[Bug tree-optimization/94131] New: [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927

[Bug tree-optimization/94131] New: [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94131

            Bug ID: 94131
           Summary: [10 Regression] ICE: tree check: expected integer_cst,
                    have plus_expr in get_len, at tree.h:5927
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Keywords: ice-on-invalid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc-10.0.1-alpha20200103 snapshot (g:9de42a8e995451cb13dceb3970ae23ff88240bff)
ICEs when compiling the following testcase w/ -O1 -fno-tree-ccp
-fno-tree-forwprop:

void
rv (int ur)
{
  char yb[ur];
  int qn = &yb[0];

  __builtin_memset (yb, '\0', sizeof (yb));
  __builtin_printf ("%s", qn ? &yb[0] : "");
}

% gcc-10.0.1 -O1 -fno-tree-ccp -fno-tree-forwprop -w -c gsngdp2d.c
during GIMPLE pass: strlen
gsngdp2d.c: In function 'rv':
gsngdp2d.c:2:1: internal compiler error: tree check: expected integer_cst, have
plus_expr in get_len, at tree.h:5927
    2 | rv (int ur)
      | ^~
0x6fbc02 tree_check_failed(tree_node const*, char const*, int, char const*,
...)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/tree.c:9685
0x7c171f tree_check(tree_node const*, char const*, int, char const*, tree_code)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/tree.h:3534
0x7c171f wi::extended_tree<192>::get_len() const
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/tree.h:5927
0x7c171f wi::int_traits<generic_wide_int<wi::extended_tree<192> >
>::decompose(long*, unsigned int, generic_wide_int<wi::extended_tree<192> >
const&)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/wide-int.h:985
0x7c171f wide_int_ref_storage<true,
false>::wide_int_ref_storage<generic_wide_int<wi::extended_tree<192> >
>(generic_wide_int<wi::extended_tree<192> > const&, unsigned int)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/wide-int.h:1034
0x7c171f generic_wide_int<wide_int_ref_storage<true, false>
>::generic_wide_int<generic_wide_int<wi::extended_tree<192> >
>(generic_wide_int<wi::extended_tree<192> > const&, unsigned int)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/wide-int.h:790
0x7c171f bool wi::lts_p<generic_wide_int<wi::extended_tree<192> >,
generic_wide_int<wi::extended_tree<192> >
>(generic_wide_int<wi::extended_tree<192> > const&,
generic_wide_int<wi::extended_tree<192> > const&)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/wide-int.h:1902
0xf5ecd8 wi::binary_traits<generic_wide_int<wi::extended_tree<192> >,
generic_wide_int<wi::extended_tree<192> >,
wi::int_traits<generic_wide_int<wi::extended_tree<192> > >::precision_type,
wi::int_traits<generic_wide_int<wi::extended_tree<192> >
>::precision_type>::signed_predicate_result operator<
<generic_wide_int<wi::extended_tree<192> >,
generic_wide_int<wi::extended_tree<192> >
>(generic_wide_int<wi::extended_tree<192> > const&,
generic_wide_int<wi::extended_tree<192> > const&)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/wide-int.h:3248
0xf5ecd8 tree_int_cst_lt(tree_node const*, tree_node const*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/tree.h:6083
0xf5ecd8 get_range_strlen_dynamic
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/tree-ssa-strlen.c:1075
0xf5ef71 get_range_strlen_dynamic(tree_node*, c_strlen_data*, vr_values const*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/tree-ssa-strlen.c:1204
0x16aa577 get_string_length
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/gimple-ssa-sprintf.c:2029
0x16aa577 format_string
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/gimple-ssa-sprintf.c:2464
0x16ab003 format_directive
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/gimple-ssa-sprintf.c:3057
0x16ad869 compute_format_length
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/gimple-ssa-sprintf.c:4000
0x16ad869 handle_printf_call(gimple_stmt_iterator*, vr_values const*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/gimple-ssa-sprintf.c:4681
0xf674e3 strlen_check_and_optimize_call
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/tree-ssa-strlen.c:5420
0xf674e3 check_and_optimize_stmt
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/tree-ssa-strlen.c:5588
0xf674e3 strlen_dom_walker::before_dom_children(basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/tree-ssa-strlen.c:5821
0x1664337 dom_walker::walk(basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-10.0.1_alpha20200308/work/gcc-10-20200308/gcc/domwalk.c:309

[Bug tree-optimization/94131] [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94131

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |10.0
           Priority|P3                          |P1
                 CC|                            |msebor at gcc dot gnu.org

[Bug tree-optimization/94131] [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927 since r10-2814-g22fca489eaf98f26

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94131

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |10.0
      Known to work|                            |9.2.0
             Status|UNCONFIRMED                 |NEW
            Summary|[10 Regression] ICE: tree   |[10 Regression] ICE: tree
                   |check: expected             |check: expected
                   |integer_cst, have plus_expr |integer_cst, have plus_expr
                   |in get_len, at tree.h:5927  |in get_len, at tree.h:5927
                   |                            |since
                   |                            |r10-2814-g22fca489eaf98f26
                 CC|                            |marxin at gcc dot gnu.org
   Last reconfirmed|                            |2020-03-11
     Ever confirmed|0                           |1

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r10-2814-g22fca489eaf98f26.

