[Bug c++/99831] New: ICE: in reshape_init, at cp/decl.c:6720

[Bug c++/99831] New: ICE: in reshape_init, at cp/decl.c:6720

[hewillk at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

            Bug ID: 99831
           Summary: ICE: in reshape_init, at cp/decl.c:6720
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c++
          Assignee: unassigned at gcc dot gnu.org
          Reporter: hewillk at gmail dot com
  Target Milestone: ---

This is a complicated one since I don't know how to reduce it.

https://godbolt.org/z/rqTGxMWef

#include <algorithm>

template <int N>
struct StringLiteral {
  constexpr StringLiteral(const char (&str)[N]) {
    std::ranges::copy_n(str, N, value);
  }
  char value[N];
};

template <StringLiteral>
struct string{
  constexpr bool operator==(const string&) const noexcept = default;
};

template <StringLiteral L1, StringLiteral L2>
constexpr auto operator+(string<L1>, string<L2>) {
  constexpr auto L3 = []{
    constexpr auto size1 = sizeof(L1.value);
    constexpr auto size2 = sizeof(L2.value);
    char value[size1 + size2 - 1] = {};
    std::ranges::sort(value);
    std::ranges::copy_n(L1.value, size1, value);
    std::ranges::copy_n(L2.value, size2, value + size1 - 1);
    return StringLiteral{value};
  }();
  return string<L3>{};
}

static_assert(
  string<"hello, world">{} ==
  string<"hello">{} + string<", world">{}
);

static_assert(
  string<"a rose is a rose is a rose">{} ==
  string<"a rose">{} + string<" is ">{} + 
  string<"a rose">{} + string<" is ">{} + 
  string<"a rose">{}
);

<source>:36:40: internal compiler error: in reshape_init, at cp/decl.c:6720
   36 |   string<"a rose is a rose is a rose">{} ==
      |                                        ^
0x1cfb6a9 internal_error(char const*, ...)
        ???:0
0x6ba871 fancy_abort(char const*, int, char const*)
        ???:0
0x7810b6 reshape_init(tree_node*, tree_node*, int)
        ???:0
0x97e050 finish_compound_literal(tree_node*, tree_node*, int, fcl_t)
        ???:0
0x8e12ad c_parse_file()
        ???:0
0xa600a2 c_common_parse_file()
        ???:0
Please submit a full bug report,
with preprocessed source if appropriate.

[Bug c++/99831] ICE: in reshape_init, at cp/decl.c:6720

[hewillk at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

--- Comment #1 from 康桓瑋 <hewillk at gmail dot com> ---
Note that if we comment one of the asserts, there will be no problem, or we
just comment the redundant std::ranges::sort.

[Bug c++/99831] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |mpolacek at gcc dot gnu.org
           Keywords|                            |ice-on-valid-code
   Last reconfirmed|                            |2021-03-30
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #2 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Confirmed.

Breakpoint 1, fancy_abort (file=0x283d618
"/home/mpolacek/src/gcc/gcc/cp/decl.c", line=6720, 
    function=0x28403ca "reshape_init") at
/home/mpolacek/src/gcc/gcc/diagnostic.c:1884
1884      if (global_dc->printer == NULL)
(gdb) up
#1  0x0000000000b284fd in reshape_init (type=<record_type 0x7fffe6374540
string>, 
    init=<ggc_freed 0x7fffe6370690>, complain=3) at
/home/mpolacek/src/gcc/gcc/cp/decl.c:6720
6720      gcc_assert (BRACE_ENCLOSED_INITIALIZER_P (init));
(gdb) p init
$1 = <ggc_freed 0x7fffe6370690>

[Bug c++/99831] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |needs-reduction

--- Comment #3 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Trying to reduce (--param ggc-min-heapsize=100 --param ggc-min-expand=10 seems
to help), but it'll take time.

[Bug c++/99831] ICE: in reshape_init, at cp/decl.c:6720

[hewillk at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

--- Comment #4 from 康桓瑋 <hewillk at gmail dot com> ---
When the array subscript is outside the bounds of array, gcc seems to fall into
infinite recursion due to the default operator==.

Here is the reduced with no header:

struct A {
  constexpr A(const char*) {}
  char value[1] = {};
};

template <A>
struct B {
  constexpr bool operator==(const B&) const = default;
};

constexpr auto foo(auto) {
  constexpr auto a = [] {
    char value[1];
    value[2] = 0; // this line
    return A{value};
  }();
  return B<a>{};
}

constexpr auto b = foo(B<"">{});

<source>: In instantiation of 'struct B<<expression error> >':
<source>:8:18:   recursively required from 'struct B<<expression error> >'
<source>:8:18:   required from 'struct B<<expression error> >'
<source>:17:15:   required from 'constexpr auto foo(auto:1) [with auto:1 =
B<A{""}>]'
<source>:20:23:   required from here
<source>:8:18: fatal error: template instantiation depth exceeds maximum of 900
(use '-ftemplate-depth=' to increase the maximum)
    8 |   constexpr bool operator==(const B&) const = default;
      |                  ^~~~~~~~
compilation terminated.

