[Bug tree-optimization/105431] New: ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[Bug tree-optimization/105431] New: ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

            Bug ID: 105431
           Summary: ICE: SIGSEGV in powi_as_mults_1
                    (tree-ssa-math-opts.cc:1512) with -Ofast and
                    __builtin_pow()
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 52903
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=52903&action=edit
reduced testcase

This might be related to PR105368; on 11-branch and older, the other PR is
triggered. The failing address is also very similar to the other PR.

This fails for me only with a bootstrapped compiler; there might be another UB
that is exploited only when bootstrapping.

$ x86_64-pc-linux-gnu-gcc -Ofast testcase.c -wrapper valgrind,-q
==24694== Invalid read of size 1
==24694==    at 0x158683D: powi_as_mults_1(gimple_stmt_iterator*, unsigned int,
tree_node*, long, tree_node**) (tree-ssa-math-opts.cc:1512)
==24694==    by 0x158B56E: powi_as_mults(gimple_stmt_iterator*, unsigned int,
tree_node*, long) (tree-ssa-math-opts.cc:1551)
==24694==    by 0x158C8B1: gimple_expand_builtin_pow(gimple_stmt_iterator*,
unsigned int, tree_node*, tree_node*) (tree-ssa-math-opts.cc:2049)
==24694==    by 0x158CF59: (anonymous
namespace)::pass_cse_sincos::execute(function*) (tree-ssa-math-opts.cc:2317)
==24694==    by 0x12EB49A: execute_one_pass(opt_pass*) (passes.cc:2638)
==24694==    by 0x12EBD5F: execute_pass_list_1(opt_pass*) (passes.cc:2738)
==24694==    by 0x12EBD71: execute_pass_list_1(opt_pass*) (passes.cc:2739)
==24694==    by 0x12EBD98: execute_pass_list(function*, opt_pass*)
(passes.cc:2749)
==24694==    by 0xF15F75: expand (cgraphunit.cc:1835)
==24694==    by 0xF15F75: cgraph_node::expand() (cgraphunit.cc:1788)
==24694==    by 0xF17536: expand_all_functions (cgraphunit.cc:1999)
==24694==    by 0xF17536: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2349)
==24694==    by 0xF1A117: compile (cgraphunit.cc:2262)
==24694==    by 0xF1A117: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2530)
==24694==    by 0x13F3E1F: compile_file() (toplev.cc:479)
==24694==  Address 0x80000000028ce240 is not stack'd, malloc'd or (recently)
free'd
==24694== 
during GIMPLE pass: sincos
testcase.c: In function 'foo':
testcase.c:2:1: internal compiler error: Segmentation fault
    2 | foo (int i)
      | ^~~
0x13f3b5f crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:322
0x158683d powi_as_mults_1
        /repo/gcc-trunk/gcc/tree-ssa-math-opts.cc:1512
0x158b56e powi_as_mults(gimple_stmt_iterator*, unsigned int, tree_node*, long)
        /repo/gcc-trunk/gcc/tree-ssa-math-opts.cc:1551
0x158c8b1 gimple_expand_builtin_pow
        /repo/gcc-trunk/gcc/tree-ssa-math-opts.cc:2049
0x158cf59 execute
        /repo/gcc-trunk/gcc/tree-ssa-math-opts.cc:2317
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-trunk-r13-21-20220428204650-g9ae8b993cd3-checking-yes-rtl-df-extra-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r13-21-20220428204650-g9ae8b993cd3-checking-yes-rtl-df-extra-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r13-21-20220428204650-g9ae8b993cd3-checking-yes-rtl-df-extra-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.0.0 20220428 (experimental) (GCC)

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
I can't reproduce in my dev tree but I guess the following will fix it?

diff --git a/gcc/tree-ssa-math-opts.cc b/gcc/tree-ssa-math-opts.cc
index 7555793948e..f3efd1ef4b2 100644
--- a/gcc/tree-ssa-math-opts.cc
+++ b/gcc/tree-ssa-math-opts.cc
@@ -1495,7 +1495,7 @@ powi_cost (HOST_WIDE_INT n)

 static tree
 powi_as_mults_1 (gimple_stmt_iterator *gsi, location_t loc, tree type,
-                HOST_WIDE_INT n, tree *cache)
+                unsigned HOST_WIDE_INT n, tree *cache)
 {
   tree op0, op1, ssa_target;
   unsigned HOST_WIDE_INT digit;
@@ -1548,7 +1548,7 @@ powi_as_mults (gimple_stmt_iterator *gsi, location_t loc,
   memset (cache, 0, sizeof (cache));
   cache[1] = arg0;

-  result = powi_as_mults_1 (gsi, loc, type, (n < 0) ? -n : n, cache);
+  result = powi_as_mults_1 (gsi, loc, type, absu_hwi (n), cache);
   if (n >= 0)
     return result;

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-04-29
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |ASSIGNED

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
While you touch it, shouldn't e.g.
  /* Avoid largest negative number.  */
  if (n != -n
be fixed as well (don't we fold that as n != 0?)?

