[Bug tree-optimization/97488] New: [11 Regression] ICE: Segmentation fault (in wi::set_bit_large)

[Bug tree-optimization/97488] New: [11 Regression] ICE: Segmentation fault (in wi::set_bit_large)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97488

            Bug ID: 97488
           Summary: [11 Regression] ICE: Segmentation fault (in
                    wi::set_bit_large)
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Keywords: ice-on-invalid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
                CC: aldyh at gcc dot gnu.org
  Target Milestone: ---
            Target: x86_64-pc-linux-gnu

gcc-11.0.0-alpha20201018 snapshot (g:1e70b1a358b6ce3b894f284d88fbb90518d45cc0)
ICEs when compiling the following testcase w/ -O1 -ftree-vrp:

__int128
ef (__int128 ms)
{
  int dh = 129;
  int *hj = &dh;

  return ms << *hj ? ms : 0;
}

% x86_64-pc-linux-gnu-gcc-11.0.0 -O1 -ftree-vrp -c byj7y5ib.c
during GIMPLE pass: evrp
byj7y5ib.c: In function 'ef':
byj7y5ib.c:8:1: internal compiler error: Segmentation fault
    8 | }
      | ^
0xdbbd3f crash_signal
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201018/work/gcc-11-20201018/gcc/toplev.c:330
0x10f9d4d wi::set_bit_large(long*, long const*, unsigned int, unsigned int,
unsigned int)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201018/work/gcc-11-20201018/gcc/wide-int.cc:699
0x1834acf wi::binary_traits<generic_wide_int<wide_int_storage>,
generic_wide_int<wide_int_storage>,
wi::int_traits<generic_wide_int<wide_int_storage> >::precision_type,
wi::int_traits<generic_wide_int<wide_int_storage>
>::precision_type>::result_type wi::set_bit<generic_wide_int<wide_int_storage>
>(generic_wide_int<wide_int_storage> const&, unsigned int)
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201018/work/gcc-11-20201018/gcc/wide-int.h:2246
0x1834acf operator_lshift::op1_range(irange&, tree_node*, irange const&, irange
const&) const
       
/var/tmp/portage/sys-devel/gcc-11.0.0_alpha20201018/work/gcc-11-20201018/gcc/range-op.cc:1610

[Bug tree-optimization/97488] [11 Regression] ICE: Segmentation fault (in wi::set_bit_large)

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97488

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2020-10-19
     Ever confirmed|0                           |1

--- Comment #1 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Confirmed.

The shift amount in operator_lshift::op1_range is > than the precision of the
type so the low_bits wrap around.

Testing the following:

diff --git a/gcc/range-op.cc b/gcc/range-op.cc
index 30d2a4d3987..13a0ee37feb 100644
--- a/gcc/range-op.cc
+++ b/gcc/range-op.cc
@@ -1608,8 +1608,10 @@ operator_lshift::op1_range (irange &r,
       // This would be [0x42, 0xFC] aka [01000010, 11111100].

       // Ideally we do this for each subrange, but just lump them all for now.
-      unsigned low_bits = TYPE_PRECISION (utype)
-                         - TREE_INT_CST_LOW (shift_amount);
+      unsigned saturated_shift_amount = TREE_INT_CST_LOW (shift_amount);
+      if (saturated_shift_amount > TYPE_PRECISION (utype))
+       saturated_shift_amount = TYPE_PRECISION (utype);
+      unsigned low_bits = TYPE_PRECISION (utype) - saturated_shift_amount;
       wide_int up_mask = wi::mask (low_bits, true, TYPE_PRECISION (utype));
       wide_int new_ub = wi::bit_or (up_mask, r.upper_bound ());
       wide_int new_lb = wi::set_bit (r.lower_bound (), low_bits);

[Bug tree-optimization/97488] [11 Regression] ICE: Segmentation fault (in wi::set_bit_large)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97488

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Aldy Hernandez <aldyh@gcc.gnu.org>:

https://gcc.gnu.org/g:2d2f4ffc97a8510e72a99ee106159aeae2627a42

commit r11-4070-g2d2f4ffc97a8510e72a99ee106159aeae2627a42
Author: Aldy Hernandez <aldyh@redhat.com>
Date:   Mon Oct 19 06:18:46 2020 -0400

    Gracefully handle right shifts larger than the precision.

    gcc/ChangeLog:

            PR tree-optimization/97488
            * range-op.cc (operator_lshift::op1_range): Handle large right
shifts.

    gcc/testsuite/ChangeLog:

            * gcc.dg/pr97488.c: New test.

[Bug tree-optimization/97488] [11 Regression] ICE: Segmentation fault (in wi::set_bit_large)

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97488

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|NEW                         |RESOLVED

--- Comment #3 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
fixed

[Bug tree-optimization/97488] [11 Regression] ICE: Segmentation fault (in wi::set_bit_large)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97488

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|ice-on-invalid-code         |ice-on-valid-code
   Target Milestone|---                         |11.0