[Bug tree-optimization/61773] [4.10 Regression] ICE in tree-ssa-strlen.c:417

[Bug tree-optimization/61773] [4.10 Regression] ICE in tree-ssa-strlen.c:417

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61773

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |4.9.0
   Target Milestone|---                         |4.10.0

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Seems to not ICE with 4.9 for me.

[Bug tree-optimization/61773] New: [4.10 Regression] ICE in tree-ssa-strlen.c:417

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61773

            Bug ID: 61773
           Summary: [4.10 Regression] ICE in tree-ssa-strlen.c:417
           Product: gcc
           Version: 4.10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: rguenth at gcc dot gnu.org

char *foo (void)
{
  char *p = __builtin_malloc (64);
  char *q = __builtin_malloc (64);
  __builtin_strcat (q, "abcde");
  __builtin_strcat (p, "ab");
  p[1] = q[3];
  __builtin_strcat (p, q);
  return q;
}

gives

> ../../obj2/gcc/cc1 -quiet -O2 t.c
t.c: In function ‘foo’:
t.c:1:7: internal compiler error: in get_string_length, at
tree-ssa-strlen.c:417
 char *foo (void)
       ^
0x876c3d2 get_string_length
        /space/rguenther/tramp3d/trunk/gcc/tree-ssa-strlen.c:417
0x8772b02 get_string_length
        /space/rguenther/tramp3d/trunk/gcc/tree.h:2731
0x8772b02 handle_builtin_strlen
        /space/rguenther/tramp3d/trunk/gcc/tree-ssa-strlen.c:899

(gdb) up
#1  0x0876c3d3 in get_string_length (si=0x3c)
    at /space/rguenther/tramp3d/trunk/gcc/tree-ssa-strlen.c:417
417           gcc_assert (builtin_decl_implicit_p (BUILT_IN_STPCPY));


while trying to write a testcase that shows that handle_char_store should
handle a character copy from a known non-zero value.  Well, while really
trying to incrementally teach handle_char_store to handle arbitrary
stores.
>From gcc-bugs-return-456054-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Thu Jul 10 13:28:09 2014
Return-Path: <gcc-bugs-return-456054-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 14207 invoked by alias); 10 Jul 2014 13:28:09 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 13574 invoked by uid 48); 10 Jul 2014 13:27:59 -0000
From: "rguenth at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug tree-optimization/61773] [4.10 Regression] ICE in tree-ssa-strlen.c:417
Date: Thu, 10 Jul 2014 13:28:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: changed
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: tree-optimization
X-Bugzilla-Version: 4.10.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: rguenth at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: 4.10.0
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields:
Message-ID: <bug-61773-4-xgVDKtYebP@http.gcc.gnu.org/bugzilla/>
In-Reply-To: <bug-61773-4@http.gcc.gnu.org/bugzilla/>
References: <bug-61773-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-07/txt/msg00645.txt.bz2
Content-length: 188

https://gcc.gnu.org/bugzilla/show_bug.cgi?ida773

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed with adding a prototype

char *stpcpy (char*, const char *);

[Bug tree-optimization/61773] [4.10 Regression] ICE in tree-ssa-strlen.c:417

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61773

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Proper testcase (string init was missing):

char *stpcpy (char*, const char *);
char *foo (void)
{
  char *p = __builtin_calloc (64, 1);
  char *q = __builtin_calloc (64, 1);
  __builtin_strcat (q, "abcde");
  __builtin_strcat (p, "ab");
  p[1] = 'a';
  __builtin_strcat (p, q);
  return q;
}

this isn't optimized either, only when p[0] = 'a'; is there the last
strcat will be optimized with known strlen of p.  Hmm, a p[1] = '\0'
isn't optimized either.

Unfortunately strlen isn't very verbose in its -details dump.

[Bug tree-optimization/61773] [4.10 Regression] ICE in tree-ssa-strlen.c:417

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61773

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Richard Biener from comment #3)
> Proper testcase (string init was missing):
> 
> char *stpcpy (char*, const char *);
> char *foo (void)
> {
>   char *p = __builtin_calloc (64, 1);
>   char *q = __builtin_calloc (64, 1);
>   __builtin_strcat (q, "abcde");
>   __builtin_strcat (p, "ab");
>   p[1] = 'a';
>   __builtin_strcat (p, q);
>   return q;
> }
> 
> this isn't optimized either, only when p[0] = 'a'; is there the last
> strcat will be optimized with known strlen of p.  Hmm, a p[1] = '\0'
> isn't optimized either.
> 
> Unfortunately strlen isn't very verbose in its -details dump.

