[Bug c/107554] New: Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[Bug c/107554] New: Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[nik_1357 at mail dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

            Bug ID: 107554
           Summary: Segmentation fault during GIMPLE pass: strlen
                    (tree-ssa-strlen.cc:4772)
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: nik_1357 at mail dot ru
  Target Milestone: ---

Hello.

Test which causes the bug:
#include <string.h>

#define ELEMS 0x40000000

int a[ELEMS];
int b[ELEMS];

int main() {
    memcpy(a, b, ELEMS*sizeof(int));
}

Command:
gcc -O1 -foptimize-strlen test.c -c

Error message:
during GIMPLE pass: strlen
memcpy_segfault.c: In function ‘main’:
memcpy_segfault.c:8:5: internal compiler error: Segmentation fault
    8 | int main()
      |     ^~~~
0xb2636f crash_signal
        ../../../gcc/gcc-10.4.0/gcc/toplev.c:328
0x7f3f359e351f ???
        ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0xcaaaed count_nonzero_bytes
        ../../../gcc/gcc-10.4.0/gcc/tree-ssa-strlen.c:4820
0xcad456 count_nonzero_bytes
        ../../../gcc/gcc-10.4.0/gcc/tree-ssa-strlen.c:4963
0xcad456 handle_store
        ../../../gcc/gcc-10.4.0/gcc/tree-ssa-strlen.c:5040
0xcad456 check_and_optimize_stmt
        ../../../gcc/gcc-10.4.0/gcc/tree-ssa-strlen.c:5687
0xcad456 strlen_dom_walker::before_dom_children(basic_block_def*)
        ../../../gcc/gcc-10.4.0/gcc/tree-ssa-strlen.c:5864
0x12d45d7 dom_walker::walk(basic_block_def*)
        ../../../gcc/gcc-10.4.0/gcc/domwalk.c:309
0xca404e printf_strlen_execute
        ../../../gcc/gcc-10.4.0/gcc/tree-ssa-strlen.c:5930

Bug is present in:
10, 11, 12 and current master.
9 is not affected by it.

[Bug c/107554] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[nik_1357 at mail dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

--- Comment #1 from Nikita Voronov <nik_1357 at mail dot ru> ---
I debugged a little and found out that this bug is caused when size of object
which has type of "long int" is being assigned to local variable of type "int".

Here's patch which fixed bug for me:
diff --git a/gcc/tree-ssa-strlen.cc b/gcc/tree-ssa-strlen.cc
index 5afbae1b72e..7789b792341 100644
--- a/gcc/tree-ssa-strlen.cc
+++ b/gcc/tree-ssa-strlen.cc
@@ -4735,7 +4735,7 @@ strlen_pass::count_nonzero_bytes (tree exp, gimple *stmt,

   /* Compute the number of leading nonzero bytes in the representation
      and update the minimum and maximum.  */
-  unsigned n = prep ? strnlen (prep, nbytes) : nbytes;
+  unsigned HOST_WIDE_INT n = prep ? strnlen (prep, nbytes) : nbytes;

   if (n < lenrange[0])
     lenrange[0] = n;

[Bug c/107554] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[nik_1357 at mail dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

--- Comment #2 from Nikita Voronov <nik_1357 at mail dot ru> ---
Seems like I attached call stack from previous release version.
Here's from master:
0xf0ad0f crash_signal
        ../../../gcc/gcc-master/gcc/toplev.cc:314
0x7f6b9445d51f ???
        ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x1118da8 strlen_pass::count_nonzero_bytes(tree_node*, gimple*, unsigned long,
unsigned long, unsigned int*, bool*, bool*, bool*, ssa_name_limit_t&)
        ../../../gcc/gcc-master/gcc/tree-ssa-strlen.cc:4772
0x1119063 strlen_pass::count_nonzero_bytes(tree_node*, gimple*, unsigned int*,
bool*, bool*, bool*)
        ../../../gcc/gcc-master/gcc/tree-ssa-strlen.cc:4924
0x1119063 strlen_pass::count_nonzero_bytes(tree_node*, gimple*, unsigned int*,
bool*, bool*, bool*)
        ../../../gcc/gcc-master/gcc/tree-ssa-strlen.cc:4905
0x111c282 strlen_pass::handle_store(bool*)
        ../../../gcc/gcc-master/gcc/tree-ssa-strlen.cc:5022
0x111ed53 strlen_pass::check_and_optimize_stmt(bool*)
        ../../../gcc/gcc-master/gcc/tree-ssa-strlen.cc:5692
0x111f0f6 strlen_pass::before_dom_children(basic_block_def*)
        ../../../gcc/gcc-master/gcc/tree-ssa-strlen.cc:5849
0x1c91ece dom_walker::walk(basic_block_def*)
        ../../../gcc/gcc-master/gcc/domwalk.cc:311
0x111f4ff printf_strlen_execute
        ../../../gcc/gcc-master/gcc/tree-ssa-strlen.cc:5908

