[Bug fortran/106331] New: Whole array assignment of empty string segfaults with -Og

[Bug fortran/106331] New: Whole array assignment of empty string segfaults with -Og

[stuart_mentzer at objexx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

            Bug ID: 106331
           Summary: Whole array assignment of empty string segfaults with
                    -Og
           Product: gcc
           Version: 12.1.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: stuart_mentzer at objexx dot com
  Target Milestone: ---

Whole array assignment of the empty string to a character array segfaults if
built with -Og.

PROGRAM main
CHARACTER(LEN=24) :: a(2)
a = ''
END PROGRAM

These variations run OK:
- Not built with -Og
- Assignment is to scalar instead of array
- Assignment is a space character
- Assignment to element of the array


This is a regression I am seeing in 12.1.0 but did not get with 11.3.0.

Tested on MinGW (Windows 10) and Manjaro with GFortran 12.1.0.

The error message I get on Windows is:
Program received signal SIGSEGV: Segmentation fault - invalid memory reference.

[Bug fortran/106331] [12/13 Regression] Whole array assignment of empty string segfaults with -Og

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Whole array assignment of   |[12/13 Regression] Whole
                   |empty string segfaults with |array assignment of empty
                   |-Og                         |string segfaults with -Og
   Last reconfirmed|                            |2022-07-17
                 CC|                            |anlauf at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Target Milestone|---                         |12.2
      Known to work|                            |11.3.1
      Known to fail|                            |12.1.1

--- Comment #1 from anlauf at gcc dot gnu.org ---
Confirmed on x86_64-pc-linux-gnu with -m64 for character length 17 to 31.
For -m32 the issue does not show up, at least for the character length values
I tried.

Note however that replacing the array assignment

  a = ''

by an explicit loop

  do i = 1,2
     a(i) = ''
  end do

does not change the behavior of the reproducer.

valgrind a.out says:

Program received signal SIGSEGV: Segmentation fault - invalid memory reference.

Backtrace for this error:
#0  0x5b0fd6f in ???
#1  0x4005e7 in ???
#2  0x40061f in ???
#3  0x5afa2bc in ???
#4  0x400519 in ???
#5  0xffffffffffffffff in ???
==14463== 
==14463== Process terminating with default action of signal 11 (SIGSEGV):
dumping core
==14463==    at 0x5B0FCB9: raise (in /lib64/libc-2.31.so)
==14463==    by 0x5B0FD6F: ??? (in /lib64/libc-2.31.so)
==14463==    by 0x4005E6: MAIN__ (in /home/anlauf/gcc-bugs/a.out)
==14463==    by 0x40061F: main (in /home/anlauf/gcc-bugs/a.out)

I have no idea what is going on here...

[Bug fortran/106331] [12/13 Regression] Whole array assignment of empty string segfaults with -Og

[tkoenig at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

Thomas Koenig <tkoenig at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-bisection

--- Comment #2 from Thomas Koenig <tkoenig at gcc dot gnu.org> ---
Would it be possible to bisect this, to see if this is a front end problem
or not?

[Bug fortran/106331] [12/13 Regression] Whole array assignment of empty string segfaults with -Og

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
                 CC|                            |rguenth at gcc dot gnu.org
             Target|                            |x86_64-*-*

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed - we get

  # S.0_3 = PHI <1(2), S.0_7(4)>
  if (S.0_3 > 2)
    goto <bb 5>; [33.33%]
  else
    goto <bb 4>; [66.67%]

  _1 = S.0_3 + -1;
  _2 = &a[_1];
  __builtin_memset (_2, 32, 24);
  S.0_7 = S.0_3 + 1;
  goto <bb 3>; [100.00%]

but somehow we fail to see that while the first [24] is 16 byte aligned, the
second is not:

.L4:
        leaq    -3(%rax,%rax,2), %rcx
        leaq    0(,%rcx,8), %rdx
        leaq    -56(%rsp,%rdx), %rdx
        movdqa  .LC0(%rip), %xmm0
        movaps  %xmm0, (%rdx)
        movabsq $2314885530818453536, %rsi
        movq    %rsi, 16(%rdx)
        addq    $1, %rax
.L3:
        cmpq    $2, %rax
        jle     .L4

we shouldn't have used movaps %xmm0, (%rdx) here.  Probably middle-end but
bisection will show.

[Bug fortran/106331] [12/13 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |
            Summary|[12/13 Regression] Whole    |[12/13 Regression] Whole
                   |array assignment of empty   |array assignment of empty
                   |string segfaults with -Og   |string segfaults with -Og
                   |                            |since
                   |                            |r12-2633-ge5e164effa30fd2b
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-2633-ge5e164effa30fd2b.

