[Bug c++/95768] New: -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[Bug c++/95768] New: -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[slyfox at inbox dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

            Bug ID: 95768
           Summary: -march=sandybridge -O2 -Wall crashes as 'during GIMPLE
                    pass: uninit ... Segmentation fault'
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: slyfox at inbox dot ru
  Target Milestone: ---

SIGSEGV initially observed on qtcore-5.14.2 package.

Here is the minimal(ish) reproducer:

// $ cat bug.cc
extern "C" void *malloc(unsigned long);
class a {
public:
  enum c { Array };
};
class d {
public:
  static int e(int);
};
class f {
public:
  int g;
  void operator=(int) { d::e(g); }
};
template < typename, int, int > using h = f;
template < int i, int j > using k = h< int, i, j >;
template < int i, int j > using l = h< int, i, j >;
class m {
public:
  k< 0, 1 > is_object;
  k< 1, 1 > length;
};
class n {
public:
  m *o() { return (m *)this; }
};
class p {
public:
  enum {} alloc;
  n *header;
  p(a::c) {
    header = (n *)malloc(alloc);
    m b = *header->o();
    b.length = 0;
  }
};
void detach2() { p(a::Array); }

LANG=C /usr/bin/x86_64-pc-linux-gnu-g++ -march=sandybridge -O2 -Wall -c bug.cc
-o bug.o
bug.cc: In constructor 'p::p(a::c)':
bug.cc:32:26: warning: '*<unknown>.p::alloc' is used uninitialized
[-Wuninitialized]
   32 |     header = (n *)malloc(alloc);
      |                          ^~~~~
'
during GIMPLE pass: uninit
In function 'void detach2()':
Segmentation fault
   37 | void detach2() { p(a::Array); }
      |      ^~~~~~~
0xa9c91f crash_signal
        ../../gcc-11.0.0_pre9999/gcc/toplev.c:328
0x7f2dc77d2c3f ???
       
/usr/src/debug/sys-libs/glibc-2.31-r5/glibc-2.31/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0xce7494 location_wrapper_p(tree_node const*)
        ../../gcc-11.0.0_pre9999/gcc/tree.h:3999
0xce7494 tree_strip_any_location_wrapper(tree_node*)
        ../../gcc-11.0.0_pre9999/gcc/tree.h:4011
0xce7494 integer_onep(tree_node const*)
        ../../gcc-11.0.0_pre9999/gcc/tree.c:2573
0x4e0ee3 dump_expr
        ../../gcc-11.0.0_pre9999/gcc/cp/error.c:2386
0x4e3640 expr_to_string(tree_node*)
        ../../gcc-11.0.0_pre9999/gcc/cp/error.c:3109
0x4e3cfc cp_printer
        ../../gcc-11.0.0_pre9999/gcc/cp/error.c:4264
0x13e0646 pp_format(pretty_printer*, text_info*)
        ../../gcc-11.0.0_pre9999/gcc/pretty-print.c:1475
0x13d48e2 diagnostic_report_diagnostic(diagnostic_context*, diagnostic_info*)
        ../../gcc-11.0.0_pre9999/gcc/diagnostic.c:1159
0x13d683a diagnostic_impl
        ../../gcc-11.0.0_pre9999/gcc/diagnostic.c:1309
0x13d683a warning_at(unsigned int, int, char const*, ...)
        ../../gcc-11.0.0_pre9999/gcc/diagnostic.c:1446
0xc5e7ed maybe_warn_operand
        ../../gcc-11.0.0_pre9999/gcc/tree-ssa-uninit.c:418
0xc619e9 warn_uninitialized_vars
        ../../gcc-11.0.0_pre9999/gcc/tree-ssa-uninit.c:640
0xc66016 execute
        ../../gcc-11.0.0_pre9999/gcc/tree-ssa-uninit.c:2936
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://bugs.gentoo.org/> for instructions.