[Bug c++/99831] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-reduction             |

--- Comment #5 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
And here's a reduced version of there original test.  Will try to reduce
further.

template <typename> struct remove_cv { using type = int; };
template <typename _Tp> using __remove_cvref_t = typename remove_cv<_Tp>::type;
template <typename _Tp> using remove_cvref_t = __remove_cvref_t<_Tp>;
template <typename _Derived, typename _Base>
concept derived_from = __is_base_of(_Base, _Derived);
template <typename> struct iterator_traits;
struct input_iterator_tag;
namespace __detail {
template <typename> struct __iter_traits_impl {
  using type = iterator_traits<int>;
};
template <typename _Iter>
using __iter_traits = typename __iter_traits_impl<_Iter>::type;
template <typename _Tp>
using __iter_diff_t = typename __iter_traits<_Tp>::difference_type;
} // namespace __detail
template <typename _Tp>
using iter_difference_t = __detail::__iter_diff_t<remove_cvref_t<_Tp>>;
namespace __detail {
template <typename> struct __iter_concept_impl;
template <typename _Iter> requires requires { typename _Iter; }
struct __iter_concept_impl<_Iter> {
  using type = typename __iter_traits<_Iter>::iterator_concept;
};
template <typename _Iter>
using __iter_concept = typename __iter_concept_impl<_Iter>::type;
} // namespace __detail
template <typename _Iter> concept weakly_incrementable = requires(_Iter __i) {
  __i;
};
template <typename _Iter>
concept input_iterator =
    derived_from<__detail::__iter_concept<_Iter>, input_iterator_tag>;
template <typename> struct iterator_traits {
  using iterator_concept = input_iterator_tag;
  using difference_type = int;
};
template <typename> struct in_out_result {};
template <typename, typename _Out> using copy_n_result = in_out_result<_Out>;
struct {
  template <input_iterator _Iter, weakly_incrementable _Out>
  constexpr copy_n_result<_Iter, _Out>
  operator()(_Iter __first, iter_difference_t<_Iter> __n, _Out __result) {
    for (; __n; --__n, ++__result)
      *__result = *__first;
    return {};
  }
} copy_n;
template <int N> struct StringLiteral {
  constexpr StringLiteral(const char (&str)[N]) { copy_n(str, N, value); }
  char value[N];
};
template <StringLiteral> struct string {
  constexpr bool operator==(const string &) const = default;
};
template <StringLiteral L2> void operator+(string<L2>) {
  char value[1];
  StringLiteral{value};
}
static_assert(string<"hello, world">{} == string<"hello"
                                                 ", world">{});
static_assert(string<"a rose is a rose is a rose">{} == string<"a rose"
                                                               " is "
                                                               "a rose"
                                                               " is "
                                                               "a rose">{});

[Bug c++/99831] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

--- Comment #6 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Even shorter:

// PR c++/99831

template <int N> struct S {
  constexpr S(const char (&str)[N]) : value{} { }
  char value[N];
};
template <S> struct string {
  constexpr bool operator==(const string &) const = default;
};
template <S L2> void operator+(string<L2>) {
  char value[1];
  S{value};
}
static_assert(string<"a">{} == string<"a">{});

[Bug c++/99831] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

--- Comment #7 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
There was en error + ICE, but since r11-5752 we only have the ICE.
Looks like the ICE started with r277865.

[Bug c++/99831] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |mpolacek at gcc dot gnu.org
             Status|NEW                         |ASSIGNED

[Bug c++/99831] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

--- Comment #8 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
The problem is that post-r277865 in defaulted_late_check we call
synthesize_method here:

  if (kind == sfk_comparison)
    {    
      /* If the function was declared constexpr, check that the definition
         qualifies.  Otherwise we can define the function lazily.  */
      if (DECL_DECLARED_CONSTEXPR_P (fn) && !DECL_INITIAL (fn))
        synthesize_method (fn);
      return;
    }

and that results in garbage collection, which then frees {} that we created
when parsing the braced-list in string<"a">{}.  Then of course accessing the
freed data fails.

