[Bug target/63910] New: [5 Regression] ICE: simplify_immed_subreg, at simplify-rtx.c:5519 with -mstringop-strategy=vector_loop -mavx512f

[Bug target/63910] New: [5 Regression] ICE: simplify_immed_subreg, at simplify-rtx.c:5519 with -mstringop-strategy=vector_loop -mavx512f

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63910

            Bug ID: 63910
           Summary: [5 Regression] ICE: simplify_immed_subreg, at
                    simplify-rtx.c:5519 with
                    -mstringop-strategy=vector_loop -mavx512f
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: target
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz

Created attachment 33999
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=33999&action=edit
reduced testcase

Compiler output:
$ gcc -O -mstringop-strategy=vector_loop -mavx512f testcase.c 
testcase.c: In function 'foo':
testcase.c:8:1: internal compiler error: in simplify_immed_subreg, at
simplify-rtx.c:5519
 }
 ^
0xc331ee simplify_immed_subreg
        /mnt/svn/gcc-trunk/gcc/simplify-rtx.c:5519
0xc48509 simplify_gen_subreg(machine_mode, rtx_def*, machine_mode, unsigned
int)
        /mnt/svn/gcc-trunk/gcc/simplify-rtx.c:5818
0x165f75c propagate_rtx_1
        /mnt/svn/gcc-trunk/gcc/fwprop.c:550
0x166014f propagate_rtx
        /mnt/svn/gcc-trunk/gcc/fwprop.c:686
0x1661f63 forward_propagate_and_simplify
        /mnt/svn/gcc-trunk/gcc/fwprop.c:1333
0x1661f63 forward_propagate_into
        /mnt/svn/gcc-trunk/gcc/fwprop.c:1391
0x1662c84 fwprop
        /mnt/svn/gcc-trunk/gcc/fwprop.c:1476
0x1662c84 execute
        /mnt/svn/gcc-trunk/gcc/fwprop.c:1509
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <http://gcc.gnu.org/bugs.html> for instructions.


Tested revisions:
r217624 - ICE
4_9 r216937 - OK

[Bug target/63910] [5 Regression] ICE: simplify_immed_subreg, at simplify-rtx.c:5519 with -mstringop-strategy=vector_loop -mavx512f

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63910

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
   Target Milestone|---                         |5.0

[Bug target/63910] [5 Regression] ICE: simplify_immed_subreg, at simplify-rtx.c:5519 with -mstringop-strategy=vector_loop -mavx512f

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63910

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2014-11-18
                 CC|                            |jakub at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r210113 aka wide-int merge.  Looking into this.

[Bug target/63910] [5 Regression] ICE: simplify_immed_subreg, at simplify-rtx.c:5519 with -mstringop-strategy=vector_loop -mavx512f

[ubizjak at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63910

--- Comment #2 from Uroš Bizjak <ubizjak at gmail dot com> ---
The compiler trips:

#2  0x0000000000a8e290 in simplify_immed_subreg (outermode=OImode,
op=0x2aaaae7afda0, innermode=<optimized out>, byte=<optimized out>)
    at ../../gcc-svn/trunk/gcc/simplify-rtx.c:5519
5519                gcc_assert (GET_MODE_PRECISION (outer_submode)
(gdb) list
5514                      buf |= (unsigned HOST_WIDE_INT)(*vp++ & value_mask)
<< i;
5515
5516                    tmp[u] = buf;
5517                    base += HOST_BITS_PER_WIDE_INT;
5518                  }
5519                gcc_assert (GET_MODE_PRECISION (outer_submode)
5520                            <= MAX_BITSIZE_MODE_ANY_INT);
5521                r = wide_int::from_array (tmp, units,
5522                                          GET_MODE_PRECISION
(outer_submode));
5523                elems[elem] = immed_wide_int_const (r, outer_submode);

trying to simplify

(gdb) p debug_rtx (op)
(const_vector:V8DI [
        (const_int 0 [0])
        (const_int 0 [0])
        (const_int 0 [0])
        (const_int 0 [0])
        (const_int 0 [0])
        (const_int 0 [0])
        (const_int 0 [0])
        (const_int 0 [0])
    ])

to OImode.

