[Bug c++/108278] New: runtime error with -O1 -Wall

[Bug c++/108278] New: runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

            Bug ID: 108278
           Summary: runtime error with -O1 -Wall
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

Created attachment 54182
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=54182&action=edit
gzipped C++ source code

The attached C++ code does this:

$ ../results/bin/g++ -c -O1 -Wall bug872.cc 
../../trunk.d1/gcc/poly-int.h:753:21: runtime error: signed integer overflow:
4611686018427387903 * 8 cannot be represented in type 'long int'
$ 

The bug first seems to occur sometime between git hash d423e8dc59045d8f,
from a couple of days ago and fee53a3194c0d8b7, from today, a distance
of 14 commits.

I have a reduction running.

[Bug c++/108278] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #1 from David Binderman <dcb314 at hotmail dot com> ---
Reduced C++ code is

typedef int mbstate_t;
namespace std {
struct Trans_NS___cxx11_basic_string {
  char *c_str();
};
template <typename _Facet> _Facet use_facet(int);
template <typename _ExternT> struct __codecvt_abstract_base {
  typedef _ExternT extern_type;
  int length(int, extern_type *, const extern_type *, long);
};
template <typename, typename _ExternT, typename>
struct codecvt : __codecvt_abstract_base<_ExternT> {};
} // namespace std
template <class T> struct intrusive_ptr {
  intrusive_ptr(T *);
  T *operator->();
};
long attach___trans_tmp_3;
struct basic_ostringstreambuf {
  struct {
    std::Trans_NS___cxx11_basic_string storage;
    long max_size;
  } m_storage_state;
  void attach() {
    attach___trans_tmp_3 = 9223372036854775807 / 2;
    long size = attach___trans_tmp_3;
    m_storage_state.max_size = size;
    length_until_boundary(m_storage_state.storage.c_str(),
                          m_storage_state.max_size);
  }
  void length_until_boundary(char *s, long max_size) {
    int loc;
    std::codecvt fac =
        std::use_facet<std::codecvt<wchar_t, char, mbstate_t>>(loc);
    mbstate_t mbs(fac.length(mbs, s, s + max_size, 0));
  }
};
struct Trans_NS_v2_mt_posix_basic_formatting_ostream {
  basic_ostringstreambuf m_streambuf;
  void attach(std::Trans_NS___cxx11_basic_string) { m_streambuf.attach(); }
};
template <typename>
struct Trans_NS_v2_mt_posix_basic_record_ostream
    : Trans_NS_v2_mt_posix_basic_formatting_ostream {
  typedef std::Trans_NS___cxx11_basic_string string_type;
  void init_stream();
};
struct attribute_value_impl {
  attribute_value_impl(std::Trans_NS___cxx11_basic_string);
  std::Trans_NS___cxx11_basic_string get();
};
template <typename CharT>
void Trans_NS_v2_mt_posix_basic_record_ostream<CharT>::init_stream() {
  typedef attribute_value_impl message_impl_type;
  intrusive_ptr p = new message_impl_type(string_type());
  attach(p->get());
}
template class Trans_NS_v2_mt_posix_basic_record_ostream<char>;

I will have a go at a git bisect in the morning.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
             Blocks|                            |63426
   Target Milestone|---                         |13.0
            Summary|runtime error with -O1      |[13 Regression] runtime
                   |-Wall                       |error with -O1 -Wall
          Component|c++                         |middle-end


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63426
[Bug 63426] [meta-bug] Issues found with -fsanitize=undefined

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note the original testcase does (inside _M_max_size):
 return std::size_t(0x7fffffffffffffffL) / sizeof(_Tp);

Which was reduced to just:
    attach___trans_tmp_3 = 9223372036854775807 / 2;

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #3 from David Binderman <dcb314 at hotmail dot com> ---
Trying revision aeee4812442c996f in bisect.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to David Binderman from comment #3)
> Trying revision aeee4812442c996f in bisect.

