From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: by sourceware.org (Postfix, from userid 48) id 31E653881D38; Tue, 28 Nov 2023 15:56:40 +0000 (GMT) DKIM-Filter: OpenDKIM Filter v2.11.0 sourceware.org 31E653881D38 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gcc.gnu.org; s=default; t=1701187000; bh=60wujrh+hq3Bnr61h0PH5ohGMgPGWD1mE+k4yOJwFOY=; h=From:To:Subject:Date:In-Reply-To:References:From; b=mwUhNCSmtG8LL+8iacs7nThfXU1HEt9pLR1PRrQtxTdNoLoLEx1mZA64Hi61alv7S Eot2AsH0ww1Guz6lY8rmbTI1TBdHMueIKXyn2vCCUThTr9Ih/E5/dZbFqX1vm/3FUW oEXLykmGGuER8YMq51K4mgJxRvIYBFCxhgaHJxi8= From: "jakub at gcc dot gnu.org" To: gcc-bugs@gcc.gnu.org Subject: [Bug middle-end/112733] [14 Regression] ICE: Segmentation fault in wide-int.cc during GIMPLE pass: sccp Date: Tue, 28 Nov 2023 15:56:39 +0000 X-Bugzilla-Reason: CC X-Bugzilla-Type: changed X-Bugzilla-Watch-Reason: None X-Bugzilla-Product: gcc X-Bugzilla-Component: middle-end X-Bugzilla-Version: 14.0 X-Bugzilla-Keywords: ice-on-valid-code X-Bugzilla-Severity: normal X-Bugzilla-Who: jakub at gcc dot gnu.org X-Bugzilla-Status: NEW X-Bugzilla-Resolution: X-Bugzilla-Priority: P3 X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org X-Bugzilla-Target-Milestone: 14.0 X-Bugzilla-Flags: X-Bugzilla-Changed-Fields: Message-ID: In-Reply-To: References: Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/ Auto-Submitted: auto-generated MIME-Version: 1.0 List-Id: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=3D112733 --- Comment #8 from Jakub Jelinek --- As for the actual crash, I have again multiple possible fixes: --- gcc/wide-int.cc.jj 2023-10-16 14:24:46.360204472 +0200 +++ gcc/wide-int.cc 2023-11-28 16:33:35.737394223 +0100 @@ -1297,6 +1297,8 @@ wi_pack (HOST_WIDE_INT *result, unsigned int j =3D 0; unsigned int blocks_needed =3D BLOCKS_NEEDED (precision); + if (in_len > blocks_needed * 2) + in_len =3D blocks_needed * 2; while (i + 1 < in_len) { result[j++] =3D ((unsigned HOST_WIDE_INT) input[i] Or another option is ensure that in_len is never larger than blocks_needed = * 2. The problem with the wide-int.cc wi_pack calls for remainder is that the in_len argument in that case is n (which is: n =3D divisor_blocks_needed; while (n > 1 && b_divisor[n - 1] =3D=3D 0) n--; i.e. at most 2 * BLOCKS_NEEDED (divisor_prec), but the last argument is dividend_prec rather than divisor_prec. In reality, I think the remainder is bound by both minimum precision of dividend and divisor, because it can't be in absolute value larger than the divisor and can't be in absolute value larger than dividend. --- gcc/wide-int.h.jj 2023-10-14 11:08:20.790471175 +0200 +++ gcc/wide-int.h 2023-11-28 16:44:26.576265870 +0100 @@ -3179,6 +3179,10 @@ wi::div_floor (const T1 &x, const T2 &y, else est_len =3D xi.len + 1; quotient_val =3D quotient.write_val (est_len); + if (sgn =3D=3D UNSIGNED && yi.val[yi.len - 1] < 0) + est_len =3D CEIL (precision, HOST_BITS_PER_WIDE_INT) + 1; + else + est_len =3D yi.len + 1; remainder_val =3D remainder.write_val (est_len); } quotient.set_len (divmod_internal (quotient_val, @@ -3231,6 +3235,10 @@ wi::div_ceil (const T1 &x, const T2 &y, else est_len =3D xi.len + 1; quotient_val =3D quotient.write_val (est_len); + if (sgn =3D=3D UNSIGNED && yi.val[yi.len - 1] < 0) + est_len =3D CEIL (precision, HOST_BITS_PER_WIDE_INT) + 1; + else + est_len =3D