[Bug fortran/99204] New: ICE in fold_read_from_constant_string, at fold-const.c:15441

[Bug fortran/99204] New: ICE in fold_read_from_constant_string, at fold-const.c:15441

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

            Bug ID: 99204
           Summary: ICE in fold_read_from_constant_string, at
                    fold-const.c:15441
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: fortran
          Assignee: unassigned at gcc dot gnu.org
          Reporter: gscfq@t-online.de
  Target Milestone: ---

Affects versions down to at least r5 at -O1+ :
(gives an error with integer, parameter :: ...)


$ cat z1.f90
program p
   character :: c
   integer :: i = -12345678
   c = 'abc'(i:i)
   print *, c
end


$ gfortran-11-20210221 -c z1.f90 -O2
during GIMPLE pass: ccp
z1.f90:1:9:

    1 | program p
      |         ^
internal compiler error: Segmentation fault
0xc060ef crash_signal
        ../../gcc/toplev.c:327
0x945af6 poly_int<1u, long>::poly_int<char>(char const&)
        ../../gcc/poly-int.h:670
0x945af6 fold_read_from_constant_string(tree_node*)
        ../../gcc/fold-const.c:15441
0x979796 fold_const_aggregate_ref_1(tree_node*, tree_node* (*)(tree_node*))
        ../../gcc/gimple-fold.c:7981
0x97a9d9 fold_const_aggregate_ref(tree_node*)
        ../../gcc/gimple-fold.c:8136
0x97a9d9 maybe_fold_reference
        ../../gcc/gimple-fold.c:334
0x980f84 fold_gimple_assign
        ../../gcc/gimple-fold.c:366
0x980f84 fold_stmt_1
        ../../gcc/gimple-fold.c:6077
0xd709b3 substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc/tree-ssa-propagate.c:1149
0x148d1b4 dom_walker::walk(basic_block_def*)
        ../../gcc/domwalk.c:309
0xd6fdf5 substitute_and_fold_engine::substitute_and_fold(basic_block_def*)
        ../../gcc/tree-ssa-propagate.c:1283
0xce231b ccp_finalize
        ../../gcc/tree-ssa-ccp.c:1022
0xce231b do_ssa_ccp
        ../../gcc/tree-ssa-ccp.c:2579
0xce231b execute
        ../../gcc/tree-ssa-ccp.c:2622

[Bug fortran/99204] ICE in fold_read_from_constant_string, at fold-const.c:15441

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

G. Steinmetz <gscfq@t-online.de> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |ice-on-invalid-code

--- Comment #1 from G. Steinmetz <gscfq@t-online.de> ---

Some cases with small numbers :

$ cat zz1.f90
program p
   character :: c = 'c'
   integer :: i = -1
   c = 'abc'(i:i)
   print *, c
end

$ cat zz2.f90
program p
   character :: c = 'c'
   integer :: i = -123
   c = 'abc'(i:i)
   print *, c
end

$ gfortran-11-20210221 zz1.f90 -O2 && ./a.out

$ gfortran-11-20210221 zz2.f90 -O2 && ./a.out
 c


---

The value at which the switchover from no-ICE to ICE occurs 
depends on used options, and changes with gfortran versions 
and environment, e.g.

$ cat za.f90   # no-ICE
program p
   character :: c
   integer :: i = -1800000
   c = 'abc'(i:i)
   print *, c
end

$ cat zb.f90   # ICE
program p
   character :: c
   integer :: i = -1900000
   c = 'abc'(i:i)
   print *, c
end

[Bug fortran/99204] ICE in fold_read_from_constant_string, at fold-const.c:15441

[dominiq at lps dot ens.fr]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

Dominique d'Humieres <dominiq at lps dot ens.fr> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-02-22
             Status|UNCONFIRMED                 |WAITING
     Ever confirmed|0                           |1

--- Comment #2 from Dominique d'Humieres <dominiq at lps dot ens.fr> ---
WORKSFORME:

% gfc pr99204.f90
% ./a.out

Program received signal SIGSEGV: Segmentation fault - invalid memory reference.

