[Bug c/106830] New: [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow)

[Bug c/106830] New: [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow)

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830

            Bug ID: 106830
           Summary: [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392
                    (from check_for_xor_used_as_pow)
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

This happens randomly, and even valgrind doesn't show any uninitialised use.

Minor modifications to the testcase might cause the issue to disappear

Compiler output:
$ cat testcase.c 
foo0_u16_0() {
  (__int128)(18302628885633695743 << 4) ^ 0;
}
$ x86_64-pc-linux-gnu-gcc testcase.c -c # OK first time
testcase.c:1:1: warning: return type defaults to 'int' [-Wimplicit-int]
    1 | foo0_u16_0() {
      | ^~~~~~~~~~
testcase.c: In function 'foo0_u16_0':
testcase.c:2:14: warning: integer constant is so large that it is unsigned
    2 |   (__int128)(18302628885633695743 << 4) ^ 0;
      |              ^~~~~~~~~~~~~~~~~~~~
$ x86_64-pc-linux-gnu-gcc testcase.c -c # ICE second time
testcase.c:1:1: warning: return type defaults to 'int' [-Wimplicit-int]
    1 | foo0_u16_0() {
      | ^~~~~~~~~~
testcase.c: In function 'foo0_u16_0':
testcase.c:2:14: warning: integer constant is so large that it is unsigned
    2 |   (__int128)(18302628885633695743 << 4) ^ 0;
      |              ^~~~~~~~~~~~~~~~~~~~
testcase.c:2:3: internal compiler error: in tree_to_uhwi, at tree.cc:6392
    2 |   (__int128)(18302628885633695743 << 4) ^ 0;
      |   ^
0x80aeaf tree_to_uhwi(tree_node const*)
        /repo/gcc-trunk/gcc/tree.cc:6392
0x80aeaf tree_to_uhwi(tree_node const*)
        /repo/gcc-trunk/gcc/tree.cc:6390
0xe428ab check_for_xor_used_as_pow(unsigned int, tree_node*, unsigned int,
tree_node*)
        /repo/gcc-trunk/gcc/c-family/c-warn.cc:3821
0xd68628 parser_build_binary_op(unsigned int, tree_code, c_expr, c_expr)
        /repo/gcc-trunk/gcc/c/c-typeck.cc:3994
0xd8f63c c_parser_binary_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:8083
0xd9072b c_parser_conditional_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:7651
0xd90f74 c_parser_expr_no_commas
        /repo/gcc-trunk/gcc/c/c-parser.cc:7565
0xd91221 c_parser_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:10768
0xd919e7 c_parser_expression_conv
        /repo/gcc-trunk/gcc/c/c-parser.cc:10807
0xda8f17 c_parser_statement_after_labels
        /repo/gcc-trunk/gcc/c/c-parser.cc:6294
0xdab364 c_parser_compound_statement_nostart
        /repo/gcc-trunk/gcc/c/c-parser.cc:5831
0xdab864 c_parser_compound_statement
        /repo/gcc-trunk/gcc/c/c-parser.cc:5640
0xdad32a c_parser_declaration_or_fndef
        /repo/gcc-trunk/gcc/c/c-parser.cc:2554
0xdb5373 c_parser_external_declaration
        /repo/gcc-trunk/gcc/c/c-parser.cc:1789
0xdb5d8b c_parser_translation_unit
        /repo/gcc-trunk/gcc/c/c-parser.cc:1662
0xdb5d8b c_parse_file()
        /repo/gcc-trunk/gcc/c/c-parser.cc:23669
0xe172b1 c_common_parse_file()
        /repo/gcc-trunk/gcc/c-family/c-opts.cc:1255
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.


Another testcase:
$ cat testcase.c 
typedef unsigned __int128 U;
U u = (U)(((U)0x8000000000000000 << 64 )) ^ 0;
$ x86_64-pc-linux-gnu-gcc testcase.c
testcase.c:2:1: internal compiler error: in tree_to_uhwi, at tree.cc:6392
    2 | U u = (U)(((U)0x8000000000000000 << 64 )) ^ 0;
      | ^
0x80aeaf tree_to_uhwi(tree_node const*)
        /repo/gcc-trunk/gcc/tree.cc:6392
0x80aeaf tree_to_uhwi(tree_node const*)
        /repo/gcc-trunk/gcc/tree.cc:6390
0xe428ab check_for_xor_used_as_pow(unsigned int, tree_node*, unsigned int,
tree_node*)
        /repo/gcc-trunk/gcc/c-family/c-warn.cc:3821
0xd68628 parser_build_binary_op(unsigned int, tree_code, c_expr, c_expr)
        /repo/gcc-trunk/gcc/c/c-typeck.cc:3994
0xd8f63c c_parser_binary_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:8083
0xd9072b c_parser_conditional_expression
        /repo/gcc-trunk/gcc/c/c-parser.cc:7651
0xd90f74 c_parser_expr_no_commas
        /repo/gcc-trunk/gcc/c/c-parser.cc:7565
0xd97c3f c_parser_initializer
        /repo/gcc-trunk/gcc/c/c-parser.cc:5234
0xd97c3f c_parser_initializer
        /repo/gcc-trunk/gcc/c/c-parser.cc:5222
0xdac1d4 c_parser_declaration_or_fndef
        /repo/gcc-trunk/gcc/c/c-parser.cc:2291
0xdb5373 c_parser_external_declaration
        /repo/gcc-trunk/gcc/c/c-parser.cc:1789
0xdb5d8b c_parser_translation_unit
        /repo/gcc-trunk/gcc/c/c-parser.cc:1662
0xdb5d8b c_parse_file()
        /repo/gcc-trunk/gcc/c/c-parser.cc:23669
0xe172b1 c_common_parse_file()
        /repo/gcc-trunk/gcc/c-family/c-opts.cc:1255
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.


