[Bug middle-end/101290] ICE with -O1 on valid code: in maybe_canonicalize_mem_ref_addr, at gimple-fold.c:5976

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101290

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|                            |accepts-invalid
          Component|tree-optimization           |middle-end
                 CC|                            |jsm28 at gcc dot gnu.org
            Version|tree-ssa                    |12.0

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
We're asking get_addr_base_and_unit_offset on arg0 of

MEM[(volatile int *)&MEM[(struct  *)&h].f]

and the FIELD_DECL is

 <field_decl 0x7ffff66a48e8 f
    type <record_type 0x7ffff6677e70 type_0 BLK
        size <integer_cst 0x7ffff6686220 constant public overflow
0x256fa5b99019a5c80>
        unit-size <integer_cst 0x7ffff66a33c0 constant public overflow
5395113836446698384>
        align:32 warn_if_not_align:0 symtab:0 alias-set -1 canonical-type
0x7ffff6677e70
        fields <field_decl 0x7ffff66a44c0 b type <record_type 0x7ffff6677f18>
            BLK t.c:56:7
            size <integer_cst 0x7ffff66861c0 constant 0x21165458500521280>
            unit-size <integer_cst 0x7ffff66a3330 constant 4768371582031250000>
            align:32 warn_if_not_align:0 offset_align 128
            offset <integer_cst 0x7ffff6543d20 constant 0>
            bit-offset <integer_cst 0x7ffff6543d68 constant 0> context
<record_type 0x7ffff6677e70> chain <field_decl 0x7ffff66a4558 c>> context
<translation_unit_decl 0x7ffff6551b40 t.c>
        pointer_to_this <pointer_type 0x7ffff669ce70> chain <type_decl
0x7ffff656b4c0 D.1944>>
    BLK t.c:57:11 size <integer_cst 0x7ffff6686220 overflow
0x256fa5b99019a5c80> unit-size <integer_cst 0x7ffff66a33c0 overflow
5395113836446698384>
    align:32 warn_if_not_align:0 offset_align 32
    offset <integer_cst 0x7ffff6686240 type <integer_type 0x7ffff655c000
sizetype> constant public overflow 10790227672893396768> bit-offset
<integer_cst 0x7ffff6543d68 0> context <record_type 0x7ffff6677dc8>>

and we hit

        case COMPONENT_REF:
          {
            tree field = TREE_OPERAND (exp, 1);
            tree this_offset = component_ref_field_offset (exp);
            poly_int64 hthis_offset;

            if (!this_offset
                || !poly_int_tree_p (this_offset, &hthis_offset)
                || (TREE_INT_CST_LOW (DECL_FIELD_BIT_OFFSET (field))
                    % BITS_PER_UNIT))
              return NULL_TREE;

because this_offset doesn't fit the signed poly_int64.  IIRC we do have to
support negative field offsets.

Eventually this testcase is invalid since sizeof (*g) is bigger than half
of the address space.  Joseph?  We seem to happily wrap TYPE_SIZE[_UNIT]
even over the sizetype bounds without diagnosing anything - we do emit
some diagnostics from layout_type so that might be the place to complain
(we could then set TYPE_SIZE[_UNIT] to error_mark_node).

 <record_type 0x7ffff6677dc8 type_0 BLK
    size <integer_cst 0x7ffff66862a0 type <integer_type 0x7ffff655c0a8
bitsizetype> constant public overflow 0x704ef12cb04cf1580>
    unit-size <integer_cst 0x7ffff6686260 type <integer_type 0x7ffff655c000
sizetype> constant public overflow 16185341509340095152>