[Bug c/99990] New: Crash in GCC-11/gimplify

[Bug c/99990] New: Crash in GCC-11/gimplify

[k.even-mendoza at imperial dot ac.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

            Bug ID: 99990
           Summary: Crash in GCC-11/gimplify
           Product: gcc
           Version: 11.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: c
          Assignee: unassigned at gcc dot gnu.org
          Reporter: k.even-mendoza at imperial dot ac.uk
  Target Milestone: ---

In Ubuntu 18, with GCC-11 (gcc (GCC) 11.0.1 20210317 (experimental)), when
trying to compile this code:

#include <stdarg.h>
void a() {
  va_arg(0, long);
  void *b[] = 0;
}

GCC-11 crashed with this error:
===
/home/user42/data/gcc-csmith-0/gcc-install/bin/gcc 
934d08d3ee1bab940b2f2f2651e06ccaf8d82f87.c
In file included from 934d08d3ee1bab940b2f2f2651e06ccaf8d82f87.c:1:
934d08d3ee1bab940b2f2f2651e06ccaf8d82f87.c: In function ‘a’:
934d08d3ee1bab940b2f2f2651e06ccaf8d82f87.c:3:13: error: first argument to
‘va_arg’ not of type ‘va_list’
    3 |   va_arg(0, long);
      |             ^~~~
934d08d3ee1bab940b2f2f2651e06ccaf8d82f87.c:4:15: error: invalid initializer
    4 |   void *b[] = 0;
      |               ^
In file included from 934d08d3ee1bab940b2f2f2651e06ccaf8d82f87.c:1:
934d08d3ee1bab940b2f2f2651e06ccaf8d82f87.c:3:13: internal compiler error: in
gimplify_va_arg_expr, at gimplify.c:15594
    3 |   va_arg(0, long);
      |             ^
0x6b7b93 gimplify_va_arg_expr(tree_node**, gimple**, gimple**)
        .././../gcc-source/gcc/gimplify.c:15594
0xb8e839 gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        .././../gcc-source/gcc/gimplify.c:14156
0xb91416 gimplify_stmt(tree_node**, gimple**)
        .././../gcc-source/gcc/gimplify.c:6876
0xb8ecbb gimplify_statement_list
        .././../gcc-source/gcc/gimplify.c:1879
0xb8ecbb gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        .././../gcc-source/gcc/gimplify.c:14526
0xb91416 gimplify_stmt(tree_node**, gimple**)
        .././../gcc-source/gcc/gimplify.c:6876
0xb91bd1 gimplify_bind_expr
        .././../gcc-source/gcc/gimplify.c:1421
0xb8e1ee gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        .././../gcc-source/gcc/gimplify.c:14283
0xba776f gimplify_stmt(tree_node**, gimple**)
        .././../gcc-source/gcc/gimplify.c:6876
0xba776f gimplify_body(tree_node*, bool)
        .././../gcc-source/gcc/gimplify.c:15318
0xba7b9d gimplify_function_tree(tree_node*)
        .././../gcc-source/gcc/gimplify.c:15472
0x9dc057 cgraph_node::analyze()
        .././../gcc-source/gcc/cgraphunit.c:670
0x9debb7 analyze_functions
        .././../gcc-source/gcc/cgraphunit.c:1236
0x9df81d symbol_table::finalize_compilation_unit()
        .././../gcc-source/gcc/cgraphunit.c:2514
Please submit a full bug report,
===
Before (gcc-10) it would just stop the compilation (with these two errors) and
exit without crashing.

[Bug c/99990] Crash in GCC-11/gimplify

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-04-09
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org
             Status|UNCONFIRMED                 |WAITING

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Can't reproduce the ICE..

[Bug c/99990] Crash in GCC-11/gimplify

[k.even-mendoza at imperial dot ac.uk]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

--- Comment #2 from Karine EM <k.even-mendoza at imperial dot ac.uk> ---
GCC is from GitHub with this version bc21277 (was: Daily bump.)
I compiled gcc-11 with gcc-10 (this gcc-10: gcc (Ubuntu 10.1.0-2ubuntu1~18.04)
10.1.0)

With cmake version 3.13.4, gmp-6.1.0, isl-0.18, mpc-1.0.3, mpfr-3.1.4
and configure with these flags: --disable-multilib --disable-bootstrap
--enable-targets='X86' --enable-languages='c,c++,lto,objc,obj-c++'

[Bug c/99990] Crash in GCC-11/gimplify

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Assignee|unassigned at gcc dot gnu.org      |jakub at gcc dot gnu.org
                 CC|                            |jakub at gcc dot gnu.org
             Status|WAITING                     |ASSIGNED

--- Comment #3 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
I can reproduce it.  The problem seems to be that when handling the void *b[] =
0; error something overwrites TREE_TYPE (error_mark_node) to some other type.

[Bug c/99990] [8/9/10/11 Regression] ICE in gimplifier on invalid va_arg

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |8.5
            Summary|Crash in GCC-11/gimplify    |[8/9/10/11 Regression] ICE
                   |                            |in gimplifier on invalid
                   |                            |va_arg

--- Comment #4 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Started with r7-2847-gba9bbd6f584afe2939c44c159cbb1c064becad5c

[Bug c/99990] [8/9/10/11 Regression] ICE in gimplifier on invalid va_arg

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

--- Comment #5 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Created attachment 50536
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=50536&action=edit
gcc11-pr99990.patch

Untested fix.