[Bug c++/95768] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[slyfox at inbox dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

--- Comment #1 from Sergei Trofimovich <slyfox at inbox dot ru> ---
On today's gcc master configured as:

$ ~/dev/git/gcc-native-quick/gcc/xg++
-B/home/slyfox/dev/git/gcc-native-quick/gcc/ -v # -march=sandybridge -O2 -Wall
-c bug.cc -o bug.o -
Reading specs from /home/slyfox/dev/git/gcc-native-quick/gcc/specs
COLLECT_GCC=/home/slyfox/dev/git/gcc-native-quick/gcc/xg++
COLLECT_LTO_WRAPPER=/home/slyfox/dev/git/gcc-native-quick/gcc/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc/configure --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--enable-languages=c,c++ --disable-bootstrap --with-multilib-list=m64
--prefix=/home/slyfox/dev/git/gcc-native-quick/../gcc-native-quick-installed
--disable-nls --without-isl --disable-libsanitizer --disable-libvtv
--disable-libgomp --disable-libstdcxx-pch --disable-libunwind-exceptions
CFLAGS='-O1 ' CXXFLAGS='-O1 ' --with-sysroot=/usr/x86_64-HEAD-linux-gnu
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 11.0.0 20200619 (experimental) (GCC)

crash is reproducible:

$ ~/dev/git/gcc-native-quick/gcc/xg++
-B/home/slyfox/dev/git/gcc-native-quick/gcc/ -march=sandybridge -O2 -Wall -c
bug.cc -o bug.o
bug.cc: In constructor 'p::p(a::c)':
bug.cc:32:26: warning: '*<unknown>.p::alloc' is used uninitialized
[-Wuninitialized]
   32 |     header = (n *)malloc(alloc);
      |                          ^~~~~
'
during GIMPLE pass: uninit
In function 'void s()':
Segmentation fault
   37 | void s() { p(a::q); }
      |      ^
0x7f7b2395dc3f ???
       
/usr/src/debug/sys-libs/glibc-2.31-r5/glibc-2.31/signal/../sysdeps/unix/sysv/linux/x86_64/sigaction.c:0
0x7f7b23948d49 __libc_start_main
        ../csu/libc-start.c:308
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug c++/95768] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[hjl.tools at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

H.J. Lu <hjl.tools at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.0
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
                 CC|                            |msebor at gcc dot gnu.org
   Last reconfirmed|                            |2020-06-19

--- Comment #2 from H.J. Lu <hjl.tools at gmail dot com> ---
It is caused by r11-959

[Bug tree-optimization/95768] [11 Regression] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-valid-code
          Component|c++                         |tree-optimization
           Priority|P3                          |P1

[Bug c++/95768] [11 Regression] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org
          Component|tree-optimization           |c++

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
This is the same case of the pretty printer not handling an expression as
pr95580, except this one is in the C++ front end (the code is duplicated almost
verbatim between the two).  tree-ssa-uninit.c calls:

      if (warning_at (location, OPT_Wuninitialized,
                      "%G%qE is used uninitialized", stmt, rhs))

with this STMT and its RHS:

  b$4$g_7 = MEM <int> [(const struct m &)_6 + 4];

expr_to_string() in cp/error.c then does this with the RHS:

    case MEM_REF:
      if (TREE_CODE (TREE_OPERAND (t, 0)) == ADDR_EXPR
          && integer_zerop (TREE_OPERAND (t, 1)))
        dump_expr (pp, TREE_OPERAND (TREE_OPERAND (t, 0), 0), flags);
      else
        {
          pp_cxx_star (pp);
          if (!integer_zerop (TREE_OPERAND (t, 1)))
            {
              pp_cxx_left_paren (pp);
              if (!integer_onep (TYPE_SIZE_UNIT
                                 (TREE_TYPE (TREE_TYPE (TREE_OPERAND (t,
0))))))

but because the MEM_REF first operand is not a ADDR_EXPR the else branch trips
the ICE in integer_zerop() because because the RHS type is void* whose
TYPE_SIZE_UNIT is null that integer_zerop() is not prepared to handle.

