https://gcc.gnu.org/bugzilla/show_bug.cgi?id=116747

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[15 Regression] ICE on      |[12/13/14/15 Regression]
                   |valid code at -O3 on        |ICE on valid code at -O3 on
                   |x86_64-linux-gnu:           |x86_64-linux-gnu:
                   |Segmentation fault          |Segmentation fault
      Known to work|                            |8.5.0
           Assignee|pinskia at gcc dot gnu.org         |unassigned at gcc dot 
gnu.org
      Known to fail|                            |9.1.0

--- Comment #12 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
decl_refs_may_alias_p (ref1=0x7ffff79edf88, base1=0x7ffff7810e10, offset1=...,
max_size1=..., size1=..., ref2=0x7ffff79eddc8, base2=0x7ffff7810e10,
offset2=..., max_size2=..., size2=...) at
/home/apinski/src/upstream-gcc-isel/gcc/gcc/tree-ssa-alias.cc:2051
2051      gcc_checking_assert (DECL_P (base1) && DECL_P (base2));
(gdb) next
2054      if (compare_base_decls (base1, base2) == 0)
(gdb)
2059      if (!ranges_maybe_overlap_p (offset1, max_size1, offset2, max_size2))
(gdb)
2060        return false;
(gdb) p offset1
$11 = {coeffs = {32}}
(gdb) p max_size1
$12 = {coeffs = {0}}
(gdb) p offset2
$13 = {coeffs = {32}}
(gdb) p max_size2
$14 = {coeffs = {0}}

Reduced testcase that fails in GCC 14 and the way back to GCC 9.1.0 even.
Compile with `-fno-tree-fre -fno-tree-dse -O3` .


```
int array1[1];
int array2[1];
int f(int a, int b, int c)
{
        if (b < 1)  __builtin_unreachable();

        if (a)
        {
                array1[b] = c;
                array1[b] = c;
        }
        else
        {
                array1[b] = c;
        }
}
int f1(int a, unsigned short b1, int c)
{
        int b = b1;
        b++;

        if (a)
        {
                array1[b] = c;
                array1[b] = c;
        }
        else
        {
                array1[b] = c;
        }
}
```

This code (and the original one) is undefined due to accessing out side of the
array bounds.

Reply via email to