yi.len + 1; remainder_val =3D remainder.write_val (est_len); } quotient.set_len (divmod_internal (quotient_val, @@ -3274,6 +3282,10 @@ wi::div_round (const T1 &x, const T2 &y, else est_len =3D xi.len + 1; quotient_val =3D quotient.write_val (est_len); + if (sgn =3D=3D UNSIGNED && yi.val[yi.len - 1] < 0) + est_len =3D CEIL (precision, HOST_BITS_PER_WIDE_INT) + 1; + else + est_len =3D yi.len + 1; remainder_val =3D remainder.write_val (est_len); } quotient.set_len (divmod_internal (quotient_val, @@ -3327,6 +3339,10 @@ wi::divmod_trunc (const T1 &x, const T2 else est_len =3D xi.len + 1; quotient_val =3D quotient.write_val (est_len); + if (sgn =3D=3D UNSIGNED && yi.val[yi.len - 1] < 0) + est_len =3D CEIL (precision, HOST_BITS_PER_WIDE_INT) + 1; + else + est_len =3D yi.len + 1; remainder_val =3D remainder.write_val (est_len); } quotient.set_len (divmod_internal (quotient_val, @@ -3375,10 +3391,10 @@ wi::mod_trunc (const T1 &x, const T2 &y, unsigned int remainder_len; if (remainder.needs_write_val_arg) remainder_val =3D remainder.write_val ((sgn =3D=3D UNSIGNED - && xi.val[xi.len - 1] < 0) + && yi.val[yi.len - 1] < 0) ? CEIL (precision, HOST_BITS_PER_WIDE_INT) + 1 - : xi.len + 1); + : yi.len + 1); divmod_internal (0, &remainder_len, remainder_val, xi.val, xi.len, precision, yi.val, yi.len, yi.precision, sgn, overflow); @@ -3427,6 +3443,10 @@ wi::mod_floor (const T1 &x, const T2 &y, else est_len =3D xi.len + 1; quotient_val =3D quotient.write_val (est_len); + if (sgn =3D=3D UNSIGNED && yi.val[yi.len - 1] < 0) + est_len =3D CEIL (precision, HOST_BITS_PER_WIDE_INT) + 1; + else + est_len =3D yi.len + 1; remainder_val =3D remainder.write_val (est_len); } quotient.set_len (divmod_internal (quotient_val, @@ -3473,6 +3493,10 @@ wi::mod_ceil (const T1 &x, const T2 &y, else est_len =3D xi.len + 1; quotient_val =3D quotient.write_val (est_len); + if (sgn =3D=3D UNSIGNED && yi.val[yi.len - 1] < 0) + est_len =3D CEIL (precision, HOST_BITS_PER_WIDE_INT) + 1; + else + est_len =3D yi.len + 1; remainder_val =3D remainder.write_val (est_len); } quotient.set_len (divmod_internal (quotient_val, @@ -3509,6 +3533,10 @@ wi::mod_round (const T1 &x, const T2 &y, else est_len =3D xi.len + 1; quotient_val =3D quotient.write_val (est_len); + if (sgn =3D=3D UNSIGNED && yi.val[yi.len - 1] < 0) + est_len =3D CEIL (precision, HOST_BITS_PER_WIDE_INT) + 1; + else + est_len =3D yi.len + 1; remainder_val =3D remainder.write_val (est_len); } quotient.set_len (divmod_internal (quotient_val, --- gcc/wide-int.cc.jj 2023-10-16 14:24:46.360204472 +0200 +++ gcc/wide-int.cc 2023-11-28 16:36:09.227244087 +0100 @@ -1985,11 +1985,11 @@ wi::divmod_internal (HOST_WIDE_INT *quot if (remainder) { - *remainder_len =3D wi_pack (remainder, b_remainder, n, dividend_prec= ); + *remainder_len =3D wi_pack (remainder, b_remainder, n, divisor_prec); /* The remainder is always the same sign as the dividend. */ if (dividend_neg) *remainder_len =3D wi::sub_large (remainder, zeros, 1, remainder, - *remainder_len, dividend_prec, + *remainder_len, divisor_prec, UNSIGNED, 0); } The advantage of the first patch is that it doesn't increase the code needed to be emitted in widest_int wi::div_{floor,ceil,round} and wi::divmod_trunc, wi::mod_{floor,ceil,round}, at the expense of one comparison in wide-int.cc (done for all large multiplications, divisions, modulo).=