If I compile with -fcheck=all I get

% gfc pr99204.f90 -fcheck=all
% ./a.out
At line 4 of file pr99204.f90
Fortran runtime error: Substring out of bounds: lower bound (-12345678) is less
than one

[Bug fortran/99204] ICE in fold_read_from_constant_string, at fold-const.c:15441

[gscfq@t-online.de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

--- Comment #3 from G. Steinmetz <gscfq@t-online.de> ---

Strange, for me the ICE is reproducible on different machines
and also on https://godbolt.org/ (!) -- always with -O2.

[Bug fortran/99204] ICE in fold_read_from_constant_string, at fold-const.c:15441

[anlauf at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

anlauf at gcc dot gnu.org changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|WAITING                     |NEW
                 CC|                            |anlauf at gcc dot gnu.org

--- Comment #4 from anlauf at gcc dot gnu.org ---
(In reply to Dominique d'Humieres from comment #2)
> WORKSFORME:
> 
> % gfc pr99204.f90

The issue really depends on optimization.

Confirmed for all tested -O greater than -O0: -Og, -O, -Os, -O2, -O3.

It disappears when declaring i volatile, as in

  integer, volatile :: i = -12345678

[Bug tree-optimization/99204] [8/9/10/11 Regression] ICE in fold_read_from_constant_string, at fold-const.c:15441

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
                 CC|                            |jakub at gcc dot gnu.org
            Summary|ICE in                      |[8/9/10/11 Regression] ICE
                   |fold_read_from_constant_str |in
                   |ing, at fold-const.c:15441  |fold_read_from_constant_str
                   |                            |ing, at fold-const.c:15441
          Component|fortran                     |tree-optimization
           Priority|P3                          |P2
   Target Milestone|---                         |8.5

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started between
r0-72863-g2b9a33aeea3d49f4e7038ecdc9d96b6220593d15
and
r0-72892-g00b79d543df80369bf196b27fbaa55cd197d6f92

[Bug tree-optimization/99204] [8/9/10/11 Regression] ICE in fold_read_from_constant_string, at fold-const.c:15441

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org

--- Comment #6 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 50236
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50236&action=edit
gcc11-pr99204.patch

Untested fix.  This does what similar code in expand_expr_real_1 does.

[Bug tree-optimization/99204] [8/9/10/11 Regression] ICE in fold_read_from_constant_string, at fold-const.c:15441

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:37b64a3547b91677189c6cbf4c08d7c80770a93a

commit r11-7341-g37b64a3547b91677189c6cbf4c08d7c80770a93a
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Feb 23 09:49:48 2021 +0100

    fold-const: Fix ICE in fold_read_from_constant_string on invalid code
[PR99204]

    fold_read_from_constant_string and expand_expr_real_1 have code to optimize
    constant reads from string (tree vs. rtl).
    If the STRING_CST array type has zero low bound, index is fold converted to
    sizetype and so the compare_tree_int works fine, but if it has some other
    low bound, it calls size_diffop_loc and that function from 2 sizetype
    operands creates a ssizetype difference.  expand_expr_real_1 then uses
    tree_fits_uhwi_p + compare_tree_int and so works fine, but fold-const.c
    only checked if index is INTEGER_CST and calls compare_tree_int, which
means
    for negative index it will succeed and result in UB in the compiler.

    2021-02-23  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/99204
            * fold-const.c (fold_read_from_constant_string): Check that
            tree_fits_uhwi_p (index) rather than just that index is
INTEGER_CST.

            * gfortran.dg/pr99204.f90: New test.

[Bug tree-optimization/99204] [8/9/10 Regression] ICE in fold_read_from_constant_string, at fold-const.c:15441

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[8/9/10/11 Regression] ICE  |[8/9/10 Regression] ICE in
                   |in                          |fold_read_from_constant_str
                   |fold_read_from_constant_str |ing, at fold-const.c:15441
                   |ing, at fold-const.c:15441  |

--- Comment #8 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk so far.

[Bug tree-optimization/99204] [8/9/10 Regression] ICE in fold_read_from_constant_string, at fold-const.c:15441

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:f53a9b563b5017af179f1fd900189c0ba83aa2ec

commit r10-9475-gf53a9b563b5017af179f1fd900189c0ba83aa2ec
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Feb 23 09:49:48 2021 +0100

    fold-const: Fix ICE in fold_read_from_constant_string on invalid code
[PR99204]

    fold_read_from_constant_string and expand_expr_real_1 have code to optimize
    constant reads from string (tree vs. rtl).
    If the STRING_CST array type has zero low bound, index is fold converted to
    sizetype and so the compare_tree_int works fine, but if it has some other
    low bound, it calls size_diffop_loc and that function from 2 sizetype
    operands creates a ssizetype difference.  expand_expr_real_1 then uses
    tree_fits_uhwi_p + compare_tree_int and so works fine, but fold-const.c
    only checked if index is INTEGER_CST and calls compare_tree_int, which
means
    for negative index it will succeed and result in UB in the compiler.

