[Bug c/107557] New: [12/13 Regression] ICE in make_ssa_name_fn, at tree-ssanames.cc:360

[Bug c/107557] New: [12/13 Regression] ICE in make_ssa_name_fn, at tree-ssanames.cc:360

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

            Bug ID: 107557
           Summary: [12/13 Regression] ICE in make_ssa_name_fn, at
                    tree-ssanames.cc:360
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gscfq@t-online.de
  Target Milestone: ---

Started between 20210822 and 20210905 at -O3|-Ofast, with file
llvm-project-llvmorg-14.0.6/clang/test/CodeGen/vlt_to_pointer.c :


$ cat z1.c
int c[1][3*2];
int f(int * const m, int (**v)[*m * 2])
{
  return &(c[0][*m]) == &((*v)[0][*m]);
}
int test(int n, int (*(*fn)(void))[n])
{
  return (*fn())[0];
}
int main()
{
  int m = 3;
  int (*d)[3*2] = c;
  int (*fn[m])(void);
  return f(&m, &d) + test(m, &fn);
}


$ gcc-13-20221106 -c z1.c -m32 -Ofast -fnon-call-exceptions -ftrapv
-fsanitize=undefined
z1.c: In function 'main':
z1.c:15:30: warning: passing argument 2 of 'test' from incompatible pointer
type [-Wincompatible-pointer-types]
   15 |   return f(&m, &d) + test(m, &fn);
      |                              ^~~
      |                              |
      |                              int (* (*)[(((m) <= 0 ?
__builtin___ubsan_handle_vla_bound_not_positive(&*.Lubsan_data0, (unsigned
int)(m)) : (void)0, (m))) - 1])(void)
z1.c:6:25: note: expected 'int (* (*)(void))[(n) - 1]' but argument is of type
'int (* (*)[(((m) <= 0 ?
__builtin___ubsan_handle_vla_bound_not_positive(&*.Lubsan_data0, (unsigned
int)(m)) : (void)0, (m))) - 1])(void)'
    6 | int test(int n, int (*(*fn)(void))[n])
      |                 ~~~~~~~~^~~~~~~~~~~~~
during GIMPLE pass: einline
z1.c:15:22: internal compiler error: in make_ssa_name_fn, at
tree-ssanames.cc:360
   15 |   return f(&m, &d) + test(m, &fn);
      |                      ^~~~~~~~~~~~
0xf0e385 make_ssa_name_fn(function*, tree_node*, gimple*, unsigned int)
        ../../gcc/tree-ssanames.cc:357
0xd7104e make_ssa_name
        ../../gcc/tree-ssanames.h:97
0xd7104e remap_ssa_name
        ../../gcc/tree-inline.cc:237
0xd74257 copy_tree_body_r(tree_node**, int*, void*)
        ../../gcc/tree-inline.cc:1226
0xfa17b2 walk_tree_1(tree_node**, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*,
tree_node* (*)(tree_node**, int*, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*))
        ../../gcc/tree.cc:11281
0xd70124 remap_type_1
        ../../gcc/tree-inline.cc:596
0xd70498 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xd7037e remap_type_1
        ../../gcc/tree-inline.cc:532
0xd70498 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xd70057 remap_type_1
        ../../gcc/tree-inline.cc:425
0xd70498 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xd700e6 remap_type_1
        ../../gcc/tree-inline.cc:509
0xd70498 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xd70057 remap_type_1
        ../../gcc/tree-inline.cc:425
0xd70498 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xd7918c initialize_inlined_parameters
        ../../gcc/tree-inline.cc:3659
0xd7918c expand_call_inline
        ../../gcc/tree-inline.cc:5020
0xd7af89 gimple_expand_calls_inline
        ../../gcc/tree-inline.cc:5323
0xd7af89 optimize_inline_calls(tree_node*)
        ../../gcc/tree-inline.cc:5495
0x190544e early_inliner(function*)
        ../../gcc/ipa-inline.cc:3038

[Bug c/107557] [12/13 Regression] ICE in make_ssa_name_fn, at tree-ssanames.cc:360

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

G. Steinmetz <gscfq@t-online.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Target|                            |x86_64-pc-linux-gnu
           Keywords|                            |ice-on-valid-code

