[Bug c/108423] New: [12/13 Regression] ICE in make_ssa_name_fn, at tree-ssanames.cc:360

[Bug c/108423] New: [12/13 Regression] ICE in make_ssa_name_fn, at tree-ssanames.cc:360

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

            Bug ID: 108423
           Summary: [12/13 Regression] ICE in make_ssa_name_fn, at
                    tree-ssanames.cc:360
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gscfq@t-online.de
  Target Milestone: ---

Started between 20211114 and 20211121, at -O2+ :


$ cat z1.c
int f (int n, int (**(*a)(void))[n])
{
  return (*a())[0];
}
int g ()
{
  int m = 3;
  int (*a[m])(void);
  return f(m, &a);
}


$ gcc-13-20230115 -c z1.c -O2
z1.c: In function 'f':
z1.c:3:10: warning: returning 'int *' from a function with return type 'int'
makes integer from pointer without a cast [-Wint-conversion]
    3 |   return (*a())[0];
      |          ^
z1.c: In function 'g':
z1.c:9:15: warning: passing argument 2 of 'f' from incompatible pointer type
[-Wincompatible-pointer-types]
    9 |   return f(m, &a);
      |               ^~
      |               |
      |               int (* (*)[m])(void)
z1.c:1:24: note: expected 'int (** (*)(void))[n]' but argument is of type 'int
(* (*)[m])(void)'
    1 | int f (int n, int (**(*a)(void))[n])
      |               ~~~~~~~~~^~~~~~~~~~~~
during GIMPLE pass: einline
z1.c:9:10: internal compiler error: in make_ssa_name_fn, at
tree-ssanames.cc:360
    9 |   return f(m, &a);
      |          ^~~~~~~~
0x11b1edd make_ssa_name_fn(function*, tree_node*, gimple*, unsigned int)
        ../../gcc/tree-ssanames.cc:357
0xfa16f6 make_ssa_name
        ../../gcc/tree-ssanames.h:97
0xfa16f6 remap_ssa_name
        ../../gcc/tree-inline.cc:237
0xfa5717 copy_tree_body_r(tree_node**, int*, void*)
        ../../gcc/tree-inline.cc:1226
0x1271d23 walk_tree_1(tree_node**, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*,
tree_node* (*)(tree_node**, int*, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*))
        ../../gcc/tree.cc:11289
0x1272784 walk_tree_1(tree_node**, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*,
tree_node* (*)(tree_node**, int*, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*))
        ../../gcc/tree.cc:11520
0xf9e851 remap_type_1
        ../../gcc/tree-inline.cc:596
0xf9fa28 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xf9e6b7 remap_type_1
        ../../gcc/tree-inline.cc:425
0xf9fa28 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xf9e6b7 remap_type_1
        ../../gcc/tree-inline.cc:425
0xf9fa28 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xf9e7bf remap_type_1
        ../../gcc/tree-inline.cc:509
0xf9fa28 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xf9e6b7 remap_type_1
        ../../gcc/tree-inline.cc:425
0xf9fa28 remap_type(tree_node*, copy_body_data*)
        ../../gcc/tree-inline.cc:713
0xfacb69 initialize_inlined_parameters
        ../../gcc/tree-inline.cc:3642
0xfacb69 expand_call_inline
        ../../gcc/tree-inline.cc:5004
0xfaf1e9 gimple_expand_calls_inline
        ../../gcc/tree-inline.cc:5307
0xfaf1e9 optimize_inline_calls(tree_node*)
        ../../gcc/tree-inline.cc:5479

[Bug middle-end/108423] [12/13 Regression] ICE in make_ssa_name_fn, at tree-ssanames.cc:360

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|c                           |middle-end
           Keywords|                            |ice-on-valid-code
   Target Milestone|---                         |12.3

[Bug c/108423] [12/13 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|middle-end                  |c
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
           Priority|P3                          |P2
   Last reconfirmed|                            |2023-01-17

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
#3  0x0000000001697500 in remap_ssa_name (name=<ssa_name 0x7ffff6271e10 1>, 
    id=0x7fffffffd910) at /home/rguenther/src/trunk/gcc/tree-inline.cc:237
237           new_tree = make_ssa_name (remap_type (TREE_TYPE (name), id));
(gdb) p debug_tree (name)
 <ssa_name 0x7ffff6271e10 type <error_mark 0x7ffff6266d80>
    nothrow
    def_stmt 
    version:1 in-free-list>
$1 = void

so another case with a missing/misplaced DECL_EXPR for the VLA size.

[Bug c/108423] [12/13 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13 Regression] ICE in   |[12/13 Regression] ICE in
                   |make_ssa_name_fn with VLA   |make_ssa_name_fn with VLA
                   |types in arguments and      |types in arguments and
                   |inlining                    |inlining since
                   |                            |r12-5338-g4e6bf0b9dd5585df
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |muecker at gwdg dot de

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-5338-g4e6bf0b9dd5585df.