$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r13-2393-20220904080942-g6832dd39d7b-checking-yes-rtl-df-extra-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/13.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r13-2393-20220904080942-g6832dd39d7b-checking-yes-rtl-df-extra-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 13.0.0 20220904 (experimental) (GCC)

[Bug c/106830] [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dmalcolm at gcc dot gnu.org,
                   |                            |jakub at gcc dot gnu.org

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I certainly see a valgrind diagnostics on it:
valgrind ./cc1 -quiet pr106830.c
==2461995== Memcheck, a memory error detector
==2461995== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
==2461995== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright info
==2461995== Command: ./cc1 -quiet pr106830.c
==2461995== 
pr106830.c:1:1: warning: return type defaults to ‘int’ [-Wimplicit-int]
    1 | foo0_u16_0() {
      | ^~~~~~~~~~
pr106830.c: In function ‘foo0_u16_0’:
pr106830.c:2:14: warning: integer constant is so large that it is unsigned
    2 |   (__int128)(18302628885633695743 << 4) ^ 0;
      |              ^~~~~~~~~~~~~~~~~~~~
==2461995== Conditional jump or move depends on uninitialised value(s)
==2461995==    at 0xAFCE3D: parser_build_binary_op(unsigned int, tree_code,
c_expr, c_expr) (c-typeck.cc:3992)
==2461995==    by 0xB4ABA2: c_parser_binary_expression(c_parser*, c_expr*,
tree_node*) (c-parser.cc:8083)
==2461995==    by 0xB486A3: c_parser_conditional_expression(c_parser*, c_expr*,
tree_node*) (c-parser.cc:7651)
==2461995==    by 0xB48308: c_parser_expr_no_commas(c_parser*, c_expr*,
tree_node*) (c-parser.cc:7565)

so pressumably arg1.m_decimal is uninitialized.

I see there various spots at which m_decimal can remain uninitialized, in this
case e.g.
c_parser_cast_expression
      ret.value = c_cast_expr (cast_loc, type_name, expr.value);
      if (ret.value && expr.value)
        set_c_expr_source_range (&ret, cast_loc, expr.get_finish ());
      ret.original_code = ERROR_MARK;
      ret.original_type = NULL;
      return ret;
doesn't set it.  I'd search for all assignments to original_code in c/*.cc and
added m_decimal = 0 next to it if it doesn't have it yet.

Another case is check_for_xor_used_as_pow implementation, if it only works on
UHWIs, then
  /* Only complain if both args are non-negative integer constants.  */
  if (!(TREE_CODE (lhs_val) == INTEGER_CST
        && tree_int_cst_sgn (lhs_val) >= 0))
    return;
  if (!(TREE_CODE (rhs_val) == INTEGER_CST
        && tree_int_cst_sgn (rhs_val) >= 0))
    return;
should actually be
  if (!tree_fits_uhwi_p (lhs_val) || !tree_fits_uhwi_p (rhs_val))
    return;
so that for larger values we return immediately.
As for lhs we only care about 2 and 10, it doesn't hurt at least for lhs_val.
For rhs, you'd need to use wide_ints otherwise but then the question is how to
print that...

[Bug c/106830] [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |13.0
     Ever confirmed|0                           |1
           Priority|P3                          |P1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-09-05

[Bug c/106830] [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow) since r13-2386-gbedfca647a9e9c1a

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org
            Summary|[13 Regression] ICE: in     |[13 Regression] ICE: in
                   |tree_to_uhwi, at            |tree_to_uhwi, at
                   |tree.cc:6392 (from          |tree.cc:6392 (from
                   |check_for_xor_used_as_pow)  |check_for_xor_used_as_pow)
                   |                            |since
                   |                            |r13-2386-gbedfca647a9e9c1a

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r13-2386-gbedfca647a9e9c1a.