[Bug tree-optimization/94131] [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927 since r10-2814-g22fca489eaf98f26

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94131

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Slightly adjusted testcase that still ICEs the same way, without warnings:

void
foo (int x)
{
  char a[x];
  int b = (int) (__INTPTR_TYPE__) &a[0];

  __builtin_memset (a, '\0', sizeof (a));
  __builtin_printf ("%s", b ? &a[0] : "");
}

[Bug tree-optimization/94131] [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927 since r10-2814-g22fca489eaf98f26

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94131

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |law at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I see multiple issues:
1)
           if (base
              && DECL_P (base)
              && TREE_CODE (TREE_TYPE (base)) == ARRAY_TYPE
              && TYPE_SIZE_UNIT (TREE_TYPE (base))
              && poff.is_constant (&off))
            {
              tree basetype = TREE_TYPE (base);
              tree size = TYPE_SIZE_UNIT (basetype);
              ++off;   /* Increment for the terminating nul.  */
              pdata->maxlen = fold_build2 (MINUS_EXPR, size_type_node, size,
                                           build_int_cst (size_type_node,
off));
              pdata->maxbound = pdata->maxlen;
            }
One can't use TYPE_SIZE_UNIT this way during GIMPLE passes.  Gimplification
(gimplify_type_sizes) will create when needed temporary VAR_DECLs for the
sizes and during gimplification they are valid:
  char[0:D.1936] * a.1;
  char a[0:D.1936] [value-expr: *a.1];
...
      x.0 = x;
      _1 = (long int) x.0;
      _2 = _1 + -1;
      D.1936 = (sizetype) _2;
...
      a.1 = __builtin_alloca_with_align (D.1940, 8);
      _12 = &(*a.1)[0];
(and could be used the way the pass wants assuming the use is added somewhere
dominated by the setting of the var) but in the actual IL nothing actually
ensures those variables aren't optimized away as unused later on; typically
they'll be around only during -O0 or with -g if lucky they might have debug
statements for them:
  # DEBUG D#2 => (long int) x_1(D)
  # DEBUG D#1 => D#2 + -1
  # DEBUG D.1936 => (sizetype) D#1
but it isn't something that can be actually used in the IL for anything.  What
you could is track down the __builtin_alloca_with_align call that allocates the
memory for the array and derive something from the argument it is called with,
that is the actual byte size of the object.

2) another thing is as clearly maxlen and maxbound can be non-INTEGER_CSTs
(minlen is probably ok), then the code can't pass it to tree_int_cst_lt and
similar; there is one TREE_CODE (pdata->maxbound) != INTEGER_CST but no similar
checks

3) and the last one is that exactly for that TREE_CODE (pdata->maxbound) !=
INTEGER_CST case, IMNSHO the function needs to punt if the trees aren't say
operand_equal_p, if we have in a PHI "abcdef" and a VLA (or vice versa), unless
we'd have a SSA_NAME + const and VRP would tell us something, I'm afraid we
can't determine which of those two will be longer at runtime

[Bug tree-optimization/94131] [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927 since r10-2814-g22fca489eaf98f26

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94131

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Keywords|ice-on-invalid-code         |ice-on-valid-code
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
The code looks valid to me.  It may be undefined because of the missing
initialization but with the VLA initialized the ICE is still there because the
function isn't prepared to deal with the VLA's non-constant bound.

[Bug tree-optimization/94131] [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927 since r10-2814-g22fca489eaf98f26

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94131

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch

--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2020-March/542190.html

[Bug tree-optimization/94131] [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927 since r10-2814-g22fca489eaf98f26

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94131

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jeff Law <law@gcc.gnu.org>:

https://gcc.gnu.org/g:05c13c439903eb78f109bcab62fd9a74f03a3c9b

commit r10-7378-g05c13c439903eb78f109bcab62fd9a74f03a3c9b
Author: Martin Sebor <msebor@redhat.com>
Date:   Wed Mar 25 09:39:50 2020 -0600

    PR tree-optimization/94131 - ICE on printf with a VLA string and
-fno-tree-ccp

    gcc/testsuite/ChangeLog:

            PR tree-optimization/94131
            * gcc.dg/pr94131.c: New test.

    gcc/ChangeLog:

            PR tree-optimization/94131
            * gimple-fold.c (get_range_strlen_tree): Fail for variable-length
            types and decls.
            * tree-ssa-strlen.c (get_range_strlen_dynamic): Avoid assuming
            types have constant sizes.

[Bug tree-optimization/94131] [10 Regression] ICE: tree check: expected integer_cst, have plus_expr in get_len, at tree.h:5927 since r10-2814-g22fca489eaf98f26

[law at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94131

Jeffrey A. Law <law at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
                 CC|                            |law at redhat dot com
         Resolution|---                         |FIXED

--- Comment #7 from Jeffrey A. Law <law at redhat dot com> ---
Fixed on the trunk.