[Bug fortran/106331] [12/13 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

--- Comment #5 from H.J. Lu <hjl.tools at gmail dot com> ---
The memory alignment passed to __builtin_memset shouldn't be 16 bytes in
this case.

[Bug fortran/106331] [12/13 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

--- Comment #6 from H.J. Lu <hjl.tools at gmail dot com> ---
This is a latent bug. GCC 11 RTL expander generates:

(insn 21 20 22 (set (mem/c:TI (reg:DI 92 [ D.3947 ]) [0 MEM <c_char[0:]> [(void 
*)&a]+0 S16 A128])
        (const_wide_int 0x20202020202020202020202020202020)) "x.f90":3:6 -1
     (nil))

[(void *)&a]+0 S16 A128] doesn't look right.

[Bug fortran/106331] [12/13 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

--- Comment #7 from H.J. Lu <hjl.tools at gmail dot com> ---
Breakpoint 6, expand_builtin_memset_args (dest=0x7ffff7b6f1a0,
val=0x7ffff7f86978, len=0x7ffff7f86960, target=0x7ffff7da7400, mode=E_VOIDmode,
orig_exp=0x7ffff7da9d38) at
/export/gnu/import/git/gitlab/x86-gcc/gcc/builtins.cc:4200
4200      dest_mem = get_memory_rtx (dest, len);
(gdb) call debug_tree (dest)
 <save_expr 0x7ffff7b6f1a0
    type <pointer_type 0x7ffff7f93738
        type <array_type 0x7ffff7f932a0 type <integer_type 0x7ffff7db9348
character(kind=1)>
            string-flag BLK
            size <integer_cst 0x7ffff7dc00c0 constant 192>
            unit-size <integer_cst 0x7ffff7dc0090 constant 24>
            align:8 warn_if_not_align:0 symtab:0 alias-set 2 canonical-type
0x7ffff7f932a0 domain <integer_type 0x7ffff7f931f8>
            pointer_to_this <pointer_type 0x7ffff7f93738>>
        public unsigned DI
        size <integer_cst 0x7ffff7da1c00 constant 64>
        unit-size <integer_cst 0x7ffff7da1c18 constant 8>
        align:64 warn_if_not_align:0 symtab:0 alias-set 1 canonical-type
0x7ffff7f93738>
    side-effects
    arg:0 <addr_expr 0x7ffff7f79e00 type <pointer_type 0x7ffff7f93738>

        arg:0 <array_ref 0x7ffff7dabf50 type <array_type 0x7ffff7f932a0>
            arg:0 <var_decl 0x7ffff7dadb40 a>
            arg:1 <ssa_name 0x7ffff7da97e0 type <integer_type 0x7ffff7db9738
integer(kind=8)>
                visited
                def_stmt _1 = S.0_3 + -1;
                version:1>
            x.f90:3:6 start: x.f90:3:6 finish: x.f90:3:6>
        x.f90:3:6 start: x.f90:3:6 finish: x.f90:3:6>
    x.f90:3:6 start: x.f90:3:6 finish: x.f90:3:6>
(gdb) next
4201      val_mode = TYPE_MODE (unsigned_char_type_node);
(gdb) call debug_rtx (dest_mem)
(mem/c:BLK (reg:DI 92 [ D.4232 ]) [0 MEM <c_char[0:]> [(void *)&a]+0 A128])
(gdb) 

Alignment on dest_mem is wrong since array reference isn't constant.

[Bug fortran/106331] [12/13 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Thanks for tracking down.  Obviously

  /* If the MEM_REF has no acceptable address, try to get the base object
     from the original address we got, and build an all-aliasing
     unknown-sized access to that one.  */
  if (is_gimple_mem_ref_addr (TREE_OPERAND (exp, 0)))
    set_mem_attributes (mem, exp, 0);
  else if (TREE_CODE (TREE_OPERAND (exp, 0)) == ADDR_EXPR
           && (exp = get_base_address (TREE_OPERAND (TREE_OPERAND (exp, 0),
                                                     0))))
    {
      exp = build_fold_addr_expr (exp);
      exp = fold_build2 (MEM_REF,
                         build_array_type (char_type_node,
                                           build_range_type (sizetype,
                                                             size_zero_node,
                                                             NULL)),
                         exp, build_int_cst (ptr_type_node, 0));
      set_mem_attributes (mem, exp, 0);

^^^

is broken.  Looks like introduced with r0-117468-g625ed1721782f6

[Bug fortran/106331] [12/13 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:e4ff11a8f2e80adb8ada69bf35ee6a1ab18a9c85

commit r13-1743-ge4ff11a8f2e80adb8ada69bf35ee6a1ab18a9c85
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jul 19 09:57:22 2022 +0200

    middle-end/106331 - fix mem attributes for string op arguments

    get_memory_rtx tries hard to come up with a MEM_EXPR to record
    in the memory attributes but in the last fallback fails to properly
    account for an unknown offset and thus, as visible in this testcase,
    incorrect alignment computed from set_mem_attributes.  The following
    rectifies both parts.

