[Bug tree-optimization/124788] tree-fnsummary.cc calls ptr_deref_may_alias_global_p on a non-pointer SSA name

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=124788

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2026-04-07

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
(In reply to Filip Kastl from comment #0)
> Compile the attached source file with trunk GCC using -O2 and debug the
> compilation using for example GDB (-wrapper gdb,--args).
> 
> Set a breakpoint at the tree-ssa-alias.cc:ptr_deref_may_alias_global_p
> function.  You'll see that it gets called on x_24.  That is not a pointer
> SSA name.  But ptr_deref_may_alias_global_p assumes the 'ptr' parameter *is*
> a pointer.  It ends up reading from ptr.ssa_name.info.ptr_info.  But info is
> an union and for x_24, ptr_deref_may_alias_global_p ends up reading garbage.
> 
>   1725   /* Value range information.  */
>   1726   union ssa_name_info_type {
>   1727     /* Range and aliasing info for pointers.  */
>   1728     struct GTY ((tag ("0"))) ptr_info_def *ptr_info;
>   1729     /* Range info for everything else.  */
>   1730     struct GTY ((tag ("1"))) vrange_storage * range_info;
>   1731   } GTY ((desc ("%1.typed.type ?" \
>   1732                 "!POINTER_TYPE_P (TREE_TYPE ((tree)&%1)) : 2"))) info;
> 
> I haven't seen this cause any ICEs or miscompilations.  I've merely noticed
> this while working on something else.  This could potentially cause problems
> in the future, so I think we should do something about it.
> 
> Seems to me that the fix could just be having
> ipa-fnsummary.cc:points_to_local_or_readonly_memory_p return false when
> !POINTER_TYPE_P(TREE_TYPE(t)) but I haven't looked into this thoroughly.

Yes, I agree.

> Also, we should probably have a
> gcc_checking_assert(POINTER_TYPE_P(TREE_TYPE(ptr)) in
> tree-ssa-alias.cc:ptr_deref_may_alias_global_p (and in other alias functions
> that assume pointer-ness).

ideally SSA_NAME_PTR_INFO would, as part of SSA_NAME_CHECK, also do
a pointer type check (similar SSA_NAME_RANGE_INFO).  Needs a separate
SSA_NAME_WITH_POINTER_TYPE_CHECK then, of course, or simply turning
SSA_NAME_PTR_INFO into a static inline function.

> Backtrace:
> 
> #0  ptr_deref_may_alias_global_p (ptr=0x7ffff7745dc0, escaped_local_p=false)
>     at ../../src/gcc/tree-ssa-alias.cc:238
> #1  0x000000000163aa24 in points_to_local_or_readonly_memory_p
> (t=0x7ffff7745dc0)
>     at ../../src/gcc/ipa-fnsummary.cc:2661
> #2  0x000000000163c485 in analyze_function_body (node=0x7ffff7735110,
> early=true)
>     at ../../src/gcc/ipa-fnsummary.cc:3078
> #3  0x000000000163e273 in compute_fn_summary (node=0x7ffff7735110,
> early=true)
>     at ../../src/gcc/ipa-fnsummary.cc:3518
> #4  0x000000000163e340 in compute_fn_summary_for_current () at
> ../../src/gcc/ipa-fnsummary.cc:3548
> #5  0x0000000001643e71 in (anonymous
> namespace)::pass_local_fn_summary::execute (this=0x4a679e0)
>     at ../../src/gcc/ipa-fnsummary.cc:5219
> #6  0x000000000188858a in execute_one_pass (pass=0x4a679e0) at
> ../../src/gcc/passes.cc:2656
> #7  0x00000000018889ce in execute_pass_list_1 (pass=0x4a679e0) at
> ../../src/gcc/passes.cc:2769
> #8  0x0000000001888a58 in execute_pass_list (fn=0x7ffff7681ea0,
> pass=0x4a66d30)
>     at ../../src/gcc/passes.cc:2780
> #9  0x0000000001886343 in do_per_function_toporder (
>     callback=0x1888a1b <execute_pass_list(function*, opt_pass*)>,
> data=0x4a66d30)
>     at ../../src/gcc/passes.cc:1785
> #10 0x00000000018896e7 in execute_ipa_pass_list (pass=0x4a66cd0) at
> ../../src/gcc/passes.cc:3123
> #11 0x000000000129251c in ipa_passes () at ../../src/gcc/cgraphunit.cc:2244
> #12 0x00000000012928b0 in symbol_table::compile (this=0x7ffff7806000)
>     at ../../src/gcc/cgraphunit.cc:2367
> #13 0x0000000001292ebd in symbol_table::finalize_compilation_unit
> (this=0x7ffff7806000)
>     at ../../src/gcc/cgraphunit.cc:2626
> #14 0x0000000001a1f633 in compile_file () at ../../src/gcc/toplev.cc:482
> #15 0x0000000001a22b59 in do_compile () at ../../src/gcc/toplev.cc:2225
> #16 0x0000000001a22fc0 in toplev::main (this=0x7fffffffd4da, argc=21,
> argv=0x7fffffffd608)
>     at ../../src/gcc/toplev.cc:2389
> #17 0x000000000388b79c in main (argc=21, argv=0x7fffffffd608) at
> ../../src/gcc/main.cc:39