    2021-02-23  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/99204
            * fold-const.c (fold_read_from_constant_string): Check that
            tree_fits_uhwi_p (index) rather than just that index is
INTEGER_CST.

            * gfortran.dg/pr99204.f90: New test.

    (cherry picked from commit 37b64a3547b91677189c6cbf4c08d7c80770a93a)

[Bug tree-optimization/99204] [8/9 Regression] ICE in fold_read_from_constant_string, at fold-const.c:15441

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[8/9/10 Regression] ICE in  |[8/9 Regression] ICE in
                   |fold_read_from_constant_str |fold_read_from_constant_str
                   |ing, at fold-const.c:15441  |ing, at fold-const.c:15441

--- Comment #10 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 10.3 too.

[Bug tree-optimization/99204] [8/9 Regression] ICE in fold_read_from_constant_string, at fold-const.c:15441

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:aec805be1ba98f9d79b1f7be3236deacc2e63551

commit r9-9425-gaec805be1ba98f9d79b1f7be3236deacc2e63551
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Feb 23 09:49:48 2021 +0100

    fold-const: Fix ICE in fold_read_from_constant_string on invalid code
[PR99204]

    fold_read_from_constant_string and expand_expr_real_1 have code to optimize
    constant reads from string (tree vs. rtl).
    If the STRING_CST array type has zero low bound, index is fold converted to
    sizetype and so the compare_tree_int works fine, but if it has some other
    low bound, it calls size_diffop_loc and that function from 2 sizetype
    operands creates a ssizetype difference.  expand_expr_real_1 then uses
    tree_fits_uhwi_p + compare_tree_int and so works fine, but fold-const.c
    only checked if index is INTEGER_CST and calls compare_tree_int, which
means
    for negative index it will succeed and result in UB in the compiler.

    2021-02-23  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/99204
            * fold-const.c (fold_read_from_constant_string): Check that
            tree_fits_uhwi_p (index) rather than just that index is
INTEGER_CST.

            * gfortran.dg/pr99204.f90: New test.

    (cherry picked from commit f53a9b563b5017af179f1fd900189c0ba83aa2ec)

[Bug tree-optimization/99204] [8/9 Regression] ICE in fold_read_from_constant_string, at fold-const.c:15441

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

--- Comment #12 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-8 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:f843203ea2c65d6319d784079baa8375c406a52c

commit r8-10890-gf843203ea2c65d6319d784079baa8375c406a52c
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Tue Feb 23 09:49:48 2021 +0100

    fold-const: Fix ICE in fold_read_from_constant_string on invalid code
[PR99204]

    fold_read_from_constant_string and expand_expr_real_1 have code to optimize
    constant reads from string (tree vs. rtl).
    If the STRING_CST array type has zero low bound, index is fold converted to
    sizetype and so the compare_tree_int works fine, but if it has some other
    low bound, it calls size_diffop_loc and that function from 2 sizetype
    operands creates a ssizetype difference.  expand_expr_real_1 then uses
    tree_fits_uhwi_p + compare_tree_int and so works fine, but fold-const.c
    only checked if index is INTEGER_CST and calls compare_tree_int, which
means
    for negative index it will succeed and result in UB in the compiler.

    2021-02-23  Jakub Jelinek  <jakub@redhat.com>

            PR tree-optimization/99204
            * fold-const.c (fold_read_from_constant_string): Check that
            tree_fits_uhwi_p (index) rather than just that index is
INTEGER_CST.

            * gfortran.dg/pr99204.f90: New test.

    (cherry picked from commit f53a9b563b5017af179f1fd900189c0ba83aa2ec)

[Bug tree-optimization/99204] [8/9 Regression] ICE in fold_read_from_constant_string, at fold-const.c:15441

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99204

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #13 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.