[Bug c/97979] New: internal compiler error: Segmentation fault with "-O3 -fno-toplevel-reorder -fno-tree-ccp"

[Bug c/97979] New: internal compiler error: Segmentation fault with "-O3 -fno-toplevel-reorder -fno-tree-ccp"

[suochenyao at 163 dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97979

            Bug ID: 97979
           Summary: internal compiler error: Segmentation fault with "-O3
                    -fno-toplevel-reorder -fno-tree-ccp"
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: suochenyao at 163 dot com
  Target Milestone: ---

*******************************************************************************
OS and Platform:
CentOS Linux release 7.8.2003 (Core), x86_64 GNU/Linux
*******************************************************************************
Program:
short a=0;
int b=0;
void c() {
  unsigned short d = b;
  a = d >> 18446744073709551614;
}
int main() {}
*******************************************************************************
gcc version:
$ gcc -v
Using built-in specs.
COLLECT_GCC=/home/suocy/bin/gcc-dev/bin/gcc
COLLECT_LTO_WRAPPER=/home/suocy/bin/gcc-dev/libexec/gcc/x86_64-pc-linux-gnu/11.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure --prefix=/home/suocy/bin/gcc-dev/
--disable-multilib --enable-languages=c,c++
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 11.0.0 20201124 (experimental) (GCC)
*******************************************************************************
Command Lines:
$ gcc -Wall -Wextra -fno-strict-aliasing -fwrapv -O3 -fno-toplevel-reorder
-fno-tree-ccp a.c
a.c: In function ‘c’:
a.c:5:12: warning: integer constant is so large that it is unsigned
    5 |   a = d >> 18446744073709551614;
      |            ^~~~~~~~~~~~~~~~~~~~
a.c:5:9: warning: right shift count >= width of type [-Wshift-count-overflow]
    5 |   a = d >> 18446744073709551614;
      |         ^~
during GIMPLE pass: forwprop
a.c:3:6: internal compiler error: Segmentation fault
    3 | void c() {
      |      ^
0xdeaf5f crash_signal
        ../../gcc/toplev.c:330
0xab3770 tree_swap_operands_p(tree_node const*, tree_node const*)
        ../../gcc/fold-const.c:7398
0x1224d14 gimple_resimplify2
        ../../gcc/gimple-match-head.c:298
0x128c1ea gimple_simplify_100
        /home/suocy/src/gcc-dev/gcc/build/gcc/gimple-match.c:6581
0x128cedf gimple_simplify_RSHIFT_EXPR
        /home/suocy/src/gcc-dev/gcc/build/gcc/gimple-match.c:107758
0x1224dac gimple_resimplify2
        ../../gcc/gimple-match-head.c:318
0x126535a gimple_simplify(gimple*, gimple_match_op*, gimple**, tree_node*
(*)(tree_node*), tree_node* (*)(tree_node*))
        ../../gcc/gimple-match-head.c:957
0xb20aee fold_stmt_1
        ../../gcc/gimple-fold.c:5930
0xf13111 execute
        ../../gcc/tree-ssa-forwprop.c:3103
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/97979] [11 Regression]: Segmentation fault with "-O3 -fno-toplevel-reorder -fno-tree-ccp" since r11-5271-g4866b2f5db117f9e

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97979

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
      Known to work|                            |10.2.0
   Last reconfirmed|                            |2020-11-25
   Target Milestone|---                         |11.0
                 CC|                            |jakub at gcc dot gnu.org,
                   |                            |marxin at gcc dot gnu.org
            Summary|internal compiler error:    |[11 Regression]:
                   |Segmentation fault with     |Segmentation fault with
                   |"-O3 -fno-toplevel-reorder  |"-O3 -fno-toplevel-reorder
                   |-fno-tree-ccp"              |-fno-tree-ccp" since
                   |                            |r11-5271-g4866b2f5db117f9e
      Known to fail|                            |11.0

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r11-5271-g4866b2f5db117f9e.

[Bug tree-optimization/97979] [11 Regression]: Segmentation fault with "-O3 -fno-toplevel-reorder -fno-tree-ccp" since r11-5271-g4866b2f5db117f9e

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97979

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
/* Fold (X {&,^,|} C2) << C1 into (X << C1) {&,^,|} (C2 << C1)
   (X {&,^,|} C2) >> C1 into (X >> C1) & (C2 >> C1).  */
(for shift (lshift rshift)
 (for bit_op (bit_and bit_xor bit_ior)
  (simplify
   (shift (convert?:s (bit_op:s @0 INTEGER_CST@2)) INTEGER_CST@1)
   (if (tree_nop_conversion_p (type, TREE_TYPE (@0)))
    (with { tree mask = int_const_binop (shift, fold_convert (type, @2), @1); }
     (bit_op (shift (convert @0) @1) { mask; }))))))

and mask ends up NULL.

 tree mask = int_const_binop (shift, fold_convert (type, captures[3]),
captures[4]);
(gdb) p debug_tree (captures[3])
 <integer_cst 0x7ffff6953138 type <integer_type 0x7ffff68255e8 int> constant
65535>
(gdb) p debug_tree (captures[4])
 <integer_cst 0x7ffff682a3a8 type <integer_type 0x7ffff6825690 unsigned int>
constant 4294967294>
(gdb) p debug_tree (type)
 <integer_type 0x7ffff68255e8 int public SI

so we push in mismatched signs and folding interprets the unsigned shift
amout as signed?

[Bug tree-optimization/97979] [11 Regression]: Segmentation fault with "-O3 -fno-toplevel-reorder -fno-tree-ccp" since r11-5271-g4866b2f5db117f9e

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97979

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 49625
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49625&action=edit
gcc11-pr97979.patch

The match.pd pattern was unprepared to handle int_const_binop giving up, which
it now does for some of the UB shifts (and I think should even for shifts with
positive shift amount but larger or equal to the bitsize).  int_const_binop
similarly gives up for division by zero etc.

[Bug tree-optimization/97979] [11 Regression]: Segmentation fault with "-O3 -fno-toplevel-reorder -fno-tree-ccp" since r11-5271-g4866b2f5db117f9e

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97979

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:39f5e9aded23e8b7e0e7080fc6020478b9c5b7b5

commit r11-5433-g39f5e9aded23e8b7e0e7080fc6020478b9c5b7b5
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Thu Nov 26 10:50:23 2020 +0100

    match.pd: Avoid ICE with shifts [PR97979]

    My recent wide_int_binop changes caused ICE on this testcase.
    The problem is that for shift where amount has MSB set now fails to
optimize
    into a constant (IMHO we should treat out of bounds shifts the same later),
    but there is a precedent for that already - e.g. division by zero fails
    to optimize into a constant too.  I think it is better if path isolation
    checks for these UBs and does something the user chooses (__builtin_trap
vs.
    __builtin_unreachable, and either a deferred warning about the UB or
    nothing).
    This patch just doesn't optimize if int_const_binop failed.

    2020-11-26  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/97979
            * match.pd ((X {&,^,|} C2) << C1 into (X << C1) {&,^,|} (C2 <<
C1)):
            Only optimize if int_const_binop returned non-NULL.

            * gcc.dg/pr97979.c: New test.
            * gcc.c-torture/compile/pr97979.c: New test.

[Bug tree-optimization/97979] [11 Regression]: Segmentation fault with "-O3 -fno-toplevel-reorder -fno-tree-ccp" since r11-5271-g4866b2f5db117f9e

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97979

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.