[Bug c++/97268] New: Segfault on 11.0.0 20200930

[Bug c++/97268] New: Segfault on 11.0.0 20200930

[ext-gcc at burakarslan dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97268

            Bug ID: 97268
           Summary: Segfault on 11.0.0 20200930
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: ext-gcc at burakarslan dot com
  Target Milestone: ---

Created attachment 49297
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49297&action=edit
testcase

The following code seems to crash on gcc HEAD:
https://wandbox.org/permlink/O9ZzBf1aG9tTwTAl

It also doesn't compile with gcc 9.x or 10.x while clang 10 seems to have no
problems for reasons unknown to me.

Output:

```
during GIMPLE pass: *early_warn_uninitialized
prog.cc: In constructor 'BetterObject<CACHED>::BetterObject(const char*, int,
Handle&) [with bool CACHED = true]':
prog.cc:63:1: internal compiler error: Segmentation fault
   63 | }
      | ^
0xc2495f crash_signal
        ../../source/gcc/toplev.c:329
0xceb9ba ao_ref_init_from_ptr_and_size(ao_ref*, tree_node*, tree_node*)
        ../../source/gcc/tree-ssa-alias.c:747
0xde0352 maybe_warn_pass_by_reference
        ../../source/gcc/tree-ssa-uninit.c:529
0xde0352 warn_uninitialized_vars
        ../../source/gcc/tree-ssa-uninit.c:643
0xde0660 execute_early_warn_uninitialized
        ../../source/gcc/tree-ssa-uninit.c:3018
0xde0660 execute
        ../../source/gcc/tree-ssa-uninit.c:3053
```

[Bug c++/97268] Segfault on 11.0.0 20200930

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97268

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |WAITING
   Last reconfirmed|                            |2020-10-02
     Ever confirmed|0                           |1

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10 says

t.C: In instantiation of 'BetterObject<CACHED>::BetterObject(const char*, int,
Handle&) [with bool CACHED = true]':
t.C:61:31:   required from here
t.C:53:45: error: use of deleted function 'Handle::Handle(const Handle&)'
   53 |             , BetterObjectBase(lc_, ln_, env) {}
      |                                             ^
t.C:9:5: note: declared here
    9 |     Handle(const Handle &) = delete;
      |     ^~~~~~

and GCC 11 doesn't crash for me, but you didn't tell us the exact compile
options or the target you are using.  So GCC 11 accepts the testcase for me.

[Bug c++/97268] Segfault on 11.0.0 20200930

[ext-gcc at burakarslan dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97268

--- Comment #2 from Burak Arslan <ext-gcc at burakarslan dot com> ---

Sorry about that. Here is the cmdline: 

g++ prog.cc -Wall -Wextra -std=gnu++2a

[Bug c++/97268] Segfault on 11.0.0 20200930

[ext-gcc at burakarslan dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97268

--- Comment #3 from Burak Arslan <ext-gcc at burakarslan dot com> ---

Sorry about that. Here is the cmdline: 

g++ prog.cc -Wall -Wextra -std=gnu++2a

[Bug c++/97268] 11 Regression] Segfault on 11.0.0 20200930

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97268

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |11.0
             Status|WAITING                     |NEW
            Summary|Segfault on 11.0.0 20200930 |11 Regression] Segfault on
                   |                            |11.0.0 20200930
                 CC|                            |msebor at gcc dot gnu.org

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
OK, confirmed.  It's -Wextra that triggers the following for me:

during GIMPLE pass: *early_warn_uninitialized
t.C: In constructor 'BetterObject<CACHED>::BetterObject(const char*, int,
Handle&) [with bool CACHED = true]':
t.C:63:1: internal compiler error: in gimple_call_arg, at gimple.h:3256
   63 | }
      | ^
0x1a61d17 gimple_call_arg
        /home/rguenther/src/gcc3/gcc/gimple.h:3256
0x1a61d6d gimple_call_arg
        /home/rguenther/src/gcc3/gcc/gimple.h:3264
0x1a63c4d maybe_warn_pass_by_reference
        /home/rguenther/src/gcc3/gcc/tree-ssa-uninit.c:526
0x1a6434d warn_uninitialized_vars
        /home/rguenther/src/gcc3/gcc/tree-ssa-uninit.c:643
0x1a693d9 execute_early_warn_uninitialized
        /home/rguenther/src/gcc3/gcc/tree-ssa-uninit.c:3018
0x1a6944c execute
        /home/rguenther/src/gcc3/gcc/tree-ssa-uninit.c:3053
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

where on a stmt

Object<true>::Object (_2, _3);

we try to access argument 3.  Not sure how readwrite attributes ended up there,
I see them on some libstdc++ functions only.  Maybe some bad sharing
of function type trees?

CCing Martin.

[Bug c++/97268] [11 Regression] ICE in maybe_warn_pass_by_reference at gcc/tree-ssa-uninit.c:514 since r11-1763-g27aebb7d6cf14175

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97268

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |10.2.0
            Summary|[11 Regression] Segfault on |[11 Regression] ICE in
                   |11.0.0 20200930             |maybe_warn_pass_by_referenc
                   |                            |e at
                   |                            |gcc/tree-ssa-uninit.c:514
                   |                            |since
                   |                            |r11-1763-g27aebb7d6cf14175
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |nathan at gcc dot gnu.org
      Known to fail|                            |11.0

--- Comment #5 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with Nathan's commit.

[Bug c++/97268] [11 Regression] ICE in maybe_warn_pass_by_reference at gcc/tree-ssa-uninit.c:514 since r11-1763-g27aebb7d6cf14175

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97268

--- Comment #6 from Martin Liška <marxin at gcc dot gnu.org> ---
(In reply to Martin Liška from comment #5)
> Started with Nathan's commit.

r11-1763-g27aebb7d6cf14175

[Bug c++/97268] [11 Regression] ICE in maybe_warn_pass_by_reference at gcc/tree-ssa-uninit.c:514 since r11-1763-g27aebb7d6cf14175

[nathan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97268

Nathan Sidwell <nathan at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Nathan Sidwell <nathan at gcc dot gnu.org> ---
Fixed r 9340d1c97b8