[Bug tree-optimization/59891] New: ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[Bug tree-optimization/59891] New: ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[su at cs dot ucdavis.edu]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

            Bug ID: 59891
           Summary: ICE on invalid code (with div-by-zero) at all
                    optimization levels on x86_64-linux-gnu
           Product: gcc
           Version: 4.9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu

The following code causes an ICE when compiled with the current gcc trunk and
4.8 at all the optimization levels on x86_64-linux-gnu in both 32-bit and
64-bit modes. 

The code causes gcc 4.7 to hang at all optimization levels. 

It is a regression from 4.6.x. 

$ gcc-trunk -v
Using built-in specs.
COLLECT_GCC=gcc-trunk
COLLECT_LTO_WRAPPER=/usr/local/gcc-trunk/libexec/gcc/x86_64-unknown-linux-gnu/4.9.0/lto-wrapper
Target: x86_64-unknown-linux-gnu
Configured with: ../gcc-trunk/configure --prefix=/usr/local/gcc-trunk
--enable-languages=c,c++ --disable-werror --enable-multilib
Thread model: posix
gcc version 4.9.0 20140120 (experimental) [trunk revision 206798] (GCC) 
$ 
$ gcc-trunk -O0 small.c
small.c: In function ‘main’:
small.c:6:28: warning: division by zero [-Wdiv-by-zero]
   return (0 ? a : 0) ? : 0 % 0;
                            ^
small.c:6:3: internal compiler error: in gimplify_expr, at gimplify.c:8157
   return (0 ? a : 0) ? : 0 % 0;
   ^
0x806fb8 gimplify_expr(tree_node**, gimple_statement_base**,
gimple_statement_base**, bool (*)(tree_node*), int)
    ../../gcc-trunk/gcc/gimplify.c:8157
0x80a139 gimplify_modify_expr
    ../../gcc-trunk/gcc/gimplify.c:4493
0x80a139 gimplify_expr(tree_node**, gimple_statement_base**,
gimple_statement_base**, bool (*)(tree_node*), int)
    ../../gcc-trunk/gcc/gimplify.c:7441
0x80ec18 gimplify_stmt(tree_node**, gimple_statement_base**)
    ../../gcc-trunk/gcc/gimplify.c:5334
0x810802 gimplify_and_add(tree_node*, gimple_statement_base**)
    ../../gcc-trunk/gcc/gimplify.c:384
0x811da0 gimplify_return_expr
    ../../gcc-trunk/gcc/gimplify.c:1234
0x808557 gimplify_expr(tree_node**, gimple_statement_base**,
gimple_statement_base**, bool (*)(tree_node*), int)
    ../../gcc-trunk/gcc/gimplify.c:7688
0x80ec18 gimplify_stmt(tree_node**, gimple_statement_base**)
    ../../gcc-trunk/gcc/gimplify.c:5334
0x80fe13 gimplify_bind_expr
    ../../gcc-trunk/gcc/gimplify.c:1072
0x8082d0 gimplify_expr(tree_node**, gimple_statement_base**,
gimple_statement_base**, bool (*)(tree_node*), int)
    ../../gcc-trunk/gcc/gimplify.c:7638
0x80ec18 gimplify_stmt(tree_node**, gimple_statement_base**)
    ../../gcc-trunk/gcc/gimplify.c:5334
0x80ed6a gimplify_body(tree_node*, bool)
    ../../gcc-trunk/gcc/gimplify.c:8548
0x80f3b1 gimplify_function_tree(tree_node*)
    ../../gcc-trunk/gcc/gimplify.c:8701
0x69ec97 analyze_function
    ../../gcc-trunk/gcc/cgraphunit.c:649
0x6a0724 analyze_functions
    ../../gcc-trunk/gcc/cgraphunit.c:1017
0x6a1660 finalize_compilation_unit()
    ../../gcc-trunk/gcc/cgraphunit.c:2310
0x55b802 c_write_global_declarations()
    ../../gcc-trunk/gcc/c/c-decl.c:10401
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.
$    


