[Bug c/115641] New: GCC crashes on function has attribute `__attribute__((const))`

[Bug c/115641] New: GCC crashes on function has attribute `__attribute__((const))`

[141242068 at smail dot nju.edu.cn]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115641

            Bug ID: 115641
           Summary: GCC crashes on function has attribute
                    `__attribute__((const))`
           Product: gcc
           Version: 15.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: 141242068 at smail dot nju.edu.cn
  Target Milestone: ---

Compiler Explorer: https://gcc.godbolt.org/z/79oo9rsxj

When compiling this with `gcc-trunk -O2`, gcc crashes.
This only occurs in trunk version, older versions like gcc-{12,13,14} are
tested to be normal.
```
#include <stdlib.h>

typedef struct {
  char hours, day, month;
  short year;
} T;

T g (void) {
  T now;
  now.hours = 1;
  now.day = 2;
  now.month = 3;
  now.year = 4;
  return now;
}

__attribute__((const)) T f (void)
{
  T virk = g ();
  return virk;
}

int main ()
{
  if (f ().hours != 1 || f ().day != 2 || f ().month != 3 || f ().year != 4)
    abort ();
  return 0;
}
```

[Bug middle-end/115641] [11/12/13/14/15 Regression] GCC crashes on function has attribute `__attribute__((const))`

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115641

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2024-06-25
          Component|c                           |middle-end
            Summary|GCC crashes on function has |[11/12/13/14/15 Regression]
                   |attribute                   |GCC crashes on function has
                   |`__attribute__((const))`    |attribute
                   |                            |`__attribute__((const))`
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Target Milestone|---                         |11.5
           Priority|P3                          |P2
                 CC|                            |mpolacek at gcc dot gnu.org
           Keywords|                            |ice-on-valid-code

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.  Started with r10-3830-g853ce7c073eedf:

commit 853ce7c073eedfba1adfb63530a8bd2baa767137
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Oct 12 14:21:45 2019 +0200

    re PR middle-end/92063 (ICE in operation_could_trap_p, at tree-eh.c:2528
when compiling Python's Python/_warnings.c)

[Bug middle-end/115641] [11/12/13/14/15 Regression] GCC crashes on function has attribute `__attribute__((const))`

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115641

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
It's the

--- a/gcc/fold-const.c
+++ b/gcc/fold-const.c
@@ -4447,8 +4447,7 @@ simple_operand_p_2 (tree exp)
 {
   enum tree_code code;

-  if (TREE_SIDE_EFFECTS (exp)
-      || tree_could_trap_p (exp))
+  if (TREE_SIDE_EFFECTS (exp) || generic_expr_could_trap_p (exp))
     return false;

   while (CONVERT_EXPR_P (exp))

change.  simple_condition_p gets

((short unsigned int) BIT_FIELD_REF <MEM <struct T> [(void *)&f ()], 16, 0> &
65535) != 513

and generic_expr_could_trap_p recurses down to tree_could_trap_p getting

MEM <struct T> [(void *)&f ()]

where we get the base which is "f ()" but DECL_SIZE_UNIT crashes on that.

[Bug middle-end/115641] [11/12/13/14/15 Regression] GCC crashes on function has const attribute since r10-3830

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115641

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
I think that

    arg:0 <addr_expr 0x7ffff6e1fcc0
        type <pointer_type 0x7ffff6e4f1f8 type <record_type 0x7ffff6e49f18 T>
            unsigned DI
            size <integer_cst 0x7ffff700bf48 constant 64>
            unit-size <integer_cst 0x7ffff700bf60 constant 8>
            align:64 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff6e4f2a0>
        readonly
        arg:0 <call_expr 0x7ffff6e3cf90 type <record_type 0x7ffff6e49f18 T>
            readonly
            fn <addr_expr 0x7ffff6e1fb60 type <pointer_type 0x7ffff6e4f000>
                readonly constant arg:0 <function_decl 0x7ffff6e46f00 f>
                t.c:25:7 start: t.c:25:7 finish: t.c:25:7>
            t.c:25:7 start: t.c:25:7 finish: t.c:25:10>>

aka &f () is invalid GENERIC.  That call needs to be wrapped in a TARGET_EXPR
or something similar.  That ADDR_EXPR is built from

