f8e
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Oct 15 08:41:57 2021 +0200

    ipa/102762 - fix ICE with invalid __builtin_va_arg_pack () use

    We have to be careful to not break the argument space calculation.
    If there's not enough arguments just do not append any.

    2021-10-15  Richard Biener  <rguenther@suse.de>

            PR ipa/102762
            * tree-inline.c (copy_bb): Avoid underflowing nargs.

            * gcc.dg/torture/pr102762.c: New testcase.

    (cherry picked from commit 11a4714860d2df6ba496d55379e7dc702d5fc425)

[Bug ipa/102762] [10 Regression] ICE with -O2: Segmentation fault, memcpy, copy_bb

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102762

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:724177df8e159dc3f70cd0e13a598e10dd321f37

commit r10-10462-g724177df8e159dc3f70cd0e13a598e10dd321f37
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Oct 15 08:41:57 2021 +0200

    ipa/102762 - fix ICE with invalid __builtin_va_arg_pack () use

    We have to be careful to not break the argument space calculation.
    If there's not enough arguments just do not append any.

    2021-10-15  Richard Biener  <rguenther@suse.de>

            PR ipa/102762
            * tree-inline.c (copy_bb): Avoid underflowing nargs.

            * gcc.dg/torture/pr102762.c: New testcase.

    (cherry picked from commit 11a4714860d2df6ba496d55379e7dc702d5fc425)

[Bug ipa/102762] [10 Regression] ICE with -O2: Segmentation fault, memcpy, copy_bb

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102762

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
      Known to fail|                            |10.3.1
         Resolution|---                         |FIXED

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.