[Bug middle-end/115137] New: [15 regression] Miscompilation of wget (test suite hangs)

[Bug middle-end/115137] New: [15 regression] Miscompilation of wget (test suite hangs)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

            Bug ID: 115137
           Summary: [15 regression] Miscompilation of wget (test suite
                    hangs)
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: sjames at gcc dot gnu.org
  Target Milestone: ---

Created attachment 58226
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58226&action=edit
url.c

I noticed that wget's testsuite was hanging today in `unit-tests`.

```
(gdb) bt
#0  0x0000555555559319 in append_uri_pathel (e=e@entry=0x55555555a09d "",
escaped=escaped@entry=false, dest=dest@entry=0x7fffffffd780, b=0x55555555a090
"somepage.html")
    at ../src/url.c:1509
#1  0x00005555555563e0 in test_append_uri_pathel () at ../src/url.c:2492
#2  all_tests () at /home/sam/git/wget/tests/unit-tests.c:47
#3  main (argc=<optimized out>, argv=<optimized out>) at
/home/sam/git/wget/tests/unit-tests.c:70
```

I'm still reducing it but it hangs with gcc-15 -O2.

```
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/libexec/gcc/x86_64-pc-linux-gnu/15/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with:
/var/tmp/portage/sys-devel/gcc-15.0.9999/work/gcc-15.0.9999/configure
--host=x86_64-pc-linux-gnu --build=x86_64-pc-linux-gnu --prefix=/usr
--bindir=/usr/x86_64-pc-linux-gnu/gcc-bin/15
--includedir=/usr/lib/gcc/x86_64-pc-linux-gnu/15/include
--datadir=/usr/share/gcc-data/x86_64-pc-linux-gnu/15
--mandir=/usr/share/gcc-data/x86_64-pc-linux-gnu/15/man
--infodir=/usr/share/gcc-data/x86_64-pc-linux-gnu/15/info
--with-gxx-include-dir=/usr/lib/gcc/x86_64-pc-linux-gnu/15/include/g++-v15
--disable-silent-rules --disable-dependency-tracking
--with-python-dir=/share/gcc-data/x86_64-pc-linux-gnu/15/python
--enable-languages=c,c++,fortran,rust --enable-obsolete --enable-secureplt
--disable-werror --with-system-zlib --enable-nls --without-included-gettext
--disable-libunwind-exceptions --enable-checking=yes,extra,rtl
--with-bugurl=https://bugs.gentoo.org/ --with-pkgversion='Gentoo Hardened
15.0.9999 p, commit bc7d81fe2f725b4043ce8b9ffb11d80032ce3f75'
--with-gcc-major-version-only --enable-libstdcxx-time --enable-lto
--disable-libstdcxx-pch --enable-shared --enable-threads=posix
--enable-__cxa_atexit --enable-clocale=gnu --enable-multilib
--with-multilib-list=m32,m64 --disable-fixed-point --enable-targets=all
--enable-libgomp --disable-libssp --disable-libada --disable-cet
--disable-systemtap --enable-valgrind-annotations --disable-vtable-verify
--disable-libvtv --with-zstd --with-isl --disable-isl-version-check
--enable-default-pie --enable-host-pie --enable-host-bind-now
--enable-default-ssp --disable-fixincludes --with-build-config=bootstrap-O3
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 15.0.0 20240516 (experimental)
556e777298dac8574533935000c57335c5232921 (Gentoo Hardened 15.0.9999 p, commit
bc7d81fe2f725b4043ce8b9ffb11d80032ce3f75) 
```

[Bug middle-end/115137] [15 regression] Miscompilation of wget (test suite hangs)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

--- Comment #1 from Sam James <sjames at gcc dot gnu.org> ---
Notable bits:
* -fno-strict-aliasing makes no difference
* -fno-strict-overflow stops the hang
* -fsanitize=address,undefined shows nothing with < GCC 15
* With GCC 15 only, I get

```
$ ./z
url.c:1575:41: runtime error: load of address 0x557b31e7c12e with insufficient
space for an object of type 'const char'
0x557b31e7c12e: note: pointer points here
 74 6d 6c 00 00 00  00 00 00 00 00 00 00 00  00 00 00 00 00 00 00 00  00 00 00
00 00 00 00 00  00 00
             ^ 
    #0 0x557b31e7b681 in append_uri_pathel /home/sam/git/wget/backup/url.c:1575
    #1 0x557b31e7b94b in test_append_uri_pathel
/home/sam/git/wget/backup/url.c:1667
    #2 0x557b31e7a3a8 in main /home/sam/git/wget/backup/url.c:1679
    #3 0x7f251342df49  (/usr/lib64/libc.so.6+0x25f49)
    #4 0x7f251342e004 in __libc_start_main (/usr/lib64/libc.so.6+0x26004)
    #5 0x557b31e7a400 in _start (/home/sam/git/wget/backup/z+0x4400)

SUMMARY: UndefinedBehaviorSanitizer: undefined-behavior url.c:1575:41 in 
Aborted (core dumped)
```

But only when building with `-O2 -fsanitize=address,undefined`. -O3 with
ASAN+UBSAN is fine.

