[Bug c/98199] New: [11 Regression] ICE: Aborted (stack smashing detected)

[Bug c/98199] New: [11 Regression] ICE: Aborted (stack smashing detected)

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98199

            Bug ID: 98199
           Summary: [11 Regression] ICE: Aborted (stack smashing detected)
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: acoplan at gcc dot gnu.org
  Target Milestone: ---

AArch64 GCC ICEs on the following testcase:

struct b {
  long a;
  short d;
  int c;
  int f;
  int e;
  int g;
};
struct h {
  int a;
  int i;
  short j;
  struct b k;
  signed : 20;
  int e;
  int g;
} __attribute__((packed));
struct {
  short a;
  unsigned i;
  unsigned k;
  struct h d;
  const int : 30;
  signed e : 20;
  signed : 18;
} const l = {1, 6, 0, {}, 0};
int m() { return l.e || 0; }

since r11-5706-g277ff3406d533990e98cf1c2075b9dc9db6fa48a. I can reproduce the
issue on both x86 and aarch64 hosts. To reproduce:

$ aarch64-elf-gcc -c test.c
*** stack smashing detected ***: <unknown> terminated
test.c: In function 'm':
test.c:27:18: internal compiler error: Aborted
   27 | int m() { return l.e || 0; }
      |                  ^~~
0xdccf89 crash_signal
        /home/alecop01/toolchain/src/gcc/gcc/toplev.c:327
0x9ff4e7 native_encode_initializer(tree_node*, unsigned char*, int, int,
unsigned char*)
        /home/alecop01/toolchain/src/gcc/gcc/fold-const.c:8476
0xa7688d fold_ctor_reference(tree_node*, tree_node*, poly_int<2u, unsigned
long> const&, poly_int<2u, unsigned long> const&, tree_node*, unsigned long*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-fold.c:7952
0xa77a77 fold_const_aggregate_ref_1(tree_node*, tree_node* (*)(tree_node*))
        /home/alecop01/toolchain/src/gcc/gcc/gimple-fold.c:8057
0xa79816 fold_const_aggregate_ref(tree_node*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-fold.c:8136
0xa7989b maybe_fold_reference
        /home/alecop01/toolchain/src/gcc/gcc/gimple-fold.c:334
0xa79cb4 fold_gimple_assign
        /home/alecop01/toolchain/src/gcc/gcc/gimple-fold.c:366
0xa7fdec fold_stmt_1
        /home/alecop01/toolchain/src/gcc/gcc/gimple-fold.c:6077
0xa81c10 fold_stmt(gimple_stmt_iterator*)
        /home/alecop01/toolchain/src/gcc/gcc/gimple-fold.c:6248
0xa9b20e maybe_fold_stmt
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:3295
0xabb0f1 gimplify_modify_expr
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:5979
0xaa9b7e gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:14010
0xaaf1b7 gimplify_stmt(tree_node**, gimple**)
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:6862
0xab2cfc gimplify_and_add(tree_node*, gimple**)
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:487
0xab2cfc internal_get_tmp_var
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:640
0xab2d7a get_formal_tmp_var(tree_node*, gimple**)
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:661
0xaaef47 gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:14998
0xaae654 gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:14764
0xaae654 gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:14764
0xaaa086 gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        /home/alecop01/toolchain/src/gcc/gcc/gimplify.c:14113
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug c/98199] [11 Regression] ICE: Aborted (stack smashing detected)

[ktkachov at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98199

ktkachov at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2020-12-08
             Status|UNCONFIRMED                 |NEW
                 CC|                            |ktkachov at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #1 from ktkachov at gcc dot gnu.org ---
Confirmed.

[Bug tree-optimization/98199] [11 Regression] ICE: Aborted (stack smashing detected)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98199

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
                 CC|                            |jakub at gcc dot gnu.org
   Target Milestone|---                         |11.0
          Component|c                           |tree-optimization

[Bug tree-optimization/98199] [11 Regression] ICE: Aborted (stack smashing detected)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98199

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #2 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 49706
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=49706&action=edit
gcc11-pr98199.patch

Untested fix.

[Bug tree-optimization/98199] [11 Regression] ICE: Aborted (stack smashing detected)

[ebotcazou at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98199

--- Comment #3 from Eric Botcazou <ebotcazou at gcc dot gnu.org> ---
> struct b {
>   long a;
>   short d;
>   int c;
>   int f;
>   int e;
>   int g;
> };
> struct h {
>   int a;
>   int i;
>   short j;
>   struct b k;
>   signed : 20;
>   int e;
>   int g;
> } __attribute__((packed));
> struct {
>   short a;
>   unsigned i;
>   unsigned k;
>   struct h d;
>   const int : 30;
>   signed e : 20;
>   signed : 18;
> } const l = {1, 6, 0, {}, 0};
> int m() { return l.e || 0; }
> 
> since r11-5706-g277ff3406d533990e98cf1c2075b9dc9db6fa48a. 

Something went wrong on your side here, this cannot possibly be true.

[Bug tree-optimization/98199] [11 Regression] ICE: Aborted (stack smashing detected)

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98199

--- Comment #4 from Alex Coplan <acoplan at gcc dot gnu.org> ---
Ah, yeah, apologies: looks like I messed up the bisect here, scratch that.

[Bug tree-optimization/98199] [11 Regression] ICE: Aborted (stack smashing detected)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98199

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I'm pretty sure it started with
r11-5704-g896048cf43d5eb21ab7c16553bb9d13b0f890b81

[Bug tree-optimization/98199] [11 Regression] ICE: Aborted (stack smashing detected)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98199

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:0673fc691175bfdb72d70c2fbbfcad238a3a9942

commit r11-5875-g0673fc691175bfdb72d70c2fbbfcad238a3a9942
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Dec 9 09:36:11 2020 +0100

    fold-const: Fix native_encode_initializer bitfield handling [PR98199]

    With the bit_cast changes, I have added support for bitfields which don't
    have scalar representatives.  For bit_cast it works fine, as when mask
    is non-NULL, off is asserted to be 0.  But when native_encode_initializer
    is called e.g. from sccvn with off > 0 (i.e. we are interested in encoding
    just a few bytes out of it somewhere from the middle or at the end), the
    following computations are incorrect.
    pos is a byte position from the start of the constructor, repr_size is the
    size in bytes of the bit-field representative and len is the length
    of the buffer.  If the buffer is offsetted by positive off, those numbers
    are uncomparable though, we need to add off to len to make both
    count bytes from the start of the constructor, and o is a utility temporary
    set to off != -1 ? off : 0 (because off -1 also means start at offset 0
    and just force special behavior).

    2020-12-09  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/98199
            * fold-const.c (native_encode_initializer): Fix handling bit-fields
            when off > 0.

            * gcc.c-torture/compile/pr98199.c: New test.

[Bug tree-optimization/98199] [11 Regression] ICE: Aborted (stack smashing detected)

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=98199

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.