[Bug lto/94822] New: ICE in lto with option -Warray-bounds and -fno-use-linker-plugin

[Bug lto/94822] New: ICE in lto with option -Warray-bounds and -fno-use-linker-plugin

[lizekun1 at huawei dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94822

            Bug ID: 94822
           Summary: ICE in lto with option -Warray-bounds and
                    -fno-use-linker-plugin
           Product: gcc
           Version: 10.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: lto
          Assignee: unassigned at gcc dot gnu.org
          Reporter: lizekun1 at huawei dot com
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---

Created attachment 48393
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=48393&action=edit
gcc10-lto-constructor-array-bounds.patch

Hi,
  I find an ICE when testing GCC10.0 on aarch64 at '-O3 -flto
-fno-use-linker-plugin -Warray-bounds' with POCs below:

test.h
---

typedef struct {
  int i;
  int ints[];
} struct_t;

---

test0.c
---

/* { dg-lto-do link } */

#include "test.h"

extern struct_t my_struct;

int main() {
return my_struct.ints[1];
}

---

test1.c
---

#include "test.h"

struct_t my_struct = {
20,
{ 1, 2 }
};

---

GCC version:
gcc version 10.0.1 20200421 (experimental)

Runcommand:
gcc -O3 -flto -fno-use-linker-plugin -Warray-bounds -c -o test0.o test0.c
gcc -O3 -flto -fno-use-linker-plugin -Warray-bounds -c -o test1.o test1.c
gcc test0.o test1.o -flto -Warray-bounds -fno-use-linker-plugin -o test.exe

Stack dump:
during GIMPLE pass: vrp
test0.c: In function 'main':
test0.c:7:5: internal compiler error: tree check: expected constructor, have
error_mark in get_initializer_for, at tree.c:13565
    7 | int main() {
      |     ^
0x15d8fc7 tree_check_failed(tree_node const*, char const*, int, char const*,
...)
        /home/lzk /gcc-10.0/gcc/tree.c:9685
0x9b0a37 tree_check(tree_node*, char const*, int, char const*, tree_code)
        /home/lzk /gcc-10.0/gcc/tree.h:3278
0x15eafdf get_initializer_for
        /home/lzk gcc-10.0/gcc/tree.c:13565
0x15eb73f component_ref_size(tree_node*, bool*)
        /home/lzk/ gcc-10.0/gcc/tree.c:13678
0x15a2037 vrp_prop::check_array_ref(unsigned int, tree_node*, bool)
        /home/lzk/gcc-10.0/gcc/tree-vrp.c:3525
0x15a46c3 check_array_bounds
        /home/lzk /gcc-10.0/gcc/tree-vrp.c:4062
0x15e3cc3 walk_tree_1(tree_node**, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*,
tree_node* (*)(tree_node**, int*, tree_node* (*)(tree_node**, int*, void*),
void*, hash_set<tree_node*, false, default_hash_traits<tree_node*> >*))
        /home/lzk/gcc-10.0/gcc/tree.c:11954
0xd2cd37 walk_gimple_op(gimple*, tree_node* (*)(tree_node**, int*, void*),
walk_stmt_info*)
        /home/lzk/gcc-10.0/gcc/gimple-walk.c:202
0x15a485b check_array_bounds_dom_walker::before_dom_children(basic_block_def*)
        /home/lzk/gcc-10.0/gcc/tree-vrp.c:4120
0x1f8c863 dom_walker::walk(basic_block_def*)
        /home/lzk/gcc-10.0/gcc/domwalk.c:309
0x15a48b7 vrp_prop::check_all_array_refs()
        /home/lzk/gcc-10.0/gcc/tree-vrp.c:4137
0x15a805f vrp_prop::vrp_finalize(bool)
        /home/lzk/gcc-10.0/gcc/tree-vrp.c:5209
0x15a80cb execute_vrp
        /home/lzk/gcc-10.0/gcc/tree-vrp.c:5277
0x15a82fb execute
        /home/lzk/gcc-10.0/gcc/tree-vrp.c:5359

This ICE appears because gcc will stream it to the function_body section when
processing the variable with the initial value of the constructor type, and the
error_mark_node to the decls section. When recompiling, the value obtained with
DECL_INITIAL will be error_mark.

My proposed fix is:
---
diff --git a/gcc/tree.c b/gcc/tree.c
index 63dc6730b2b..385c22e667f 100644
--- a/gcc/tree.c
+++ b/gcc/tree.c
@@ -13719,6 +13719,13 @@ component_ref_size (tree ref, bool *inte
        the initializer of the BASE object if it has one.  */
     if (tree init = DECL_P (base) ? DECL_INITIAL (base) : NULL_TREE)
       {
+       varpool_node *vnode;
+       if (TREE_CODE (init) == ERROR_MARK
+           && in_lto_p
+           && VAR_P (base)
+           && (vnode = varpool_node::get (base)
+               ? varpool_node::get (base)->ultimate_alias_target () : NULL))
+         init = vnode->get_constructor ();
        init = get_initializer_for (init, member);
        if (init)
          {

---
any suggestion?

[Bug lto/94822] [10 Regression] ICE in lto with option -Warray-bounds and -fno-use-linker-plugin since r10-4300-g49fb45c81f4ac068

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94822

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |10.0
            Summary|ICE in lto with option      |[10 Regression] ICE in lto
                   |-Warray-bounds and          |with option -Warray-bounds
                   |-fno-use-linker-plugin      |and -fno-use-linker-plugin
                   |                            |since
                   |                            |r10-4300-g49fb45c81f4ac068
   Last reconfirmed|                            |2020-04-28
   Target Milestone|---                         |10.0
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
      Known to work|                            |9.3.0
           Keywords|                            |ice-on-valid-code
                 CC|                            |hubicka at gcc dot gnu.org,
                   |                            |msebor at gcc dot gnu.org

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r10-4300-g49fb45c81f4ac068.

[Bug lto/94822] [10 Regression] ICE in lto with option -Warray-bounds and -fno-use-linker-plugin since r10-4300-g49fb45c81f4ac068

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94822

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug lto/94822] [10 Regression] ICE in lto with option -Warray-bounds and -fno-use-linker-plugin since r10-4300-g49fb45c81f4ac068

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94822

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:e6e616074f02b81c397a2848ab242b54ef21efbc

commit r10-8043-ge6e616074f02b81c397a2848ab242b54ef21efbc
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Apr 29 12:21:23 2020 +0200

    lto/94822 - fix ICE in component_ref_size

    This ICE appears because gcc will stream it to the function_body section
    when processing the variable with the initial value of the constructor
    type, and the error_mark_node to the decls section.
    When recompiling, the value obtained with DECL_INITIAL will be error_mark.

    2020-04-29  Richard Biener  <rguenther@suse.de>
                Li Zekun  <lizekun1@huawei.com>

            PR lto/94822
            * tree.c (component_ref_size): Guard against error_mark_node
            DECL_INITIAL as it happens with LTO.

            * gcc.dg/lto/pr94822_0.c: New testcase.
            * gcc.dg/lto/pr94822_1.c: Alternate file.
            * gcc.dg/lto/pr94822.h: Likewise.

[Bug lto/94822] [10 Regression] ICE in lto with option -Warray-bounds and -fno-use-linker-plugin since r10-4300-g49fb45c81f4ac068

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=94822

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.