[Bug c/111873] New: runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-loop-optimize -fno-tree-pre'

[Bug c/111873] New: runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-loop-optimize -fno-tree-pre'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

            Bug ID: 111873
           Summary: runtime Segmentation fault with '-O3
                    -fno-code-hoisting -fno-early-inlining -fno-tree-fre
                    -fno-tree-loop-optimize -fno-tree-pre'
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: 19373742 at buaa dot edu.cn
  Target Milestone: ---

Created attachment 56148
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56148&action=edit
The preprocessed file

*******************************************************************************
OS and Platform:
Ubuntu 20.04.4 LTS
*******************************************************************************
gcc version:
$ gcc -v
Using built-in specs.
COLLECT_GCC=/home/cuisk/ctc/gcc-releases/gcc-14/bin/gcc
COLLECT_LTO_WRAPPER=/home/cuisk/ctc/gcc-releases/gcc-14/libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ./configure --prefix=/home/cuisk/ctc/gcc-releases/gcc-14
--disable-multilib --enable-language=c,c++
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 14.0.0 20231015 (experimental) (GCC) 
*******************************************************************************
Command Lines:
$ gcc -O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre
-fno-tree-loop-optimize -fno-tree-pre -I ~/ctc/csmith/include/csmith-2.3.0 a.c
-o ec
$ ./ec
Segmentation fault (core dumped)

$ gcc -fsanitize=undefined -I ~/ctc/csmith/include/csmith-2.3.0 a.c -o nec
$ ./nec
checksum = 99D13A7E

[Bug c/111873] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-loop-optimize -fno-tree-pre'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

--- Comment #1 from CTC <19373742 at buaa dot edu.cn> ---
Created attachment 56149
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56149&action=edit
The compiler output

[Bug middle-end/111873] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-loop-optimize -fno-tree-pre'

[19373742 at buaa dot edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

--- Comment #2 from CTC <19373742 at buaa dot edu.cn> ---
A reduced testcase:

struct a {
  short b;
};
int d;
const struct a c;
void e(short x) {}
void f(short x) {}
int g(const struct a i) {return 0;}
void h(const struct a i) {
  d = g(i);
  f(i.b);
  e(i.b);
}
int main() { 
  h(c);
  return 0;
}

[Bug ipa/111873] [12/13/14 Regression] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-loop-optimize -fno-tree-pre'

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|runtime Segmentation fault  |[12/13/14 Regression]
                   |with '-O3                   |runtime Segmentation fault
                   |-fno-code-hoisting          |with '-O3
                   |-fno-early-inlining         |-fno-code-hoisting
                   |-fno-tree-fre               |-fno-early-inlining
                   |-fno-tree-loop-optimize     |-fno-tree-fre
                   |-fno-tree-pre'              |-fno-tree-loop-optimize
                   |                            |-fno-tree-pre'
   Target Milestone|---                         |12.4
             Status|UNCONFIRMED                 |NEW
                 CC|                            |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-10-19
          Component|middle-end                  |ipa

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed.
It is the inliner which messes up and introduces the store to a const variable.
We go from:
```
int main ()
{
  <bb 2> [local count: 1073741824]:
  h (c);
  return 0;

}


void h (const struct a i)
{
  const short int i$b;
  int _1;

  <bb 2> [local count: 1073741824]:
  i$b_5 = i.b;
  i.b = i$b_5;
```

To:
```
int main ()
{
  int D.2031;
  const short int i$b;
  int _4;
  int _6;

  <bb 2> [local count: 1073741824]:
  i$b_3 = 0;
  c.b = i$b_3;
```

Which is totally wrong.

[Bug ipa/111873] [12/13/14 Regression] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-loop-optimize -fno-tree-pre' since r12-434-g93f8cb4965cebe

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |ebotcazou at gcc dot gnu.org,
                   |                            |sjames at gcc dot gnu.org
           Keywords|needs-bisection             |
            Summary|[12/13/14 Regression]       |[12/13/14 Regression]
                   |runtime Segmentation fault  |runtime Segmentation fault
                   |with '-O3                   |with '-O3
                   |-fno-code-hoisting          |-fno-code-hoisting
                   |-fno-early-inlining         |-fno-early-inlining
                   |-fno-tree-fre               |-fno-tree-fre
                   |-fno-tree-loop-optimize     |-fno-tree-loop-optimize
                   |-fno-tree-pre'              |-fno-tree-pre' since
                   |                            |r12-434-g93f8cb4965cebe

--- Comment #4 from Sam James <sjames at gcc dot gnu.org> ---
bisect says:

93f8cb4965cebee125f96376367f05e18ee5749b is the first bad commit
commit 93f8cb4965cebee125f96376367f05e18ee5749b
Author: Eric Botcazou <ebotcazou@adacore.com>
Date:   Tue May 4 12:47:11 2021 +0200

    Reuse non-gimple_reg variable for inlining

i.e. r12-434-g93f8cb4965cebe

[Bug ipa/111873] [12/13/14 Regression] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-loop-optimize -fno-tree-pre' since r12-434-g93f8cb4965cebe

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

--- Comment #5 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
People really should stop spamming the database with bug reports about random
combinations of switches, this is a waste of time and resources for everyone.

