[Bug sanitizer/99106] New: ICE in tree_to_poly_int64, at tree.c:3091

[Bug sanitizer/99106] New: ICE in tree_to_poly_int64, at tree.c:3091

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

            Bug ID: 99106
           Summary: ICE in tree_to_poly_int64, at tree.c:3091
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: sanitizer
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: dodji at gcc dot gnu.org, dvyukov at gcc dot gnu.org,
                    jakub at gcc dot gnu.org, kcc at gcc dot gnu.org, marxin at gcc dot gnu.org
  Target Milestone: ---

Started with the same revision as PR99033:

$ g++ /home/marxin/Programming/gcc/gcc/testsuite/g++.dg/ext/flexary38.C -c
-fsanitize=undefined
during GIMPLE pass: ubsan
/home/marxin/Programming/gcc/gcc/testsuite/g++.dg/ext/flexary38.C: In function
‘void foo()’:
/home/marxin/Programming/gcc/gcc/testsuite/g++.dg/ext/flexary38.C:18:1:
internal compiler error: in tree_to_poly_int64, at tree.c:3091
   18 | }
      | ^
0x87f81e tree_to_poly_int64(tree_node const*)
        /home/marxin/Programming/gcc/gcc/tree.c:3091
0x87f81e tree_to_poly_int64(tree_node const*)
        /home/marxin/Programming/gcc/gcc/tree.c:3089
0x148775e component_ref_size(tree_node*, special_array_member*)
        /home/marxin/Programming/gcc/gcc/tree.c:13920
0x1232ece decl_init_size(tree_node*, bool)
        /home/marxin/Programming/gcc/gcc/tree-object-size.c:196
0x12336ca addr_object_size
        /home/marxin/Programming/gcc/gcc/tree-object-size.c:285
0x123556b compute_builtin_object_size(tree_node*, int, unsigned long*,
tree_node**, tree_node**)
        /home/marxin/Programming/gcc/gcc/tree-object-size.c:570
0x11a6565 instrument_object_size
        /home/marxin/Programming/gcc/gcc/ubsan.c:2150
0x11ab575 execute
        /home/marxin/Programming/gcc/gcc/ubsan.c:2405
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug sanitizer/99106] [9/10/11 Regression] ICE in tree_to_poly_int64, at tree.c:3091

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2
            Summary|ICE in tree_to_poly_int64,  |[9/10/11 Regression] ICE in
                   |at tree.c:3091              |tree_to_poly_int64, at
                   |                            |tree.c:3091
   Target Milestone|---                         |9.4
           Keywords|                            |ice-on-valid-code

[Bug sanitizer/99106] [9/10/11 Regression] ICE in tree_to_poly_int64, at tree.c:3091

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
   Last reconfirmed|                            |2021-02-16
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
     Ever confirmed|0                           |1

--- Comment #1 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 50199
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50199&action=edit
gcc11-pr99106.patch

Untested fix.

[Bug sanitizer/99106] [9/10/11 Regression] ICE in tree_to_poly_int64, at tree.c:3091

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

--- Comment #2 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:7768cadb4246117964a9ba159740da3b9c20811d

commit r11-7267-g7768cadb4246117964a9ba159740da3b9c20811d
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Feb 17 15:03:25 2021 +0100

    c++: Fix up build_zero_init_1 once more [PR99106]

    My earlier build_zero_init_1 patch for flexible array members created
    an empty CONSTRUCTOR.  As the following testcase shows, that doesn't work
    very well because the middle-end doesn't expect CONSTRUCTOR elements with
    incomplete type (that the empty CONSTRUCTOR at the end of outer CONSTRUCTOR
    had).

    The following patch just doesn't add any CONSTRUCTOR for the flexible array
    members, it doesn't seem to be needed.

    2021-02-17  Jakub Jelinek  <jakub@redhat.com>

            PR sanitizer/99106
            * init.c (build_zero_init_1): For flexible array members just
return
            NULL_TREE instead of returning empty CONSTRUCTOR with non-complete
            ARRAY_TYPE.

            * g++.dg/ubsan/pr99106.C: New test.

[Bug sanitizer/99106] [9/10 Regression] ICE in tree_to_poly_int64, at tree.c:3091

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[9/10/11 Regression] ICE in |[9/10 Regression] ICE in
                   |tree_to_poly_int64, at      |tree_to_poly_int64, at
                   |tree.c:3091                 |tree.c:3091

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk so far.

