[Bug c++/105946] New: [12/13 Regression] ICE in maybe_warn_pass_by_reference, at tree-ssa-uninit.cc:843

[Bug c++/105946] New: [12/13 Regression] ICE in maybe_warn_pass_by_reference, at tree-ssa-uninit.cc:843

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105946

            Bug ID: 105946
           Summary: [12/13 Regression] ICE in
                    maybe_warn_pass_by_reference, at
                    tree-ssa-uninit.cc:843
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gscfq@t-online.de
  Target Milestone: ---

Started between 20210627 and 20210704,
with g++.dg/pr100253.C or g++.dg/tree-ssa/pr46228.C :


$ gcc-13-20220612 -c pr100253.C -O2 -fdisable-ipa-inline -W
cc1plus: note: disable pass ipa-inline for functions in the range of [0,
4294967295]
during GIMPLE pass: uninit
In file included from .../gcc-13-20220612/include/c++/13.0.0/vector:64,
                 from pr100253.C:4:
.../gcc-13-20220612/include/c++/13.0.0/bits/stl_vector.h: In function
'std::vector<_Tp, _Alloc>::pointer std::vector<_Tp,
_Alloc>::_M_allocate_and_copy(size_type, _ForwardIterator, _ForwardIterator)
[with _ForwardIterator = __gnu_cxx::__normal_iterator<const std::vector<T>*,
std::vector<std::vector<T> > >; _Tp = std::vector<T>; _Alloc =
std::allocator<std::vector<T> >]':
.../gcc-13-20220612/include/c++/13.0.0/bits/stl_vector.h:1611:9: internal
compiler error: Segmentation fault
 1611 |         _M_allocate_and_copy(size_type __n,
      |         ^~~~~~~~~~~~~~~~~~~~
0xdb3fff crash_signal
        ../../gcc/toplev.cc:322
0xfb5cd8 maybe_warn_pass_by_reference
        ../../gcc/tree-ssa-uninit.cc:843
0xfb5cd8 warn_uninitialized_vars
        ../../gcc/tree-ssa-uninit.cc:1050
0xfb637e execute_late_warn_uninitialized
        ../../gcc/tree-ssa-uninit.cc:1343
0xfb637e execute
        ../../gcc/tree-ssa-uninit.cc:1396

[Bug c++/105946] [12/13 Regression] ICE in maybe_warn_pass_by_reference, at tree-ssa-uninit.cc:843

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105946

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2022-06-14
           Priority|P3                          |P2
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1
           Keywords|                            |needs-reduction
   Target Milestone|---                         |12.2
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.

(gdb) p debug_gimple_stmt (stmt)
# .MEM_8 = VDEF <.MEM_7(D)>
_2 = std::__new_allocator<std::vector<T> >::allocate (__n_1(D), 0B);

842           tree arg = gimple_call_arg (stmt, argno - 1);
(gdb) p argno
$2 = 3
(gdb) p debug_generic_expr (fntype)
struct vector * __new_allocator::<T514c> (struct __new_allocator *, size_type,
const void *)

so the number of actual arguments does not match the function type of the call.

I have a simple patch.

[Bug c++/105946] [12/13 Regression] ICE in maybe_warn_pass_by_reference, at tree-ssa-uninit.cc:843

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105946

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:e07a876c07601e1f3a27420f7d055d20193c362c

commit r13-1086-ge07a876c07601e1f3a27420f7d055d20193c362c
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jun 14 11:10:13 2022 +0200

    tree-optimization/105946 - avoid accessing excess args from uninit diag

    uninit diagnostics uses passing via reference and access attributes
    but that iterates over function type arguments which can in some
    cases appearantly outrun the actual arguments leading to ICEs.
    The following simply ignores not present arguments.

    2022-06-14  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105946
            * tree-ssa-uninit.cc (maybe_warn_pass_by_reference):
            Do not look at arguments not specified in the function call.

