[Bug tree-optimization/108522] New: [Regression 12/13] ICE in tree-object-size when struct has VLA

[Bug tree-optimization/108522] New: [Regression 12/13] ICE in tree-object-size when struct has VLA

[siddhesh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108522

            Bug ID: 108522
           Summary: [Regression 12/13] ICE in tree-object-size when struct
                    has VLA
           Product: gcc
           Version: 13.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: siddhesh at gcc dot gnu.org
  Target Milestone: ---

Reproducer:

__SIZE_TYPE__ foo (unsigned int n)
{
 struct {
  unsigned char a[n];
  unsigned char b;
 } s;

 return __builtin_dynamic_object_size (&s.b, 1);
}

$ gcc/cc1 -quiet ../repro.cc -O2 -Wall -o -
        .file   "repro.cc"
        .text
during GIMPLE pass: objsz
../repro.cc: In function ‘foo’:
../repro.cc:1:15: internal compiler error: in execute_todo, at passes.cc:2140
    1 | __SIZE_TYPE__ foo (unsigned int n)
      |               ^~~
0x72216f execute_todo
        ../../gcc/passes.cc:2140
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

Looks like getting the size of object for a pointer right after a VLA in a
struct results in an ICE.  I'm on it.

[Bug tree-optimization/108522] [Regression 12/13] ICE in tree-object-size when struct has VLA

[siddhesh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108522

Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://bugzilla.redhat.com
                   |                            |/show_bug.cgi?id=2164035
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-01-24
           Keywords|                            |ice-on-valid-code
             Status|UNCONFIRMED                 |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |siddhesh at gcc dot gnu.org

[Bug tree-optimization/108522] [12/13 Regression] ICE in tree-object-size when struct has VLA

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108522

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
           Priority|P3                          |P2
   Target Milestone|---                         |12.3

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
At least for backports one option can be punt (give the constant maximum or
minimum) when variable length structures are involved, almost nobody uses them
(with the exception of Ada but then _FORTIFY_SOURCE=3 isn't on) and they are
quite a mess to support.
Otherwise, one needs to make sure to use TREE_OPERAND (t, 2) of COMPONENT_REF
if non-NULL.
On the above testcase one can see:
  _3 = &s.1_9->b{off: _1};
  _12 = __builtin_dynamic_object_size (_3, 1);
That {off: _1} in there means COMPONENT_REF's last operand isn't NULL, but is
SSA_NAME _1.  That contains something that should be used instead of
DECL_FIELD_OFFSET if specified, because in DECL_FIELD_OFFSET you'll see a
VAR_DECL that contained that value during gimplification, but isn't maintained
later on.
tree-object-size.cc currently uses byte_position, which is ok if last
COMPONENT_REF's operand is NULL, otherwise it should be
byte_from_pos (TREE_OPERAND (component_ref, 2), DECL_FIELD_BIT_OFFSET (field));
where field is TREE_OPERAND (component_ref, 1).

[Bug tree-optimization/108522] [12/13 Regression] ICE in tree-object-size when struct has VLA

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108522

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Ah, actually
      off = size_binop (PLUS_EXPR, DECL_FIELD_OFFSET (t),
                        size_int (tree_to_uhwi (DECL_FIELD_BIT_OFFSET (t))
                                  / BITS_PER_UNIT));
So:
-      off = size_binop (PLUS_EXPR, DECL_FIELD_OFFSET (t),
+      off = size_binop (PLUS_EXPR, TREE_OPERAND (expr, 2)
+                                   ? TREE_OPERAND (expr, 2) :
DECL_FIELD_OFFSET (t),
                         size_int (tree_to_uhwi (DECL_FIELD_BIT_OFFSET (t))
                                   / BITS_PER_UNIT));
or so.

[Bug tree-optimization/108522] [12/13 Regression] ICE in tree-object-size when struct has VLA

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108522

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Siddhesh Poyarekar
<siddhesh@gcc.gnu.org>:

https://gcc.gnu.org/g:b851ee9fdf0f3023635f0cb1f7c607b2d6801053

commit r13-5341-gb851ee9fdf0f3023635f0cb1f7c607b2d6801053
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date:   Tue Jan 24 19:47:05 2023 -0500

    tree-optimization/108522 Use COMPONENT_REF offset when available

    Use the offset in TREE_OPERAND(component_ref, 2) when available instead
    of DECL_FIELD_OFFSET when trying to compute offset for a COMPONENT_REF.

