[Bug c/110818] New: Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[Bug c/110818] New: Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

            Bug ID: 110818
           Summary: Segmentation fault with '-O3 -fno-dce -fno-ipa-cp
                    -fno-tree-dce -fno-tree-sink'
           Product: gcc
           Version: 11.4.1
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: 19373742 at buaa dot edu.cn
  Target Milestone: ---

Created attachment 55640
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55640&action=edit
The preprocessed file

*******************************************************************************
OS and Platform:
CentOS Linux release 7.9.2009 (Core), x86_64 GNU/Linux
*******************************************************************************
gcc version:
gcc -v
Using built-in specs.
COLLECT_GCC=/home/gcc-releases/gcc-11-0720/bin/gcc
COLLECT_LTO_WRAPPER=/home/gcc-releases/gcc-11-0720/libexec/gcc/x86_64-pc-linux-gnu/11.4.1/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ./configure --prefix=/home/gcc-releases/gcc-11-0720
--disable-multilib --enable-language=c,c++
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.4.1 20230720 (GCC)
*******************************************************************************
Command lines:
# /home/gcc-releases/gcc-11-0720/bin/gcc -O3 -fno-dce -fno-ipa-cp -fno-tree-dce
-fno-tree-sink tmpp.i -o works
# ./works
Segmentation fault
*******************************************************************************
Reduced issue:
a() { b(); }
b(int, int *c) { d(*c <= 0); }
d() {}
main() { a(); }

[Bug c/110818] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
The reduced testcase is undefined code ....
Though the original is most likely well defined valid code.

[Bug c/110818] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #2 from CTC <19373742 at buaa dot edu.cn> ---
(In reply to Andrew Pinski from comment #1)
> The reduced testcase is undefined code ....
> Though the original is most likely well defined valid code.

I tried to add "-fsanitize=undefined" to make reduced testcase well defined.
But the original testcase with "-fsanitize=undefined" can work successfully
without run-time errors.

[Bug c/110818] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #3 from CTC <19373742 at buaa dot edu.cn> ---
Created attachment 55641
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55641&action=edit
The compiler output

[Bug middle-end/110818] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|c                           |middle-end

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to CTC from comment #2)
> (In reply to Andrew Pinski from comment #1)
> > The reduced testcase is undefined code ....
> > Though the original is most likely well defined valid code.
> 
> I tried to add "-fsanitize=undefined" to make reduced testcase well defined.
> But the original testcase with "-fsanitize=undefined" can work successfully
> without run-time errors.

The way I normally reduce testcases like this is to run it a few different ways
to avoid reducing it to an undefined code. Plus error out on uninitialized
variable warnings too.
Since this is reported against 11.4, it could be fixed already on the trunk too
so it might take me some time to reduce it ...

I might get around to trying to reduce the issue later today or tomorrow.

[Bug middle-end/110818] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

Xi Ruoyao <xry111 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |xry111 at gcc dot gnu.org

--- Comment #5 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
(In reply to CTC from comment #2)
> (In reply to Andrew Pinski from comment #1)
> > The reduced testcase is undefined code ....
> > Though the original is most likely well defined valid code.
> 
> I tried to add "-fsanitize=undefined" to make reduced testcase well defined.
> But the original testcase with "-fsanitize=undefined" can work successfully
> without run-time errors.

But this is really obvious that the reduced testcase is undefined.

Use your brain before pasting an output of automatic tools into a bug report.

[Bug middle-end/110818] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

Xi Ruoyao <xry111 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-bisection,
                   |                            |needs-reduction
      Known to work|                            |12.1.0
      Known to fail|                            |11.4.0

--- Comment #6 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
Not reproducible with 12.1.0 or later, maybe we can just bisect.

[Bug middle-end/110818] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #7 from CTC <19373742 at buaa dot edu.cn> ---
Reduced testcase:

# cat testcase.i
struct a {
  short b;
} d, g;
int c;
static struct a e(short);
static struct a f(int *i) {
  long h[] = {1, 1, 1, 1, 1, 1, 1};
  for (; c <= 8; ++c)
    e(*i <= (c > 0));
  return d;
}
struct a e() {
  return g;
}
void main() { f(&c); }

No errors or warnings raised and 0 alarms generated by the analysis when
analyzed by frama-c.

[Bug middle-end/110818] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #8 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to CTC from comment #7)
> No errors or warnings raised and 0 alarms generated by the analysis when
> analyzed by frama-c.

