[Bug tree-optimization/113102] New: during GIMPLE pass: bitintlower ICE: SIGSEGV with _BitInt() at -O1 or -O2

[Bug tree-optimization/113102] New: during GIMPLE pass: bitintlower ICE: SIGSEGV with _BitInt() at -O1 or -O2

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113102

            Bug ID: 113102
           Summary: during GIMPLE pass: bitintlower ICE: SIGSEGV with
                    _BitInt() at -O1 or -O2
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
                CC: jakub at gcc dot gnu.org
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 56913
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56913&action=edit
reduced testcase

Thank you for the fixes so far.

I am observing SIGSEGV at various places at -O1 and -O2, when using _BitInt().
This happens also with the PR112941#c8 patch applied.

Compiler output:
$ x86_64-pc-linux-gnu-gcc -O testcase-O1.c -wrapper valgrind,-q
testcase-O1.c: In function 'foo2':
testcase-O1.c:24:17: warning: division by zero [-Wdiv-by-zero]
   24 |   bi8 /= x >> 0 / 0;
      |                 ^
==16226== Invalid read of size 2
==16226==    at 0x261843D: (anonymous
namespace)::bitint_large_huge::add_cast(tree_node*, tree_node*)
(gimple-lower-bitint.cc:1052)
==16226==    by 0x2621F90: (anonymous
namespace)::bitint_large_huge::handle_cast(tree_node*, tree_node*, tree_node*)
(gimple-lower-bitint.cc:1501)
==16226==    by 0x261F200: (anonymous
namespace)::bitint_large_huge::handle_operand(tree_node*, tree_node*)
(gimple-lower-bitint.cc:790)
==16226==    by 0x262E269: (anonymous
namespace)::bitint_large_huge::lower_shift_stmt(tree_node*, gimple*)
(gimple-lower-bitint.cc:3137)
==16226==    by 0x2631849: gimple_lower_bitint() (gimple-lower-bitint.cc:6469)
==16226==    by 0x13C4D6A: execute_one_pass(opt_pass*) (passes.cc:2646)
==16226==    by 0x13C565F: execute_pass_list_1(opt_pass*) (passes.cc:2755)
==16226==    by 0x13C5671: execute_pass_list_1(opt_pass*) (passes.cc:2756)
==16226==    by 0x13C5698: execute_pass_list(function*, opt_pass*)
(passes.cc:2766)
==16226==    by 0xFC6085: expand (cgraphunit.cc:1842)
==16226==    by 0xFC6085: cgraph_node::expand() (cgraphunit.cc:1795)
==16226==    by 0xFC73CA: expand_all_functions (cgraphunit.cc:2025)
==16226==    by 0xFC73CA: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2399)
==16226==    by 0xFC9F47: compile (cgraphunit.cc:2312)
==16226==    by 0xFC9F47: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2584)
==16226==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==16226== 
during GIMPLE pass: bitintlower
testcase-O1.c: In function 'foo0':
testcase-O1.c:9:1: internal compiler error: Segmentation fault
    9 | foo0(void)
      | ^~~~
0x150673f crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:316
0x261843d add_cast
        /repo/gcc-trunk/gcc/gimple-lower-bitint.cc:1052
0x2621f90 handle_cast
        /repo/gcc-trunk/gcc/gimple-lower-bitint.cc:1501
0x261f200 handle_operand
        /repo/gcc-trunk/gcc/gimple-lower-bitint.cc:790
0x262e269 lower_shift_stmt
        /repo/gcc-trunk/gcc/gimple-lower-bitint.cc:3137
0x2631849 gimple_lower_bitint
        /repo/gcc-trunk/gcc/gimple-lower-bitint.cc:6469
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r14-6769-20231221032123-g514ea1df444-checking-yes-rtl-df-extra-nobootstrap-pr112941-mul-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/14.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--disable-bootstrap --with-cloog --with-ppl --with-isl
--build=x86_64-pc-linux-gnu --host=x86_64-pc-linux-gnu
--target=x86_64-pc-linux-gnu --with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r14-6769-20231221032123-g514ea1df444-checking-yes-rtl-df-extra-nobootstrap-pr112941-mul-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 14.0.0 20231221 (experimental) (GCC)

[Bug tree-optimization/113102] during GIMPLE pass: bitintlower ICE: SIGSEGV with _BitInt() at -O1 or -O2

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113102

--- Comment #1 from Zdenek Sojka <zsojka at seznam dot cz> ---
Created attachment 56914
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56914&action=edit
testcase failing at -O2

