[Bug c/105232] New: ICE in tree_to_poly_int64, at tree.cc:3224

[Bug c/105232] New: ICE in tree_to_poly_int64, at tree.cc:3224

[k.even-mendoza at imperial dot ac.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105232

            Bug ID: 105232
           Summary: ICE in tree_to_poly_int64, at tree.cc:3224
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: k.even-mendoza at imperial dot ac.uk
  Target Milestone: ---

The following code crashed gcc-12 with all flags, and gcc-11 with -O1, -O2, -O3
and -Os but works fine with -O0. gcc-10 and below works fine.

===
c;
#define d(expr, e)                                                            
\
  char *f = expr;                                                             
\
  strlen(f) ?: ++c;
struct {
  char a[0], b[1537228674000000000]
} cma[] = {{}, {}, {}, {}, {}, {}};
g() { d(cma[4].a, ) }
===

crashed with:
/home/user42/data/gcc-csmith-1201/gcc-install/bin/gcc -O2 fuzzer-file-3200.c
...
fuzzer-file-3200-1.c:8:7: note: in expansion of macro ‘d’
    8 | g() { d(cma[4].a, ) }
      |       ^
during GIMPLE pass: waccess
fuzzer-file-3200-1.c:8:1: internal compiler error: in tree_to_poly_int64, at
tree.cc:3224
    8 | g() { d(cma[4].a, ) }
      | ^
0x7e75cb tree_to_poly_int64(tree_node const*)
        .././../gcc-source/gcc/tree.cc:3224
0x7e75cb tree_to_poly_int64(tree_node const*)
        .././../gcc-source/gcc/tree.cc:3222
...
0xc0ffb8 check_builtin
        .././../gcc-source/gcc/gimple-ssa-warn-access.cc:3181
0xc0ffb8 check_call
        .././../gcc-source/gcc/gimple-ssa-warn-access.cc:4280
0xc0ffb8 check_block
        .././../gcc-source/gcc/gimple-ssa-warn-access.cc:4393
0xc0ffb8 execute
        .././../gcc-source/gcc/gimple-ssa-warn-access.cc:4742

===========================
With -O0 it ends without crashing and prints the right error:
gcc-11 -O0 fuzzer-file-3200.c
...
fuzzer-file-3200.c:8:7: note: in expansion of macro ‘d’
    8 | g() { d(cma[4].a, ) }
      |       ^
fuzzer-file-3200.c: At top level:
fuzzer-file-3200.c:7:3: error: size of variable ‘cma’ is too large
    7 | } cma[] = {{}, {}, {}, {}, {}, {}};

[Bug tree-optimization/105232] [11/12 Regression] ICE in tree_to_poly_int64 via check_builtin

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105232

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.3
            Summary|ICE in tree_to_poly_int64,  |[11/12 Regression] ICE in
                   |at tree.cc:3224             |tree_to_poly_int64 via
                   |                            |check_builtin
           Keywords|                            |diagnostic,
                   |                            |ice-on-valid-code
          Component|c                           |tree-optimization

[Bug tree-optimization/105232] [11/12 Regression] ICE in tree_to_poly_int64 via check_builtin

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105232

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |msebor at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-04-12

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r11-2928-gd14c547abd484d35.

[Bug tree-optimization/105232] [11/12 Regression] ICE in tree_to_poly_int64 via check_builtin

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105232

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Testing a patch.

[Bug tree-optimization/105232] [11/12 Regression] ICE in tree_to_poly_int64 via check_builtin

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105232

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

[Bug tree-optimization/105232] [11/12 Regression] ICE in tree_to_poly_int64 via check_builtin

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105232

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:1bd96873cf73c4f59de48e9bc0d17a498f1ede04

commit r12-8105-g1bd96873cf73c4f59de48e9bc0d17a498f1ede04
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Apr 12 09:54:32 2022 +0200

    tree-optimization/105232 - handle overly large sizes in component_ref_size

    The following properly checks tree_fits_poly_int64_p before converting
    a size to a poly_int64.

    2022-04-12  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105232
            * tree.cc (component_ref_size): Bail out for too large
            or non-constant sizes.

[Bug tree-optimization/105232] [11 Regression] ICE in tree_to_poly_int64 via check_builtin

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105232

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[11/12 Regression] ICE in   |[11 Regression] ICE in
                   |tree_to_poly_int64 via      |tree_to_poly_int64 via
                   |check_builtin               |check_builtin
      Known to work|                            |12.0
           Priority|P3                          |P2

[Bug tree-optimization/105232] [11 Regression] ICE in tree_to_poly_int64 via check_builtin

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105232

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:008d568ac7eba4057172c52d306e09d174041c59

commit r11-9813-g008d568ac7eba4057172c52d306e09d174041c59
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Apr 12 09:54:32 2022 +0200

    tree-optimization/105232 - handle overly large sizes in component_ref_size

    The following properly checks tree_fits_poly_int64_p before converting
    a size to a poly_int64.

    2022-04-12  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105232
            * tree.c (component_ref_size): Bail out for too large
            or non-constant sizes.

    (cherry picked from commit 1bd96873cf73c4f59de48e9bc0d17a498f1ede04)

[Bug tree-optimization/105232] [11 Regression] ICE in tree_to_poly_int64 via check_builtin

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105232

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |11.2.0
             Status|ASSIGNED                    |RESOLVED
      Known to work|                            |11.2.1
         Resolution|---                         |FIXED

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.