[Bug c/108423] [12/13 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

--- Comment #3 from Martin Uecker <muecker at gwdg dot de> ---
Smaller example:

void f(int n, int (*a(void))[n])
{
        (a())[0];
}

void g(void)
{
        int (*a(void))[1];
        f(1, a);
}

[Bug c/108423] [12/13 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

--- Comment #4 from Martin Uecker <muecker at gwdg dot de> ---

The specific problem is triggered by the change to pointer_int_sum in
gcc/c-family/c-common.cc, but the underlying problem is older. The following
example fails since gcc 7:

void f(int n, int (*a(void))[n])
{
    sizeof (*a());
}

int (*a(void))[1];

void g(void)
{
    f(1, a);
}


https://godbolt.org/z/645ahfrzx

[Bug c/108423] [12/13 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

--- Comment #5 from Martin Uecker <muecker at gwdg dot de> ---
Probably related to PR88256

[Bug c/108423] [12/13 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

--- Comment #6 from Martin Uecker <muecker at gwdg dot de> ---
Actually, I meant PR84305 for C.

[Bug c/108423] [12/13 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

--- Comment #7 from Martin Uecker <muecker at gwdg dot de> ---


* gimplify_type_size does not recurse into pointer, record, or function types
(the later are not mentioned). 

* the C FE has code to emit fake TYPE_DECLs for pointer types in
c-decl.cc/grokdeclarator 

* In the FE, size expressions in parameters go into pending_sizes and emitted
at a start of a function c-decl.cc/store_parm_decls

* function.cc/gimplify_parm_type only considers types with non-constant size
and otherwise recurses only into pointer types


How all this fits together is a bit of mystery to me. 

Modifying gimplify_parm_type to also recurse into function types seems to fix
this bug (and PR107557) but I am not sure if this is the right fix. Then there
should also be similar missing cases related to records/unions?

[Bug c/108423] [12/13 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

--- Comment #8 from Martin Uecker <muecker at gwdg dot de> ---
https://gcc.gnu.org/pipermail/gcc-patches/2023-February/611562.html

[Bug c/108423] [12/13/14 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.

[Bug c/108423] [12/13/14 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[muecker at gwdg dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

--- Comment #10 from Martin Uecker <muecker at gwdg dot de> ---
PATCH: https://gcc.gnu.org/pipermail/gcc-patches/2023-May/618911.html

[Bug c/108423] [12/13/14 Regression] ICE in make_ssa_name_fn with VLA types in arguments and inlining since r12-5338-g4e6bf0b9dd5585df

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108423

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Uecker <uecker@gcc.gnu.org>:

https://gcc.gnu.org/g:f9b5be322358ee63798e02a9103b6bbe459e7aea

commit r14-1142-gf9b5be322358ee63798e02a9103b6bbe459e7aea
Author: Martin Uecker <uecker@tugraz.at>
Date:   Thu Apr 13 19:37:12 2023 +0200

    Fix ICEs related to VM types in C 1/2 [PR70418, PR107557, PR108423]

    Size expressions were sometimes lost and not gimplified correctly, leading
to
    ICEs and incorrect evaluation order.  Fix this by 1) not recursing into
    pointers when gimplifying parameters in the middle-end (the code is merged
with
    gimplify_type_sizes), which is incorrect because it might access variables
    declared later for incomplete structs, and 2) tracking size expressions for
    struct/union members correctly, 3) emitting code to evaluate size
expressions
    for missing cases (nested functions, empty declarations, and
structs/unions).

            PR c/70418
            PR c/106465
            PR c/107557
            PR c/108423

            gcc/c/
            * c-decl.cc (start_decl): Make sure size expression are
            evaluated only in correct context.
            (grokdeclarator): Size expression in fields may need a bind
            expression, make sure DECL_EXPR is always created.
            (grokfield, declspecs_add_type): Pass along size expressions.
            (finish_struct): Remove unneeded DECL_EXPR.
            (start_function): Evaluate size expressions for nested functions.
            * c-parser.cc (c_parser_struct_declarations,
            c_parser_struct_or_union_specifier): Pass along size expressions.
            (c_parser_declaration_or_fndef): Evaluate size expression.
            (c_parser_objc_at_property_declaration,
            c_parser_objc_class_instance_variables): Adapt.
            * c-tree.h (grokfield): Adapt declaration.

            gcc/testsuite/
            * gcc.dg/nested-vla-1.c: New test.
            * gcc.dg/nested-vla-2.c: New test.
            * gcc.dg/nested-vla-3.c: New test.
            * gcc.dg/pr70418.c: New test.
            * gcc.dg/pr106465.c: New test.
            * gcc.dg/pr107557-1.c: New test.
            * gcc.dg/pr107557-2.c: New test.
            * gcc.dg/pr108423-1.c: New test.
            * gcc.dg/pr108423-2.c: New test.
            * gcc.dg/pr108423-3.c: New test.
            * gcc.dg/pr108423-4.c: New test.
            * gcc.dg/pr108423-5.c: New test.
            * gcc.dg/pr108423-6.c: New test.
            * gcc.dg/typename-vla-2.c: New test.
            * gcc.dg/typename-vla-3.c: New test.
            * gcc.dg/typename-vla-4.c: New test.
            * gcc.misc-tests/gcov-pr85350.c: Adapt.