Ok, those are all because the store is

  MEM[ptr, 1] = ...

while only a zero offset MEM is handled in handle_char_store.  For
non-constant offset this gets handled by handle_pointer_plus.

It seems to me that all builtin handling will have a similar issue
when faced with arguments of &MEM[ptr_1, <nonzero-offset>] (zero-offset
should be folded to plain ptr_1 of course, so doesn't happen).

Simple

char *stpcpy (char*, const char *);
char *foo (void)
{
  char *p = __builtin_calloc (64, 1);
  char *q = __builtin_calloc (64, 1);
  __builtin_strcat (q, "abcde");
  __builtin_strcat (p, "ab");
  p = p + 1;
  __builtin_strcat (p, q);
  return q;
}

isn't optimized because we get

  _10 = p_3 + _9;
  __builtin_memcpy (_10, "ab", 3);
  p_12 = p_3 + 1;
  __builtin_strcat (p_12, q_5);

and likely p_3 string-info is invalidated instead of made a copy of that
of _10 (as _9 is zero).

char *stpcpy (char*, const char *);
char *foo (char *q)
{
  char *p = __builtin_strdup ("abcde");
  p = p + 1;
  __builtin_strcat (p, "blah");
  return q;
}

is also not handled well as we don't seem to recognize strdup?

[Bug tree-optimization/61773] [5 Regression] ICE in tree-ssa-strlen.c:417

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61773

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug tree-optimization/61773] [5 Regression] ICE in tree-ssa-strlen.c:417

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61773

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
The ICE started with r211956, before that it was assumed that any non-NULL
si->stmt is something to be optimized with stpcpy and friends, so has to be
guarded when creating it so that such optimization isn't attempted if stpcpy
isn't declared.

So, for the ICE I'd like to fix it with:
--- gcc/tree-ssa-strlen.c.jj    2014-11-19 18:47:59.000000000 +0100
+++ gcc/tree-ssa-strlen.c    2014-11-20 09:46:33.949017462 +0100
@@ -430,7 +430,6 @@ get_string_length (strinfo si)
       callee = gimple_call_fndecl (stmt);
       gcc_assert (callee && DECL_BUILT_IN_CLASS (callee) == BUILT_IN_NORMAL);
       lhs = gimple_call_lhs (stmt);
-      gcc_assert (builtin_decl_implicit_p (BUILT_IN_STPCPY));
       /* unshare_strinfo is intentionally not called here.  The (delayed)
      transformation of strcpy or strcat into stpcpy is done at the place
      of the former strcpy/strcat call and so can affect all the strinfos
@@ -479,6 +478,7 @@ get_string_length (strinfo si)
     case BUILT_IN_STRCPY_CHK:
     case BUILT_IN_STRCPY_CHKP:
     case BUILT_IN_STRCPY_CHK_CHKP:
+      gcc_assert (builtin_decl_implicit_p (BUILT_IN_STPCPY));
       if (gimple_call_num_args (stmt) == (with_bounds ? 4 : 2))
         fn = builtin_decl_implicit (BUILT_IN_STPCPY);
       else

now that BUILT_IN_MALLOC uses si->stmt non-NULL too and obviously isn't in any
way related to stpcpy.  I'll look at the missed optimizations.

[Bug tree-optimization/61773] [5 Regression] ICE in tree-ssa-strlen.c:417

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61773

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 34048
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34048&action=edit
gcc5-pr61773.patch

Full (untested) patch.  Let's split this PR into the ICE part and another one
for the enhancement request, which isn't a regression.

[Bug tree-optimization/61773] [5 Regression] ICE in tree-ssa-strlen.c:417

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61773

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Fri Nov 21 09:27:19 2014
New Revision: 217910

URL: https://gcc.gnu.org/viewcvs?rev=217910&root=gcc&view=rev
Log:
    PR tree-optimization/61773
    * tree-ssa-strlen.c (get_string_length): Don't assert
    stpcpy has been prototyped if si->stmt is BUILT_IN_MALLOC.

    * gcc.dg/pr61773.c: New test.

Added:
    trunk/gcc/testsuite/gcc.dg/pr61773.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/testsuite/ChangeLog
    trunk/gcc/tree-ssa-strlen.c

[Bug tree-optimization/61773] [5 Regression] ICE in tree-ssa-strlen.c:417

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=61773

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.