[Bug c/97175] New: ice in maybe_warn_for_bound, at builtins.c:3483

[Bug c/97175] New: ice in maybe_warn_for_bound, at builtins.c:3483

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

            Bug ID: 97175
           Summary: ice in maybe_warn_for_bound, at builtins.c:3483
           Product: gcc
           Version: unknown
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: dcb314 at hotmail dot com
  Target Milestone: ---

For this C source code:

int a, b;
int *c;
void d() {
  while (a > 0)
    ;
  c = malloc(1);
  strncpy(c, b, a);
}

compiled by recent gcc trunk and compiler flag -O2, does this:

during RTL pass: expand
bug642.c:7:3: internal compiler error: tree check: expected tree that contains
‘
decl minimal’ structure, have ‘ssa_name’ in maybe_warn_for_bound, at
builtins.c:
3483
0xfb13c0 tree_contains_struct_check_failed(tree_node const*,
tree_node_structure
_enum, char const*, int, char const*)
        ../../trunk.git/gcc/tree.c:9902
0x74e77b contains_struct_check(tree_node*, tree_node_structure_enum, char
const*
, int, char const*)
        ../../trunk.git/gcc/tree.h:3413
0x74e77b maybe_warn_for_bound(int, unsigned int, tree_node*, tree_node*,
tree_no
de**, tree_node*, access_data const*)
        ../../trunk.git/gcc/builtins.c:3483
0x74d796 check_access(tree_node*, tree_node*, tree_node*, tree_node*,
tree_node*
, access_mode, access_data const*)

The bug first seems to occur sometime between 20200827 and 20200829.

[Bug tree-optimization/97175] [11 Regression] ICE in maybe_warn_for_bound, at builtins.c:3483 since r11-2928-gd14c547abd484d35

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org
      Known to fail|                            |11.0
            Summary|ice in                      |[11 Regression] ICE in
                   |maybe_warn_for_bound, at    |maybe_warn_for_bound, at
                   |builtins.c:3483             |builtins.c:3483 since
                   |                            |r11-2928-gd14c547abd484d35
             Status|UNCONFIRMED                 |NEW
          Component|c                           |tree-optimization
   Target Milestone|---                         |11.0
   Last reconfirmed|                            |2020-09-23
      Known to work|                            |10.2.0

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r11-2928-gd14c547abd484d35.

[Bug middle-end/97175] [11 Regression] ICE in maybe_warn_for_bound, at builtins.c:3483 since r11-2928-gd14c547abd484d35

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
          Component|tree-optimization           |middle-end
           Keywords|diagnostic                  |ice-on-invalid-code

[Bug middle-end/97175] [11 Regression] ICE in maybe_warn_for_bound, at builtins.c:3483 since r11-2928-gd14c547abd484d35

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:6edc8f5bfe7d9db8fb8bd37bb8086a69850c6c6d

commit r11-3409-g6edc8f5bfe7d9db8fb8bd37bb8086a69850c6c6d
Author: Martin Sebor <msebor@redhat.com>
Date:   Wed Sep 23 15:04:32 2020 -0600

    Handle DECLs and EXPRESSIONs consistently (PR middle-end/97175).

    gcc/ChangeLog:

            PR middle-end/97175
            * builtins.c (maybe_warn_for_bound): Handle both DECLs and
EXPRESSIONs
            in pad->dst.ref, same is pad->src.ref.

    gcc/testsuite/ChangeLog:

            PR middle-end/97175
            * gcc.dg/Wstringop-overflow-44.c: New test.

[Bug middle-end/97175] [11 Regression] ICE in maybe_warn_for_bound, at builtins.c:3483 since r11-2928-gd14c547abd484d35

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org

--- Comment #3 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fixed: https://gcc.gnu.org/pipermail/gcc-patches/2020-September/554653.html

[Bug middle-end/97175] [11 Regression] ICE in maybe_warn_for_bound, at builtins.c:3483 since r11-2928-gd14c547abd484d35

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|ice-on-invalid-code         |ice-on-valid-code

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
The original test case wasn't strictly valid but the same ICE can be reproduced
even with valid code.