That seems fine, so trying 3b6cac2b44b384cd.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #5 from David Binderman <dcb314 at hotmail dot com> ---
Another runtime bug, probably related:

../../trunk.d1/gcc/expmed.cc:3282:26: runtime error: signed integer overflow:
-9223372036854775808 - 1 cannot be represented in type 'long int'

I am not sure if this one should be a separate bug report or not.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

David Binderman <dcb314 at hotmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |fweimer at redhat dot com

--- Comment #6 from David Binderman <dcb314 at hotmail dot com> ---
The Author list for the revisions under test is:

Author: GCC Administrator <gccadmin@gcc.gnu.org>
Author: Alexander Monakov <amonakov@ispras.ru>
Author: Florian Weimer <fweimer@redhat.com>
Author: Florian Weimer <fweimer@redhat.com>
Author: Florian Weimer <fweimer@redhat.com>
Author: Iain Sandoe <iain@sandoe.co.uk>
Author: Jakub Jelinek <jakub@redhat.com>

Alex, Iain and Jakub make what look like unrelated changes, so adding
Florian for their opinion.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #7 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to David Binderman from comment #4)
> (In reply to David Binderman from comment #3)
> > Trying revision aeee4812442c996f in bisect.
> 
> That seems fine, so trying 3b6cac2b44b384cd.

That seems ok, so git range seems to be: 3b6cac2b44b384cd..fee53a3194c0d8b7

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[fw at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #8 from Florian Weimer <fw at gcc dot gnu.org> ---
I believe the revert in 455acc43518744b89d6a795bbba5045bd228060b should have
fixed this?

I also brought up the initialization issue on the gcc list:

Default initialization of poly-ints
<https://gcc.gnu.org/pipermail/gcc/2023-January/240456.html>

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
If it is the unwinder stuff, then it shouldn't affect anything but
-fbuilding-libgcc, no?  The macros were predefined only if -fbuilding-libgcc,
and __builtin_init_dwarf_reg_size_table is only called in libgcc.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
BTW, please use g: prefix for git hashes or r13-4989-g345dffd0d4ebff7 or
r13-4989 styles, anything else is quite useless as it doesn't create hyperlinks
in bugzilla.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #11 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Anyway, can't reproduce with current trunk (just stage1 built with
-fsanitize=undefined).

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #12 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to Jakub Jelinek from comment #10)
> BTW, please use g: prefix for git hashes or r13-4989-g345dffd0d4ebff7 or
> r13-4989 styles, anything else is quite useless as it doesn't create
> hyperlinks in bugzilla.

Let's try that out:

g:d423e8dc59045d8f and g:fee53a3194c0d8b7

I am a novice at git, so where does the 4989 in r13-4989-g* come from ?
The 4989 looks like a useful serial number to me.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #13 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to David Binderman from comment #12)
> Let's try that out:
> 
> g:d423e8dc59045d8f and g:fee53a3194c0d8b7

Seems to work. Good.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #14 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to Florian Weimer from comment #8)
> I believe the revert in 455acc43518744b89d6a795bbba5045bd228060b should have
> fixed this?

It looks to me like it does.

> I also brought up the initialization issue on the gcc list:
> 
> Default initialization of poly-ints
> <https://gcc.gnu.org/pipermail/gcc/2023-January/240456.html>

This is the second time I have noticed this issue has occurred with a 
data type in gcc. It would be safer if there was a default initialisation
to zero for all gcc data types.

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |WAITING
   Last reconfirmed|                            |2023-01-09

--- Comment #15 from Richard Biener <rguenth at gcc dot gnu.org> ---
So this bug is fixed?

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #16 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to Richard Biener from comment #15)
> So this bug is fixed?

Jakub and I seem to think so. Good enough ?

[Bug middle-end/108278] [13 Regression] runtime error with -O1 -Wall

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

--- Comment #17 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
We know the commit introduced UB on the compiler side, but what I don't
understand is why it triggered on the testcases you've provided.  It surely
introduced UB when compiling libgcc/unwind-dw2.c or during predefining macros
with -fbuilding-libgcc, but I think the problematic code with uninitialized
array of poly_ints could happen at different times.

[Bug middle-end/108278] [13/14 Regression] runtime error with -O1 -Wall

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|13.0                        |13.2

--- Comment #18 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 13.1 is being released, retargeting bugs to GCC 13.2.

[Bug middle-end/108278] [13/14 Regression] runtime error with -O1 -Wall

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|13.2                        |13.3

--- Comment #19 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 13.2 is being released, retargeting bugs to GCC 13.3.

[Bug middle-end/108278] [13/14 Regression] runtime error with -O1 -Wall

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108278

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org
             Status|WAITING                     |RESOLVED
         Resolution|---                         |FIXED

--- Comment #20 from Jeffrey A. Law <law at gcc dot gnu.org> ---
Per c#16.