[Bug c/105663] New: Segmentation Fault on optimization level O2/O3

[Bug c/105663] New: Segmentation Fault on optimization level O2/O3

[r.j.dejong at student dot utwente.nl]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

            Bug ID: 105663
           Summary: Segmentation Fault on optimization level O2/O3
           Product: gcc
           Version: 12.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: r.j.dejong at student dot utwente.nl
  Target Milestone: ---

Created attachment 53000
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=53000&action=edit
source.c

Source file of STM32U5 HAL library fails to compile on arm-none-eabi-gcc 12.1.0
with optimization levels O2 or O3. Command used to reproduce: arm-none-eabi-gcc
-O2 -c source.c -o foo .

The error also occurs for x86-64 GCC. Using godbolt.org compiler explorer, I
found that the minimum GCC version is 11.1 for this segfault to occur.

Preprocessed source code is attached (file source.c). The backtrace is:

> arm-none-eabi-gcc -O2 -c source.c -o foo
during GIMPLE pass: evrp
./stm32u5xx_hal_dma_ex.c: In function 'HAL_DMAEx_List_ReplaceNode_Head':
./stm32u5xx_hal_dma_ex.c:4689:1: internal compiler error: Segmentation fault
 4689 | }
      | ^
0x165320d internal_error(char const*, ...)
        ???:0
0x158bc83 operator_bitwise_not::fold_range(irange&, tree_node*, irange const&,
irange const&, tree_code) const
        ???:0
0x149a439 fold_using_range::range_of_range_op(irange&, gimple*, fur_source&)
        ???:0
0x149bfcb fold_using_range::fold_stmt(irange&, gimple*, fur_source&,
tree_node*)
        ???:0
0x1490448 gimple_ranger::range_of_stmt(irange&, gimple*, tree_node*)
        ???:0
0x1490d43 gimple_ranger::range_of_expr(irange&, tree_node*, gimple*)
        ???:0
0xe3f061 range_query::value_of_expr(tree_node*, gimple*)
        ???:0
0xe1f5d6 rvrp_folder::value_of_expr(tree_node*, gimple*)
        ???:0
0xd30f2e substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
        ???:0
0x1462b37 dom_walker::walk(basic_block_def*)
        ???:0
0xd301fd substitute_and_fold_engine::substitute_and_fold(basic_block_def*)
        ???:0
0xe15b7a execute_ranger_vrp(function*, bool)
        ???:0

Version information:
> arm-none-eabi-gcc --version
arm-none-eabi-gcc (Arch Repository) 12.1.0
Copyright (C) 2022 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

> gcc --version
gcc (GCC) 11.2.0
Copyright (C) 2021 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.

OS information:
> lsb_release -a
LSB Version:    n/a
Distributor ID: ManjaroLinux
Description:    Manjaro Linux
Release:        21.2.6
Codename:       Qonos

--------------

My attempts to localize the offending source code were not very successful.
Although the error suggests something is wrong with
HAL_DMAEx_List_InsertNode_Head, if that function is removed the segfault jumps
to another function (with varying backtraces). By some trial and error I was
able to minimize the LOC to be removed to the function
DMA_List_CheckNodesBaseAddresses, lines 11827 till 11844. When these are
commented out, the segfault disappears. However, solely that function does not
seem to be responsible for the error, so I am unsure how useful this
information is for chasing a moving target, so therefore I included the
complete file.

[Bug tree-optimization/105663] [12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.2
          Component|c                           |tree-optimization
            Summary|Segmentation Fault on       |[12/13 Regression] ICE
                   |optimization level O2/O3    |(segfault) in
                   |                            |operator_bitwise_not::fold_
                   |                            |range with O2/O3
           Keywords|                            |ice-on-valid-code

[Bug tree-optimization/105663] [12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2022-05-19
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Reduced testcase:

typedef __SIZE_TYPE__ size_t;

static 
int gggg(void  * pNode1, void  * pNode2,  void  * pNode3)
{
  size_t temp = (((size_t)pNode1 | (size_t)pNode2 | (size_t)pNode3) & (0xFFFFUL
<< (16U)));
  size_t ref = 0U;


  if ((size_t)pNode1 != 0U)
  {
    ref = (size_t)pNode1;
  }
  else if ((size_t)pNode2 != 0U)
  {
    ref = (size_t)pNode2;
  }
  else if ((size_t)pNode3 != 0U)
  {
    ref = (size_t)pNode3;
  }
  return temp != ((size_t)ref & (0xFFFFUL << (16U)));
}
int hhh(void*  pQList, void * pNewNode)
{
  if (pQList == 0)
  {
    return 1;
  }
  if (gggg(pQList, pNewNode, ((void *)0)) != 0U)
    return 1;
  return 0;
}

