[Bug rtl-optimization/105211] New: ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[Bug rtl-optimization/105211] New: ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105211

            Bug ID: 105211
           Summary: ICE: SIGSEGV in contains_struct_check (tree.h:3570)
                    with -Os -ffast-math and __builtin_roundf()
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: rtl-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 52775
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52775&action=edit
reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc -Os -ffast-math testcase.c -wrapper valgrind,-q
==23239== Invalid read of size 2
==23239==    at 0xE330C0: contains_struct_check (tree.h:3570)
==23239==    by 0xE330C0: build_call_nofold_loc(unsigned int, tree_node*, int,
...) (builtins.cc:2735)
==23239==    by 0xE39B22: expand_builtin_int_roundingfn_2(tree_node*, rtx_def*)
(builtins.cc:2974)
==23239==    by 0xE4A1AA: expand_builtin(tree_node*, rtx_def*, rtx_def*,
machine_mode, int) (builtins.cc:7085)
==23239==    by 0xFAD188: expand_expr_real_1(tree_node*, rtx_def*,
machine_mode, expand_modifier, rtx_def**, bool) (expr.cc:11536)
==23239==    by 0xFB9B3D: store_expr(tree_node*, rtx_def*, int, bool, bool)
(expr.cc:6087)
==23239==    by 0xFBB3F0: expand_assignment(tree_node*, tree_node*, bool)
[clone .part.0] (expr.cc:5819)
==23239==    by 0xE70EFC: expand_call_stmt (cfgexpand.cc:2829)
==23239==    by 0xE70EFC: expand_gimple_stmt_1 (cfgexpand.cc:3869)
==23239==    by 0xE70EFC: expand_gimple_stmt(gimple*) (cfgexpand.cc:4033)
==23239==    by 0xE7730E: expand_gimple_basic_block(basic_block_def*, bool)
(cfgexpand.cc:6080)
==23239==    by 0xE78F0F: (anonymous
namespace)::pass_expand::execute(function*) (cfgexpand.cc:6806)
==23239==    by 0x128A17A: execute_one_pass(opt_pass*) (passes.cc:2638)
==23239==    by 0x128AA3F: execute_pass_list_1(opt_pass*) (passes.cc:2738)
==23239==    by 0x128AA78: execute_pass_list(function*, opt_pass*)
(passes.cc:2749)
==23239==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==23239== 
during RTL pass: expand
testcase.c: In function 'foo':
testcase.c:4:10: internal compiler error: Segmentation fault
    4 |   return __builtin_roundf (f);
      |          ^~~~~~~~~~~~~~~~~~~~
0x13928ff crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:322
0xe330c0 contains_struct_check(tree_node*, tree_node_structure_enum, char
const*, int, char const*)
        /repo/gcc-trunk/gcc/tree.h:3570
0xe330c0 build_call_nofold_loc
        /repo/gcc-trunk/gcc/builtins.cc:2735
0xe39b22 expand_builtin_int_roundingfn_2
        /repo/gcc-trunk/gcc/builtins.cc:2974
0xe4a1aa expand_builtin(tree_node*, rtx_def*, rtx_def*, machine_mode, int)
        /repo/gcc-trunk/gcc/builtins.cc:7085
0xfad188 expand_expr_real_1(tree_node*, rtx_def*, machine_mode,
expand_modifier, rtx_def**, bool)
        /repo/gcc-trunk/gcc/expr.cc:11536
0xfb9b3d store_expr(tree_node*, rtx_def*, int, bool, bool)
        /repo/gcc-trunk/gcc/expr.cc:6087
0xfbb3f0 expand_assignment(tree_node*, tree_node*, bool)
        /repo/gcc-trunk/gcc/expr.cc:5819
0xe70efc expand_call_stmt
        /repo/gcc-trunk/gcc/cfgexpand.cc:2829
0xe70efc expand_gimple_stmt_1
        /repo/gcc-trunk/gcc/cfgexpand.cc:3869
0xe70efc expand_gimple_stmt
        /repo/gcc-trunk/gcc/cfgexpand.cc:4033
0xe7730e expand_gimple_basic_block
        /repo/gcc-trunk/gcc/cfgexpand.cc:6080
0xe78f0f execute
        /repo/gcc-trunk/gcc/cfgexpand.cc:6806
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r12-8072-20220410001634-g71cac7de8f1-checking-yes-rtl-df-extra-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/12.0.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r12-8072-20220410001634-g71cac7de8f1-checking-yes-rtl-df-extra-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 12.0.1 20220410 (experimental) (GCC)

