[Bug c/110662] New: Segmentation fault with '-O3'

[Bug c/110662] New: Segmentation fault with '-O3'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110662

            Bug ID: 110662
           Summary: Segmentation fault with '-O3'
           Product: gcc
           Version: 11.4.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: 19373742 at buaa dot edu.cn
  Target Milestone: ---

Created attachment 55539
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55539&action=edit
The preprocessed file

*******************************************************************************
OS and Platform:
CentOS Linux release 7.9.2009 (Core), x86_64 GNU/Linux
*******************************************************************************
gcc version:
gcc -v
Using built-in specs.
COLLECT_GCC=/home/new-gcc/gcc-11-0706/bin/gcc
COLLECT_LTO_WRAPPER=/home/new-gcc/gcc-11-0706/libexec/gcc/x86_64-pc-linux-gnu/11.4.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ./configure --prefix=/home/new-gcc/gcc-11-0706/
--disable-multilib --enable-language=c,c++
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.4.1 20230706 (GCC)
*******************************************************************************
Command Lines:
# /home/new-gcc/gcc-11-0706/bin/gcc -I /home/csmith/include/csmith-2.3.0/ -O3
-fno-aggressive-loop-optimizations -fno-align-functions -fno-align-jumps
-fno-align-labels -fno-align-loops -fno-allocation-dce
-fno-asynchronous-unwind-tables -fno-auto-inc-dec -fno-bit-tests
-fno-branch-count-reg -fno-caller-saves -fno-code-hoisting
-fno-combine-stack-adjustments -fno-compare-elim -fno-cprop-registers
-fno-crossjumping -fno-cse-follow-jumps -fno-dce -fno-defer-pop
-fno-delete-null-pointer-checks -fno-devirtualize
-fno-devirtualize-speculatively -fno-dse -fno-early-inlining
-fno-expensive-optimizations -fno-forward-propagate -fno-fp-int-builtin-inexact
-fno-function-cse -fno-gcse -fno-gcse-after-reload -fno-gcse-lm
-fno-guess-branch-probability -fno-hoist-adjacent-loads -fno-if-conversion
-fno-if-conversion2 -fno-indirect-inlining -fno-inline -fno-inline-atomics
-fno-inline-functions -fno-inline-functions-called-once
-fno-inline-small-functions -fno-ipa-bit-cp -fno-ipa-cp -fno-ipa-cp-clone
-fno-ipa-icf -fno-ipa-icf-functions -fno-ipa-icf-variables -fno-ipa-modref
-fno-ipa-profile -fno-ipa-pure-const -fno-ipa-ra -fno-ipa-reference
-fno-ipa-reference-addressable -fno-ipa-sra -fno-ipa-stack-alignment
-fno-ipa-vrp -fno-ira-hoist-pressure -fno-ira-share-save-slots
-fno-ira-share-spill-slots -fno-isolate-erroneous-paths-dereference -fno-ivopts
-fno-jump-tables -fno-lifetime-dse -fno-loop-interchange
-fno-loop-unroll-and-jam -fno-lra-remat -fno-math-errno
-fno-move-loop-invariants -fno-omit-frame-pointer -fno-optimize-sibling-calls
-fno-optimize-strlen -fno-partial-inlining -fno-peel-loops -fno-peephole
-fno-peephole2 -fno-plt -fno-predictive-commoning -fno-prefetch-loop-arrays
-fno-printf-return-value -fno-ree -fno-reg-struct-return -fno-rename-registers
-fno-reorder-blocks -fno-reorder-blocks-and-partition -fno-reorder-functions
-fno-rerun-cse-after-loop -fno-sched-critical-path-heuristic
-fno-sched-dep-count-heuristic -fno-sched-group-heuristic -fno-sched-interblock
-fno-sched-last-insn-heuristic -fno-sched-rank-heuristic -fno-sched-spec
-fno-sched-spec-insn-heuristic -fno-sched-stalled-insns-dep
-fno-schedule-fusion -fno-schedule-insns2 -fno-short-enums -fno-shrink-wrap
-fno-shrink-wrap-separate -fno-signed-zeros -fno-split-ivs-in-unroller
-fno-split-loops -fno-split-paths -fno-split-wide-types -fno-ssa-backprop
-fno-ssa-phiopt -fno-stdarg-opt -fno-store-merging -fno-strict-aliasing
-fno-strict-volatile-bitfields -fno-thread-jumps -fno-toplevel-reorder
-fno-trapping-math -fno-tree-bit-ccp -fno-tree-builtin-call-dce -fno-tree-ccp
-fno-tree-ch -fno-tree-coalesce-vars -fno-tree-copy-prop -fno-tree-cselim
-fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-forwprop
-fno-tree-fre -fno-tree-loop-distribute-patterns -fno-tree-loop-distribution
-fno-tree-loop-if-convert -fno-tree-loop-im -fno-tree-loop-ivcanon
-fno-tree-loop-optimize -fno-tree-loop-vectorize -fno-tree-partial-pre
-fno-tree-phiprop -fno-tree-pre -fno-tree-pta -fno-tree-reassoc
-fno-tree-scev-cprop -fno-tree-sink -fno-tree-slp-vectorize -fno-tree-slsr
-fno-tree-sra -fno-tree-switch-conversion -fno-tree-tail-merge -fno-tree-ter
-fno-tree-vrp -fno-unroll-completely-grow-size -fno-unswitch-loops
-fno-unwind-tables -fno-var-tracking -fno-var-tracking-assignments
-fno-version-loops-for-strides -fno-web -fno-allow-store-data-races
-fno-associative-math -fno-branch-probabilities -fno-conserve-stack
-fno-cx-fortran-rules -fno-cx-limited-range -fno-delayed-branch
-fno-delete-dead-exceptions -fno-exceptions -fno-finite-loops
-fno-finite-math-only -fno-float-store -fno-gcse-las -fno-gcse-sm -fno-graphite
-fno-graphite-identity -fno-ipa-pta -fno-ira-loop-pressure
-fno-isolate-erroneous-paths-attribute -fno-keep-gc-roots-live
-fno-limit-function-alignment -fno-live-range-shrinkage -fno-loop-nest-optimize
-fno-loop-parallelize-all -fno-modulo-sched -fno-modulo-sched-allow-regmoves
-fno-non-call-exceptions -fno-opt-info -fno-pack-struct
-fno-profile-partial-training -fno-profile-reorder-functions