[Bug ipa/111873] [12/13/14 Regression] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-loop-optimize -fno-tree-pre' since r12-434-g93f8cb4965cebe

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |ebotcazou at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

--- Comment #6 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Investigating.

[Bug ipa/111873] [12/13/14 Regression] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-pre'

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12/13/14 Regression]       |[12/13/14 Regression]
                   |runtime Segmentation fault  |runtime Segmentation fault
                   |with '-O3                   |with '-O3
                   |-fno-code-hoisting          |-fno-code-hoisting
                   |-fno-early-inlining         |-fno-early-inlining
                   |-fno-tree-fre               |-fno-tree-fre
                   |-fno-tree-loop-optimize     |-fno-tree-pre'
                   |-fno-tree-pre' since        |
                   |r12-434-g93f8cb4965cebe     |

--- Comment #7 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
-fno-tree-loop-optimize is not needed, but the 4 other switches are!

[Bug ipa/111873] [12/13/14 Regression] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-pre'

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

--- Comment #8 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
The bug is in the (early) SRA pass though;

void h (const struct a i)
{
  const short int i$b;
  int _1;
  short int _2;
  int _3;
  short int _4;
  int _5;

  <bb 2> :
  i$b_10 = i.b;
  i.b = i$b_10;
  _1 = g (i);
  d = _1;
  _2 = i$b_10;
  _3 = (int) _2;
  f (_3);
  _4 = i$b_10;
  _5 = (int) _4;
  e (_5);
  return;

}

which creates a store to the read-only parameter i:

(gdb) p debug_gimple_stmt(stmt)
# .MEM = VDEF <.MEM>
i.b = i$b;
$2 = void
(gdb) p debug_tree(gimple_get_lhs (stmt))
 <component_ref 0x7ffff71dee10
    type <integer_type 0x7ffff71b6930 short int readonly sizes-gimplified HI
        size <integer_cst 0x7ffff702c0f0 constant 16>
        unit-size <integer_cst 0x7ffff702c108 constant 2>
        align:16 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff71b6930 precision:16 min <integer_cst 0x7ffff702c090 -32768> max
<integer_cst 0x7ffff702c0c0 32767>>
    readonly
    arg:0 <parm_decl 0x7ffff7fc8300 i
        type <record_type 0x7ffff71b6540 a readonly sizes-gimplified type_0 HI
size <integer_cst 0x7ffff702c0f0 16> unit-size <integer_cst 0x7ffff702c108 2>
            align:16 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff71b6540 fields <field_decl 0x7ffff7039688 b>>
        readonly used read HI pr111873.c:18:24 size <integer_cst 0x7ffff702c0f0
16> unit-size <integer_cst 0x7ffff702c108 2>
        align:16 warn_if_not_align:0 context <function_decl 0x7ffff71e2300 h>
arg-type <record_type 0x7ffff71b6540 a>>
    arg:1 <field_decl 0x7ffff7039688 b
        type <integer_type 0x7ffff702a498 short int sizes-gimplified HI size
<integer_cst 0x7ffff702c0f0 16> unit-size <integer_cst 0x7ffff702c108 2>
            align:16 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff702a498 precision:16 min <integer_cst 0x7ffff702c090 -32768> max
<integer_cst 0x7ffff702c0c0 32767>>
        HI pr111873.c:5:9 size <integer_cst 0x7ffff702c0f0 16> unit-size
<integer_cst 0x7ffff702c108 2>
        align:16 warn_if_not_align:0 offset_align 128 decl_not_flexarray: 1
        offset <integer_cst 0x7ffff700bf60 constant 0>
        bit-offset <integer_cst 0x7ffff700bfa8 constant 0> context <record_type
0x7ffff71b6f18 a>>
    pr111873.c:21:7 start: pr111873.c:21:6 finish: pr111873.c:21:8>

/* In a VAR_DECL, PARM_DECL or FIELD_DECL, or any kind of ..._REF node,
   nonzero means it may not be the lhs of an assignment.
   Nonzero in a FUNCTION_DECL means this function should be treated
   as "const" function (can only read its arguments).  */
#define TREE_READONLY(NODE) (NON_TYPE_CHECK (NODE)->base.readonly_flag)

[Bug tree-optimization/111873] [12/13/14 Regression] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-pre'

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

Eric Botcazou <ebotcazou at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
          Component|ipa                         |tree-optimization
           Assignee|ebotcazou at gcc dot gnu.org       |unassigned at gcc dot gnu.org
             Status|ASSIGNED                    |NEW
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #9 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
Very similar to PR tree-opt/100453.  Martin, would you mind having a look when
you have some time?  Thanks in advance.

[Bug tree-optimization/111873] [12/13/14 Regression] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-pre'

[law at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

Jeffrey A. Law <law at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
                 CC|                            |law at gcc dot gnu.org

[Bug tree-optimization/111873] [12/13/14 Regression] runtime Segmentation fault with '-O3 -fno-code-hoisting -fno-early-inlining -fno-tree-fre -fno-tree-pre'

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111873

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P1                          |P2
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 12-13 has been released with this bug, so P2.