[Bug rtl-optimization/105211] ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105211

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-04-10

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
ICEs since _Float32 has been implemented in
r7-2736-gc65699efcce48d68ef57ab3ce7fc5420fac5cbf9

[Bug rtl-optimization/105211] ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105211

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 52779
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52779&action=edit
gcc12-pr105211.patch

Untested fix.

[Bug rtl-optimization/105211] ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105211

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:91a38e8a848c61b2e23ee277306dc8cd194d135b

commit r12-8101-g91a38e8a848c61b2e23ee277306dc8cd194d135b
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Apr 12 09:16:06 2022 +0200

    builtins: Fix up expand_builtin_int_roundingfn_2 [PR105211]

    The expansion of __builtin_iround{,f,l} etc. builtins in some cases
    emits calls to a different fallback builtin.  To locate the right builtin
    it uses mathfn_built_in_1 with the type of the first argument.
    If its TYPE_MAIN_VARIANT is {float,double,long_double}_type_node, all is
    fine, but on the following testcase, because GIMPLE considers scalar
    float conversions between types with the same mode as useless,
    TYPE_MAIN_VARIANT of the arg's type is float32_type_node and because there
    isn't __builtin_lroundf32 returns NULL and we ICE.

    This patch will first try the type of the first argument of the builtin's
    prototype (so that say on sizeof(double)==sizeof(long double) target it
honors
    whether it was a *l or non-*l call; though even that can't be 100% trusted,
    user could incorrectly prototype it) and as fallback the type argument.
    If neither works, doesn't fallback.

    2022-04-11  Jakub Jelinek  <jakub@redhat.com>

            PR rtl-optimization/105211
            * builtins.cc (expand_builtin_int_roundingfn_2): If
mathfn_built_in_1
            fails for TREE_TYPE (arg), retry it with
            TREE_VALUE (TYPE_ARG_TYPES (TREE_TYPE (fndecl))) and if even that
            fails, emit call normally.

            * gcc.dg/pr105211.c: New test.

[Bug rtl-optimization/105211] ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105211

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk so far.

[Bug rtl-optimization/105211] ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105211

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:1e4dd03e3a39c65aa5d75df7dd51f4b7fbcc8daa

commit r11-9848-g1e4dd03e3a39c65aa5d75df7dd51f4b7fbcc8daa
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Apr 12 09:16:06 2022 +0200

    builtins: Fix up expand_builtin_int_roundingfn_2 [PR105211]

    The expansion of __builtin_iround{,f,l} etc. builtins in some cases
    emits calls to a different fallback builtin.  To locate the right builtin
    it uses mathfn_built_in_1 with the type of the first argument.
    If its TYPE_MAIN_VARIANT is {float,double,long_double}_type_node, all is
    fine, but on the following testcase, because GIMPLE considers scalar
    float conversions between types with the same mode as useless,
    TYPE_MAIN_VARIANT of the arg's type is float32_type_node and because there
    isn't __builtin_lroundf32 returns NULL and we ICE.

    This patch will first try the type of the first argument of the builtin's
    prototype (so that say on sizeof(double)==sizeof(long double) target it
honors
    whether it was a *l or non-*l call; though even that can't be 100% trusted,
    user could incorrectly prototype it) and as fallback the type argument.
    If neither works, doesn't fallback.