    Co-authored-by: Jakub Jelinek <jakub@redhat.com>

    gcc/ChangeLog:

            PR tree-optimization/108522
            * tree-object-size.cc (compute_object_offset): Use
            TREE_OPERAND(ref, 2) for COMPONENT_REF when available.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/108522
            * gcc.dg/builtin-dynamic-object-size-0.c
            (test_dynarray_struct_member): New test.
            (main): Call it.

    Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>

[Bug tree-optimization/108522] [12/13 Regression] ICE in tree-object-size when struct has VLA

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108522

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Siddhesh Poyarekar
<siddhesh@gcc.gnu.org>:

https://gcc.gnu.org/g:0573a0778af88e805f7630ac8640ecd67d692665

commit r13-5382-g0573a0778af88e805f7630ac8640ecd67d692665
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date:   Thu Jan 26 07:07:03 2023 -0500

    tree-optimization/108522 Use component_ref_field_offset

    Instead of using TREE_OPERAND (expr, 2) directly, use
    component_ref_field_offset instead, which does scaling for us.  The
    function also substitutes PLACEHOLDER_EXPRs but it is not relevant for
    tree-object-size.

    gcc/ChangeLog:

            PR tree-optimization/108522
            * tree-object-size.cc (compute_object_offset): Make EXPR
            argument non-const.  Call component_ref_field_offset.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/108522
            * gcc.dg/builtin-dynamic-object-size-0.c (DEFSTRUCT): New
            macro.
            (test_dynarray_struct_member_b, test_dynarray_struct_member_c,
            test_dynarray_struct_member_d,
            test_dynarray_struct_member_subobj_b,
            test_dynarray_struct_member_subobj_c,
            test_dynarray_struct_member_subobj_d): New tests.
            (main): Call them.

    Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>

[Bug tree-optimization/108522] [12 Regression] ICE in tree-object-size when struct has VLA

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108522

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Siddhesh Poyarekar
<siddhesh@gcc.gnu.org>:

https://gcc.gnu.org/g:4526562a305b3bfc18485a2aa017500aa22aa14b

commit r12-9112-g4526562a305b3bfc18485a2aa017500aa22aa14b
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date:   Tue Jan 24 19:47:05 2023 -0500

    tree-optimization/108522 Use COMPONENT_REF offset when available

    Use the offset in TREE_OPERAND(component_ref, 2) when available instead
    of DECL_FIELD_OFFSET when trying to compute offset for a COMPONENT_REF.

    Co-authored-by: Jakub Jelinek <jakub@redhat.com>

    gcc/ChangeLog:

            PR tree-optimization/108522
            * tree-object-size.cc (compute_object_offset): Use
            TREE_OPERAND(ref, 2) for COMPONENT_REF when available.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/108522
            * gcc.dg/builtin-dynamic-object-size-0.c
            (test_dynarray_struct_member): New test.
            (main): Call it.

    Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
    (cherry picked from commit b851ee9fdf0f3023635f0cb1f7c607b2d6801053)

[Bug tree-optimization/108522] [12 Regression] ICE in tree-object-size when struct has VLA

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108522

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-12 branch has been updated by Siddhesh Poyarekar
<siddhesh@gcc.gnu.org>:

https://gcc.gnu.org/g:45b346664c0af57053e77276cd030015eb21f851

commit r12-9113-g45b346664c0af57053e77276cd030015eb21f851
Author: Siddhesh Poyarekar <siddhesh@gotplt.org>
Date:   Thu Jan 26 07:07:03 2023 -0500

    tree-optimization/108522 Use component_ref_field_offset

    Instead of using TREE_OPERAND (expr, 2) directly, use
    component_ref_field_offset instead, which does scaling for us.  The
    function also substitutes PLACEHOLDER_EXPRs but it is not relevant for
    tree-object-size.

    gcc/ChangeLog:

            PR tree-optimization/108522
            * tree-object-size.cc (compute_object_offset): Make EXPR
            argument non-const.  Call component_ref_field_offset.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/108522
            * gcc.dg/builtin-dynamic-object-size-0.c (DEFSTRUCT): New
            macro.
            (test_dynarray_struct_member_b, test_dynarray_struct_member_c,
            test_dynarray_struct_member_d,
            test_dynarray_struct_member_subobj_b,
            test_dynarray_struct_member_subobj_c,
            test_dynarray_struct_member_subobj_d): New tests.
            (main): Call them.

    Signed-off-by: Siddhesh Poyarekar <siddhesh@gotplt.org>
    (cherry picked from commit 0573a0778af88e805f7630ac8640ecd67d692665)

[Bug tree-optimization/108522] [12 Regression] ICE in tree-object-size when struct has VLA

[siddhesh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=108522

Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Siddhesh Poyarekar <siddhesh at gcc dot gnu.org> ---
Fixed on master as well as gcc-12 now.