[Bug c++/111929] New: in decompose, at wide-int.h:1049

[Bug c++/111929] New: in decompose, at wide-int.h:1049

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

            Bug ID: 111929
           Summary: in decompose, at wide-int.h:1049
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

Created attachment 56174
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56174&action=edit
gzipped C++ source code

The attached C++ code does this:


$ ../results/bin/gcc -c -w bug968.cc 
In file included from main.cpp:32:
../../src/zsolve/LinearSystem.hpp: In function ‘std::ostream&
_4ti2_zsolve_::operator<<(std::ostream&, LinearSystem<T>&)’:
../../src/zsolve/LinearSystem.hpp:162:40: internal compiler error: in
decompose, at wide-int.h:1049
0xd52950 tree_nonzero_bits(tree_node const*)
        ../../trunk.year/gcc/fold-const.cc:0
0xd519f1 tree_nonzero_bits(tree_node const*)
        ../../trunk.year/gcc/fold-const.cc:16835

The bug first seems to occur sometime between g:88c27070c253094f
and g:66c26e5cfdf65ae0

[Bug c++/111929] in decompose, at wide-int.h:1049

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2023-10-23
                 CC|                            |rguenth at gcc dot gnu.org
            Version|unknown                     |14.0
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.  Full backtrace - unfortunately it's no longer easy to spot the
match.pd line from the generated files and it's not possible to force
indirect_line_numbers to false at build time :/

In file included from main.cpp:32:
../../src/zsolve/LinearSystem.hpp: In function 'std::ostream&
_4ti2_zsolve_::operator<<(std::ostream&, LinearSystem<T>&)':
../../src/zsolve/LinearSystem.hpp:162:40: internal compiler error: in
decompose, at wide-int.h:1049
0x12a3366 wi::int_traits<generic_wide_int<wide_int_storage> >::decompose(long*,
unsigned int, generic_wide_int<wide_int_storage> const&)
  /space/rguenther/src/gcc/gcc/wide-int.h:1049
0x12ec1a2 wide_int_ref_storage<true,
false>::wide_int_ref_storage<generic_wide_int<wide_int_storage>
>(generic_wide_int<wide_int_storage> const&, unsigned int)
  /space/rguenther/src/gcc/gcc/wide-int.h:1099
0x12ec15a generic_wide_int<wide_int_ref_storage<true, false>
>::generic_wide_int<generic_wide_int<wide_int_storage>
>(generic_wide_int<wide_int_storage> const&, unsigned int)
  /space/rguenther/src/gcc/gcc/wide-int.h:855
0x131e14d wi::binary_traits<generic_wide_int<wide_int_storage>,
generic_wide_int<wide_int_storage>,
wi::int_traits<generic_wide_int<wide_int_storage> >::precision_type,
wi::int_traits<generic_wide_int<wide_int_storage>
>::precision_type>::result_type wi::bit_and<generic_wide_int<wide_int_storage>,
generic_wide_int<wide_int_storage> >(generic_wide_int<wide_int_storage> const&,
generic_wide_int<wide_int_storage> const&)
  /space/rguenther/src/gcc/gcc/wide-int.h:2757
0x15c25b2 tree_nonzero_bits(tree_node const*)
  /space/rguenther/src/gcc/gcc/fold-const.cc:16843
0x15c23f2 tree_nonzero_bits(tree_node const*)
  /space/rguenther/src/gcc/gcc/fold-const.cc:16835
0x24a1597 tree_zero_one_valued_p(tree_node*)
  /abuild/rguenther/obj-gcc-g/gcc/generic-match-5.cc:20
0x24c1864 generic_simplify_MULT_EXPR(unsigned int, tree_code, tree_node*,
tree_node*, tree_node*)
  /abuild/rguenther/obj-gcc-g/gcc/generic-match-5.cc:7078
0x245848a generic_simplify(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
  /abuild/rguenther/obj-gcc-g/gcc/generic-match-3.cc:8706
0x15a9727 fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
  /space/rguenther/src/gcc/gcc/fold-const.cc:11178
0x15b8b2b fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
  /space/rguenther/src/gcc/gcc/fold-const.cc:14068
0x15a967a fold_binary_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
  /space/rguenther/src/gcc/gcc/fold-const.cc:11170
0x15b8b2b fold_build2_loc(unsigned int, tree_code, tree_node*, tree_node*,
tree_node*)
  /space/rguenther/src/gcc/gcc/fold-const.cc:14068
0x157fec7 size_binop_loc(unsigned int, tree_code, tree_node*, tree_node*)
  /space/rguenther/src/gcc/gcc/fold-const.cc:2079
0xf782e6 build_new_1
  /space/rguenther/src/gcc/gcc/cp/init.cc:3264
0xf7b132 build_new(unsigned int, vec<tree_node*, va_gc, vl_embed>**,
tree_node*, tree_node*, vec<tree_node*, va_gc, vl_embed>**, int, int)
  /space/rguenther/src/gcc/gcc/cp/init.cc:4023
0x1063b15 cp_parser_new_expression
  /space/rguenther/src/gcc/gcc/cp/parser.cc:9489
0x10626da cp_parser_unary_expression
  /space/rguenther/src/gcc/gcc/cp/parser.cc:8941
0x106484d cp_parser_cast_expression
  /space/rguenther/src/gcc/gcc/cp/parser.cc:10121
0x1064944 cp_parser_binary_expression
  /space/rguenther/src/gcc/gcc/cp/parser.cc:10223
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code,
                   |                            |needs-bisection
            Summary|in decompose, at            |[14 Regression] in
                   |wide-int.h:1049             |decompose, at
                   |                            |wide-int.h:1049
   Target Milestone|---                         |14.0