[Bug middle-end/97175] [11 Regression] ICE in maybe_warn_for_bound, at builtins.c:3483 since r11-2928-gd14c547abd484d35

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

--- Comment #5 from David Binderman <dcb314 at hotmail dot com> ---
>From the text in the proposed patch:

>Using DECL_SOURCE_LOCATION() with a tree node that's not a DECL
>isn't a good idea, and neither is using EXPR_LOCATION() with
>a node that is a DECL.  Both trigger an ICE when presented with
>a node they don't expect. 

How much work would it be to move this test from run time to compile time ?

So if DECL_SOURCE_LOCATION was given a non-DECL node or
EXPR_LOCATION is given a DECL, then gcc refuses to compile.

Flushing out all the bugs where these macros are misused sounds like
a step in the right direction to me.

[Bug middle-end/97175] [11 Regression] ICE in maybe_warn_for_bound, at builtins.c:3483 since r11-2928-gd14c547abd484d35

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

--- Comment #6 from Martin Sebor <msebor at gcc dot gnu.org> ---
It definitely would be a step in the right direction.  But I'm not sure how
feasible it is to turn any of these tests into compile-time.  They often test
different bits in different structures.  For example, the location macros:

(gdb) info macro DECL_SOURCE_LOCATION
Defined at /src/gcc/master/gcc/tree.h:2437
  included at /src/gcc/master/gcc/builtins.c:30
#define DECL_SOURCE_LOCATION(NODE) (DECL_MINIMAL_CHECK
(NODE)->decl_minimal.locus)
(gdb) info macro EXPR_LOCATION
Defined at /src/gcc/master/gcc/tree.h:1176
  included at /src/gcc/master/gcc/builtins.c:30
#define EXPR_LOCATION(NODE) (CAN_HAVE_LOCATION_P ((NODE)) ? (NODE)->exp.locus :
UNKNOWN_LOCATION)

In GCC, everything is an instance of tree_node (pointed-to by the NODE argument
above), a union of a bunch of different data structures that represent the most
common elements of a program (like a declaration, a type, a constant, etc.). 
Except for a small common subset of leading members the structures have a
different layout, with the same thing (such as a location) sometimes being
represented by different sets of bits.  So decl_minimal.locus is at a different
offset from the beginning of tree_node than exp.locus.  Some of these bits may
even be beyond the end of the union (in sort of a "flexible array member.") 
The only way to tell what is what and where things are is to query bits in the
same position (typically the tree_code enum).

I suspect changing this basic structure would amount to essentially rewriting
the whole compiler.  What might be doable with much less effort, though, is
replacing all (or at least some of) these awful macros with more general inline
functions.  The location macros could be replaced (or supplanted) with:

  inline location_t get_location (cons_tree t)
  {
    if (DECL_P (t))
      return DECL_SOURCE_LOCATION (t);
    if (EXPR_P (t && EXPR_HAS_LOCATION (t))
      return EXPR_LOCATION (t);
    return UNKNOWN_LOCATION;
  }

Some might argue that the function too should abort if t is neither a DECL nor
EXPR.  Others might object that using the function instead of either macro is
wasteful when the caller "knows" that they're working with one or the other. 
But it might be worth at least proposing it.

[Bug middle-end/97175] [11 Regression] ICE in maybe_warn_for_bound, at builtins.c:3483 since r11-2928-gd14c547abd484d35

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

--- Comment #7 from David Binderman <dcb314 at hotmail dot com> ---

Interesting.

$ fgrep DECL_SOURCE_LOCATION `find trunk/gcc -name \*.c -print | fgrep -v
/testsuite/` | wc -l
1002
$ fgrep EXPR_LOCATION `find trunk/gcc -name \*.c -print | fgrep -v /testsuite/`
| wc -l
588

So almost 1,600 edits to change every use of DECL_SOURCE_LOCATION and
EXPR_LOCATION to anything else.

So it looks like some of these awful macros are a lot of work to change.

[Bug middle-end/97175] [11 Regression] ICE in maybe_warn_for_bound, at builtins.c:3483 since r11-2928-gd14c547abd484d35

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97175

--- Comment #8 from Martin Sebor <msebor at gcc dot gnu.org> ---
*** Bug 97190 has been marked as a duplicate of this bug. ***