[Bug c++/95768] [11 Regression] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=95580

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
In fact, the same test case as for pr95580 triggers the C++ ICE as well:

$ gcc -O1 -S -Wall -fno-tree-dce -xc++
/src/gcc/trunk/gcc/testsuite/gcc.dg/pr95580.c
‘
during GIMPLE pass: uninit
In function ‘void foo(int)’:
Segmentation fault
    8 | foo (int x)
      | ^~~
0x15c3040 crash_signal
        /src/gcc/trunk/gcc/toplev.c:328
0x9559fc location_wrapper_p(tree_node const*)
        /src/gcc/trunk/gcc/tree.h:4004
0x955a79 tree_strip_any_location_wrapper(tree_node*)
        /src/gcc/trunk/gcc/tree.h:4016
0x1a04ede integer_onep(tree_node const*)
        /src/gcc/trunk/gcc/tree.c:2573
0xa9878e dump_expr
        /src/gcc/trunk/gcc/cp/error.c:2386
0xa9b4f4 expr_to_string(tree_node*)
        /src/gcc/trunk/gcc/cp/error.c:3109
0xa9f1e7 cp_printer
        /src/gcc/trunk/gcc/cp/error.c:4264
0x270616b pp_format(pretty_printer*, text_info*)
        /src/gcc/trunk/gcc/pretty-print.c:1475
0x26df21d diagnostic_report_diagnostic(diagnostic_context*, diagnostic_info*)
        /src/gcc/trunk/gcc/diagnostic.c:1159
0x26df841 diagnostic_impl
        /src/gcc/trunk/gcc/diagnostic.c:1309
0x26e00bd warning_at(unsigned int, int, char const*, ...)
        /src/gcc/trunk/gcc/diagnostic.c:1446
0x1915da3 maybe_warn_operand
        /src/gcc/trunk/gcc/tree-ssa-uninit.c:431
0x1916782 warn_uninitialized_vars
        /src/gcc/trunk/gcc/tree-ssa-uninit.c:640
0x191b3e7 execute
        /src/gcc/trunk/gcc/tree-ssa-uninit.c:2936
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug c++/95768] [11 Regression] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch

--- Comment #5 from Martin Sebor <msebor at gcc dot gnu.org> ---
Patch: https://gcc.gnu.org/pipermail/gcc-patches/2020-June/548683.html

[Bug c++/95768] [11 Regression] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Martin Sebor from comment #5)
> Patch: https://gcc.gnu.org/pipermail/gcc-patches/2020-June/548683.html

Am I right that the patch is stuck in the mailing list?

[Bug c++/95768] [11 Regression] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

--- Comment #7 from Martin Sebor <msebor at gcc dot gnu.org> ---
Sort of.  Richard has some objections that we never resolved but  but I'm still
planning to dust it off and resubmit it in some form for GCC 11 with the
corresponding C front end changes.

[Bug c++/95768] [11 Regression] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

--- Comment #8 from Martin Sebor <msebor at gcc dot gnu.org> ---
Updated patch:
https://gcc.gnu.org/pipermail/gcc-patches/2021-January/562665.html

[Bug c++/95768] [11 Regression] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:abb1b6058c09a7c0430d9bf019466ada07ca7b40

commit r11-6508-gabb1b6058c09a7c0430d9bf019466ada07ca7b40
Author: Martin Sebor <msebor@redhat.com>
Date:   Wed Jan 6 13:44:27 2021 -0700

    PR c++/95768 - pretty-printer ICE on -Wuninitialized with allocated storage

    gcc/c-family/ChangeLog:

            PR c++/95768
            * c-pretty-print.c (c_pretty_printer::primary_expression): For
            SSA_NAMEs print VLA names and GIMPLE defining statements.
            (print_mem_ref): New function.
            (c_pretty_printer::unary_expression): Call it.

    gcc/cp/ChangeLog:

            PR c++/95768
            * error.c (dump_expr): Call c_pretty_printer::unary_expression.

    gcc/testsuite/ChangeLog:

            PR c++/95768
            * g++.dg/pr95768.C: New test.
            * g++.dg/warn/Wuninitialized-12.C: New test.
            * gcc.dg/uninit-38.c: New test.

[Bug c++/95768] [11 Regression] -march=sandybridge -O2 -Wall crashes as 'during GIMPLE pass: uninit ... Segmentation fault'

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=95768

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #10 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fix committed in r11-6508.