[Bug sanitizer/99106] [9/10 Regression] ICE in tree_to_poly_int64, at tree.c:3091

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:af868e89ec21340d1cafd26eaed356ce4b0104c3

commit r10-9471-gaf868e89ec21340d1cafd26eaed356ce4b0104c3
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Feb 17 15:03:25 2021 +0100

    c++: Fix up build_zero_init_1 once more [PR99106]

    My earlier build_zero_init_1 patch for flexible array members created
    an empty CONSTRUCTOR.  As the following testcase shows, that doesn't work
    very well because the middle-end doesn't expect CONSTRUCTOR elements with
    incomplete type (that the empty CONSTRUCTOR at the end of outer CONSTRUCTOR
    had).

    The following patch just doesn't add any CONSTRUCTOR for the flexible array
    members, it doesn't seem to be needed.

    2021-02-17  Jakub Jelinek  <jakub@redhat.com>

            PR sanitizer/99106
            * init.c (build_zero_init_1): For flexible array members just
return
            NULL_TREE instead of returning empty CONSTRUCTOR with non-complete
            ARRAY_TYPE.

            * g++.dg/ubsan/pr99106.C: New test.

    (cherry picked from commit 7768cadb4246117964a9ba159740da3b9c20811d)

[Bug sanitizer/99106] [9 Regression] ICE in tree_to_poly_int64, at tree.c:3091

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[9/10 Regression] ICE in    |[9 Regression] ICE in
                   |tree_to_poly_int64, at      |tree_to_poly_int64, at
                   |tree.c:3091                 |tree.c:3091

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 10.3 too.

[Bug sanitizer/99106] [9 Regression] ICE in tree_to_poly_int64, at tree.c:3091

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:89da2c8127c373573e5e486efe7699da794d469b

commit r9-9421-g89da2c8127c373573e5e486efe7699da794d469b
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Feb 17 15:03:25 2021 +0100

    c++: Fix up build_zero_init_1 once more [PR99106]

    My earlier build_zero_init_1 patch for flexible array members created
    an empty CONSTRUCTOR.  As the following testcase shows, that doesn't work
    very well because the middle-end doesn't expect CONSTRUCTOR elements with
    incomplete type (that the empty CONSTRUCTOR at the end of outer CONSTRUCTOR
    had).

    The following patch just doesn't add any CONSTRUCTOR for the flexible array
    members, it doesn't seem to be needed.

    2021-02-17  Jakub Jelinek  <jakub@redhat.com>

            PR sanitizer/99106
            * init.c (build_zero_init_1): For flexible array members just
return
            NULL_TREE instead of returning empty CONSTRUCTOR with non-complete
            ARRAY_TYPE.

            * g++.dg/ubsan/pr99106.C: New test.

    (cherry picked from commit af868e89ec21340d1cafd26eaed356ce4b0104c3)

[Bug sanitizer/99106] [9 Regression] ICE in tree_to_poly_int64, at tree.c:3091

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-8 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:3a51e6261f7d98d54fc370125b1895542c3cdce9

commit r8-10886-g3a51e6261f7d98d54fc370125b1895542c3cdce9
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Wed Feb 17 15:03:25 2021 +0100

    c++: Fix up build_zero_init_1 once more [PR99106]

    My earlier build_zero_init_1 patch for flexible array members created
    an empty CONSTRUCTOR.  As the following testcase shows, that doesn't work
    very well because the middle-end doesn't expect CONSTRUCTOR elements with
    incomplete type (that the empty CONSTRUCTOR at the end of outer CONSTRUCTOR
    had).

    The following patch just doesn't add any CONSTRUCTOR for the flexible array
    members, it doesn't seem to be needed.

    2021-02-17  Jakub Jelinek  <jakub@redhat.com>

            PR sanitizer/99106
            * init.c (build_zero_init_1): For flexible array members just
return
            NULL_TREE instead of returning empty CONSTRUCTOR with non-complete
            ARRAY_TYPE.

            * g++.dg/ubsan/pr99106.C: New test.

    (cherry picked from commit af868e89ec21340d1cafd26eaed356ce4b0104c3)

[Bug sanitizer/99106] [9 Regression] ICE in tree_to_poly_int64, at tree.c:3091

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99106

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.