[Bug middle-end/115137] [15 regression] Miscompilation of wget (test suite hangs)

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

--- Comment #2 from Sam James <sjames at gcc dot gnu.org> ---
I have a reduction still running but I didn't do much manual analysis other
than doing enough to remove its dependency on other files + remove the need for
LTO (which was originally required).

I haven't yet bisected either.

[Bug middle-end/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

Sam James <sjames at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org
            Summary|[15 regression]             |[15 regression]
                   |Miscompilation of wget      |Miscompilation of wget
                   |(test suite hangs)          |(test suite hangs) since
                   |                            |r15-580-gf3e5f4c58591f5

--- Comment #3 from Sam James <sjames at gcc dot gnu.org> ---
Bisect says r15-580-gf3e5f4c58591f5.

[Bug middle-end/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

--- Comment #4 from Sam James <sjames at gcc dot gnu.org> ---
(In reply to Sam James from comment #3)
> Bisect says r15-580-gf3e5f4c58591f5.

(Still fails on trunk as of r15-634-gb59de4113262f2.)

[Bug middle-end/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

--- Comment #5 from Sam James <sjames at gcc dot gnu.org> ---
Reduced further:
```
enum { a } b;
char *c;
int d, e;
static void f(char *g, char *h) {
  char a[1024];
  c = a;
  for (; g < h; g++)
    if (b)
      ++d;
}
int main() { f("somepage.html", "" + e); }
```

[Bug middle-end/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

--- Comment #6 from Sam James <sjames at gcc dot gnu.org> ---
```
char *c;
int b, d, e;

static void f(char *g, char *h) {
  char a[1024] = {};
  c = a;
  for (; g < h; g++)
    if (b)
      ++d;
}

int main() { f("somepage.html", "" + e); }
```

[Bug middle-end/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

--- Comment #7 from Sam James <sjames at gcc dot gnu.org> ---
(In reply to Sam James from comment #6)
> ```
> char *c;
> int b, d, e;
> 
> static void f(char *g, char *h) {
>   char a[1024] = {};
>   c = a;
>   for (; g < h; g++)
>     if (b)
>       ++d;
> }
> 
> int main() { f("somepage.html", "" + e); }
> ```

I've been looking at this on/off for a while because it didn't feel right. A
friend pointed out that it's UB to compare distinct objects, duh. The original
code looks like this too. I think it's therefore INVALID.

The remaining question is: is -fno-strict-aliasing supposed to disable pointer
provenance analysis as QOI or is it purely for TBAA?

[Bug middle-end/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

--- Comment #8 from Sam James <sjames at gcc dot gnu.org> ---
The original is:
```
append_uri_pathel (fname_len_check,
    fname_len_check + strlen (fname_len_check), true, &temp_fnres);

[...]

/* Walk the PATHEL string and check how many characters we'll need
     to quote.  */
  quoted = 0;
  for (p = b; p < e; p++)
    if (FILE_CHAR_TEST (*p, mask))
      ++quoted;
```

... so there, b and e do overlap and point to the same object. Let me try
reduce again.

[Bug middle-end/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[sjames at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

--- Comment #9 from Sam James <sjames at gcc dot gnu.org> ---
Created attachment 58233
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=58233&action=edit
reduced.c

[Bug tree-optimization/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Version|unknown                     |15.0
          Component|middle-end                  |tree-optimization
   Target Milestone|---                         |15.0

[Bug tree-optimization/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2024-05-21
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
             Status|UNCONFIRMED                 |ASSIGNED
     Ever confirmed|0                           |1

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.  Testing patch.

[Bug tree-optimization/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

--- Comment #11 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:85f7828679edc3ae7488594145756cd53787650e

commit r15-753-g85f7828679edc3ae7488594145756cd53787650e
Author: Richard Biener <rguenther@suse.de>
Date:   Tue May 21 10:12:40 2024 +0200

    tree-optimization/115137 - more ptr-vs-ptr compare fixes

    The following fixes the omission of const-pool included in NONLOCAL.

            PR tree-optimization/115137
            * tree-ssa-structalias.cc (pt_solution_includes_const_pool):
NONLOCAL
            also includes constant pool entries.

            * gcc.dg/torture/pr115137.c: New testcase.

[Bug tree-optimization/115137] [15 regression] Miscompilation of wget (test suite hangs) since r15-580-gf3e5f4c58591f5

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115137

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.