[Bug c/96235] New: Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[Bug c/96235] New: Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[suochenyao at 163 dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

            Bug ID: 96235
           Summary: Segmentation fault with "-Og -fno-dce -fno-tree-dce
                    -finline-small-functions -fipa-sra"
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: suochenyao at 163 dot com
  Target Milestone: ---

Hi,

I've got a problem when using gcc new trunk version. I compile the following
source code with "-Og -fno-dce -fno-tree-dce -finline-small-functions
-fipa-sra" on x86_64 GNU/Linux. It reports "Segmentation fault (core dumped)".
If I using "gcc -O2 -Wall -Wextra", it will only say "variable ‘g’ set but not
used". But with only optimization level, the problem will not occur. And if I
reduce any one of "-fno-dce -fno-tree-dce -finline-small-functions -fipa-sra",
this problem will not occur as well.
Looking forward to your reply, Thanks!

$ gcc --version
$ gcc (GCC) 11.0.0 20200717 (experimental)
$ 
$ gcc -O2  -Wall -Wextra -fno-strict-aliasing -fwrapv a.c
a.c: In function ‘e’:
a.c:5:7: warning: variable ‘g’ set but not used [-Wunused-but-set-variable]
    5 |   int g = (b >= *f);
      |       ^
$
$ gcc -Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra a.c;
./a.out
Segmentation fault (core dumped)
$ 
$ gcc -O0 a.c; ./a.out
$ gcc -O1 a.c; ./a.out
$ gcc -O2 a.c; ./a.out
$ gcc -O3 a.c; ./a.out
$ gcc -Og a.c; ./a.out
$ gcc -Os a.c; ./a.out
$ 
$ gcc -O1 -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra a.c;
./a.out
$ gcc -O2 -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra a.c;
./a.out
$ gcc -O3 -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra a.c;
./a.out
$ gcc -Os -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra a.c;
./a.out
$ gcc -Og -fno-tree-dce -finline-small-functions -fipa-sra a.c; ./a.out
$ gcc -Og -fno-dce -finline-small-functions -fipa-sra a.c; ./a.out
$ gcc -Og -fno-dce -fno-tree-dce -fipa-sra a.c; ./a.out
$ gcc -Og -fno-dce -fno-tree-dce -finline-small-functions a.c; ./a.out
$
-------------------------------
int b=1;
long d=1L;
long c=1L;
static int e(long *f) {
  int g = (b >= *f);
  g = (d && c);
  return 0;
}
int main() {
  long a=1L;
  e(&a);
  return 0;
}

[Bug ipa/96235] Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
I cannot reproduce this.

[Bug ipa/96235] Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[josephcsible at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

Joseph C. Sible <josephcsible at gmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |josephcsible at gmail dot com

--- Comment #2 from Joseph C. Sible <josephcsible at gmail dot com> ---
I can reproduce it on godbolt ("Program returned: 139"):
https://godbolt.org/z/c7eYzx

Here's the assembly output:

main:
        movslq  b(%rip), %rax
        cmpq    0, %rax
        cmpq    $0, d(%rip)
        movl    $0, %eax
        ret
c:
        .quad   1
d:
        .quad   1
b:
        .long   1

The problem is that "cmpq    0, %rax" tries to read memory at address 0.

[Bug ipa/96235] Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |marxin at gcc dot gnu.org
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2020-07-23
             Status|UNCONFIRMED                 |ASSIGNED

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed, working on that. Unfortunately it started with
r10-3542-g0b92cf305dcf3438.

[Bug ipa/96235] Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |NEW
           Assignee|marxin at gcc dot gnu.org          |unassigned at gcc dot gnu.org
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
It seems to me something related to IPA SRA.
@Martin: Can you please take a look?

[Bug ipa/96235] Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Summary for node e/3:
  Returns value
  Descriptor for parameter 0:
    (locally) unused
    param_size_limit: 16, size_reached: 8, by_ref
    * Access to unit offset: 0, unit size: 8, type: long int, alias_ptr_type:
long int *, certain

========== IPA-SRA decisions ==========

Evaluating analysis results for e/3
  Will remove return value.
  Will remove parameter 0

[Bug ipa/96235] Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

--- Comment #6 from Martin Jambor <jamborm at gcc dot gnu.org> ---
(In reply to Martin Liška from comment #4)
> It seems to me something related to IPA SRA.
> @Martin: Can you please take a look?

I will but -fno-dce -fno-tree-dce strongly suggest this is a duplicate of PR
93385.

[Bug ipa/96235] Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=93385

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Martin Jambor from comment #6)
> (In reply to Martin Liška from comment #4)
> > It seems to me something related to IPA SRA.
> > @Martin: Can you please take a look?
> 
> I will but -fno-dce -fno-tree-dce strongly suggest this is a duplicate of PR
> 93385.

Thank you.

[Bug ipa/96235] Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |DUPLICATE
             Status|NEW                         |RESOLVED

--- Comment #8 from Martin Jambor <jamborm at gcc dot gnu.org> ---
It is clearly a duplicate of PR 93385.

What was the reason to switch off DCE in the first place?  Was it just meant as
a stress test for the compiler?

I'll try to come up with somewhat less controversial patch for the problem.

*** This bug has been marked as a duplicate of bug 93385 ***

[Bug ipa/96235] Segmentation fault with "-Og -fno-dce -fno-tree-dce -finline-small-functions -fipa-sra"

[suochenyao at 163 dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=96235

--- Comment #9 from suochenyao at 163 dot com <suochenyao at 163 dot com> ---
(In reply to Martin Jambor from comment #8)
> It is clearly a duplicate of PR 93385.
> 
> What was the reason to switch off DCE in the first place?  Was it just meant
> as a stress test for the compiler?
> 
> I'll try to come up with somewhat less controversial patch for the problem.
> 
> *** This bug has been marked as a duplicate of bug 93385 ***

Ummm, yes, this is just a stress test. And I get many, similar to this case.
Because there is generally no reason to switch off it.