[Bug middle-end/59399] New: ICE in expand_expr_real_1 with -m64 -fsanitize=signed-integer-overflow

["bergner at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59399

            Bug ID: 59399
           Summary: ICE in expand_expr_real_1 with -m64
                    -fsanitize=signed-integer-overflow
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: bergner at gcc dot gnu.org

On powerpc64-linux, I'm seeing a failure in the ubsan testsuite that causes an
ICE in expand_real_1, line 9484.  A simplified test case is:

[bergner@igoo BUGS]$ cat bug.ii 
void
foo (int i, int j)
{
  volatile int k = j + i;
}

[bergner@igoo BUGS]$ /home/bergner/gcc/build/gcc-fsf-mainline-debug/gcc/cc1plus
-fpreprocessed -quiet -m64 -fsanitize=signed-integer-overflow bug.ii 
bug.ii: In function ‘void foo(int, int)’:
bug.ii:4:22: internal compiler error: in expand_expr_real_1, at expr.c:9484
   volatile int k = j + i;
                      ^
0x107c1d2f expand_expr_real_1(tree_node*, rtx_def*, machine_mode,
expand_modifier, rtx_def**)
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/expr.c:9484
0x107b9d57 expand_expr_real(tree_node*, rtx_def*, machine_mode,
expand_modifier, rtx_def**)
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/expr.c:7927
0x109590af expand_expr
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/expr.h:453
0x1095a383 ubsan_expand_si_overflow_addsub_check(tree_code,
gimple_statement_base*)
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/internal-fn.c:182
0x1095b30f expand_UBSAN_CHECK_ADD
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/internal-fn.c:436
0x1095b467 expand_internal_call(gimple_statement_base*)
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/internal-fn.c:476
0x106071ab expand_call_stmt
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/cfgexpand.c:2185
0x1060b9d3 expand_gimple_stmt_1
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/cfgexpand.c:3154
0x1060c20f expand_gimple_stmt
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/cfgexpand.c:3306
0x106149eb expand_gimple_basic_block
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/cfgexpand.c:5146
0x106170db gimple_expand_cfg
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/cfgexpand.c:5712
0x10617aff execute
    /home/bergner/gcc/gcc-fsf-mainline-base/gcc/cfgexpand.c:5932

We're dying in the gcc_assert below:

          /* Get the signedness to be used for this variable.  Ensure we get
             the same mode we got when the variable was declared.  */
          if (code == SSA_NAME
              && (g = SSA_NAME_DEF_STMT (ssa_name))
              && gimple_code (g) == GIMPLE_CALL)
            {
              gcc_assert (!gimple_call_internal_p (g));
              pmode = promote_function_mode (type, mode, &unsignedp,
                                             gimple_call_fntype (g),
                                             2);
            }

The debugger shows g to be:

(gdb) p *g
$1 = {code = GIMPLE_CALL, no_warning = 0, visited = 0, nontemporal_move = 0,
plf = 0, modified = 0, 
  has_volatile_ops = 0, subcode = 64, uid = 0, location = 2147483648, num_ops =
5, bb = 0xfffb0070208, 
  next = 0xfffb00a00a0, prev = 0xfffb00a00a0}
>From gcc-bugs-return-436757-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Dec 05 18:31:00 2013
Return-Path: <gcc-bugs-return-436757-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 9358 invoked by alias); 5 Dec 2013 18:30:59 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 9318 invoked by uid 48); 5 Dec 2013 18:30:56 -0000
From: "olegendo at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug target/59343] miscompiled for loop in sh4 target (-Os)
Date: Thu, 05 Dec 2013 18:30:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: target
X-Bugzilla-Version: 4.8.1
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: olegendo at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-59343-4-TSVpQnLNYi@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-59343-4@http.gcc.gnu.org/bugzilla/>
References: <bug-59343-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2013-12/txt/msg00412.txt.bz2
Content-length: 439

http://gcc.gnu.org/bugzilla/show_bug.cgi?idY343

--- Comment #8 from Oleg Endo <olegendo at gcc dot gnu.org> ---
(In reply to gcc-bugzilla-f5d8 from comment #0)
> Created attachment 31327 [details]
> miscompilation testcase
>
> The attached testcase miscompiles on sh4 target if build with -Os
>

BTW thanks for the test case.  It's an interesting case for further
optimizations of the sh_treg_combine pass (see PR 51244 comment 72).