    2022-04-11  Jakub Jelinek  <jakub@redhat.com>

            PR rtl-optimization/105211
            * builtins.c (expand_builtin_int_roundingfn_2): If
mathfn_built_in_1
            fails for TREE_TYPE (arg), retry it with
            TREE_VALUE (TYPE_ARG_TYPES (TREE_TYPE (fndecl))) and if even that
            fails, emit call normally.

            * gcc.dg/pr105211.c: New test.

    (cherry picked from commit 91a38e8a848c61b2e23ee277306dc8cd194d135b)

[Bug rtl-optimization/105211] ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105211

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:b2a09805d7df2d3ba3b8f27161cc37809f37d27a

commit r10-10707-gb2a09805d7df2d3ba3b8f27161cc37809f37d27a
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Apr 12 09:16:06 2022 +0200

    builtins: Fix up expand_builtin_int_roundingfn_2 [PR105211]

    The expansion of __builtin_iround{,f,l} etc. builtins in some cases
    emits calls to a different fallback builtin.  To locate the right builtin
    it uses mathfn_built_in_1 with the type of the first argument.
    If its TYPE_MAIN_VARIANT is {float,double,long_double}_type_node, all is
    fine, but on the following testcase, because GIMPLE considers scalar
    float conversions between types with the same mode as useless,
    TYPE_MAIN_VARIANT of the arg's type is float32_type_node and because there
    isn't __builtin_lroundf32 returns NULL and we ICE.

    This patch will first try the type of the first argument of the builtin's
    prototype (so that say on sizeof(double)==sizeof(long double) target it
honors
    whether it was a *l or non-*l call; though even that can't be 100% trusted,
    user could incorrectly prototype it) and as fallback the type argument.
    If neither works, doesn't fallback.

    2022-04-11  Jakub Jelinek  <jakub@redhat.com>

            PR rtl-optimization/105211
            * builtins.c (expand_builtin_int_roundingfn_2): If
mathfn_built_in_1
            fails for TREE_TYPE (arg), retry it with
            TREE_VALUE (TYPE_ARG_TYPES (TREE_TYPE (fndecl))) and if even that
            fails, emit call normally.

            * gcc.dg/pr105211.c: New test.

    (cherry picked from commit 91a38e8a848c61b2e23ee277306dc8cd194d135b)

[Bug rtl-optimization/105211] ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105211

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:fd68b02744886b57ce852630c090857db48efd96

commit r9-10148-gfd68b02744886b57ce852630c090857db48efd96
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Apr 12 09:16:06 2022 +0200

    builtins: Fix up expand_builtin_int_roundingfn_2 [PR105211]

    The expansion of __builtin_iround{,f,l} etc. builtins in some cases
    emits calls to a different fallback builtin.  To locate the right builtin
    it uses mathfn_built_in_1 with the type of the first argument.
    If its TYPE_MAIN_VARIANT is {float,double,long_double}_type_node, all is
    fine, but on the following testcase, because GIMPLE considers scalar
    float conversions between types with the same mode as useless,
    TYPE_MAIN_VARIANT of the arg's type is float32_type_node and because there
    isn't __builtin_lroundf32 returns NULL and we ICE.

    This patch will first try the type of the first argument of the builtin's
    prototype (so that say on sizeof(double)==sizeof(long double) target it
honors
    whether it was a *l or non-*l call; though even that can't be 100% trusted,
    user could incorrectly prototype it) and as fallback the type argument.
    If neither works, doesn't fallback.

    2022-04-11  Jakub Jelinek  <jakub@redhat.com>

            PR rtl-optimization/105211
            * builtins.c (expand_builtin_int_roundingfn_2): If
mathfn_built_in_1
            fails for TREE_TYPE (arg), retry it with
            TREE_VALUE (TYPE_ARG_TYPES (TREE_TYPE (fndecl))) and if even that
            fails, emit call normally.

            * gcc.dg/pr105211.c: New test.

    (cherry picked from commit 91a38e8a848c61b2e23ee277306dc8cd194d135b)

[Bug rtl-optimization/105211] ICE: SIGSEGV in contains_struct_check (tree.h:3570) with -Os -ffast-math and __builtin_roundf()

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105211

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.