--- Comment #1 from G. Steinmetz <gscfq@t-online.de> ---

Or this combination :


$ gcc-13-20221106 -c z1.c -flto -fsanitize=undefined
z1.c: In function 'main':
z1.c:15:30: warning: passing argument 2 of 'test' from incompatible pointer
type [-Wincompatible-pointer-types]
   15 |   return f(&m, &d) + test(m, &fn);
      |                              ^~~
      |                              |
      |                              int (* (*)[(long int)(((m) <= 0 ?
__builtin___ubsan_handle_vla_bound_not_positive(&*.Lubsan_data0, (long unsigned
int)(m)) : (void)0, (m))) - 1])(void)
z1.c:6:25: note: expected 'int (* (*)(void))[(long int)(n) - 1]' but argument
is of type 'int (* (*)[(long int)(((m) <= 0 ?
__builtin___ubsan_handle_vla_bound_not_positive(&*.Lubsan_data0, (long unsigned
int)(m)) : (void)0, (m))) - 1])(void)'
    6 | int test(int n, int (*(*fn)(void))[n])
      |                 ~~~~~~~~^~~~~~~~~~~~~
during IPA pass: modref
z1.c: At top level:
z1.c:16:1: internal compiler error: tree code 'ssa_name' is not supported in
LTO streams
   16 | }
      | ^
0xb9c2ab lto_write_tree
        ../../gcc/lto-streamer-out.cc:561
0xb9c2ab lto_output_tree_1
        ../../gcc/lto-streamer-out.cc:599
0xba2b17 DFS::DFS(output_block*, tree_node*, bool, bool, bool)
        ../../gcc/lto-streamer-out.cc:899
0xba3a18 lto_output_tree(output_block*, tree_node*, bool, bool)
        ../../gcc/lto-streamer-out.cc:1866
0xb9beb1 write_global_stream
        ../../gcc/lto-streamer-out.cc:2861
0xba64bf lto_output_decl_state_streams(output_block*, lto_out_decl_state*)
        ../../gcc/lto-streamer-out.cc:2908
0xba64bf produce_asm_for_decls()
        ../../gcc/lto-streamer-out.cc:3302
0xc1ee6f write_lto
        ../../gcc/passes.cc:2780
0xc22c2e ipa_write_summaries_1
        ../../gcc/passes.cc:2841
0xc22c2e ipa_write_summaries()
        ../../gcc/passes.cc:2897
0x8e4874 ipa_passes
        ../../gcc/cgraphunit.cc:2218
0x8e4874 symbol_table::compile()
        ../../gcc/cgraphunit.cc:2291
0x8e764f symbol_table::compile()
        ../../gcc/cgraphunit.cc:2546
0x8e764f symbol_table::finalize_compilation_unit()
        ../../gcc/cgraphunit.cc:2543

[Bug c/107557] [12/13 Regression] ICE in make_ssa_name_fn, at tree-ssanames.cc:360

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.3

[Bug c/107557] [12/13 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
This hints at VLA gimplification not working properly, aka a missed DECL_EXPR
from the frontend.

[Bug c/107557] [12/13 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2022-11-21
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
If you add -fexceptions, it started with when UBSAN was added, so really old.

[Bug c/107557] [12/13 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
So likely ubsan instrumentation happens before the emitted decl_expr.

[Bug c/107557] [12/13 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

Martin Uecker <muecker at gwdg dot de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |muecker at gwdg dot de

--- Comment #5 from Martin Uecker <muecker at gwdg dot de> ---
This seems similar to PR108423 and I assume the common cause is that the fix
for PR84305 did not consider the case of function types with variably modified
return type (which are obscure).

[Bug c/107557] [12/13 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

--- Comment #6 from Martin Uecker <muecker at gwdg dot de> ---

Patch: https://gcc.gnu.org/pipermail/gcc-patches/2023-February/611562.html

[Bug c/107557] [12/13 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

--- Comment #7 from Martin Uecker <muecker at gwdg dot de> ---
Created attachment 54529
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54529&action=edit
new version of patch


Here is another patch that does all the recursion in gimplify_type_sizes.
Unfortunately, there are regression tests failing for fortran.