#0  0x000000000121075e in make_bit_field_ref (loc=2147483940, 
    inner=<call_expr 0x7ffff6e3cf90>, 
    orig_inner=<component_ref 0x7ffff6e3cfc0>, 
    type=<integer_type 0x7ffff702b540 short unsigned int>, bitsize=16, 
    bitpos=..., unsignedp=0, reversep=0)
    at /space/rguenther/src/gcc/gcc/fold-const.cc:4718
#1  0x0000000001219fef in fold_truth_andor_1 (loc=2147483940, 
    code=TRUTH_OR_EXPR, truth_type=<integer_type 0x7ffff702b5e8 int>, 
    lhs=<ne_expr 0x7ffff6e4adc0>, rhs=<ne_expr 0x7ffff6e4ade8>)
    at /space/rguenther/src/gcc/gcc/fold-const.cc:6934
#2  0x0000000001228073 in fold_truth_andor (loc=2147483940, 
    code=TRUTH_ORIF_EXPR, type=<integer_type 0x7ffff702b5e8 int>, 
    arg0=<ne_expr 0x7ffff6e4adc0>, arg1=<ne_expr 0x7ffff6e4ade8>, 
    op0=<ne_expr 0x7ffff6e4adc0>, op1=<ne_expr 0x7ffff6e4ade8>)
    at /space/rguenther/src/gcc/gcc/fold-const.cc:9983
#3  0x0000000001235b31 in fold_binary_loc (loc=2147483940, 
    code=TRUTH_ORIF_EXPR, type=<integer_type 0x7ffff702b5e8 int>, 
    op0=<ne_expr 0x7ffff6e4adc0>, op1=<ne_expr 0x7ffff6e4ade8>)
    at /space/rguenther/src/gcc/gcc/fold-const.cc:12543
#4  0x000000000123cbad in fold_build2_loc (loc=2147483940, 
    code=TRUTH_ORIF_EXPR, type=<integer_type 0x7ffff702b5e8 int>, 
    op0=<ne_expr 0x7ffff6e4adc0>, op1=<ne_expr 0x7ffff6e4ade8>)
    at /space/rguenther/src/gcc/gcc/fold-const.cc:14222
#5  0x0000000000e9d19b in c_fully_fold_internal (
    expr=<truth_orif_expr 0x7ffff6e4ac58>, in_init=false, 
    maybe_const_operands=0x7fffffffd367, maybe_const_itself=0x7fffffffd364, 
    for_int_const=false, lval=false)
    at /space/rguenther/src/gcc/gcc/c/c-fold.cc:552

the f ().day GENERIC tree is border-line with no decl visible.  At least
we don't want to introduce that via a TARGET_EXPR during folding.  I have
a patch to simply reject it.

[Bug middle-end/115641] [11/12/13/14/15 Regression] GCC crashes on function has const attribute since r10-3830

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115641

--- Comment #4 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:3670c70c561656a19f6bff36dd229f18120af127

commit r15-2139-g3670c70c561656a19f6bff36dd229f18120af127
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Jul 18 13:35:33 2024 +0200

    middle-end/115641 - invalid address construction

    fold_truth_andor_1 via make_bit_field_ref builds an address of
    a CALL_EXPR which isn't valid GENERIC and later causes an ICE.
    The following simply avoids the folding for f ().a != 1 || f ().b != 2
    as it is a premature optimization anyway.  The alternative would
    have been to build a TARGET_EXPR around the call.  To get this far
    f () has to be const as otherwise the two calls are not semantically
    equivalent for the optimization.

            PR middle-end/115641
            * fold-const.cc (decode_field_reference): If the inner
            reference isn't something we can take the address of, fail.

            * gcc.dg/torture/pr115641.c: New testcase.

[Bug middle-end/115641] [11/12/13/14 Regression] GCC crashes on function has const attribute since r10-3830

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115641

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |15.0
            Summary|[11/12/13/14/15 Regression] |[11/12/13/14 Regression]
                   |GCC crashes on function has |GCC crashes on function has
                   |const attribute since       |const attribute since
                   |r10-3830                    |r10-3830

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug middle-end/115641] [12/13/14 Regression] GCC crashes on function has const attribute since r10-3830

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115641

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|11.5                        |12.5

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 11 branch is being closed.

[Bug middle-end/115641] [12/13/14 Regression] GCC crashes on function has const attribute since r10-3830

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=115641

--- Comment #7 from GCC Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-14 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:98dc0471d5409701ae700cd7aba8716fdc500401

commit r14-10677-g98dc0471d5409701ae700cd7aba8716fdc500401
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Jul 18 13:35:33 2024 +0200

    middle-end/115641 - invalid address construction

    fold_truth_andor_1 via make_bit_field_ref builds an address of
    a CALL_EXPR which isn't valid GENERIC and later causes an ICE.
    The following simply avoids the folding for f ().a != 1 || f ().b != 2
    as it is a premature optimization anyway.  The alternative would
    have been to build a TARGET_EXPR around the call.  To get this far
    f () has to be const as otherwise the two calls are not semantically
    equivalent for the optimization.

            PR middle-end/115641
            * fold-const.cc (decode_field_reference): If the inner
            reference isn't something we can take the address of, fail.

            * gcc.dg/torture/pr115641.c: New testcase.

    (cherry picked from commit 3670c70c561656a19f6bff36dd229f18120af127)