$ x86_64-pc-linux-gnu-gcc -O2 testcase-O2.c -wrapper valgrind,-q
==16387== Invalid read of size 4
==16387==    at 0x114FEA7: phi_nodes_ptr (gimple.h:4700)
==16387==    by 0x114FEA7: gsi_start_phis (gimple-iterator.cc:935)
==16387==    by 0x114FEA7: gsi_for_stmt(gimple*) (gimple-iterator.cc:620)
==16387==    by 0x263223A: gimple_lower_bitint() (gimple-lower-bitint.cc:6695)
==16387==    by 0x13C4DCA: execute_one_pass(opt_pass*) (passes.cc:2646)
==16387==    by 0x13C56BF: execute_pass_list_1(opt_pass*) (passes.cc:2755)
==16387==    by 0x13C56D1: execute_pass_list_1(opt_pass*) (passes.cc:2756)
==16387==    by 0x13C56F8: execute_pass_list(function*, opt_pass*)
(passes.cc:2766)
==16387==    by 0xFC60E5: expand (cgraphunit.cc:1842)
==16387==    by 0xFC60E5: cgraph_node::expand() (cgraphunit.cc:1795)
==16387==    by 0xFC742A: expand_all_functions (cgraphunit.cc:2025)
==16387==    by 0xFC742A: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2399)
==16387==    by 0xFC9FA7: compile (cgraphunit.cc:2312)
==16387==    by 0xFC9FA7: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2584)
==16387==    by 0x1506CF1: compile_file() (toplev.cc:473)
==16387==    by 0xDE3BFB: do_compile (toplev.cc:2150)
==16387==    by 0xDE3BFB: toplev::main(int, char**) (toplev.cc:2306)
==16387==    by 0xDE53DA: main (main.cc:39)
==16387==  Address 0x50 is not stack'd, malloc'd or (recently) free'd
==16387== 
during GIMPLE pass: bitintlower
testcase-O2.c: In function 'foo':
testcase-O2.c:4:1: internal compiler error: Segmentation fault
    4 | foo(void)
      | ^~~
0x150680f crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:316
0x114fea7 phi_nodes_ptr(basic_block_def*)
        /repo/gcc-trunk/gcc/gimple.h:4700
0x114fea7 gsi_start_phis(basic_block_def*)
        /repo/gcc-trunk/gcc/gimple-iterator.cc:935
0x114fea7 gsi_for_stmt(gimple*)
        /repo/gcc-trunk/gcc/gimple-iterator.cc:620
0x263223a gimple_lower_bitint
        /repo/gcc-trunk/gcc/gimple-lower-bitint.cc:6695
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/113102] during GIMPLE pass: bitintlower ICE: SIGSEGV with _BitInt() at -O1 or -O2

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113102

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2023-12-21
             Status|UNCONFIRMED                 |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 56918
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56918&action=edit
gcc14-pr113102-1.patch

So far only lightly tested patch for the #c0 issue.

[Bug tree-optimization/113102] during GIMPLE pass: bitintlower ICE: SIGSEGV with _BitInt() at -O1 or -O2

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113102

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 56919
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=56919&action=edit
gcc14-pr113102-2.patch

So far only lightly tested patch for the #c1 issue.

[Bug tree-optimization/113102] during GIMPLE pass: bitintlower ICE: SIGSEGV with _BitInt() at -O1 or -O2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113102

--- Comment #4 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:d3defa435e9d04d6ab6585ac184989941c7ad51e

commit r14-6803-gd3defa435e9d04d6ab6585ac184989941c7ad51e
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Fri Dec 22 12:27:05 2023 +0100

    lower-bitint: Fix handle_cast ICE [PR113102]

    My recent change to use m_data[save_data_cnt] instead of
    m_data[save_data_cnt + 1] when inside of a loop (m_bb is non-NULL)
    broke the following testcase.  When we create a PHI node on the loop
    using prepare_data_in_out, both m_data[save_data_cnt{, + 1}] are
    computed and the fix was right, but there are also cases when we in
    a loop (m_bb non-NULL) emit a nested cast with too few limbs and
    then just use constant indexes for all accesses - in that case
    only m_data[save_data_cnt + 1] is initialized and m_data[save_data_cnt]
    is NULL.  In those cases, we want to use the former.

    2023-12-22  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/113102
            * gimple-lower-bitint.cc (bitint_large_huge::handle_cast): Only
            use m_data[save_data_cnt] if it is non-NULL.

            * gcc.dg/bitint-58.c: New test.

[Bug tree-optimization/113102] during GIMPLE pass: bitintlower ICE: SIGSEGV with _BitInt() at -O1 or -O2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113102

--- Comment #5 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:f5198f0264e773d3b5d55f09a579313b0b231527

commit r14-6804-gf5198f0264e773d3b5d55f09a579313b0b231527
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Fri Dec 22 12:28:06 2023 +0100

    lower-bitint: Handle unreleased SSA_NAMEs from earlier passes gracefully
[PR113102]

    On the following testcase earlier passes leave around an unreleased
    SSA_NAME - non-GIMPLE_NOP SSA_NAME_DEF_STMT which isn't in any bb.
    The following patch makes bitint lowering resistent against those,
    the first hunk is where we'd for certain kinds of stmts try to ammend
    them and the latter is where we'd otherwise try to remove them,
    neither of which works.  The other loops over all SSA_NAMEs either
    already also check gimple_bb (SSA_NAME_DEF_STMT (s)) or it doesn't
    matter that much if we process it or not (worst case it means e.g.
    the pass wouldn't return early even when it otherwise could).

    2023-12-22  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/113102
            * gimple-lower-bitint.cc (gimple_lower_bitint): Handle unreleased
            large/huge _BitInt SSA_NAMEs.

            * gcc.dg/bitint-59.c: New test.

[Bug tree-optimization/113102] during GIMPLE pass: bitintlower ICE: SIGSEGV with _BitInt() at -O1 or -O2

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113102

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/113102] during GIMPLE pass: bitintlower ICE: SIGSEGV with _BitInt() at -O1 or -O2

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113102

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0