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |sjames at gcc dot gnu.org

--- Comment #2 from Sam James <sjames at gcc dot gnu.org> ---
(wonder if --with-matchpd-partitions=1 could help)

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

--- Comment #3 from rguenther at suse dot de <rguenther at suse dot de> ---
On Mon, 23 Oct 2023, sjames at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929
> 
> Sam James <sjames at gcc dot gnu.org> changed:
> 
>            What    |Removed                     |Added
> ----------------------------------------------------------------------------
>                  CC|                            |sjames at gcc dot gnu.org
> 
> --- Comment #2 from Sam James <sjames at gcc dot gnu.org> ---
> (wonder if --with-matchpd-partitions=1 could help)

No, we need a new flag to control indirect_line_numbers I guess.

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
Reduced test case seems to be:

struct LinearSystem {};
template <typename> void operator<<(int, LinearSystem) {
  long vars = new long[vars + 2];
}

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
My bet it was the c++ change
https://gcc.gnu.org/git/?p=gcc.git;a=commit;h=dad311874ac3b3cf4eca1c04f67cae80c953f7b8
or the one right after that one which caused it.

Since it looks like template related

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

--- Comment #6 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Better reduced testcase:
```
template <int>
void f(__SIZE_TYPE__ var) {
  new int[var + 2];
}
```

And yes if you change f into an non-template, there is no crash.

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

--- Comment #7 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
So the C++ front-end produces:

(gdb) p debug_generic_expr(t)
VIEW_CONVERT_EXPR<long unsigned int>(var) + NON_LVALUE_EXPR <2>
(gdb) p debug_tree(t)
 <plus_expr 0x7ffff79aeac8
    type <integer_type 0x7ffff78267e0 long unsigned int public unsigned type_6
DI
        size <integer_cst 0x7ffff7820168 constant 64>
        unit-size <integer_cst 0x7ffff7820180 constant 8>
        align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff78267e0 precision:64 min <integer_cst 0x7ffff7820438 0> max <integer_cst
0x7ffff7803640 18446744073709551615>
        pointer_to_this <pointer_type 0x7ffff7838a80>>

    arg:0 <view_convert_expr 0x7ffff79a6ba0 type <integer_type 0x7ffff78267e0
long unsigned int>
        public
        arg:0 <parm_decl 0x7ffff7fb7100 var type <integer_type 0x7ffff78267e0
long unsigned int>
            used unsigned read DI t.cc:2:23 size <integer_cst 0x7ffff7820168
64> unit-size <integer_cst 0x7ffff7820180 8>
            align:64 warn_if_not_align:0 context <function_decl 0x7ffff79b4c00
f> arg-type <integer_type 0x7ffff78267e0 long unsigned int>>
        t.cc:3:11 start: t.cc:3:11 finish: t.cc:3:13>
    arg:1 <non_lvalue_expr 0x7ffff79a6bc0
        type <integer_type 0x7ffff78265e8 int public type_6 SI
            size <integer_cst 0x7ffff78203a8 constant 32>
            unit-size <integer_cst 0x7ffff78203c0 constant 4>
            align:32 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff78265e8 precision:32 min <integer_cst 0x7ffff7820360 -2147483648> max
<integer_cst 0x7ffff7820378 2147483647>
            pointer_to_this <pointer_type 0x7ffff782db28>>
        constant public
        arg:0 <integer_cst 0x7ffff78208e8 constant 2>
        t.cc:3:17 start: t.cc:3:17 finish: t.cc:3:17>
    t.cc:3:15 start: t.cc:3:11 finish: t.cc:3:17>



But the type of NON_LVALUE_EXPR/2 is int:
(gdb) p debug_tree((tree)0x7ffff79a6bc0)
 <non_lvalue_expr 0x7ffff79a6bc0
    type <integer_type 0x7ffff78265e8 int public type_6 SI
        size <integer_cst 0x7ffff78203a8 constant 32>
        unit-size <integer_cst 0x7ffff78203c0 constant 4>
        align:32 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff78265e8 precision:32 min <integer_cst 0x7ffff7820360 -2147483648> max
<integer_cst 0x7ffff7820378 2147483647>
        pointer_to_this <pointer_type 0x7ffff782db28>>
    constant public
    arg:0 <integer_cst 0x7ffff78208e8 type <integer_type 0x7ffff78265e8 int>
constant 2>
    t.cc:3:17 start: t.cc:3:17 finish: t.cc:3:17>


Which breaks the type system for generic.