Still undefined reduced testcase (with `-Wextra -Wall`):
<source>: At top level:
<source>:16:6: warning: return type of 'main' is not 'int' [-Wmain]
   16 | void main() { f(&c); }
      |      ^~~~

Once I change the return type to int, the reduced testcase always passes.

[Bug middle-end/110818] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #9 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #8)
> (In reply to CTC from comment #7)
> > No errors or warnings raised and 0 alarms generated by the analysis when
> > analyzed by frama-c.
> 
> Still undefined reduced testcase (with `-Wextra -Wall`):
> <source>: At top level:
> <source>:16:6: warning: return type of 'main' is not 'int' [-Wmain]
>    16 | void main() { f(&c); }
>       |      ^~~~
> 
> Once I change the return type to int, the reduced testcase always passes.

No it doesn't:

https://godbolt.org/z/5vr1oPExb

Looks like .LC0 is not aligned but GCC 11 attempts to use movdqa to load it.

[Bug middle-end/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

Xi Ruoyao <xry111 at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|Segmentation fault with     |[11 Regression]
                   |'-O3 -fno-dce -fno-ipa-cp   |Segmentation fault with
                   |-fno-tree-dce               |'-O3 -fno-dce -fno-ipa-cp
                   |-fno-tree-sink'             |-fno-tree-dce
                   |                            |-fno-tree-sink'
      Known to work|                            |9.1.0
           Keywords|needs-reduction             |
      Known to fail|                            |10.5.0

--- Comment #10 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
And "struct a e()" should be "struct a e(short unused)".  But after this fix it
still crashes.

It's a regression started in GCC 10, but GCC 10 branch is closed anyway.

[Bug middle-end/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #11 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Xi Ruoyao from comment #9)
> https://godbolt.org/z/5vr1oPExb
> 
> Looks like .LC0 is not aligned but GCC 11 attempts to use movdqa to load it.

But it is aligned ...
Maybe there is a binutils fix for merging of .rodata.cst sections ....

[Bug middle-end/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #12 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Created attachment 55656
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=55656&action=edit
Assembly code

The only difference between GCC 9 and GCC 10 is:
#cmpl    %edx, 0

GCC 10 has this line uncommented.

So I almost think this is a bug in the binutils ...

[Bug middle-end/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #13 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #11)
> (In reply to Xi Ruoyao from comment #9)
> > https://godbolt.org/z/5vr1oPExb
> > 
> > Looks like .LC0 is not aligned but GCC 11 attempts to use movdqa to load it.
> 
> But it is aligned ...
> Maybe there is a binutils fix for merging of .rodata.cst sections ....

Alright, godbolt does not print .align directives by default...

[Bug middle-end/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[xry111 at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #14 from Xi Ruoyao <xry111 at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #12)
> Created attachment 55656 [details]
> Assembly code
> 
> The only difference between GCC 9 and GCC 10 is:
> #cmpl    %edx, 0
> 
> GCC 10 has this line uncommented.
> 
> So I almost think this is a bug in the binutils ...

Hmm, but isn't "cmpl %edx, 0" accessing address 0?  Constant 0 should be "$0".

I don't think it's correct...

[Bug ipa/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org
           Keywords|                            |wrong-code
          Component|middle-end                  |ipa

--- Comment #15 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
  _4 = *i_3(D);

That is the problem.
cmpl    %edx, 0
is a comparing %edx to the memory location 0 ...

[Bug ipa/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

--- Comment #16 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #15)
>   _4 = *i_3(D);
> 
> That is the problem.
> cmpl    %edx, 0
> is a comparing %edx to the memory location 0 ...

========== IPA-SRA decisions ==========

Evaluating analysis results for f/3
  Will remove return value.
  Will remove parameter 0

  Created adjustments:
    m_always_copy_start: 1
    Will SKIP return.
  Created new node f.isra/7

[Bug ipa/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.5

[Bug ipa/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|https://gcc.gnu.org/bugzill |https://gcc.gnu.org/bugzill
                   |a/show_bug.cgi?id=104543    |a/show_bug.cgi?id=93385

--- Comment #17 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Maybe PR 93385.

[Bug ipa/110818] [11 Regression] Segmentation fault with '-O3 -fno-dce -fno-ipa-cp -fno-tree-dce -fno-tree-sink'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=110818

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|UNCONFIRMED                 |RESOLVED

--- Comment #18 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Yes this is a dup of bug 93385.

*** This bug has been marked as a duplicate of bug 93385 ***