[Bug tree-optimization/107554] [10/11/12/13 Regression] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
            Summary|Segmentation fault during   |[10/11/12/13 Regression]
                   |GIMPLE pass: strlen         |Segmentation fault during
                   |(tree-ssa-strlen.cc:4772)   |GIMPLE pass: strlen
                   |                            |(tree-ssa-strlen.cc:4772)
   Last reconfirmed|                            |2022-11-07
   Target Milestone|---                         |10.5
     Ever confirmed|0                           |1

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/107554] [10/11/12/13 Regression] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
Looks even like an obvious fix.

[Bug tree-optimization/107554] [10/11/12/13 Regression] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
going to test / push the fix

[Bug tree-optimization/107554] [10/11/12/13 Regression] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:81de4037454275f8ed6d858fbc129e832c6147ef

commit r13-3905-g81de4037454275f8ed6d858fbc129e832c6147ef
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Nov 11 14:28:52 2022 +0100

    tree-optimization/107554 - fix ICE in stlen optimization

    The following fixes a wrongly typed variable causing an ICE.

            PR tree-optimization/107554
            * tree-ssa-strlen.cc (strlen_pass::count_nonzero_bytes):
            Use unsigned HOST_WIDE_INT type for the strlen.

            * gcc.dg/pr107554.c: New testcase.

    Co-Authored-By: Nikita Voronov <nik_1357@mail.ru>

[Bug tree-optimization/107554] [10/11/12 Regression] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I agree.  For prep != NULL, we know it must fit into unsigned int, we don't
even support longer STRING_CSTs, but for NULL prep it can be larger.

[Bug tree-optimization/107554] [10/11/12 Regression] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ca8b8191983d1a211a718b39ca07e35b8c626416

commit r12-9062-gca8b8191983d1a211a718b39ca07e35b8c626416
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Nov 11 14:28:52 2022 +0100

    tree-optimization/107554 - fix ICE in stlen optimization

    The following fixes a wrongly typed variable causing an ICE.

            PR tree-optimization/107554
            * tree-ssa-strlen.cc (strlen_pass::count_nonzero_bytes):
            Use unsigned HOST_WIDE_INT type for the strlen.

            * gcc.dg/pr107554.c: New testcase.

    Co-Authored-By: Nikita Voronov <nik_1357@mail.ru>
    (cherry picked from commit 81de4037454275f8ed6d858fbc129e832c6147ef)

[Bug tree-optimization/107554] [10/11 Regression] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:23a9270c999a24cdc0b716e832e5f16bb13db891

commit r11-10483-g23a9270c999a24cdc0b716e832e5f16bb13db891
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Nov 11 14:28:52 2022 +0100

    tree-optimization/107554 - fix ICE in stlen optimization

    The following fixes a wrongly typed variable causing an ICE.

            PR tree-optimization/107554
            * tree-ssa-strlen.c (strlen_pass::count_nonzero_bytes):
            Use unsigned HOST_WIDE_INT type for the strlen.

            * gcc.dg/pr107554.c: New testcase.

    Co-Authored-By: Nikita Voronov <nik_1357@mail.ru>
    (cherry picked from commit 81de4037454275f8ed6d858fbc129e832c6147ef)

[Bug tree-optimization/107554] [10 Regression] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:5d62d86d958a217cdb4155a557aeda1d0e644aba

commit r10-11179-g5d62d86d958a217cdb4155a557aeda1d0e644aba
Author: Richard Biener <rguenther@suse.de>
Date:   Fri Nov 11 14:28:52 2022 +0100

    tree-optimization/107554 - fix ICE in stlen optimization

    The following fixes a wrongly typed variable causing an ICE.

            PR tree-optimization/107554
            * tree-ssa-strlen.c (strlen_pass::count_nonzero_bytes):
            Use unsigned HOST_WIDE_INT type for the strlen.

            * gcc.dg/pr107554.c: New testcase.

    Co-Authored-By: Nikita Voronov <nik_1357@mail.ru>
    (cherry picked from commit 81de4037454275f8ed6d858fbc129e832c6147ef)

[Bug tree-optimization/107554] [10 Regression] Segmentation fault during GIMPLE pass: strlen (tree-ssa-strlen.cc:4772)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107554

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
      Known to work|                            |10.4.1
         Resolution|---                         |FIXED

--- Comment #11 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.