[Bug middle-end/104453] New: [9/10/11/12 Regression] ICE: SIGSEGV in handled_component_p with truncated input

[Bug middle-end/104453] New: [9/10/11/12 Regression] ICE: SIGSEGV in handled_component_p with truncated input

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104453

            Bug ID: 104453
           Summary: [9/10/11/12 Regression] ICE: SIGSEGV in
                    handled_component_p with truncated input
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-invalid-code
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 52382
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52382&action=edit
reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc -mavx512f testcase.c -wrapper valgrind,-q
testcase.c: In function 'foo':
testcase.c:7:33: error: expected ')' at end of input
    7 |   __builtin_ia32_psrawi256 (g, 0
      |                            ~    ^
      |                                 )
testcase.c:7:3: error: expected declaration or statement at end of input
    7 |   __builtin_ia32_psrawi256 (g, 0
      |   ^~~~~~~~~~~~~~~~~~~~~~~~
==13315== Invalid read of size 2
==13315==    at 0x1062CC4: handled_component_p (tree.h:5069)
==13315==    by 0x1062CC4: get_base_loadstore(tree_node*) (gimple-walk.cc:732)
==13315==    by 0x1063B70: walk_stmt_load_store_addr_ops(gimple*, void*, bool
(*)(gimple*, tree_node*, tree_node*, void*), bool (*)(gimple*, tree_node*,
tree_node*, void*), bool (*)(gimple*, tree_node*, tree_node*, void*))
(gimple-walk.cc:765)
==13315==    by 0xEA8CBA: record_stmt_references (cgraphbuild.cc:263)
==13315==    by 0xEA8CBA: (anonymous
namespace)::pass_build_cgraph_edges::execute(function*) (cgraphbuild.cc:330)
==13315==    by 0x127E0DA: execute_one_pass(opt_pass*) (passes.cc:2637)
==13315==    by 0x127E99F: execute_pass_list_1(opt_pass*) (passes.cc:2737)
==13315==    by 0x127E9D8: execute_pass_list(function*, opt_pass*)
(passes.cc:2748)
==13315==    by 0xEAB0FB: cgraph_node::analyze() (cgraphunit.cc:685)
==13315==    by 0xEADF97: analyze_functions(bool) (cgraphunit.cc:1240)
==13315==    by 0xEAEC2D: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2500)
==13315==    by 0x1386F3F: compile_file() (toplev.cc:479)
==13315==    by 0xCF54E8: do_compile (toplev.cc:2158)
==13315==    by 0xCF54E8: toplev::main(int, char**) (toplev.cc:2310)
==13315==    by 0xCF6C0A: main (main.cc:39)
==13315==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==13315== 
during GIMPLE pass: *build_cgraph_edges
testcase.c:5:1: internal compiler error: Segmentation fault
    5 | foo (void)
      | ^~~
0x1386c7f crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:322
0x1062cc4 handled_component_p
        /repo/gcc-trunk/gcc/tree.h:5069
0x1062cc4 get_base_loadstore
        /repo/gcc-trunk/gcc/gimple-walk.cc:732
0x1063b70 walk_stmt_load_store_addr_ops(gimple*, void*, bool (*)(gimple*,
tree_node*, tree_node*, void*), bool (*)(gimple*, tree_node*, tree_node*,
void*), bool (*)(gimple*, tree_node*, tree_node*, void*))
        /repo/gcc-trunk/gcc/gimple-walk.cc:765
0xea8cba cgraph_node::record_stmt_references(gimple*)
        /repo/gcc-trunk/gcc/cgraphbuild.cc:263
0xea8cba execute
        /repo/gcc-trunk/gcc/cgraphbuild.cc:330
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r12-7089-20220208123931-g0103c2e4082-checking-yes-rtl-df-extra-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/12.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r12-7089-20220208123931-g0103c2e4082-checking-yes-rtl-df-extra-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 12.0.1 20220208 (experimental) (GCC)

[Bug target/104453] [9/10/11/12 Regression] ICE: SIGSEGV in handled_component_p with truncated input

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104453

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|middle-end                  |target
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
   Last reconfirmed|                            |2022-02-09
           Priority|P3                          |P2
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
   Target Milestone|---                         |9.5

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
(gdb) p stmt
$1 = <gimple_assign 0x7ffff66f9280>
(gdb) p debug_gimple_stmt (stmt)
 = g.0_1;

ICK.  Mine, I have a patch.