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |ppalka at gcc dot gnu.org

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049 since r14-4793-gdad311874ac3b3

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |
            Summary|[14 Regression] in          |[14 Regression] in
                   |decompose, at               |decompose, at
                   |wide-int.h:1049             |wide-int.h:1049 since
                   |                            |r14-4793-gdad311874ac3b3

--- Comment #8 from Sam James <sjames at gcc dot gnu.org> ---
dad311874ac3b3cf4eca1c04f67cae80c953f7b8 is the first bad commit
commit dad311874ac3b3cf4eca1c04f67cae80c953f7b8
Author: Patrick Palka <ppalka@redhat.com>
Date:   Fri Oct 20 10:45:00 2023 -0400

    c++: remove NON_DEPENDENT_EXPR, part 1

i.e. r14-4793-gdad311874ac3b3

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049 since r14-4793-gdad311874ac3b3

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

--- Comment #9 from Sam James <sjames at gcc dot gnu.org> ---
Hit this with libsass too.

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049 since r14-4793-gdad311874ac3b3

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Patrick Palka <ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:d80a26cca025877b7657fa355570bc301223b50b

commit r14-4899-gd80a26cca025877b7657fa355570bc301223b50b
Author: Patrick Palka <ppalka@redhat.com>
Date:   Tue Oct 24 18:03:17 2023 -0400

    c++: non-dep array new-expr size [PR111929]

    This PR is another instance of NON_DEPENDENT_EXPR having acted as an
    "analysis barrier" for middle-end routines, and now that it's gone we're
    more prone to passing weird templated trees (that have a generic tree
    code) to middle-end routines which end up ICEing on such trees.

    In the testcase below the non-dependent array new-expr size 'x + 42' is
    expressed as an ordinary PLUS_EXPR, but whose operands have different
    types (since templated trees encode just the syntactic form of an
    expression devoid of e.g. implicit conversions).  This type incoherency
    triggers an ICE from size_binop in build_new_1 due to a wide_int assert
    that expects the operand types to have the same precision.

    This patch fixes this by replacing our piecemeal folding of 'size' in
    build_new_1 with a single call to cp_fully_fold (which is a no-op in a
    template context) once 'size' is built up.

            PR c++/111929

    gcc/cp/ChangeLog:

            * init.cc (build_new_1): Use convert, build2, build3 and
            cp_fully_fold instead of fold_convert, size_binop and
            fold_build3 when building up 'size'.

    gcc/testsuite/ChangeLog:

            * g++.dg/template/non-dependent28.C: New test.

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049 since r14-4793-gdad311874ac3b3

[ppalka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

Patrick Palka <ppalka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #11 from Patrick Palka <ppalka at gcc dot gnu.org> ---
Fixed, hopefully

[Bug c++/111929] [14 Regression] in decompose, at wide-int.h:1049 since r14-4793-gdad311874ac3b3

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=111929

--- Comment #12 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Patrick Palka <ppalka@gcc.gnu.org>:

https://gcc.gnu.org/g:6ff8b93c7b0bf3913fb7754f9985e7e31c46d89c

commit r14-4979-g6ff8b93c7b0bf3913fb7754f9985e7e31c46d89c
Author: Patrick Palka <ppalka@redhat.com>
Date:   Fri Oct 27 11:31:02 2023 -0400

    c++: another build_new_1 folding fix [PR111929]

    In build_new_1, we also need to avoid folding 'outer_nelts_check' when
    in a template context to prevent an ICE on the below testcase.  This
    patch replaces the problematic fold_build2 call with build2 (we'll later
    fold it if appropriate during cp_fully_fold).

    In passing, this patch removes an unnecessary conversion of 'nelts'
    since it should always already be a size_t (and 'convert' isn't the best
    conversion entry point to use anyway since it lacks a complain parameter).

            PR c++/111929

    gcc/cp/ChangeLog:

            * init.cc (build_new_1): Remove unnecessary call to convert
            on 'nelts'.  Use build2 instead of fold_build2 for
            'outer_nelts_checks'.

    gcc/testsuite/ChangeLog:

            * g++.dg/template/non-dependent28a.C: New test.