MAX_BITSIZE_MODE_ANY_INT is 128 in the above assert.

gcc-4.9 generates movoi without problems:

vmovdqa .LC0(%rip), %ymm0       # 26    *movoi_internal_avx/2   [length = 9]
>From gcc-bugs-return-467129-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org Tue Nov 18 09:15:30 2014
Return-Path: <gcc-bugs-return-467129-listarch-gcc-bugs=gcc.gnu.org@gcc.gnu.org>
Delivered-To: listarch-gcc-bugs@gcc.gnu.org
Received: (qmail 30645 invoked by alias); 18 Nov 2014 09:15:30 -0000
Mailing-List: contact gcc-bugs-help@gcc.gnu.org; run by ezmlm
Precedence: bulk
List-Id: <gcc-bugs.gcc.gnu.org>
List-Archive: <http://gcc.gnu.org/ml/gcc-bugs/>
List-Post: <mailto:gcc-bugs@gcc.gnu.org>
List-Help: <mailto:gcc-bugs-help@gcc.gnu.org>
Sender: gcc-bugs-owner@gcc.gnu.org
Delivered-To: mailing list gcc-bugs@gcc.gnu.org
Received: (qmail 30607 invoked by uid 48); 18 Nov 2014 09:15:26 -0000
From: "trippels at gcc dot gnu.org" <gcc-bugzilla@gcc.gnu.org>
To: gcc-bugs@gcc.gnu.org
Subject: [Bug c++/63928] New: [5 Regression] use after free in cp/constexpr.c
Date: Tue, 18 Nov 2014 09:15:00 -0000
X-Bugzilla-Reason: CC
X-Bugzilla-Type: new
X-Bugzilla-Watch-Reason: None
X-Bugzilla-Product: gcc
X-Bugzilla-Component: c++
X-Bugzilla-Version: 5.0
X-Bugzilla-Keywords:
X-Bugzilla-Severity: normal
X-Bugzilla-Who: trippels at gcc dot gnu.org
X-Bugzilla-Status: UNCONFIRMED
X-Bugzilla-Priority: P3
X-Bugzilla-Assigned-To: unassigned at gcc dot gnu.org
X-Bugzilla-Target-Milestone: ---
X-Bugzilla-Flags:
X-Bugzilla-Changed-Fields: bug_id short_desc product version bug_status bug_severity priority component assigned_to reporter cc
Message-ID: <bug-63928-4@http.gcc.gnu.org/bugzilla/>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit
X-Bugzilla-URL: http://gcc.gnu.org/bugzilla/
Auto-Submitted: auto-generated
MIME-Version: 1.0
X-SW-Source: 2014-11/txt/msg01601.txt.bz2
Content-length: 9313

https://gcc.gnu.org/bugzilla/show_bug.cgi?idc928

            Bug ID: 63928
           Summary: [5 Regression] use after free in cp/constexpr.c
           Product: gcc
           Version: 5.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: trippels at gcc dot gnu.org
                CC: jason at gcc dot gnu.org

bootstrap-asan shows:

=i040==ERROR: AddressSanitizer: heap-use-after-free on address 0x0a8800353c88
at pc 0x000010972e94 bp 0x3fffd9fbb510 sp 0x3fffd9fbb580
READ of size 8 at 0x0a8800353c88 thread T0
    #0 0x10972e90 in cxx_eval_store_expression
../../gcc/gcc/cp/constexpr.c:2541
    #1 0x10972e90 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2913
    #2 0x1096e540 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2924
    #3 0x1096d808 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2918
    #4 0x1096e998 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:3188
    #5 0x1096a684 in cxx_eval_call_expression ../../gcc/gcc/cp/constexpr.c:1329
    #6 0x1096ebd8 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2834
    #7 0x1097d4a8 in cxx_eval_outermost_constant_expr
../../gcc/gcc/cp/constexpr.c:3314
    #8 0x1098723c in maybe_constant_value(tree_node*, tree_node*)
../../gcc/gcc/cp/constexpr.c:3427
    #9 0x107e30f8 in finish_static_assert(tree_node*, tree_node*, unsigned int,
bool) ../../gcc/gcc/cp/semantics.c:7046
    #10 0x10658d94 in cp_parser_static_assert ../../gcc/gcc/cp/parser.c:12139
    #11 0x106aa5a8 in cp_parser_member_declaration
../../gcc/gcc/cp/parser.c:20673
    #12 0x1062f158 in cp_parser_member_specification_opt
../../gcc/gcc/cp/parser.c:20542
    #13 0x1062f158 in cp_parser_class_specifier_1
../../gcc/gcc/cp/parser.c:19734
    #14 0x1062f158 in cp_parser_class_specifier ../../gcc/gcc/cp/parser.c:19970
    #15 0x1062f158 in cp_parser_type_specifier ../../gcc/gcc/cp/parser.c:14630
    #16 0x10636e84 in cp_parser_decl_specifier_seq
../../gcc/gcc/cp/parser.c:11864
    #17 0x106a4038 in cp_parser_simple_declaration
../../gcc/gcc/cp/parser.c:11454
    #18 0x106a53e0 in cp_parser_block_declaration
../../gcc/gcc/cp/parser.c:11403
    #19 0x106b2084 in cp_parser_declaration ../../gcc/gcc/cp/parser.c:11300
    #20 0x106b290c in cp_parser_declaration_seq_opt
../../gcc/gcc/cp/parser.c:11186
    #21 0x106b45ec in cp_parser_namespace_body ../../gcc/gcc/cp/parser.c:16166
    #22 0x106b45ec in cp_parser_namespace_definition
../../gcc/gcc/cp/parser.c:16147
    #23 0x106b2254 in cp_parser_declaration ../../gcc/gcc/cp/parser.c:11288
    #24 0x106b290c in cp_parser_declaration_seq_opt
../../gcc/gcc/cp/parser.c:11186
    #25 0x106b45ec in cp_parser_namespace_body ../../gcc/gcc/cp/parser.c:16166
    #26 0x106b45ec in cp_parser_namespace_definition
../../gcc/gcc/cp/parser.c:16147
    #27 0x106b2254 in cp_parser_declaration ../../gcc/gcc/cp/parser.c:11288
    #28 0x106b290c in cp_parser_declaration_seq_opt
../../gcc/gcc/cp/parser.c:11186
    #29 0x106b45ec in cp_parser_namespace_body ../../gcc/gcc/cp/parser.c:16166
    #30 0x106b45ec in cp_parser_namespace_definition
../../gcc/gcc/cp/parser.c:16147
    #31 0x106b2254 in cp_parser_declaration ../../gcc/gcc/cp/parser.c:11288
    #32 0x106b290c in cp_parser_declaration_seq_opt
../../gcc/gcc/cp/parser.c:11186
    #33 0x106b3980 in cp_parser_translation_unit ../../gcc/gcc/cp/parser.c:4101
    #34 0x106b3980 in c_parse_file() ../../gcc/gcc/cp/parser.c:32197
    #35 0x10a7a9fc in c_common_parse_file()
../../gcc/gcc/c-family/c-opts.c:1039
    #36 0x119d855c in compile_file ../../gcc/gcc/toplev.c:570
    #37 0x101edb5c in do_compile ../../gcc/gcc/toplev.c:2040
    #38 0x101edb5c in toplev::main(int, char**) ../../gcc/gcc/toplev.c:2137
    #39 0x101f3098 in main ../../gcc/gcc/main.c:38
    #40 0x3fff817e47a8  (/lib64/libc.so.6+0x447a8)

0x0a8800353c88 is located 200 bytes inside of 208-byte region
[0x0a8800353bc0,0x0a8800353c90)
freed by thread T0 here:
    #0 0x10291710 in __interceptor_free
../../../../gcc/libsanitizer/asan/asan_malloc_linux.cc:28
    #1 0x10501d1c in xcallocator<hash_map<tree_node*, tree_node*,
default_hashmap_traits>::hash_entry>::data_free(hash_map<tree_node*,
tree_node*, default_hashmap_traits>::hash_entry*)
../../gcc/gcc/hash-table.h:233
    #2 0x10501d1c in hash_table<hash_map<tree_node*, tree_node*,
default_hashmap_traits>::hash_entry, xcallocator, true>::expand()
../../gcc/gcc/hash-table.h:1346
    #3 0x10502220 in hash_table<hash_map<tree_node*, tree_node*,
default_hashmap_traits>::hash_entry, xcallocator,
true>::find_slot_with_hash(tree_node* const&, unsigned int, insert_option)
../../gcc/gcc/hash-table.h:1455
    #4 0x10502220 in hash_map<tree_node*, tree_node*,
default_hashmap_traits>::put(tree_node* const&, tree_node* const&)
../../gcc/gcc/hash-map.h:207
    #5 0x109706e0 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2888
    #6 0x1096e5d0 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2958
    #7 0x10969548 in cxx_bind_parameters_in_call
../../gcc/gcc/cp/constexpr.c:1072
    #8 0x10969548 in cxx_eval_call_expression ../../gcc/gcc/cp/constexpr.c:1235
    #9 0x1096ebd8 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2834
    #10 0x10974554 in cxx_eval_binary_expression
../../gcc/gcc/cp/constexpr.c:1485
    #11 0x1096e064 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:3064
    #12 0x109716b0 in cxx_eval_store_expression
../../gcc/gcc/cp/constexpr.c:2527
    #13 0x109716b0 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2913
    #14 0x1096e540 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2924
    #15 0x1096d808 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2918
    #16 0x1096e998 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:3188
    #17 0x1096a684 in cxx_eval_call_expression
../../gcc/gcc/cp/constexpr.c:1329
    #18 0x1096ebd8 in cxx_eval_constant_expression
../../gcc/gcc/cp/constexpr.c:2834
    #19 0x1097d4a8 in cxx_eval_outermost_constant_expr
../../gcc/gcc/cp/constexpr.c:3314
    #20 0x1098723c in maybe_constant_value(tree_node*, tree_node*)
../../gcc/gcc/cp/constexpr.c:3427
    #21 0x107e30f8 in finish_static_assert(tree_node*, tree_node*, unsigned
int, bool) ../../gcc/gcc/cp/semantics.c:7046
    #22 0x10658d94 in cp_parser_static_assert ../../gcc/gcc/cp/parser.c:12139
    #23 0x106aa5a8 in cp_parser_member_declaration
../../gcc/gcc/cp/parser.c:20673
    #24 0x1062f158 in cp_parser_member_specification_opt
../../gcc/gcc/cp/parser.c:20542
    #25 0x1062f158 in cp_parser_class_specifier_1
../../gcc/gcc/cp/parser.c:19734
    #26 0x1062f158 in cp_parser_class_specifier ../../gcc/gcc/cp/parser.c:19970
    #27 0x1062f158 in cp_parser_type_specifier ../../gcc/gcc/cp/parser.c:14630
    #28 0x10636e84 in cp_parser_decl_specifier_seq
../../gcc/gcc/cp/parser.c:11864
    #29 0x106a4038 in cp_parser_simple_declaration
../../gcc/gcc/cp/parser.c:11454
    #30 0x106a53e0 in cp_parser_block_declaration
../../gcc/gcc/cp/parser.c:11403
    #31 0x106b2084 in cp_parser_declaration ../../gcc/gcc/cp/parser.c:11300
    #32 0x106b290c in cp_parser_declaration_seq_opt
../../gcc/gcc/cp/parser.c:11186
    #33 0x106b45ec in cp_parser_namespace_body ../../gcc/gcc/cp/parser.c:16166
    #34 0x106b45ec in cp_parser_namespace_definition
../../gcc/gcc/cp/parser.c:16147
    #35 0x106b2254 in cp_parser_declaration ../../gcc/gcc/cp/parser.c:11288
    #36 0x106b290c in cp_parser_declaration_seq_opt
../../gcc/gcc/cp/parser.c:11186

