[Bug tree-optimization/113491] New: ICE: SIGSEGV in make_ssa_name_fn (tree-ssanames.cc:354) at -Os with _BitInt() used as switch control expression

[Bug tree-optimization/113491] New: ICE: SIGSEGV in make_ssa_name_fn (tree-ssanames.cc:354) at -Os with _BitInt() used as switch control expression

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113491

            Bug ID: 113491
           Summary: ICE: SIGSEGV in make_ssa_name_fn
                    (tree-ssanames.cc:354) at -Os with _BitInt() used as
                    switch control expression
           Product: gcc
           Version: 14.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
                CC: jakub at gcc dot gnu.org
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu
            Target: x86_64-pc-linux-gnu

Created attachment 57146
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57146&action=edit
reduced testcase (from gcc.c-torture/compile/pr34093.c -Dint=_BitInt(617) )

Compiler output:
$ x86_64-pc-linux-gnu-gcc -Os testcase.c -wrapper valgrind,-q
==8560== Invalid read of size 2
==8560==    at 0x177D8AA: make_ssa_name_fn(function*, tree_node*, gimple*,
unsigned int) (tree-ssanames.cc:354)
==8560==    by 0x1610EB2: make_ssa_name (tree-ssanames.h:98)
==8560==    by 0x1610EB2:
tree_switch_conversion::switch_conversion::build_arrays()
(tree-switch-conversion.cc:727)
==8560==    by 0x1611296:
tree_switch_conversion::switch_conversion::expand(gswitch*) [clone .part.0]
(tree-switch-conversion.cc:1067)
==8560==    by 0x161135A: expand (tree-switch-conversion.cc:2546)
==8560==    by 0x161135A: (anonymous
namespace)::pass_convert_switch::execute(function*)
(tree-switch-conversion.cc:2564)
==8560==    by 0x13CC03A: execute_one_pass(opt_pass*) (passes.cc:2646)
==8560==    by 0x13CC92F: execute_pass_list_1(opt_pass*) (passes.cc:2755)
==8560==    by 0x13CC941: execute_pass_list_1(opt_pass*) (passes.cc:2756)
==8560==    by 0x13CC968: execute_pass_list(function*, opt_pass*)
(passes.cc:2766)
==8560==    by 0x13CD28C: do_per_function_toporder(void (*)(function*, void*),
void*) [clone .part.0] (passes.cc:1773)
==8560==    by 0x13CD4BE: do_per_function_toporder (passes.cc:1740)
==8560==    by 0x13CD4BE: execute_ipa_pass_list(opt_pass*) (passes.cc:3100)
==8560==    by 0xFCDD37: ipa_passes (cgraphunit.cc:2211)
==8560==    by 0xFCDD37: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2332)
==8560==    by 0xFD05B7: compile (cgraphunit.cc:2312)
==8560==    by 0xFD05B7: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2584)
==8560==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==8560== 
during GIMPLE pass: switchconv
testcase.c: In function 'foo':
testcase.c:263:1: internal compiler error: Segmentation fault
  263 | }
      | ^
0x150ddef crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:317
0x177d8aa make_ssa_name_fn(function*, tree_node*, gimple*, unsigned int)
        /repo/gcc-trunk/gcc/tree-ssanames.cc:354
0x1610eb2 make_ssa_name(tree_node*, gimple*)
        /repo/gcc-trunk/gcc/tree-ssanames.h:98
0x1610eb2 tree_switch_conversion::switch_conversion::build_arrays()
        /repo/gcc-trunk/gcc/tree-switch-conversion.cc:727
0x1611296 tree_switch_conversion::switch_conversion::expand(gswitch*)
        /repo/gcc-trunk/gcc/tree-switch-conversion.cc:1067
0x161135a tree_switch_conversion::switch_conversion::expand(gswitch*)
        /repo/gcc-trunk/gcc/tree-switch-conversion.cc:2546
0x161135a execute
        /repo/gcc-trunk/gcc/tree-switch-conversion.cc:2564
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/113491] ICE: SIGSEGV in make_ssa_name_fn (tree-ssanames.cc:354) at -Os with _BitInt() used as switch control expression

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113491

--- Comment #1 from Zdenek Sojka <zsojka at seznam dot cz> ---
Created attachment 57162
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57162&action=edit
shorter testcase (reduced from gcc.dg/torture/pr45830.c)