[Bug c/106830] [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow) since r13-2386-gbedfca647a9e9c1a

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830

--- Comment #3 from Zdenek Sojka <zsojka at seznam dot cz> ---
(In reply to Jakub Jelinek from comment #1)
> I certainly see a valgrind diagnostics on it:
> valgrind ./cc1 -quiet pr106830.c
> ==2461995== Memcheck, a memory error detector
> ==2461995== Copyright (C) 2002-2022, and GNU GPL'd, by Julian Seward et al.
> ==2461995== Using Valgrind-3.19.0 and LibVEX; rerun with -h for copyright
> info
> ==2461995== Command: ./cc1 -quiet pr106830.c
> ==2461995== 
> pr106830.c:1:1: warning: return type defaults to ‘int’ [-Wimplicit-int]
>     1 | foo0_u16_0() {
>       | ^~~~~~~~~~
> pr106830.c: In function ‘foo0_u16_0’:
> pr106830.c:2:14: warning: integer constant is so large that it is unsigned
>     2 |   (__int128)(18302628885633695743 << 4) ^ 0;
>       |              ^~~~~~~~~~~~~~~~~~~~
> ==2461995== Conditional jump or move depends on uninitialised value(s)
> ==2461995==    at 0xAFCE3D: parser_build_binary_op(unsigned int, tree_code,
> c_expr, c_expr) (c-typeck.cc:3992)
> ==2461995==    by 0xB4ABA2: c_parser_binary_expression(c_parser*, c_expr*,
> tree_node*) (c-parser.cc:8083)
> ==2461995==    by 0xB486A3: c_parser_conditional_expression(c_parser*,
> c_expr*, tree_node*) (c-parser.cc:7651)
> ==2461995==    by 0xB48308: c_parser_expr_no_commas(c_parser*, c_expr*,
> tree_node*) (c-parser.cc:7565)
> 
> so pressumably arg1.m_decimal is uninitialized.
> 

Ah right, my fault, I forgot to add --trace-children=yes, and run valgrind on
the gcc binary instead... thanks.

[Bug c/106830] [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow) since r13-2386-gbedfca647a9e9c1a

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |dmalcolm at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #4 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Thanks for filing this; sorry about the breakage.

I'm working on a fix.

[Bug c/106830] [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow) since r13-2386-gbedfca647a9e9c1a

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |WAITING
           Keywords|                            |patch

--- Comment #5 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
Patch posted for review here:
  https://gcc.gnu.org/pipermail/gcc-patches/2022-September/601179.html

[Bug c/106830] [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow) since r13-2386-gbedfca647a9e9c1a

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:

https://gcc.gnu.org/g:86254629b636db579616befde49022f098af8148

commit r13-2773-g86254629b636db579616befde49022f098af8148
Author: David Malcolm <dmalcolm@redhat.com>
Date:   Thu Sep 22 08:35:26 2022 -0400

    c: fix uninitialized c_expr::m_decimal [PR106830]

    I added c_expr::m_decimal in r13-2386-gbedfca647a9e9c1a as part of the
    implementation of -Wxor-used-as-pow, but I missed various places where
    the field needed to be initialized.

    Fixed thusly.

    gcc/c-family/ChangeLog:
            PR c/106830
            * c-warn.cc (check_for_xor_used_as_pow): Don't try checking
            values that don't fit in uhwi.

    gcc/c/ChangeLog:
            PR c/106830
            * c-parser.cc (c_parser_initelt): Initialize m_decimal.
            (c_parser_cast_expression): Likewise.
            (c_parser_alignof_expression): Likewise.
            (c_parser_postfix_expression_after_paren_type): Likewise.
            (c_parser_postfix_expression_after_primary): Likewise.
            (c_parser_expression): Likewise.
            (c_parser_omp_variable_list): Likewise.
            (c_parser_transaction_expression): Likewise.
            * c-tree.h (c_expr::set_error): Likewise.
            * c-typeck.cc (c_expr_sizeof_expr): Likewise.
            (parser_build_unary_op): Likewise.
            (parser_build_binary_op): Likewise.
            (digest_init): Likewise.
            (pop_init_level): Likewise.
            * gimple-parser.cc (c_parser_gimple_call_internal): Likewise.

    gcc/testsuite/ChangeLog:
            PR c/106830
            * gcc.dg/Wxor-used-as-pow-pr106830.c: New test.

    Signed-off-by: David Malcolm <dmalcolm@redhat.com>

[Bug c/106830] [13 Regression] ICE: in tree_to_uhwi, at tree.cc:6392 (from check_for_xor_used_as_pow) since r13-2386-gbedfca647a9e9c1a

[dmalcolm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=106830

David Malcolm <dmalcolm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from David Malcolm <dmalcolm at gcc dot gnu.org> ---
(In reply to CVS Commits from comment #6)
> The master branch has been updated by David Malcolm <dmalcolm@gcc.gnu.org>:
> 
> https://gcc.gnu.org/g:86254629b636db579616befde49022f098af8148
> 
> commit r13-2773-g86254629b636db579616befde49022f098af8148

Should be fixed by this commit; I've verified the original reproducer using
valgrind.  Sorry again about the breakage.