-fno-reciprocal-math -fno-reschedule-modulo-scheduled-loops -fno-rounding-math
-fno-save-optimization-record -fno-sched-pressure -fno-sched-spec-load
-fno-sched-spec-load-dangerous -fno-sched-stalled-insns
-fno-sched2-use-superblocks -fno-schedule-insns -fno-section-anchors
-fno-sel-sched-pipelining -fno-sel-sched-pipelining-outer-loops
-fno-sel-sched-reschedule-pipelined -fno-short-wchar -fno-signaling-nans
-fno-single-precision-constant -fno-split-wide-types-early
-fno-stack-clash-protection -fno-tracer -fno-trapv -fno-tree-lrs
-fno-unconstrained-commons -fno-unroll-all-loops -fno-unroll-loops
-fno-unsafe-math-optimizations -fno-var-tracking-assignments-toggle
-fno-var-tracking-uninit -fno-variable-expansion-in-unroller -fno-vpt
-fno-wrapv -fno-wrapv-pointer -fno-aggressive-loop-optimizations
-fno-align-functions -falign-jumps -fno-align-labels -fno-align-loops
-fallocation-dce -fasynchronous-unwind-tables -fno-auto-inc-dec -fno-bit-tests
-fno-branch-count-reg -fcaller-saves -fno-code-hoisting
-fno-combine-stack-adjustments -fcompare-elim -fno-cprop-registers
-fno-crossjumping -fcse-follow-jumps -fno-dce -fdefer-pop
-fno-delete-null-pointer-checks -fno-devirtualize -fdevirtualize-speculatively
-fno-dse -fearly-inlining -fexpensive-optimizations -fno-forward-propagate
-ffp-int-builtin-inexact -ffunction-cse -fno-gcse -fno-gcse-after-reload
-fgcse-lm -fguess-branch-probability -fno-hoist-adjacent-loads -fif-conversion
-fno-if-conversion2 -findirect-inlining -finline -finline-atomics
-fno-inline-functions -fno-inline-functions-called-once
-finline-small-functions -fipa-bit-cp -fipa-cp -fipa-cp-clone -fipa-icf
-fipa-icf-functions -fno-ipa-icf-variables -fno-ipa-modref -fipa-profile
-fno-ipa-pure-const -fipa-ra -fno-ipa-reference -fipa-reference-addressable
-fipa-sra -fipa-stack-alignment -fno-ipa-vrp -fira-hoist-pressure
-fira-share-save-slots -fno-ira-share-spill-slots
-fno-isolate-erroneous-paths-dereference -fivopts -fno-jump-tables
-flifetime-dse -floop-interchange -fno-loop-unroll-and-jam -flra-remat
-fmath-errno -fmove-loop-invariants -fomit-frame-pointer
-fno-optimize-sibling-calls -foptimize-strlen -fno-partial-inlining
-fpeel-loops -fpeephole -fpeephole2 -fno-plt -fpredictive-commoning
-fno-prefetch-loop-arrays -fprintf-return-value -fno-ree -freg-struct-return
-fno-rename-registers -freorder-blocks -freorder-blocks-and-partition
-freorder-functions -fno-rerun-cse-after-loop
-fno-sched-critical-path-heuristic -fsched-dep-count-heuristic
-fno-sched-group-heuristic -fsched-interblock -fno-sched-last-insn-heuristic
-fno-sched-rank-heuristic -fno-sched-spec -fno-sched-spec-insn-heuristic
-fsched-stalled-insns-dep -fno-schedule-fusion -fno-schedule-insns2
-fshort-enums -fno-shrink-wrap -fshrink-wrap-separate -fsigned-zeros
-fno-split-ivs-in-unroller -fsplit-loops -fsplit-paths -fno-split-wide-types
-fssa-backprop -fno-ssa-phiopt -fno-stdarg-opt -fstore-merging
-fstrict-aliasing -fno-strict-volatile-bitfields -fthread-jumps
-ftoplevel-reorder -ftrapping-math -ftree-bit-ccp -fno-tree-builtin-call-dce
-fno-tree-ccp -ftree-ch -ftree-coalesce-vars -ftree-copy-prop -fno-tree-cselim
-fno-tree-dce -ftree-dominator-opts -fno-tree-dse -fno-tree-forwprop -ftree-fre
-fno-tree-loop-distribute-patterns -ftree-loop-distribution
-ftree-loop-if-convert -fno-tree-loop-im -ftree-loop-ivcanon
-fno-tree-loop-optimize -fno-tree-loop-vectorize -fno-tree-partial-pre
-fno-tree-phiprop -fno-tree-pre -ftree-pta -fno-tree-reassoc
-fno-tree-scev-cprop -fno-tree-sink -ftree-slp-vectorize -fno-tree-slsr
-fno-tree-sra -ftree-switch-conversion -ftree-tail-merge -ftree-ter
-fno-tree-vrp -fno-unroll-completely-grow-size -funswitch-loops -funwind-tables
-fno-var-tracking -fno-var-tracking-assignments -fno-version-loops-for-strides
-fno-web -fallow-store-data-races -fno-associative-math
-fno-branch-probabilities -fconserve-stack -fno-cx-fortran-rules
-fno-cx-limited-range -fno-delayed-branch -fno-delete-dead-exceptions
-fno-exceptions -ffinite-loops -fno-finite-math-only -ffloat-store
-fno-gcse-las -fno-gcse-sm -fgraphite -fgraphite-identity -fipa-pta
-fira-loop-pressure -fisolate-erroneous-paths-attribute -fkeep-gc-roots-live
-flimit-function-alignment -fno-live-range-shrinkage -floop-nest-optimize
-fno-loop-parallelize-all -fmodulo-sched -fno-modulo-sched-allow-regmoves
-fnon-call-exceptions -fopt-info -fno-pack-struct -fno-profile-partial-training
-fno-profile-reorder-functions -fno-reciprocal-math
-freschedule-modulo-scheduled-loops -fno-rounding-math
-fsave-optimization-record -fno-sched-pressure -fno-sched-spec-load
-fno-sched-spec-load-dangerous -fno-sched-stalled-insns
-fsched2-use-superblocks -fschedule-insns -fsection-anchors
-fsel-sched-pipelining -fsel-sched-pipelining-outer-loops
-fsel-sched-reschedule-pipelined -fno-short-wchar -fno-signaling-nans
-fsingle-precision-constant -fsplit-wide-types-early -fstack-clash-protection
-fno-tracer -fno-trapv -fno-tree-lrs -fno-unconstrained-commons
-fno-unroll-all-loops -funroll-loops -fno-unsafe-math-optimizations
-fvar-tracking-assignments-toggle -fno-var-tracking-uninit
-fvariable-expansion-in-unroller -fno-vpt -fwrapv -fno-wrapv-pointer
-save-temps sf.c -o sf.o 2>sf.txt