[Bug target/104453] [9/10/11/12 Regression] ICE: SIGSEGV in handled_component_p with truncated input

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104453

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:1c827873ed283df282f2df11dfe0ff607e07dab3

commit r12-7122-g1c827873ed283df282f2df11dfe0ff607e07dab3
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Feb 9 08:48:35 2022 +0100

    target/104453 - guard call folding with NULL LHS

    This guards shift builtin folding to do nothing when there is
    no LHS, similar to what other foldings do.

    2022-02-09  Richard Biener  <rguenther@suse.de>

            PR target/104453
            * config/i386/i386.cc (ix86_gimple_fold_builtin): Guard shift
            folding for NULL LHS.

            * gcc.target/i386/pr104453.c: New testcase.

[Bug target/104453] [9/10/11 Regression] ICE: SIGSEGV in handled_component_p with truncated input

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104453

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|12.0                        |
            Summary|[9/10/11/12 Regression]     |[9/10/11 Regression] ICE:
                   |ICE: SIGSEGV in             |SIGSEGV in
                   |handled_component_p with    |handled_component_p with
                   |truncated input             |truncated input
      Known to work|                            |12.0
           Keywords|error-recovery,             |ice-on-valid-code
                   |ice-on-invalid-code         |

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Also ICEs with the valid testcase I added to the testsuite.

[Bug target/104453] [9/10/11 Regression] ICE: SIGSEGV in handled_component_p with truncated input

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104453

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:070bb453f1c0fa47a62a7b0cdeed397e889600f6

commit r11-9659-g070bb453f1c0fa47a62a7b0cdeed397e889600f6
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Feb 9 08:48:35 2022 +0100

    target/104453 - guard call folding with NULL LHS

    This guards shift builtin folding to do nothing when there is
    no LHS, similar to what other foldings do.

    2022-02-09  Richard Biener  <rguenther@suse.de>

            PR target/104453
            * config/i386/i386.c (ix86_gimple_fold_builtin): Guard shift
            folding for NULL LHS.

            * gcc.target/i386/pr104453.c: New testcase.

    (cherry picked from commit 1c827873ed283df282f2df11dfe0ff607e07dab3)

[Bug target/104453] [9/10 Regression] ICE: SIGSEGV in handled_component_p with truncated input

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104453

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:807bfd4357609655c81d0a3282b699b10e7aeb5a

commit r10-10501-g807bfd4357609655c81d0a3282b699b10e7aeb5a
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Feb 9 08:48:35 2022 +0100

    target/104453 - guard call folding with NULL LHS

    This guards shift builtin folding to do nothing when there is
    no LHS, similar to what other foldings do.

    2022-02-09  Richard Biener  <rguenther@suse.de>

            PR target/104453
            * config/i386/i386.c (ix86_gimple_fold_builtin): Guard shift
            folding for NULL LHS.

            * gcc.target/i386/pr104453.c: New testcase.

    (cherry picked from commit 1c827873ed283df282f2df11dfe0ff607e07dab3)

[Bug target/104453] [9/10 Regression] ICE: SIGSEGV in handled_component_p with truncated input

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104453

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:48fde80dea1fd59db34d0723427c41d0fb1ad951

commit r9-9985-g48fde80dea1fd59db34d0723427c41d0fb1ad951
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Feb 9 08:48:35 2022 +0100

    target/104453 - guard call folding with NULL LHS

    This guards shift builtin folding to do nothing when there is
    no LHS, similar to what other foldings do.

    2022-02-09  Richard Biener  <rguenther@suse.de>

            PR target/104453
            * config/i386/i386.c (ix86_gimple_fold_builtin): Guard shift
            folding for NULL LHS.

            * gcc.target/i386/pr104453.c: New testcase.

    (cherry picked from commit 1c827873ed283df282f2df11dfe0ff607e07dab3)

[Bug target/104453] [9/10 Regression] ICE: SIGSEGV in handled_component_p with truncated input

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104453

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
      Known to work|                            |10.3.1, 9.4.1
      Known to fail|10.3.1, 9.4.1               |10.3.0, 9.4.0

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.