[Bug c/110043] New: ice in size_remaining, at pointer-query.cc:875

[Bug c/110043] New: ice in size_remaining, at pointer-query.cc:875

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110043

            Bug ID: 110043
           Summary: ice in size_remaining, at pointer-query.cc:875
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

For this C source code:

__int128 g_116_1;
char g_521[][8];
func_24() {
  for (; g_116_1 >= 0;)
    g_521[g_116_1][g_116_1] &= 0;
}

compiled by recent gcc, does this:

$ ~/gcc/results/bin/gcc -c -w -O1 bug927.c
during GIMPLE pass: waccess
bug927.c: In function ‘func_24’:
bug927.c:3:1: internal compiler error: in size_remaining, at
pointer-query.cc:875
    3 | func_24() {
      | ^~~~~~~
0xd1823d
access_ref::size_remaining(generic_wide_int<fixed_wide_int_storage<128>
 >*) const
        ../../trunk.year/gcc/pointer-query.cc:875

The bug seems to exist since sometime before 20220515.

[Bug tree-optimization/110043] [14 Regression] ice in size_remaining, at pointer-query.cc:875

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110043

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|ice in size_remaining, at   |[14 Regression] ice in
                   |pointer-query.cc:875        |size_remaining, at
                   |                            |pointer-query.cc:875
          Component|c                           |tree-optimization
   Target Milestone|---                         |14.0
           Keywords|                            |ice-on-valid-code

[Bug tree-optimization/110043] [14 Regression] ice in size_remaining, at pointer-query.cc:875

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110043

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-05-30
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note you can make this C++ valid code too:
```
__int128 g_116_1;
extern char g_521[][8];
void func_24() {
  for (; g_116_1 >= 0;)
    g_521[g_116_1][g_116_1] &= 0;
}
```

Confirmed.

[Bug tree-optimization/110043] [14 Regression] ice in size_remaining, at pointer-query.cc:875

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110043

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
More simplified testcase:
```
__int128 g_116_1;
extern char g_521[][8];
void func_24() {
  if (g_116_1 >= 0)
    g_521[g_116_1][g_116_1] &= 0;
}
```

I think this ICEs with types which >= sizeof(offset_int)

Which is defined as:
typedef FIXED_WIDE_INT (ADDR_MAX_PRECISION) offset_int;

Which is basically says:
     The extra sign bit means that offset_int is effectively a signed
     128-bit integer, i.e. it behaves like int128_t.

[Bug tree-optimization/110043] [14 Regression] ice in size_remaining, at pointer-query.cc:875

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110043

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |msebor at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
We run into

void access_ref::add_offset (const offset_int &min, const offset_int &max)
{
  if (min <= max)
    {
      /* To add an ordinary range just add it to the bounds.  */
      offrng[0] += min;
      offrng[1] += max;

with

(gdb) p offrng[0]
$20 = {<fixed_wide_int_storage<128>> = {val = {0, 0}, len = 1}, 
  static is_sign_extended = true, static needs_write_val_arg = false}
(gdb) p offrng[1]
$21 = {<fixed_wide_int_storage<128>> = {val = {9223372036854775807, 
      140737488342928}, len = 1}, static is_sign_extended = true, 
  static needs_write_val_arg = false}
(gdb) p min
$22 = (const offset_int &) @0x7fffffffd320: {<fixed_wide_int_storage<128>> = {
    val = {0, 15546413}, len = 1}, static is_sign_extended = true, 
  static needs_write_val_arg = false}
(gdb) p max
$23 = (const offset_int &) @0x7fffffffd338: {<fixed_wide_int_storage<128>> = {
    val = {-1, 9223372036854775807}, len = 2}, static is_sign_extended = true, 
  static needs_write_val_arg = false}

min <= max which is supposed to use a signed compare, returns true and
then the offrng[1] += max operation overflows offrng[1] to negative.

Looks like most offset arithmetic in pointer-query should be saturating
somehow ...

[Bug tree-optimization/110043] [12/13/14 Regression] ice in size_remaining, at pointer-query.cc:875 since r12-6606-g9d6a0f388eb048

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110043

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sjames at gcc dot gnu.org
            Summary|[14 Regression] ice in      |[12/13/14 Regression] ice
                   |size_remaining, at          |in size_remaining, at
                   |pointer-query.cc:875        |pointer-query.cc:875 since
                   |                            |r12-6606-g9d6a0f388eb048

--- Comment #4 from Sam James <sjames at gcc dot gnu.org> ---
9d6a0f388eb048f8d87f47af78f07b5ce513bfe6 is the first bad commit
commit 9d6a0f388eb048f8d87f47af78f07b5ce513bfe6
Author: Martin Sebor <msebor@redhat.com>
Date:   Sat Jan 15 16:41:40 2022 -0700

    Add -Wdangling-pointer [PR63272].

    Resolves:
    PR c/63272 - GCC should warn when using pointer to dead scoped variable
with
    in the same function

i.e. r12-6606-g9d6a0f388eb048

[Bug tree-optimization/110043] [12/13/14 Regression] ice in size_remaining, at pointer-query.cc:875 since r12-6606-g9d6a0f388eb048

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110043

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
   Target Milestone|14.0                        |12.4