[Bug c/107557] [12/13 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

--- Comment #8 from Martin Uecker <muecker at gwdg dot de> ---
Created attachment 54818
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54818&action=edit
another version


This works without regressions, but is still not correct.

[Bug c/107557] [12/13/14 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.

[Bug c/107557] [12/13/14 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

--- Comment #10 from Martin Uecker <muecker at gwdg dot de> ---
PATCH https://gcc.gnu.org/pipermail/gcc-patches/2023-May/618911.html

[Bug c/107557] [12/13/14 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Uecker <uecker@gcc.gnu.org>:

https://gcc.gnu.org/g:f9b5be322358ee63798e02a9103b6bbe459e7aea

commit r14-1142-gf9b5be322358ee63798e02a9103b6bbe459e7aea
Author: Martin Uecker <uecker@tugraz.at>
Date:   Thu Apr 13 19:37:12 2023 +0200

    Fix ICEs related to VM types in C 1/2 [PR70418, PR107557, PR108423]

    Size expressions were sometimes lost and not gimplified correctly, leading
to
    ICEs and incorrect evaluation order.  Fix this by 1) not recursing into
    pointers when gimplifying parameters in the middle-end (the code is merged
with
    gimplify_type_sizes), which is incorrect because it might access variables
    declared later for incomplete structs, and 2) tracking size expressions for
    struct/union members correctly, 3) emitting code to evaluate size
expressions
    for missing cases (nested functions, empty declarations, and
structs/unions).

            PR c/70418
            PR c/106465
            PR c/107557
            PR c/108423

            gcc/c/
            * c-decl.cc (start_decl): Make sure size expression are
            evaluated only in correct context.
            (grokdeclarator): Size expression in fields may need a bind
            expression, make sure DECL_EXPR is always created.
            (grokfield, declspecs_add_type): Pass along size expressions.
            (finish_struct): Remove unneeded DECL_EXPR.
            (start_function): Evaluate size expressions for nested functions.
            * c-parser.cc (c_parser_struct_declarations,
            c_parser_struct_or_union_specifier): Pass along size expressions.
            (c_parser_declaration_or_fndef): Evaluate size expression.
            (c_parser_objc_at_property_declaration,
            c_parser_objc_class_instance_variables): Adapt.
            * c-tree.h (grokfield): Adapt declaration.

            gcc/testsuite/
            * gcc.dg/nested-vla-1.c: New test.
            * gcc.dg/nested-vla-2.c: New test.
            * gcc.dg/nested-vla-3.c: New test.
            * gcc.dg/pr70418.c: New test.
            * gcc.dg/pr106465.c: New test.
            * gcc.dg/pr107557-1.c: New test.
            * gcc.dg/pr107557-2.c: New test.
            * gcc.dg/pr108423-1.c: New test.
            * gcc.dg/pr108423-2.c: New test.
            * gcc.dg/pr108423-3.c: New test.
            * gcc.dg/pr108423-4.c: New test.
            * gcc.dg/pr108423-5.c: New test.
            * gcc.dg/pr108423-6.c: New test.
            * gcc.dg/typename-vla-2.c: New test.
            * gcc.dg/typename-vla-3.c: New test.
            * gcc.dg/typename-vla-4.c: New test.
            * gcc.misc-tests/gcov-pr85350.c: Adapt.

[Bug c/107557] [12/13/14 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sjames at gcc dot gnu.org

--- Comment #12 from Sam James <sjames at gcc dot gnu.org> ---
12 still ICEs for me, 13 doesn't but I couldn't spot the cherry-pick at a
glance. 14 is fine. Dunno if it just needs backports or if something made it
latent for 13.

martin?

[Bug c/107557] [12/13/14 Regression] ICE -fsanitize=undefined and VLA as argument type to a function

[uecker at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=107557

uecker at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |uecker at gcc dot gnu.org

--- Comment #13 from uecker at gcc dot gnu.org ---
I think we should backport these changes to 12 and 13.  But there is a case
which now breaks with these in GCC 14 (PR112488).  So I would like to look at
this and fix it first.