[Bug c/103314] New: ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault

[Bug c/103314] New: ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

            Bug ID: 103314
           Summary: ICE on valid code at -O1 and above on
                    x86_64-linux-gnu: Segmentation fault
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zhendong.su at inf dot ethz.ch
  Target Milestone: ---

It seems to be a recent regression.

[585] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-languages=c,c++
--disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20211118 (experimental) [master r12-5359-g280d2838c11] (GCC) 
[586] % 
[586] % gcctk -O0 small.c; ./a.out
[587] % 
[587] % gcc110 -O1 small.c; ./a.out
small.c: In function ‘main’:
small.c:3:37: warning: right shift count is negative [-Wshift-count-negative]
    3 |   unsigned c = 0, d = c ? 1 ^ c ^ 1 >> a : 0;
      |                                   ~~^~~~
[588] % 
[588] % gcctk -O1 small.c
small.c: In function ‘main’:
small.c:3:37: warning: right shift count is negative [-Wshift-count-negative]
    3 |   unsigned c = 0, d = c ? 1 ^ c ^ 1 >> a : 0;
      |                                   ~~^~~~
gcctk: internal compiler error: Segmentation fault signal terminated program
cc1
Please submit a full bug report,
with preprocessed source if appropriate.
See <https://gcc.gnu.org/bugs/> for instructions.
[589] % 
[589] % cat small.c
const int a = -1;
int main() {
  unsigned c = 0, d = c ? 1 ^ c ^ 1 >> a : 0;
  return 0;
}

[Bug c/103314] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

--- Comment #1 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
BT below:

#0  0x00000000011ee287 in wi::fits_to_tree_p<poly_int<1u,
generic_wide_int<wide_int_ref_storage<false, true> > > > (x=..., 
    type=0x7ffff65f15e8) at ../../gcc-trunk/gcc/tree.h:6263
#1  0x00000000011ddf6f in force_fit_type (type=type@entry=0x7ffff65f15e8,
cst=..., overflowable=1, overflowed=<optimized out>)
    at ../../gcc-trunk/gcc/tree.c:1558
#2  0x0000000000a98fba in fold_convert_const_int_from_int (arg1=0x7ffff6720450,
type=0x7ffff65f15e8)
    at ../../gcc-trunk/gcc/fold-const.c:2002
#3  fold_convert_const (code=code@entry=NOP_EXPR,
type=type@entry=0x7ffff65f15e8, arg1=arg1@entry=0x7ffff6720450)
    at ../../gcc-trunk/gcc/fold-const.c:2284
#4  0x0000000000ab9885 in const_unop (code=code@entry=NOP_EXPR,
type=type@entry=0x7ffff65f15e8, arg0=arg0@entry=0x7ffff6720450)
    at ../../gcc-trunk/gcc/fold-const.c:1741
#5  0x0000000000aadd2d in fold_unary_loc (loc=loc@entry=2147483650,
code=code@entry=NOP_EXPR, type=type@entry=0x7ffff65f15e8, 
    op0=op0@entry=0x7ffff6720450) at ../../gcc-trunk/gcc/fold-const.c:9245
#6  0x0000000000ab00ea in fold_build1_loc (loc=loc@entry=2147483650,
code=code@entry=NOP_EXPR, type=0x7ffff65f15e8, 
    op0=0x7ffff6720450) at ../../gcc-trunk/gcc/fold-const.c:13728
#7  0x0000000001572dcf in generic_simplify_359 (loc=loc@entry=2147483650,
type=type@entry=0x7ffff65f1690, 
    captures=0x7ffffbfff7a0, bitop=bitop@entry=BIT_XOR_EXPR,
_p1=0x7ffff6720450, _p0=0x7ffff61a33a0) at generic-match.c:18945
#8  0x000000000161f20e in generic_simplify_BIT_XOR_EXPR (loc=2147483650,
type=type@entry=0x7ffff65f1690, 
    _p0=_p0@entry=0x7ffff61a33a0, _p1=_p1@entry=0x7ffff6720450,
code=BIT_XOR_EXPR) at generic-match.c:42342
#9  0x000000000166995e in generic_simplify (loc=loc@entry=2147483650,
code=code@entry=BIT_XOR_EXPR, 
    type=type@entry=0x7ffff65f1690, _p0=_p0@entry=0x7ffff61a33a0,
_p1=_p1@entry=0x7ffff6720450) at generic-match.c:84379
#10 0x0000000000aa2946 in fold_binary_loc (loc=loc@entry=2147483650,
code=code@entry=BIT_XOR_EXPR, 
    type=type@entry=0x7ffff65f1690, op0=op0@entry=0x7ffff61a33a0,
op1=op1@entry=0x7ffff6720450)
    at ../../gcc-trunk/gcc/fold-const.c:10822
#11 0x0000000000aabd3b in fold_build2_loc (loc=2147483650, code=BIT_XOR_EXPR,
type=0x7ffff65f1690, op0=0x7ffff61a33a0, 
    op1=0x7ffff6720450) at ../../gcc-trunk/gcc/fold-const.c:13774
#12 0x0000000000aa34cc in fold_binary_loc (loc=loc@entry=2147483650,
code=code@entry=BIT_XOR_EXPR, 
    type=type@entry=0x7ffff65f1690, op0=op0@entry=0x7ffff7ff6cf0,
op1=op1@entry=0x7ffff61a3380)
    at ../../gcc-trunk/gcc/fold-const.c:11365
#13 0x0000000000aabd3b in fold_build2_loc (loc=2147483650, code=BIT_XOR_EXPR,
type=0x7ffff65f1690, op0=0x7ffff7ff6cf0, 
    op1=0x7ffff61a3380) at ../../gcc-trunk/gcc/fold-const.c:13774
#14 0x0000000000aa35a9 in fold_binary_loc (loc=loc@entry=2147483650,
code=code@entry=BIT_XOR_EXPR, 
    type=type@entry=0x7ffff65f1690, op0=op0@entry=0x7ffff7ff6cf0,
op1=op1@entry=0x7ffff61a3340)
    at ../../gcc-trunk/gcc/fold-const.c:11397
#15 0x0000000000aabd3b in fold_build2_loc (loc=2147483650, code=BIT_XOR_EXPR,
type=0x7ffff65f1690, op0=0x7ffff7ff6cf0, 
    op1=0x7ffff61a3340) at ../../gcc-trunk/gcc/fold-const.c:13774
#16 0x0000000000aa35a9 in fold_binary_loc (loc=loc@entry=2147483650,
code=code@entry=BIT_XOR_EXPR, 
    type=type@entry=0x7ffff65f1690, op0=op0@entry=0x7ffff7ff6cf0,
op1=op1@entry=0x7ffff61a3300)
    at ../../gcc-trunk/gcc/fold-const.c:11397
#17 0x0000000000aabd3b in fold_build2_loc (loc=2147483650, code=BIT_XOR_EXPR,
type=0x7ffff65f1690, op0=0x7ffff7ff6cf0, 
    op1=0x7ffff61a3300) at ../../gcc-trunk/gcc/fold-const.c:13774
#18 0x0000000000aa35a9 in fold_binary_loc (loc=loc@entry=2147483650,
code=code@entry=BIT_XOR_EXPR, 
    type=type@entry=0x7ffff65f1690, op0=op0@entry=0x7ffff7ff6cf0,
op1=op1@entry=0x7ffff61a32c0)
    at ../../gcc-trunk/gcc/fold-const.c:11397
#19 0x0000000000aabd3b in fold_build2_loc (loc=2147483650, code=BIT_XOR_EXPR,
type=0x7ffff65f1690, op0=0x7ffff7ff6cf0, 
    op1=0x7ffff61a32c0) at ../../gcc-trunk/gcc/fold-const.c:13774
#20 0x0000000000aa35a9 in fold_binary_loc (loc=loc@entry=2147483650,
code=code@entry=BIT_XOR_EXPR, 
    type=type@entry=0x7ffff65f1690, op0=op0@entry=0x7ffff7ff6cf0,
op1=op1@entry=0x7ffff61a3280)
    at ../../gcc-trunk/gcc/fold-const.c:11397
#21 0x0000000000aabd3b in fold_build2_loc (loc=2147483650, code=BIT_XOR_EXPR,
type=0x7ffff65f1690, op0=0x7ffff7ff6cf0, 
    op1=0x7ffff61a3280) at ../../gcc-trunk/gcc/fold-const.c:13774
#22 0x0000000000aa35a9 in fold_binary_loc (loc=loc@entry=2147483650,
code=code@entry=BIT_XOR_EXPR, 
    type=type@entry=0x7ffff65f1690, op0=op0@entry=0x7ffff7ff6cf0,
op1=op1@entry=0x7ffff61a3240)
    at ../../gcc-trunk/gcc/fold-const.c:11397

[Bug middle-end/103314] [12 regression] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED
            Summary|ICE on valid code at -O1    |[12 regression] ICE on
                   |and above on                |valid code at -O1 and above
                   |x86_64-linux-gnu:           |on x86_64-linux-gnu:
                   |Segmentation fault          |Segmentation fault
           Priority|P3                          |P1
           Assignee|unassigned at gcc dot gnu.org      |pinskia at gcc dot gnu.org
   Target Milestone|---                         |12.0
          Component|c                           |middle-end
   Last reconfirmed|                            |2021-11-18

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Mine.