/home/new-gcc/gcc-11-0706/bin/gcc -I /home/csmith/include/csmith-2.3.0/ sf.c -o
sf2.o

# ./sf.o
Segmentation fault

# ./sf2.o
checksum = 8E178A3B

[Bug c/110662] Segmentation fault with '-O3'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110662

--- Comment #1 from CTC <19373742 at buaa dot edu.cn> ---
Created attachment 55540
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55540&action=edit
The compiler output

[Bug c/110662] Segmentation fault with '-O3'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110662

--- Comment #2 from CTC <19373742 at buaa dot edu.cn> ---
The reduced sequence is -O3 -fno-dce -fno-tree-dce -fno-tree-sink

[Bug ipa/110662] Segmentation fault with '-O3'

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110662

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |wrong-code
      Known to fail|                            |11.3.0
      Known to work|                            |12.3.0
                 CC|                            |marxin at gcc dot gnu.org
   Last reconfirmed|                            |2023-07-14
          Component|c                           |ipa
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Likely a duplicate of one of the IPA bugs where we assume some code is DCEd but
isn't.  Later compilers manually forced DCEing there.

For this testcase -fno-ipa-sra fixes it.

Fixed in GCC 12.

[Bug ipa/110662] [11 Regression] Segmentation fault with '-O3'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110662

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.5
            Summary|Segmentation fault with     |[11 Regression]
                   |'-O3'                       |Segmentation fault with
                   |                            |'-O3'

[Bug ipa/110662] [11 Regression] Segmentation fault with '-O3'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110662

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Dup of bug 93385.

*** This bug has been marked as a duplicate of bug 93385 ***