-------------------------


unsigned int a;

int 
main ()
{
  return (0 ? a : 0) ? : 0 % 0;
}
>From gcc-bugs-return-441036-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Mon Jan 20 18:11:33 2014
Return-Path: <gcc-bugs-return-441036-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 3538 invoked by alias); 20 Jan 2014 18:11:33 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 3516 invoked by uid 48); 20 Jan 2014 18:11:29 -0000
From: "mpolacek at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu
Date: Mon, 20 Jan 2014 18:11:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 4.9.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: mpolacek at gcc dot gnu.org
X-Bugzilla-Status: NEW
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.7.4
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_status cf_reconfirmed_on cc target_milestone short_desc everconfirmed
Message-ID: <bug-59891-4-uNtWgWh8nE@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-59891-4@http.gcc.gnu.org/bugzilla/>
References: <bug-59891-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-01/txt/msg02178.txt.bz2
Content-length: 970

http://gcc.gnu.org/bugzilla/show_bug.cgi?idY891

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-01-20
                 CC|                            |mpolacek at gcc dot gnu.org
   Target Milestone|---                         |4.7.4
            Summary|ICE on invalid code (with   |[4.7/4.8/4.9 Regression]
                   |div-by-zero) at all         |ICE on invalid code (with
                   |optimization levels on      |div-by-zero) at all
                   |x86_64-linux-gnu            |optimization levels on
                   |                            |x86_64-linux-gnu
     Ever confirmed|0                           |1

--- Comment #1 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.

[Bug c/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org
          Component|tree-optimization           |c

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r145254.

[Bug c/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jsm28 at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Seems the problem is nested C_MAYBE_CONST_EXPRs, and c_fully_fold_internal
doesn't seem to fully fold the operands of this.
The inner C_MAYBE_CONST_EXPR comes from:
#5  0x0000000000608b40 in c_wrap_maybe_const (expr=<trunc_mod_expr
0x7ffff19b9870>, non_const=false) at ../../gcc/c-family/c-common.c:4455
#6  0x00000000005ac3a3 in build_conditional_expr (colon_loc=5669,
ifexp=<integer_cst 0x7ffff18b4620>, ifexp_bcp=false, 
    op1=<integer_cst 0x7ffff18b4400>, op1_original_type=<tree 0x0>,
op2=<trunc_mod_expr 0x7ffff19b9870>, op2_original_type=<tree 0x0>)
    at ../../gcc/c/c-typeck.c:4577
#7  0x00000000005d99c4 in c_parser_conditional_expression
(parser=0x7ffff19d9000, after=0x0, omp_atomic_lhs=<tree 0x0>)
    at ../../gcc/c/c-parser.c:5969
and build_conditional_expr clearly calls c_fully_fold on expressions before
(optionally) passing them to c_wrap_maybe_const.

The outer C_MAYBE_CONST_EXPR comes from:
#5  0x000000000059abd4 in note_integer_operands (expr=<cond_expr
0x7ffff19d8840>) at ../../gcc/c/c-typeck.c:151
#6  0x00000000005accab in build_conditional_expr (colon_loc=5669,
ifexp=<integer_cst 0x7ffff18b4620>, ifexp_bcp=false, 
    op1=<integer_cst 0x7ffff18b4400>, op1_original_type=<tree 0x0>,
op2=<nop_expr 0x7ffff19c87c0>, op2_original_type=<tree 0x0>)
    at ../../gcc/c/c-typeck.c:4716
#7  0x00000000005d99c4 in c_parser_conditional_expression
(parser=0x7ffff19d9000, after=0x0, omp_atomic_lhs=<tree 0x0>)
    at ../../gcc/c/c-parser.c:5969
and there we don't fully fold it.

So, should the fix be to call c_fully_fold on expr before creating the
C_MAYBE_CONST_EXPR?

[Bug c/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[joseph at codesourcery dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

--- Comment #4 from joseph at codesourcery dot com <joseph at codesourcery dot com> ---
On Tue, 21 Jan 2014, jakub at gcc dot gnu.org wrote:

> The outer C_MAYBE_CONST_EXPR comes from:
> #5  0x000000000059abd4 in note_integer_operands (expr=<cond_expr
> 0x7ffff19d8840>) at ../../gcc/c/c-typeck.c:151
> #6  0x00000000005accab in build_conditional_expr (colon_loc=5669,
> ifexp=<integer_cst 0x7ffff18b4620>, ifexp_bcp=false, 
>     op1=<integer_cst 0x7ffff18b4400>, op1_original_type=<tree 0x0>,
> op2=<nop_expr 0x7ffff19c87c0>, op2_original_type=<tree 0x0>)
>     at ../../gcc/c/c-typeck.c:4716
> #7  0x00000000005d99c4 in c_parser_conditional_expression
> (parser=0x7ffff19d9000, after=0x0, omp_atomic_lhs=<tree 0x0>)
>     at ../../gcc/c/c-parser.c:5969
> and there we don't fully fold it.