[Bug middle-end/103314] [12 regression] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault since r12-5358

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
            Summary|[12 regression] ICE on      |[12 regression] ICE on
                   |valid code at -O1 and above |valid code at -O1 and above
                   |on x86_64-linux-gnu:        |on x86_64-linux-gnu:
                   |Segmentation fault          |Segmentation fault since
                   |                            |r12-5358

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r12-5358-g32221357007666124409ec3ee0d3a1cf263ebc9e

[Bug middle-end/103314] [12 regression] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault since r12-5358

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I bet the TYPE_PRECISION (TREE_TYPE (@0)) == TYPE_PRECISION (type)
case should only be allowed if @1 != @3, i.e. when the bitop initially has 2
conversions and turns it into just one, otherwise it will ping-pong endlessly.

[Bug middle-end/103314] [12 regression] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault since r12-5358

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Simplified testcase:
int main() {
  unsigned c = 0, d = c ? 1 ^ c ^ 1 >> (-1) : 0;
  return c;
}

The problem is we get:
#3  0x0000000000b5aa2d in fold_binary_loc(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*) () at
/home/apinski/src/upstream-gcc/gcc/gcc/fold-const.c:10822
10822     tem = generic_simplify (loc, code, type, op0, op1);
$1 = void
(gdb) p debug_generic_expr(op0)
(unsigned int) (1 >> -1)
$2 = void
(gdb) p debug_generic_expr(op1)
1
$3 = void
(gdb) op code
Undefined command: "op".  Try "help".
(gdb) p code
$4 = BIT_XOR_EXPR

Which we produce:
(unsigned int) ((1 >> -1) ^ 1)

But the code in fold_binary_loc comes a long and decides we should
reassociative this and it just goes back and forth or deciding which is
correct.

So doing this instead:
           TYPE_PRECISION (TREE_TYPE (@0)) < TYPE_PRECISION (type)
           || (GIMPLE && TYPE_PRECISION (TREE_TYPE (@0)) == TYPE_PRECISION
(type))

Fixes the problem and we should not run into the back and forth issue.

[Bug middle-end/103314] [12 regression] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault since r12-5358

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #5)
> Fixes the problem and we should not run into the back and forth issue.

Oh and it only happens with this undefined (at runtime) code :).

[Bug middle-end/103314] [12 regression] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault since r12-5358

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch
                URL|                            |https://gcc.gnu.org/piperma
                   |                            |il/gcc-patches/2021-Novembe
                   |                            |r/584935.html

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Patch submitted:
https://gcc.gnu.org/pipermail/gcc-patches/2021-November/584935.html

[Bug middle-end/103314] [12 regression] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault since r12-5358

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The trunk branch has been updated by Andrew Pinski <pinskia@gcc.gnu.org>:

https://gcc.gnu.org/g:ea2954df43d4162af23a20c84f4c5485463977ac

commit r12-5400-gea2954df43d4162af23a20c84f4c5485463977ac
Author: Andrew Pinski <apinski@marvell.com>
Date:   Fri Nov 19 01:42:41 2021 +0000

    Fix tree-optimization/103314 : Limit folding of (type) X op CST where type
is a nop convert to gimple

    There is some re-association code in fold_binary which conflicts with
    this optimization due keeping around some "constants" which are not
    INTEGER_CST (1 << -1) so we end up in an infinite loop because of that.
    So we need to limit this case to GIMPLE level only.

    OK? Bootstrapped and tested on x86_64-linux-gnu with no regressions.

            PR tree-optimization/103314

    gcc/ChangeLog:

            * match.pd ((type) X op CST): Restrict the equal
            TYPE_PRECISION case to GIMPLE only.

    gcc/testsuite/ChangeLog:

            * gcc.c-torture/compile/pr103314-1.c: New test.

[Bug middle-end/103314] [12 regression] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault since r12-5358

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Fixed.

[Bug middle-end/103314] [12 regression] ICE on valid code at -O1 and above on x86_64-linux-gnu: Segmentation fault since r12-5358

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103314

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |k.even-mendoza at imperial dot ac.
                   |                            |uk

--- Comment #10 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 103493 has been marked as a duplicate of this bug. ***