[Bug c/99990] [8/9/10/11 Regression] ICE in gimplifier on invalid va_arg

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jakub Jelinek <jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:9f7d77bd6d65aa1cf2e195d3776052705c6e636b

commit r11-8116-g9f7d77bd6d65aa1cf2e195d3776052705c6e636b
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Apr 10 17:01:54 2021 +0200

    c: Avoid clobbering TREE_TYPE (error_mark_node) [PR99990]

    The following testcase ICEs during error recovery, because finish_decl
    overwrites TREE_TYPE (error_mark_node), which better should stay always
    to be error_mark_node.

    2021-04-10  Jakub Jelinek  <jakub@redhat.com>

            PR c/99990
            * c-decl.c (finish_decl): Don't overwrite TREE_TYPE of
            error_mark_node.

            * gcc.dg/pr99990.c: New test.

[Bug c/99990] [8/9/10 Regression] ICE in gimplifier on invalid va_arg

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[8/9/10/11 Regression] ICE  |[8/9/10 Regression] ICE in
                   |in gimplifier on invalid    |gimplifier on invalid
                   |va_arg                      |va_arg

--- Comment #7 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed on the trunk.

[Bug c/99990] [8/9/10 Regression] ICE in gimplifier on invalid va_arg

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-10 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:91e076f3a66c1c9f6aa51e9d53d07803606e3bf1

commit r10-9725-g91e076f3a66c1c9f6aa51e9d53d07803606e3bf1
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Apr 10 17:01:54 2021 +0200

    c: Avoid clobbering TREE_TYPE (error_mark_node) [PR99990]

    The following testcase ICEs during error recovery, because finish_decl
    overwrites TREE_TYPE (error_mark_node), which better should stay always
    to be error_mark_node.

    2021-04-10  Jakub Jelinek  <jakub@redhat.com>

            PR c/99990
            * c-decl.c (finish_decl): Don't overwrite TREE_TYPE of
            error_mark_node.

            * gcc.dg/pr99990.c: New test.

    (cherry picked from commit 9f7d77bd6d65aa1cf2e195d3776052705c6e636b)

[Bug c/99990] [8/9 Regression] ICE in gimplifier on invalid va_arg

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[8/9/10 Regression] ICE in  |[8/9 Regression] ICE in
                   |gimplifier on invalid       |gimplifier on invalid
                   |va_arg                      |va_arg

--- Comment #9 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed for 10.4 too.

[Bug c/99990] [8/9 Regression] ICE in gimplifier on invalid va_arg

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

--- Comment #10 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-9 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:9861f00a08a5f5fecd2c1c4135d3d540b0ed9cc7

commit r9-9444-g9861f00a08a5f5fecd2c1c4135d3d540b0ed9cc7
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Apr 10 17:01:54 2021 +0200

    c: Avoid clobbering TREE_TYPE (error_mark_node) [PR99990]

    The following testcase ICEs during error recovery, because finish_decl
    overwrites TREE_TYPE (error_mark_node), which better should stay always
    to be error_mark_node.

    2021-04-10  Jakub Jelinek  <jakub@redhat.com>

            PR c/99990
            * c-decl.c (finish_decl): Don't overwrite TREE_TYPE of
            error_mark_node.

            * gcc.dg/pr99990.c: New test.

    (cherry picked from commit 91e076f3a66c1c9f6aa51e9d53d07803606e3bf1)

[Bug c/99990] [8/9 Regression] ICE in gimplifier on invalid va_arg

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-8 branch has been updated by Jakub Jelinek
<jakub@gcc.gnu.org>:

https://gcc.gnu.org/g:d3a2bb8009f50acd90637f9407f5c704b318f8f4

commit r8-10907-gd3a2bb8009f50acd90637f9407f5c704b318f8f4
Author: Jakub Jelinek <jakub@redhat.com>
Date:   Sat Apr 10 17:01:54 2021 +0200

    c: Avoid clobbering TREE_TYPE (error_mark_node) [PR99990]

    The following testcase ICEs during error recovery, because finish_decl
    overwrites TREE_TYPE (error_mark_node), which better should stay always
    to be error_mark_node.

    2021-04-10  Jakub Jelinek  <jakub@redhat.com>

            PR c/99990
            * c-decl.c (finish_decl): Don't overwrite TREE_TYPE of
            error_mark_node.

            * gcc.dg/pr99990.c: New test.

    (cherry picked from commit 91e076f3a66c1c9f6aa51e9d53d07803606e3bf1)

[Bug c/99990] [8/9 Regression] ICE in gimplifier on invalid va_arg

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #12 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
Fixed.

[Bug c/99990] [8/9 Regression] ICE in gimplifier on invalid va_arg

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=99990

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |anbu1024.me at gmail dot com

--- Comment #13 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 96610 has been marked as a duplicate of this bug. ***