            PR middle-end/106331
            * builtins.cc (get_memory_rtx): Compute alignment from
            the original address and set MEM_OFFSET to unknown when
            we create a MEM_EXPR from the base object of the address.

            * gfortran.dg/pr106331.f90: New testcase.

[Bug middle-end/106331] [10/11/12 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.2                        |10.5
      Known to work|11.3.1                      |13.0
           Priority|P3                          |P2
          Component|fortran                     |middle-end
            Summary|[12/13 Regression] Whole    |[10/11/12 Regression] Whole
                   |array assignment of empty   |array assignment of empty
                   |string segfaults with -Og   |string segfaults with -Og
                   |since                       |since
                   |r12-2633-ge5e164effa30fd2b  |r12-2633-ge5e164effa30fd2b

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
As indicated the issue is latent, so queuing for further backports.

[Bug middle-end/106331] [10/11/12 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:1a7200da71550e6f92da66f0b328bb20d3bcdf35

commit r12-8584-g1a7200da71550e6f92da66f0b328bb20d3bcdf35
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jul 19 09:57:22 2022 +0200

    middle-end/106331 - fix mem attributes for string op arguments

    get_memory_rtx tries hard to come up with a MEM_EXPR to record
    in the memory attributes but in the last fallback fails to properly
    account for an unknown offset and thus, as visible in this testcase,
    incorrect alignment computed from set_mem_attributes.  The following
    rectifies both parts.

            PR middle-end/106331
            * builtins.cc (get_memory_rtx): Compute alignment from
            the original address and set MEM_OFFSET to unknown when
            we create a MEM_EXPR from the base object of the address.

            * gfortran.dg/pr106331.f90: New testcase.

    (cherry picked from commit e4ff11a8f2e80adb8ada69bf35ee6a1ab18a9c85)

[Bug middle-end/106331] [10/11 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[10/11/12 Regression] Whole |[10/11 Regression] Whole
                   |array assignment of empty   |array assignment of empty
                   |string segfaults with -Og   |string segfaults with -Og
                   |since                       |since
                   |r12-2633-ge5e164effa30fd2b  |r12-2633-ge5e164effa30fd2b
      Known to fail|12.1.1                      |12.1.0
      Known to work|                            |12.1.1

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed - as said, the latent bug makes it worth backporting further even if we
sofar lack a testcase that makes it a problem.

[Bug middle-end/106331] [10/11 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:90d3b4dd84c08cc134578397d9c6b30b7dc4b440

commit r11-10305-g90d3b4dd84c08cc134578397d9c6b30b7dc4b440
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jul 19 09:57:22 2022 +0200

    middle-end/106331 - fix mem attributes for string op arguments

    get_memory_rtx tries hard to come up with a MEM_EXPR to record
    in the memory attributes but in the last fallback fails to properly
    account for an unknown offset and thus, as visible in this testcase,
    incorrect alignment computed from set_mem_attributes.  The following
    rectifies both parts.

            PR middle-end/106331
            * builtins.c (get_memory_rtx): Compute alignment from
            the original address and set MEM_OFFSET to unknown when
            we create a MEM_EXPR from the base object of the address.

            * gfortran.dg/pr106331.f90: New testcase.

    (cherry picked from commit e4ff11a8f2e80adb8ada69bf35ee6a1ab18a9c85)

[Bug middle-end/106331] [10 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

--- Comment #14 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:cf404eb3b55a3711134bddee98d6d8d881be8a69

commit r10-11037-gcf404eb3b55a3711134bddee98d6d8d881be8a69
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jul 19 09:57:22 2022 +0200

    middle-end/106331 - fix mem attributes for string op arguments

    get_memory_rtx tries hard to come up with a MEM_EXPR to record
    in the memory attributes but in the last fallback fails to properly
    account for an unknown offset and thus, as visible in this testcase,
    incorrect alignment computed from set_mem_attributes.  The following
    rectifies both parts.

            PR middle-end/106331
            * builtins.c (get_memory_rtx): Compute alignment from
            the original address and set MEM_OFFSET to unknown when
            we create a MEM_EXPR from the base object of the address.

            * gfortran.dg/pr106331.f90: New testcase.

    (cherry picked from commit e4ff11a8f2e80adb8ada69bf35ee6a1ab18a9c85)

[Bug middle-end/106331] [10 Regression] Whole array assignment of empty string segfaults with -Og since r12-2633-ge5e164effa30fd2b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106331

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |10.4.1
             Status|ASSIGNED                    |RESOLVED
      Known to fail|                            |10.4.0
         Resolution|---                         |FIXED

--- Comment #15 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.