[Bug c++/99831] [10/11 Regression] ICE: in reshape_init, at cp/decl.c:6720

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|ICE: in reshape_init, at    |[10/11 Regression] ICE: in
                   |cp/decl.c:6720              |reshape_init, at
                   |                            |cp/decl.c:6720
   Target Milestone|---                         |10.3
           Priority|P3                          |P2

[Bug c++/99831] [10/11 Regression] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |patch

--- Comment #9 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
https://gcc.gnu.org/pipermail/gcc-patches/2021-April/567599.html

[Bug c++/99831] [10/11 Regression] ICE: in reshape_init, at cp/decl.c:6720

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Marek Polacek <mpolacek@gcc.gnu.org>:

https://gcc.gnu.org/g:6a60ffc297b9d4903543a25538e62e7fb39420a9

commit r11-7954-g6a60ffc297b9d4903543a25538e62e7fb39420a9
Author: Marek Polacek <polacek@redhat.com>
Date:   Thu Apr 1 10:42:43 2021 -0400

    c++: GC collects live data when synthesizing operator== [PR99831]

    Here we crash in reshape_init because we're accessing ggc_freed
    & poisoned data: since r277865 in defaulted_late_check we call
    synthesize_method here:

      if (kind == sfk_comparison)
        {
          /* If the function was declared constexpr, check that the definition
             qualifies.  Otherwise we can define the function lazily.  */
          if (DECL_DECLARED_CONSTEXPR_P (fn) && !DECL_INITIAL (fn))
            synthesize_method (fn);
          return;
        }

    which in this test triggers when we're processing the string<"a">{} in
    the static_assert.  First, we create a CONSTRUCTOR for the "{}" in
    cp_parser_functional_cast, then we call finish_compound_literal which
    calls complete_type and that results in garbage collection, which then
    frees the CONSTRUCTOR {} we created when parsing the braced-list in
    string<"a">{} -- at this point, it's not referenced by anything.
    (That's not the case for 'type' in finish_compound_literal: the symbol
    table contains a node for operator==, so ggc_mark_roots goes and marks
    the fn decl, its type, its arguments etc., as used, so we don't collect
    it.)

    We could just bump function_depth around the new call to synthesize_method
    to prevent GC.

    gcc/cp/ChangeLog:

            PR c++/99831
            * method.c (defaulted_late_check): ++ and -- function_depth around
            the call to synthesize_method.
            * pt.c: Remove the saved_trees global.

    gcc/testsuite/ChangeLog:

            PR c++/99831
            * g++.dg/other/gc6.C: New test.

[Bug c++/99831] [10 Regression] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[10/11 Regression] ICE: in  |[10 Regression] ICE: in
                   |reshape_init, at            |reshape_init, at
                   |cp/decl.c:6720              |cp/decl.c:6720

--- Comment #11 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Fixed on trunk so far.

[Bug c++/99831] [10 Regression] ICE: in reshape_init, at cp/decl.c:6720

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|10.3                        |10.4

--- Comment #12 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 10.3 is being released, retargeting bugs to GCC 10.4.

[Bug c++/99831] [10 Regression] ICE: in reshape_init, at cp/decl.c:6720

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

--- Comment #13 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Marek Polacek
<mpolacek@gcc.gnu.org>:

https://gcc.gnu.org/g:3252b78f7ef7847b109e7b43daf7ca1a6f0d6fab

commit r10-9689-g3252b78f7ef7847b109e7b43daf7ca1a6f0d6fab
Author: Marek Polacek <polacek@redhat.com>
Date:   Thu Apr 1 10:42:43 2021 -0400

    c++: GC collects live data when synthesizing operator== [PR99831]

    Here we crash in reshape_init because we're accessing ggc_freed
    & poisoned data: since r277865 in defaulted_late_check we call
    synthesize_method here:

      if (kind == sfk_comparison)
        {
          /* If the function was declared constexpr, check that the definition
             qualifies.  Otherwise we can define the function lazily.  */
          if (DECL_DECLARED_CONSTEXPR_P (fn) && !DECL_INITIAL (fn))
            synthesize_method (fn);
          return;
        }

    which in this test triggers when we're processing the string<"a">{} in
    the static_assert.  First, we create a CONSTRUCTOR for the "{}" in
    cp_parser_functional_cast, then we call finish_compound_literal which
    calls complete_type and that results in garbage collection, which then
    frees the CONSTRUCTOR {} we created when parsing the braced-list in
    string<"a">{} -- at this point, it's not referenced by anything.
    (That's not the case for 'type' in finish_compound_literal: the symbol
    table contains a node for operator==, so ggc_mark_roots goes and marks
    the fn decl, its type, its arguments etc., as used, so we don't collect
    it.)

    We could just bump function_depth around the new call to synthesize_method
    to prevent GC.

    gcc/cp/ChangeLog:

            PR c++/99831
            * method.c (defaulted_late_check): ++ and -- function_depth around
            the call to synthesize_method.
            * pt.c: Remove the saved_trees global.

    gcc/testsuite/ChangeLog:

            PR c++/99831
            * g++.dg/other/gc6.C: New test.

    (cherry picked from commit 6a60ffc297b9d4903543a25538e62e7fb39420a9)

[Bug c++/99831] [10 Regression] ICE: in reshape_init, at cp/decl.c:6720

[mpolacek at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99831

Marek Polacek <mpolacek at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #14 from Marek Polacek <mpolacek at gcc dot gnu.org> ---
Fixed.