---- CUT ---
On the trunk we get:
<source>: In function 'hhh':
<source>:34:1: error: invalid types for 'bit_not_expr'
   34 | }
      | ^
void *
void *
_16 = ~pQList_4(D);
during GIMPLE pass: evrp

[Bug tree-optimization/105663] [12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Hmm:
  _13 = pQList_4(D) | pNewNode_6(D);
  _14 = (long unsigned int) _13;

That should be invalid gimple also ...

This might be my bug introduced by r12-5358-g32221357007666 .

[Bug tree-optimization/105663] [12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

Andrew Macleod <amacleod at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |amacleod at redhat dot com

--- Comment #3 from Andrew Macleod <amacleod at redhat dot com> ---
I also seee the trap in operator_bitwise_not::op1_range if i disable:
  -fno-tree-fre -fno-tree-forwprop

Otherwise I get verify_gimple failures from those passes.

I presume its invalid, but it boils down in rangers case to the bitwise_not
operation assuming there is a MINUS_EXPR for the type that it is performing the
NOT on.    In the case of pointers, there is no MINUX_EXPR.. 

I'll adjust range-ops so that whenever it invokes another handler, it first
verifies there is such an operation, and if not, it'll give up and the result
will be VARYING

[Bug tree-optimization/105663] [12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

--- Comment #4 from Andrew Macleod <amacleod at redhat dot com> ---
Or perhaps there shouldnt be 
  set (BIT_NOT_EXPR, op_bitwise_not);
  set (BIT_XOR_EXPR, op_bitwise_xor);

operations on pointer values?  I see also support

  set (BIT_AND_EXPR, op_pointer_and);
  set (BIT_IOR_EXPR, op_pointer_or);

but those are pointer specific versions...

[Bug tree-optimization/105663] [12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r11-35-g496f4f884716ae06.

[Bug tree-optimization/105663] [11/12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13 Regression] ICE      |[11/12/13 Regression] ICE
                   |(segfault) in               |(segfault) in
                   |operator_bitwise_not::fold_ |operator_bitwise_not::fold_
                   |range with O2/O3            |range with O2/O3
   Target Milestone|12.2                        |11.4

[Bug tree-optimization/105663] [11/12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
bitwise and is allowed for pointers on GIMPLE for alignment purposes and to
avoid round-trips to/from integer types for this.  It's only natural to then
allow all bit operations on pointers (and hard to excempt some given we have
many patterns transforming between them).  It looks like also MIN/MAX is
allowed (why not, we also allow relational compares), but BIT_NOT is
explicitely disallowed.

I think we simply have to accept those operations on pointers or decide
allowing
BIT_AND was a mistake and remove support for all of them.

[Bug tree-optimization/105663] [11/12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug tree-optimization/105663] [11/12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O2/O3

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Andrew Macleod from comment #4)
> Or perhaps there shouldnt be 
>   set (BIT_NOT_EXPR, op_bitwise_not);
>   set (BIT_XOR_EXPR, op_bitwise_xor);
> 
> operations on pointer values?  I see also support

if ranger then just gives up (VARYING) that's a reasonable thing for pointers.

>   set (BIT_AND_EXPR, op_pointer_and);
>   set (BIT_IOR_EXPR, op_pointer_or);
> 
> but those are pointer specific versions...

[Bug tree-optimization/105663] [11/12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O1/O2/O3/Os

[gcc-hbfypl at hansdejong dot eu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

--- Comment #8 from Hans de Jong <gcc-hbfypl at hansdejong dot eu> ---
The reduced testcase of comment #1 also fails on optimization levels O1 and Os.

I added the compiler versions which I have seen break on godbolt.org.

[Bug tree-optimization/105663] [11/12/13 Regression] ICE (segfault) in operator_bitwise_not::fold_range with O1/O2/O3/Os

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105663

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|NEW                         |RESOLVED

--- Comment #9 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Even though PR 106878 is newer, PR 106878 already has a patch associated with
it for the trunk so closing this one as a dup of bug 106878.

*** This bug has been marked as a duplicate of bug 106878 ***