previously allocated by thread T0 here:
    #0 0x10291c80 in __interceptor_calloc
../../../../gcc/libsanitizer/asan/asan_malloc_linux.cc:54
    #1 0x12bfff50 in xcalloc ../../gcc/libiberty/xmalloc.c:162

SUMMARY: AddressSanitizer: heap-use-after-free
../../gcc/gcc/cp/constexpr.c:2541 cxx_eval_store_expression
Shadow bytes around the buggy address:
  0x03510006a740: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x03510006a750: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x03510006a760: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
  0x03510006a770: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x03510006a780: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x03510006a790: fd[fd]fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x03510006a7a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x03510006a7b0: fd fd fd fd fd fd fd fd fd fd fa fa fa fa fa fa
  0x03510006a7c0: fa fa fa fa fa fa fa fa fd fd fd fd fd fd fd fd
  0x03510006a7d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
  0x03510006a7e0: fd fd fa fa fa fa fa fa fa fa fa fa fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Heap right redzone:      fb
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack partial redzone:   f4
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe

[Bug target/63910] [5 Regression] ICE: simplify_immed_subreg, at simplify-rtx.c:5519 with -mstringop-strategy=vector_loop -mavx512f

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63910

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 34017
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=34017&action=edit
gcc5-pr63910.patch

Untested fix.

[Bug target/63910] [5 Regression] ICE: simplify_immed_subreg, at simplify-rtx.c:5519 with -mstringop-strategy=vector_loop -mavx512f

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63910

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Author: jakub
Date: Fri Nov 21 09:23:26 2014
New Revision: 217908

URL: https://gcc.gnu.org/viewcvs?rev=217908&root=gcc&view=rev
Log:
    PR target/63910
    * simplify-rtx.c (simplify_immed_subreg): Return NULL for integer
    modes wider than MAX_BITSIZE_MODE_ANY_INT.  If not using
    CONST_WIDE_INT, make sure r fits into CONST_DOUBLE.

    * gcc.target/i386/pr63910.c: New test.

Added:
    trunk/gcc/testsuite/gcc.target/i386/pr63910.c
Modified:
    trunk/gcc/ChangeLog
    trunk/gcc/simplify-rtx.c
    trunk/gcc/testsuite/ChangeLog

[Bug target/63910] [5 Regression] ICE: simplify_immed_subreg, at simplify-rtx.c:5519 with -mstringop-strategy=vector_loop -mavx512f

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=63910

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.