This code was supposed to have removed C_MAYBE_CONST_EXPRs where they 
could cause problems, through:

      if (int_operands)
        {
          op1 = remove_c_maybe_const_expr (op1);
          op2 = remove_c_maybe_const_expr (op2);
        }

(the relevant note_integer_operands call being conditional on 
int_operands).  So why didn't that work?

[Bug c/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Because the C_MAYBE_CONST_EXPR has been added again in:
4576              if (!op2_maybe_const || TREE_CODE (op2) != INTEGER_CST)
4577                op2 = c_wrap_maybe_const (op2, !op2_maybe_const);
around the TRUNC_MOD_EXPR, then
4680      op1 = ep_convert_and_check (result_type, op1, semantic_result_type);
4681      op2 = ep_convert_and_check (result_type, op2, semantic_result_type);
converted the int type C_MAYBE_CONST_EXPR to unsigned int type (i.e. added
NOP_EXPR around it), and then the remove_c_maybe_const_expr in:
4709          if (int_operands)
4710        {
4711          op1 = remove_c_maybe_const_expr (op1);
4712          op2 = remove_c_maybe_const_expr (op2);
4713        }
4714          ret = build3 (COND_EXPR, result_type, ifexp, op1, op2);
4715          if (int_operands)
4716        ret = note_integer_operands (ret);
doesn't do anything anymore, since it only looks at toplevel
C_MAYBE_CONST_EXPR, not embedded in some NOP_EXPR.

[Bug c/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

--- Comment #6 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Would it work if remove_c_maybe_const_expr stripped NOP_EXPRs first?

[Bug c/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[jakub at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
It would need to add it back afterwards.  And, is NOP_EXPR the only thing that
can be added this way around it?

[Bug c/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[joseph at codesourcery dot com]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

--- Comment #8 from joseph at codesourcery dot com <joseph at codesourcery dot com> ---
I guess that means re-folding is the simplest thing to do (in this 
int_operands case where an operand might have a C_MAYBE_CONST_EXPR not at 
top level), instead of using remove_c_maybe_const_expr.

[Bug c/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |mpolacek at gcc dot gnu.org

--- Comment #9 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Mine for now.

[Bug c/59891] [4.7/4.8/4.9 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

--- Comment #10 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Author: mpolacek
Date: Wed Jan 22 22:15:12 2014
New Revision: 206944

URL: http://gcc.gnu.org/viewcvs?rev=206944&root=gcc&view=rev
Log:
    PR c/59891
c/
    * c-typeck.c (build_conditional_expr): Call c_fully_fold instead
    of remove_c_maybe_const_expr on op1 and op2.
testsuite/
    * gcc.dg/torture/pr59891.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/torture/pr59891.c
Modified:
    trunk/gcc/c/ChangeLog
    trunk/gcc/c/c-typeck.c
    trunk/gcc/testsuite/ChangeLog

[Bug c/59891] [4.7/4.8 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

--- Comment #11 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Author: mpolacek
Date: Wed Jan 22 22:20:14 2014
New Revision: 206945

URL: http://gcc.gnu.org/viewcvs?rev=206945&root=gcc&view=rev
Log:
    PR c/59891
c/
    * c-typeck.c (build_conditional_expr): Call c_fully_fold instead
    of remove_c_maybe_const_expr on op1 and op2.
testsuite/
    * gcc.dg/torture/pr59891.c: New test.

Added:
    branches/gcc-4_8-branch/gcc/testsuite/gcc.dg/torture/pr59891.c
Modified:
    branches/gcc-4_8-branch/gcc/c/ChangeLog
    branches/gcc-4_8-branch/gcc/c/c-typeck.c
    branches/gcc-4_8-branch/gcc/testsuite/ChangeLog

[Bug c/59891] [4.7 Regression] ICE on invalid code (with div-by-zero) at all optimization levels on x86_64-linux-gnu

[mpolacek at gcc dot gnu.org]

http://gcc.gnu.org/bugzilla/show_bug.cgi?id=59891

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
            Summary|[4.7/4.8 Regression] ICE on |[4.7 Regression] ICE on
                   |invalid code (with          |invalid code (with
                   |div-by-zero) at all         |div-by-zero) at all
                   |optimization levels on      |optimization levels on
                   |x86_64-linux-gnu            |x86_64-linux-gnu

--- Comment #12 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Fixed.