crash on cast of fwrite address

[nlewycky]

Bugzilla Link	910
Resolution	FIXED
Resolved on	Feb 22, 2010 12:43
Version	1.7
OS	All

Extended Description

This code came out of the CBE when I was running bugpoint. Amazingly, it crashes
llvm-gcc:

$ llvm-gcc -O0 -emit-llvm 000.c -c -o 000.bc
000.c: In function ‘Usage’:
000.c:7: internal compiler error: Segmentation fault
Please submit a full bug report,
with preprocessed source if appropriate.
See URL:http://llvm.org/bugs for instructions.

Here's the code reduced snippet:

struct l_struct_2E_FILE { char x; };
unsigned fwrite(signed char *, unsigned , unsigned , signed char *);
static signed char str301[39];
static void Usage(signed char *ltmp_611_6) {
struct l_struct_2E_FILE ltmp_6202_16;
unsigned ltmp_6203_92;
ltmp_6203_92 = /tail/ ((unsigned () (signed char *, unsigned , unsigned ,
struct l_struct_2E_FILE ))(void)fwrite)((&(str301[0u])), 38u, 1u, ltmp_6202_16);
}

It crashes even if you remove the first line defining struct l_struct_2E_FILE,
but then it ceases to be a crash on valid.

[nlewycky]

assigned to @lattner

[nlewycky]

I've found that it crashes with this commandline:

llvm-gcc/install/libexec/gcc/i686-pc-linux-gnu/4.0.1/cc1 -iprefix
/usr/local/lib/gcc/i686-pc-linux-gnu/4.0.1/ -dumpbase pr910.c -mtune=pentiumpro
-auxbase pr910 pr910.c -o /tmp/ccJmCdWb.s

With that, I get this backtrace from gdb:

Program received signal SIGSEGV, Segmentation fault.
[Switching to Thread 1434541600 (LWP 29118)]
fold_builtin (exp=0x55b4a09c, ignore=false) at ../../src/gcc/builtins.c:7940
7940 tree type = TREE_TYPE (TREE_TYPE (fndecl));
Current language: auto; currently c
(gdb) bt
#​0 fold_builtin (exp=0x55b4a09c, ignore=false)
at ../../src/gcc/builtins.c:7940
#​1 0x080e74f0 in gimplify_call_expr (expr_p=0x55af536c, pre_p=0xffffb8f4,
want_value=true) at ../../src/gcc/gimplify.c:1863
#​2 0x080e0d68 in gimplify_expr (expr_p=0x55af536c, pre_p=0xffffb8f4,
post_p=, gimple_test_f=0x80dc6b0 <is_gimple_reg_rhs>,
fallback=fb_rvalue) at ../../src/gcc/gimplify.c:3902
#​3 0x080e07de in gimplify_expr (expr_p=0x55af4098, pre_p=0xffffb8f4,
post_p=0xffffb8f0, gimple_test_f=0x80dc5c0 <is_gimple_stmt>,
fallback=fb_none) at ../../src/gcc/gimplify.c:3058
#​4 0x080e3c0c in gimplify_stmt (stmt_p=0x55af4098)
at ../../src/gcc/gimplify.c:3742
#​5 0x080e0882 in gimplify_expr (expr_p=0x55b4a15c, pre_p=0xffffb9b4,
post_p=0xffffb9b0, gimple_test_f=0x80dc5c0 <is_gimple_stmt>,
fallback=fb_none) at ../../src/gcc/gimplify.c:3208
#​6 0x080e3c0c in gimplify_stmt (stmt_p=0x55b4a15c)
at ../../src/gcc/gimplify.c:3742
#​7 0x080e44d7 in gimplify_to_stmt_list (stmt_p=0x55b4a15c)
at ../../src/gcc/gimplify.c:3750
#​8 0x080e45be in gimplify_bind_expr (expr_p=0x55b514a0, temp=0x0,
pre_p=0xffffbae4) at ../../src/gcc/gimplify.c:913
#​9 0x080e0d4d in gimplify_expr (expr_p=0x55b514a0, pre_p=0xffffbae4,
post_p=, gimple_test_f=0x80dc5c0 <is_gimple_stmt>,
fallback=fb_none) at ../../src/gcc/gimplify.c:4034
#​10 0x080e3c0c in gimplify_stmt (stmt_p=0x55b514a0)
at ../../src/gcc/gimplify.c:3742
#​11 0x080e3c94 in gimplify_body (body_p=0x55b514a0, fndecl=0x55b51438,
do_parms=true) at ../../src/gcc/gimplify.c:4642
#​12 0x080e400a in gimplify_function_tree (fndecl=0x55b51438)
at ../../src/gcc/gimplify.c:4701
#​13 0x080b1a4c in c_genericize (fndecl=0x55b51438)
at ../../src/gcc/c-gimplify.c:136
#​14 0x0805e7ea in finish_function () at ../../src/gcc/c-decl.c:6729
#​15 0x08054750 in yyparse () at c-parse.y:436
#​16 0x080556fb in c_parse_file () at c-parse.y:3438
#​17 0x080a4b8a in c_common_parse_file (set_yydebug=0)
at ../../src/gcc/c-opts.c:1221
#​18 0x082d1a1b in toplev_main (argc=11, argv=0xffffc6c4)
at ../../src/gcc/toplev.c:1105
#​19 0x080ba482 in main (argc=-1983893163, argv=0x89c35de5)
at ../../src/gcc/llvm-main.cpp:37
(gdb)

Hm, that makes it look a bit like a non-LLVM issue to me. Anyone?

[lattner]

Fixed.  Testcase here:
Regression/CFrontend/2006-09-18-fwrite-cast-crash.c

Patch applied to llvm-gcc svn.

-Chris