[Bug ipa/78258] [7 Regression] ICE in compare_values_warnv, at tree-vrp.c:1218

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=78258

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |accepts-invalid
                 CC|                            |kugan at gcc dot gnu.org
          Component|fortran                     |ipa
   Target Milestone|---                         |7.0
            Summary|ICE in                      |[7 Regression] ICE in
                   |compare_values_warnv, at    |compare_values_warnv, at
                   |tree-vrp.c:1218             |tree-vrp.c:1218

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
1215      /* Below we rely on the fact that VAL1 and VAL2 are both pointers or
1216         both integers.  */
1217      gcc_assert (POINTER_TYPE_P (TREE_TYPE (val1))
1218                  == POINTER_TYPE_P (TREE_TYPE (val2)));

(gdb) p debug_tree (val1)
 <integer_cst 0x2aaaac025fc0 type <pointer_type 0x2aaaac03e2a0> constant 0>
$1 = void
(gdb) p debug_tree (val2)
 <integer_cst 0x2aaaac1f9528 type <integer_type 0x2aaaac0297e0 integer(kind=4)>
constant 7>

vrp_meet gets called from IPA-CP with one pointer and one
integer range.  Oops.

#7  0x0000000001947890 in ipcp_vr_lattice::meet_with_1 (this=0x28e8b78, 
    other_vr=0x2aaaac201a88) at /space/rguenther/src/gcc-git/gcc/ipa-cp.c:909
909       vrp_meet (&m_vr, other_vr);
(gdb) p debug_value_range (other_vr)
[0B, 0B]
(gdb) p debug_value_range ( &this->m_vr)
[7, 7]

The FE ends up emitting / accepting mismatched param / call arg types:

sub (integer(kind=4) & restrict x1, character(kind=1)[1:4] * x2,
character(kind=1)[1:8] * x3, integer(kind=4) * x4, integer(kind=4) _x2,
integer(kind=4) _x3)
{
...
}
...
  {
    static integer(kind=4) C.3445 = 1;

    sub (&C.3445, &"abcd"[1]{lb: 1 sz: 1}, 0B, 0B, 4, 0);
  }
  {
    static integer(kind=4) C.3446 = 2;
    static integer(kind=4) C.3447 = 4;

    sub (&C.3446, &C.3447, &"1234567"[1]{lb: 1 sz: 1}, 7);


here 7 is passed in place of a pointer arg.

IPA-CP needs to be hardened against such mismatches (I believe the -CP part
simply converts, the IPA-CP part needs to, too).

Of course this looks like an invalid testcase that should have been rejected?