[Bug tree-optimization/97556] New: ICE at -O2 and -O3 in 32-bit mode on x86_64-pc-linux-gnu in size_remaining, at builtins.c:235

[Bug tree-optimization/97556] New: ICE at -O2 and -O3 in 32-bit mode on x86_64-pc-linux-gnu in size_remaining, at builtins.c:235

[su at cs dot ucdavis.edu]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97556

            Bug ID: 97556
           Summary: ICE at -O2 and -O3 in 32-bit mode on
                    x86_64-pc-linux-gnu in size_remaining, at
                    builtins.c:235
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: su at cs dot ucdavis.edu
  Target Milestone: ---

[520] % gcctk -v
Using built-in specs.
COLLECT_GCC=gcctk
COLLECT_LTO_WRAPPER=/local/suz-local/software/local/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/11.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../gcc-trunk/configure --disable-bootstrap
--prefix=/local/suz-local/software/local/gcc-trunk --enable-languages=c,c++
--disable-werror --enable-multilib --with-system-zlib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.0.0 20201023 (experimental) [master revision
7991e963239:9cbfe237f74:757ba6653c2699761c2243e0194749a6695112d8] (GCC) 
[521] % 
[521] % gcctk -m32 -Os -c small.c
[522] % 
[522] % gcctk -m32 -O2 -c small.c
during GIMPLE pass: strlen
small.c: In function ‘f’:
small.c:4:6: internal compiler error: in size_remaining, at builtins.c:235
    4 | void f () {
      |      ^
0x7a510b
access_ref::size_remaining(generic_wide_int<fixed_wide_int_storage<128> >*)
const
        ../../gcc-trunk/gcc/builtins.c:235
0x7a53d5 access_ref::add_offset(generic_wide_int<fixed_wide_int_storage<128> >
const&, generic_wide_int<fixed_wide_int_storage<128> > const&)
        ../../gcc-trunk/gcc/builtins.c:334
0x7a6bd3 compute_objsize
        ../../gcc-trunk/gcc/builtins.c:4840
0x7a6b63 compute_objsize
        ../../gcc-trunk/gcc/builtins.c:4781
0x7a7de1 compute_objsize(tree_node*, int, access_ref*, range_query*)
        ../../gcc-trunk/gcc/builtins.c:5039
0x7a7f61 compute_objsize(tree_node*, int, tree_node**, tree_node**,
range_query*)
        ../../gcc-trunk/gcc/builtins.c:5063
0xf15fc2 maybe_warn_overflow
        ../../gcc-trunk/gcc/tree-ssa-strlen.c:2042
0xf1a7f8 maybe_warn_overflow
        ../../gcc-trunk/gcc/tree-ssa-strlen.c:2351
0xf1a7f8 handle_store
        ../../gcc-trunk/gcc/tree-ssa-strlen.c:5059
0xf1c744 check_and_optimize_stmt
        ../../gcc-trunk/gcc/tree-ssa-strlen.c:5697
0xf1c744 strlen_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc-trunk/gcc/tree-ssa-strlen.c:5874
0x1729737 dom_walker::walk(basic_block_def*)
        ../../gcc-trunk/gcc/domwalk.c:309
0xf0dd4f printf_strlen_execute
        ../../gcc-trunk/gcc/tree-ssa-strlen.c:5940
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[523] % 
[523] % cat small.c
char a[1][3];
int b;

void f () {
  unsigned c = 1000000000;
  if (b)
    goto L;
  while (b) {
    c = ~0;
  L:
    a[c][0] = 0;
  }
}

[Bug tree-optimization/97556] [11 Regression] ICE at -O2 and -O3 in 32-bit mode on x86_64-pc-linux-gnu in size_remaining, at builtins.c:235 since r11-3827

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97556

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-10-24
             Status|UNCONFIRMED                 |NEW
   Target Milestone|---                         |11.0
                 CC|                            |jakub at gcc dot gnu.org
           Priority|P3                          |P1
     Ever confirmed|0                           |1
            Summary|ICE at -O2 and -O3 in       |[11 Regression] ICE at -O2
                   |32-bit mode on              |and -O3 in 32-bit mode on
                   |x86_64-pc-linux-gnu in      |x86_64-pc-linux-gnu in
                   |size_remaining, at          |size_remaining, at
                   |builtins.c:235              |builtins.c:235 since
                   |                            |r11-3827

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r11-3827-g83685efd5fd1623cfc4e4c435ce2773d95d458d1

[Bug tree-optimization/97556] [11 Regression] ICE at -O2 and -O3 in 32-bit mode on x86_64-pc-linux-gnu in size_remaining, at builtins.c:235 since r11-3827

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97556

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I think the problem is that compute_objsize doesn't bother to check for any
kind of overflow on any arithmetics it does.
E.g. in:
4815              offset_int sz = wi::to_offset (tpsize);
4816              orng[0] *= sz;
4817              orng[1] *= sz;
when orng[0] is 1000000000 and orng[1] is -1 and sz is 3, everything is
multiplied by 3, so we end up with 3000000000 and -3.  Later on the upper bound
is set to
311           offset_int maxoff = wi::to_offset (TYPE_MAX_VALUE
(ptrdiff_type_node));
312           offrng[1] = maxoff;
and size_remaining then asserts something that the computation can't really
guarantee.

Adjusted testcase that ICEs with -O2 -m64 the same way:
char a[1][3];
int b;

void f () {
  unsigned long long c = 7000000000000000000ULL;
  if (b)
    goto L;
  while (b) {
    c = ~0ULL;
  L:
    a[c][0] = 0;
  }
}

[Bug tree-optimization/97556] [11 Regression] ICE at -O2 and -O3 in 32-bit mode on x86_64-pc-linux-gnu in size_remaining, at builtins.c:235 since r11-3827

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97556

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |msebor at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

[Bug tree-optimization/97556] [11 Regression] ICE at -O2 and -O3 in 32-bit mode on x86_64-pc-linux-gnu in size_remaining, at builtins.c:235 since r11-3827

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97556

--- Comment #3 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Sebor <msebor@gcc.gnu.org>:

https://gcc.gnu.org/g:bdf6524bc0bfa0908a7a7c52e799dbecbebaefe8

commit r11-4576-gbdf6524bc0bfa0908a7a7c52e799dbecbebaefe8
Author: Martin Sebor <msebor@redhat.com>
Date:   Fri Oct 30 13:04:29 2020 -0600

    PR middle-end/97556 - ICE on excessively large index into a
multidimensional array

    gcc/ChangeLog:

            PR middle-end/97556
            * builtins.c (access_ref::add_offset): Cap offset lower bound
            to at most the the upper bound.

    gcc/testsuite/ChangeLog:

            PR middle-end/97556
            * gcc.dg/Warray-bounds-70.c: New test.

[Bug tree-optimization/97556] [11 Regression] ICE at -O2 and -O3 in 32-bit mode on x86_64-pc-linux-gnu in size_remaining, at builtins.c:235 since r11-3827

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97556

Martin Sebor <msebor at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #4 from Martin Sebor <msebor at gcc dot gnu.org> ---
Fixed in r11-4576.