[Bug c/104505] New: ICE: SIGSEGV in c_pretty_printer::postfix_expression() on invalid code

[Bug c/104505] New: ICE: SIGSEGV in c_pretty_printer::postfix_expression() on invalid code

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104505

            Bug ID: 104505
           Summary: ICE: SIGSEGV in c_pretty_printer::postfix_expression()
                    on invalid code
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-invalid-code
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 52417
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52417&action=edit
reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc testcase.c -wrapper valgrind,-q
==19778== Invalid read of size 2
==19778==    at 0xDF9304: c_pretty_printer::postfix_expression(tree_node*)
(c-pretty-print.cc:1584)
==19778==    by 0xDF9859: c_pretty_printer::postfix_expression(tree_node*)
(c-pretty-print.cc:1604)
==19778==    by 0xD5842D: c_tree_printer (c-objc-common.cc:308)
==19778==    by 0xD5842D: c_tree_printer(pretty_printer*, text_info*, char
const*, int, bool, bool, bool, bool*, char const**) (c-objc-common.cc:258)
==19778==    by 0x253CE9C: pp_format(pretty_printer*, text_info*)
(pretty-print.cc:1475)
==19778==    by 0x251ED02: diagnostic_report_diagnostic(diagnostic_context*,
diagnostic_info*) (diagnostic.cc:1384)
==19778==    by 0x251F287: diagnostic_impl(rich_location*, diagnostic_metadata
const*, int, char const*, __va_list_tag (*) [1], diagnostic_t)
(diagnostic.cc:1546)
==19778==    by 0x251FC3F: error_at(unsigned int, char const*, ...)
(diagnostic.cc:1869)
==19778==    by 0xDCB5D0: c_build_shufflevector(unsigned int, tree_node*,
tree_node*, vec<tree_node*, va_heap, vl_ptr> const&, bool) (c-common.cc:1189)
==19778==    by 0xD66819: c_parser_postfix_expression(c_parser*)
(c-parser.cc:10075)
==19778==    by 0xD687AA: c_parser_unary_expression(c_parser*)
(c-parser.cc:8261)
==19778==    by 0xD69F41: c_parser_cast_expression(c_parser*, c_expr*)
(c-parser.cc:8103)
==19778==    by 0xD6A1AE: c_parser_binary_expression(c_parser*, c_expr*,
tree_node*) (c-parser.cc:7906)
==19778==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==19778== 
'
In function 'foo':
Segmentation fault
    9 |   u = __builtin_shufflevector (u, u, __builtin_convertvector (v, U));
      |   ^
0x13994df crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:322
0xdf9304 c_pretty_printer::postfix_expression(tree_node*)
        /repo/gcc-trunk/gcc/c-family/c-pretty-print.cc:1584
0xdf9859 c_pretty_printer::postfix_expression(tree_node*)
        /repo/gcc-trunk/gcc/c-family/c-pretty-print.cc:1604
0xd5842d c_tree_printer
        /repo/gcc-trunk/gcc/c/c-objc-common.cc:308
0xd5842d c_tree_printer
        /repo/gcc-trunk/gcc/c/c-objc-common.cc:258
0x253ce9c pp_format(pretty_printer*, text_info*)
        /repo/gcc-trunk/gcc/pretty-print.cc:1475
0x251ed02 diagnostic_report_diagnostic(diagnostic_context*, diagnostic_info*)
        /repo/gcc-trunk/gcc/diagnostic.cc:1384
0x251f287 diagnostic_impl
        /repo/gcc-trunk/gcc/diagnostic.cc:1546
0x251fc3f error_at(unsigned int, char const*, ...)
        /repo/gcc-trunk/gcc/diagnostic.cc:1869
0xdcb5d0 c_build_shufflevector(unsigned int, tree_node*, tree_node*,
vec<tree_node*, va_heap, vl_ptr> const&, bool)
        /repo/gcc-trunk/gcc/c-family/c-common.cc:1189
0xd66819 c_parser_postfix_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:10075
0xd687aa c_parser_unary_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:8261
0xd69f41 c_parser_cast_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:8103
0xd6a1ae c_parser_binary_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:7906
0xd6b63b c_parser_conditional_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:7606
0xd6be60 c_parser_expr_no_commas
        /repo/gcc-trunk/gcc/c/c-parser.cc:7521
0xd6bf1b c_parser_expr_no_commas
        /repo/gcc-trunk/gcc/c/c-parser.cc:7564
0xd6c0d1 c_parser_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:10697
0xd6c838 c_parser_expression_conv
        /repo/gcc-trunk/gcc/c/c-parser.cc:10736
0xd61817 c_parser_statement_after_labels
        /repo/gcc-trunk/gcc/c/c-parser.cc:6263
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

Compiling as C++ doesn't ICE, though the diagnostics exposes gcc internals:
$ x86_64-pc-linux-gnu-gcc -xc++ testcase.c
testcase.c: In function 'void foo(V)':
testcase.c:9:7: error: invalid element index 'VEC_CONVERT(v)' to
'__builtin_shufflevector'
    9 |   u = __builtin_shufflevector (u, u, __builtin_convertvector (v, U));
      |       ^~~~~~~~~~~~~~~~~~~~~~~


$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r12-7199-20220211084605-gcc68ad87014-checking-yes-rtl-df-extra-nobootstrap-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/12.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r12-7199-20220211084605-gcc68ad87014-checking-yes-rtl-df-extra-nobootstrap-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 12.0.1 20220211 (experimental) (GCC)

[Bug c/104505] ICE: SIGSEGV in c_pretty_printer::postfix_expression() on invalid code

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104505

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-02-13
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.

[Bug c/104505] ICE: SIGSEGV in c_pretty_printer::postfix_expression() on invalid code

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104505

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

[Bug c/104505] ICE: SIGSEGV in c_pretty_printer::postfix_expression() on invalid code

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104505

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:f7e26913187ce0ed35e340c4fd14104bbcd1932e

commit r12-7223-gf7e26913187ce0ed35e340c4fd14104bbcd1932e
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Feb 14 09:29:20 2022 +0100

    c/104505 - ICE with internal function call in diagnostic expression

    The following handles internal function calls similar to how the
    C++ frontend does, avoiding ICEing on those.

    2022-02-14  Richard Biener  <rguenther@suse.de>

            PR c/104505
    gcc/c-family/
            * c-pretty-print.cc (c_pretty_printer::postfix_expression): Handle
            internal function calls.

    gcc/testsuite/
            * c-c++-common/pr104505.c: New testcase.

[Bug c/104505] ICE: SIGSEGV in c_pretty_printer::postfix_expression() on invalid code

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=104505

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|12.0                        |
      Known to work|                            |12.0
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed but generally latent.