$ x86_64-pc-linux-gnu-gcc -Os pr45830.i -wrapper valgrind,-q
==7594== Invalid read of size 2
==7594==    at 0x177D97A: make_ssa_name_fn(function*, tree_node*, gimple*,
unsigned int) (tree-ssanames.cc:354)
==7594==    by 0x1610F62: make_ssa_name (tree-ssanames.h:98)
==7594==    by 0x1610F62:
tree_switch_conversion::switch_conversion::build_arrays()
(tree-switch-conversion.cc:727)
==7594==    by 0x1611346:
tree_switch_conversion::switch_conversion::expand(gswitch*) [clone .part.0]
(tree-switch-conversion.cc:1067)
==7594==    by 0x161140A: expand (tree-switch-conversion.cc:2546)
==7594==    by 0x161140A: (anonymous
namespace)::pass_convert_switch::execute(function*)
(tree-switch-conversion.cc:2564)
==7594==    by 0x13CC0EA: execute_one_pass(opt_pass*) (passes.cc:2646)
==7594==    by 0x13CC9DF: execute_pass_list_1(opt_pass*) (passes.cc:2755)
==7594==    by 0x13CC9F1: execute_pass_list_1(opt_pass*) (passes.cc:2756)
==7594==    by 0x13CCA18: execute_pass_list(function*, opt_pass*)
(passes.cc:2766)
==7594==    by 0x13CD33C: do_per_function_toporder(void (*)(function*, void*),
void*) [clone .part.0] (passes.cc:1773)
==7594==    by 0x13CD56E: do_per_function_toporder (passes.cc:1740)
==7594==    by 0x13CD56E: execute_ipa_pass_list(opt_pass*) (passes.cc:3100)
==7594==    by 0xFCDDE7: ipa_passes (cgraphunit.cc:2211)
==7594==    by 0xFCDDE7: symbol_table::compile() [clone .part.0]
(cgraphunit.cc:2332)
==7594==    by 0xFD0667: compile (cgraphunit.cc:2312)
==7594==    by 0xFD0667: symbol_table::finalize_compilation_unit()
(cgraphunit.cc:2584)
==7594==  Address 0x0 is not stack'd, malloc'd or (recently) free'd
==7594== 
during GIMPLE pass: switchconv
pr45830.i: In function 'foo':
pr45830.i:19:1: internal compiler error: Segmentation fault
   19 | }
      | ^
0x150de9f crash_signal
        /repo/gcc-trunk/gcc/toplev.cc:317
0x177d97a make_ssa_name_fn(function*, tree_node*, gimple*, unsigned int)
        /repo/gcc-trunk/gcc/tree-ssanames.cc:354
0x1610f62 make_ssa_name(tree_node*, gimple*)
        /repo/gcc-trunk/gcc/tree-ssanames.h:98
0x1610f62 tree_switch_conversion::switch_conversion::build_arrays()
        /repo/gcc-trunk/gcc/tree-switch-conversion.cc:727
0x1611346 tree_switch_conversion::switch_conversion::expand(gswitch*)
        /repo/gcc-trunk/gcc/tree-switch-conversion.cc:1067
0x161140a tree_switch_conversion::switch_conversion::expand(gswitch*)
        /repo/gcc-trunk/gcc/tree-switch-conversion.cc:2546
0x161140a execute
        /repo/gcc-trunk/gcc/tree-switch-conversion.cc:2564
Please submit a full bug report, with preprocessed source (by using
-freport-bug).
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/113491] ICE: SIGSEGV in make_ssa_name_fn (tree-ssanames.cc:354) at -Os with _BitInt() used as switch control expression

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113491

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
   Last reconfirmed|                            |2024-01-19
     Ever confirmed|0                           |1

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 57163
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=57163&action=edit
gcc14-pr113491.patch

Untested fix.

[Bug tree-optimization/113491] ICE: SIGSEGV in make_ssa_name_fn (tree-ssanames.cc:354) at -Os with _BitInt() used as switch control expression

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113491

--- Comment #3 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:291e00e2d88a352f46cd539e3c5785982dc3fdd9

commit r14-8302-g291e00e2d88a352f46cd539e3c5785982dc3fdd9
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Jan 20 12:35:38 2024 +0100

    tree-switch-conversion: Bugfixes for _BitInt [PR113491]

    The following patch fixes various issues with large/huge _BitInt used as
switch
    expressions.
    In particular:
    1) the indexes in CONSTRUCTORs shouldn't be types with precision larger
than
       sizetype precision, varasm uses wi::to_offset on those and too large
       indexes ICE; we've already checked earlier that the cluster is at most
       sizetype bits and arrays can't be larger than that anyway
    2) some spots were using SCALAR_INT_TYPE_MODE or
       lang_hooks.types.type_for_mode on TYPE_MODE to determine types to use,
       that obviously doesn't work for the large/huge BITINT_TYPE
    3) like the recent change in the C FE, this patch makes sure we don't
create
       ARRAY_REFs with indexes with precision above sizetype precision, because
       bitint lowering isn't prepared for that and because the indexes can't be
       larger than sizetype anyway; the subtraction of the cluster minimum from
       the index obviously needs to be done in unsigned __int128 or large/huge
       BITINT_TYPE, but then we cast to sizetype if the precision is larger
than
       sizetype

    2024-01-20  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/113491
            * tree-switch-conversion.cc
(switch_conversion::build_constructors):
            If elt.index has precision higher than sizetype, fold_convert it to
            sizetype.
            (switch_conversion::array_value_type): Return type if type is
            BITINT_TYPE with precision above MAX_FIXED_MODE_SIZE or with
BLKmode.
            (switch_conversion::build_arrays): Use unsigned_type_for rather
than
            lang_hooks.types.type_for_mode if utype is BITINT_TYPE with
precision
            above MAX_FIXED_MODE_SIZE or with BLKmode.  If utype has precision
            higher than sizetype, use sizetype as tidx type and fold_convert
the
            subtraction to sizetype.

            * gcc.dg/torture/bitint-51.c: New test.

[Bug tree-optimization/113491] ICE: SIGSEGV in make_ssa_name_fn (tree-ssanames.cc:354) at -Os with _BitInt() used as switch control expression

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113491

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/113491] ICE: SIGSEGV in make_ssa_name_fn (tree-ssanames.cc:354) at -Os with _BitInt() used as switch control expression

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=113491

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |14.0