[Bug c++/105946] [12 Regression] ICE in maybe_warn_pass_by_reference, at tree-ssa-uninit.cc:843

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105946

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13 Regression] ICE in   |[12 Regression] ICE in
                   |maybe_warn_pass_by_referenc |maybe_warn_pass_by_referenc
                   |e, at                       |e, at
                   |tree-ssa-uninit.cc:843      |tree-ssa-uninit.cc:843
      Known to work|                            |13.0
      Known to fail|                            |12.1.0

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug c++/105946] [12 Regression] ICE in maybe_warn_pass_by_reference, at tree-ssa-uninit.cc:843

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105946

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org
           Keywords|needs-reduction             |

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
Reduced to something like:

$ cat ice.ii
void __throw_bad_array_new_length();
template <typename> void forward();
template <typename> struct __new_allocator {
  int allocate(long __n, const void * = 0) {
    if (__builtin_expect(__n, false))
      if (__n)
        __throw_bad_array_new_length();
  }
};
template <typename> struct allocator_traits;
template <typename _Tp> struct allocator_traits<__new_allocator<_Tp>> {
  using allocator_type = __new_allocator<_Tp>;
  using pointer = _Tp;
  using size_type = long;
  static pointer allocate(allocator_type &__a, size_type __n) {
    __a.allocate(__n);
  }
};
struct __alloc_traits : allocator_traits<__new_allocator<int>> {};
template <typename, typename, typename, typename, typename = int>
struct _Rb_tree {
  struct _Alloc_node {
    _Alloc_node(_Rb_tree);
    template <typename _Arg> void operator()(_Arg) {
      __new_allocator<int> __trans_tmp_1;
      __alloc_traits::allocate(__trans_tmp_1, 1);
    }
  };
  template <typename _Arg, typename _NodeGen>
  int _M_insert_(int, int, _Arg &&, _NodeGen &);
  template <typename _Arg> int _M_insert_unique(_Arg &&);
};
template <typename _Key, typename _Val, typename _KeyOfValue, typename
_Compare,
          typename _Alloc>
template <typename _Arg, typename _NodeGen>
int _Rb_tree<_Key, _Val, _KeyOfValue, _Compare, _Alloc>::_M_insert_(
    int, int, _Arg &&, _NodeGen &__node_gen) {
  __node_gen(forward<_Arg>);
}
template <typename _Key, typename _Val, typename _KeyOfValue, typename
_Compare,
          typename _Alloc>
template <typename _Arg>
int _Rb_tree<_Key, _Val, _KeyOfValue, _Compare, _Alloc>::_M_insert_unique(
    _Arg &&) {
  int __res_1, __res_0;
  _Alloc_node __an(*this);
  _M_insert_(__res_0, __res_1, forward<_Arg>, __an);
}
struct set {
  _Rb_tree<int, int, int, int> _M_t;
  int insert___x;
  void insert() { _M_t._M_insert_unique(insert___x); }
};
main() {
  set the_set;
  the_set.insert();
}

[Bug c++/105946] [12 Regression] ICE in maybe_warn_pass_by_reference, at tree-ssa-uninit.cc:843

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105946

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:92aa9490315d969d6e7580fb6e8d006415877bd6

commit r12-8577-g92aa9490315d969d6e7580fb6e8d006415877bd6
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jun 14 11:10:13 2022 +0200

    tree-optimization/105946 - avoid accessing excess args from uninit diag

    uninit diagnostics uses passing via reference and access attributes
    but that iterates over function type arguments which can in some
    cases appearantly outrun the actual arguments leading to ICEs.
    The following simply ignores not present arguments.

    2022-06-14  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/105946
            * tree-ssa-uninit.cc (maybe_warn_pass_by_reference):
            Do not look at arguments not specified in the function call.

    (cherry picked from commit e07a876c07601e1f3a27420f7d055d20193c362c)

[Bug c++/105946] [12 Regression] ICE in maybe_warn_pass_by_reference, at tree-ssa-uninit.cc:843

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105946

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
      Known to work|                            |12.1.1
         Resolution|---                         |FIXED

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.