[Bug tree-optimization/91570] New: [10 Regression] ICE in get_range_strlen_dynamic on a conditional of two strings

[msebor at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=91570

            Bug ID: 91570
           Summary: [10 Regression] ICE in get_range_strlen_dynamic on a
                    conditional of two strings
           Product: gcc
           Version: 9.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: msebor at gcc dot gnu.org
  Target Milestone: ---

A snprintf call with the conditional expression involving a string of known
length (zero) and another of some minimum length (at least 1) triggers an ICE
in the get_range_strlen_dynamic function newly added in r274933.

$ cat z.c && gcc -O2 -S -Wall -fdump-tree-strlen=/dev/stdout z.c
extern char a[], b[];

void f (int i)
{
  a[0] = 0; 
  b[0] = '1';

  const char *p = i ? b : a;

  if (__builtin_snprintf (0, 0, "%s", p) < 4)
    __builtin_abort ();  
}

;; Function f (f, funcdef_no=0, decl_uid=1926, cgraph_uid=1, symbol_order=0)

;; 1 loops found
;;
;; Loop 0
;;  header 0, latch 1
;;  depth 0, outer -1
;;  nodes: 0 1 2 3 4 5 6
;; 2 succs { 3 4 }
;; 3 succs { 4 }
;; 4 succs { 5 6 }
;; 5 succs { }
;; 6 succs { 1 }
z.c:10: __builtin_snprintf: objsize = 9223372036854775807, fmtstr = "%s"
  Directive 1 at offset 0: "%s"
during GIMPLE pass: strlen
dump file: /dev/stdout



EMERGENCY DUMP:

f (int i)
{
  int _1;
  char[<unknown>] * iftmp.0_2;

  <bb 2> [local count: 1073741824]:
  a[0] = 0;
  b[0] = 49;
  if (i_6(D) != 0)
    goto <bb 3>; [50.00%]
  else
    goto <bb 4>; [50.00%]

  <bb 3> [local count: 536870912]:

  <bb 4> [local count: 1073741824]:
  # iftmp.0_2 = PHI <&a(2), &b(3)>
  _1 = __builtin_snprintf (0B, 0, "%s", iftmp.0_2);
  if (_1 <= 3)
    goto <bb 5>; [0.00%]
  else
    goto <bb 6>; [100.00%]

  <bb 5> [count: 0]:
  __builtin_abort ();

  <bb 6> [local count: 1073741824]:
  return;

}


z.c: In function ‘f’:
z.c:3:6: internal compiler error: Segmentation fault
    3 | void f (int i)
      |      ^
0x11c54ca crash_signal
        /src/gcc/svn/gcc/toplev.c:326
0x815854 contains_struct_check(tree_node const*, tree_node_structure_enum, char
const*, int, char const*)
        /src/gcc/svn/gcc/tree.h:3632
0x84e032 wi::extended_tree<192>::extended_tree(tree_node const*)
        /src/gcc/svn/gcc/tree.h:5802
0x84cedf generic_wide_int<wi::extended_tree<192> >::generic_wide_int<tree_node
const*>(tree_node const* const&)
        /src/gcc/svn/gcc/wide-int.h:782
0x84ca19 wi::to_widest(tree_node const*)
        /src/gcc/svn/gcc/tree.h:5729
0x84ca3b tree_int_cst_lt(tree_node const*, tree_node const*)
        /src/gcc/svn/gcc/tree.h:5982
0x14bdde1 get_range_strlen_dynamic
        /src/gcc/svn/gcc/tree-ssa-strlen.c:916
0x14be432 get_range_strlen_dynamic(tree_node*, c_strlen_data*, vr_values
const*)
        /src/gcc/svn/gcc/tree-ssa-strlen.c:1037
0x2047374 get_string_length
        /src/gcc/svn/gcc/gimple-ssa-sprintf.c:1980
0x204796b format_string
        /src/gcc/svn/gcc/gimple-ssa-sprintf.c:2170
0x2049274 format_directive
        /src/gcc/svn/gcc/gimple-ssa-sprintf.c:2730
0x204b522 compute_format_length
        /src/gcc/svn/gcc/gimple-ssa-sprintf.c:3532
0x204cdec handle_printf_call(gimple_stmt_iterator*, vr_values const*)
        /src/gcc/svn/gcc/gimple-ssa-sprintf.c:4199
0x14c8560 strlen_check_and_optimize_call
        /src/gcc/svn/gcc/tree-ssa-strlen.c:4445
0x14c8ed3 check_and_optimize_stmt
        /src/gcc/svn/gcc/tree-ssa-strlen.c:4581
0x14c9a08 strlen_dom_walker::before_dom_children(basic_block_def*)
        /src/gcc/svn/gcc/tree-ssa-strlen.c:4808
0x1fbf79c dom_walker::walk(basic_block_def*)
        /src/gcc/svn/gcc/domwalk.c:309
0x14c9cdc printf_strlen_execute
        /src/gcc/svn/gcc/tree-ssa-strlen.c:4872
0x14c9f72 execute
        /src/gcc/svn/gcc/tree-ssa-strlen.c:4974
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.