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

--- Comment #3 from rguenther at suse dot de <rguenther at suse dot de> ---
On Fri, 29 Apr 2022, jakub at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431
> 
> Jakub Jelinek <jakub at gcc dot gnu.org> changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>                  CC|                            |jakub at gcc dot gnu.org
> 
> --- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
> While you touch it, shouldn't e.g.
>   /* Avoid largest negative number.  */
>   if (n != -n
> be fixed as well (don't we fold that as n != 0?)?

Yeah, that probably guarded against the other misuses of -n ... in
fact we should handle the most negative number fine now so I'm
going to just remove this check (n == 0 is also handled well).

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

--- Comment #4 from Zdenek Sojka <zsojka at seznam dot cz> ---
(In reply to Richard Biener from comment #1)
> I can't reproduce in my dev tree but I guess the following will fix it?
> 
> diff --git a/gcc/tree-ssa-math-opts.cc b/gcc/tree-ssa-math-opts.cc
> index 7555793948e..f3efd1ef4b2 100644
> --- a/gcc/tree-ssa-math-opts.cc
> +++ b/gcc/tree-ssa-math-opts.cc
> @@ -1495,7 +1495,7 @@ powi_cost (HOST_WIDE_INT n)
>  
>  static tree
>  powi_as_mults_1 (gimple_stmt_iterator *gsi, location_t loc, tree type,
> -                HOST_WIDE_INT n, tree *cache)
> +                unsigned HOST_WIDE_INT n, tree *cache)
>  {
>    tree op0, op1, ssa_target;
>    unsigned HOST_WIDE_INT digit;
> @@ -1548,7 +1548,7 @@ powi_as_mults (gimple_stmt_iterator *gsi, location_t
> loc,
>    memset (cache, 0, sizeof (cache));
>    cache[1] = arg0;
>  
> -  result = powi_as_mults_1 (gsi, loc, type, (n < 0) ? -n : n, cache);
> +  result = powi_as_mults_1 (gsi, loc, type, absu_hwi (n), cache);
>    if (n >= 0)
>      return result;


Thank you, I missed that "(n < 0) ? -n : n" in the code...
I can confirm the compiler bootstraps, and no longer crashes on the testcase.
I didn't try to run the testsuite.

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:44b09adb9bad99dd7e3017c5ecefed7f7c9a1590

commit r13-35-g44b09adb9bad99dd7e3017c5ecefed7f7c9a1590
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Apr 29 08:45:48 2022 +0200

    tree-optimization/105431 - another overflow in powi handling

    This avoids undefined signed overflow when calling powi_as_mults_1.

    2022-04-29  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105431
            * tree-ssa-math-opts.cc (powi_as_mults_1): Make n unsigned.
            (powi_as_mults): Use absu_hwi.
            (gimple_expand_builtin_powi): Remove now pointless n != -n
            check.

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|13.0                        |
      Known to work|                            |13.0

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:1e43783b3f3570f59bbe80fe38ba65049fa77a0a

commit r12-8396-g1e43783b3f3570f59bbe80fe38ba65049fa77a0a
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Apr 29 08:45:48 2022 +0200

    tree-optimization/105431 - another overflow in powi handling

    This avoids undefined signed overflow when calling powi_as_mults_1.

    2022-04-29  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105431
            * tree-ssa-math-opts.cc (powi_as_mults_1): Make n unsigned.
            (powi_as_mults): Use absu_hwi.
            (gimple_expand_builtin_powi): Remove now pointless n != -n
            check.

    (cherry picked from commit 44b09adb9bad99dd7e3017c5ecefed7f7c9a1590)

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:16a2fcfe247364088ca9d6d058d870bdfa28b345

commit r11-10020-g16a2fcfe247364088ca9d6d058d870bdfa28b345
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Apr 29 08:45:48 2022 +0200

    tree-optimization/105431 - another overflow in powi handling

    This avoids undefined signed overflow when calling powi_as_mults_1.

    2022-04-29  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105431
            * tree-ssa-math-opts.c (powi_as_mults_1): Make n unsigned.
            (powi_as_mults): Use absu_hwi.
            (gimple_expand_builtin_powi): Remove now pointless n != -n
            check.

    (cherry picked from commit 44b09adb9bad99dd7e3017c5ecefed7f7c9a1590)

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:e41fa23451c965516a37282268231933fd948845

commit r10-10765-ge41fa23451c965516a37282268231933fd948845
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Apr 29 08:45:48 2022 +0200

    tree-optimization/105431 - another overflow in powi handling

    This avoids undefined signed overflow when calling powi_as_mults_1.

    2022-04-29  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105431
            * tree-ssa-math-opts.c (powi_as_mults_1): Make n unsigned.
            (powi_as_mults): Use absu_hwi.
            (gimple_expand_builtin_powi): Remove now pointless n != -n
            check.

    (cherry picked from commit 44b09adb9bad99dd7e3017c5ecefed7f7c9a1590)

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |10.3.0, 11.2.0
      Known to work|                            |10.3.1, 11.2.1
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/105431] ICE: SIGSEGV in powi_as_mults_1 (tree-ssa-math-opts.cc:1512) with -Ofast and __builtin_pow()

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105431

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |10.4