https://gcc.gnu.org/bugzilla/show_bug.cgi?id=128008

            Bug ID: 128008
           Summary: wrong code at -O2: store through a restrict member
                    pointing to its own struct type is deleted
           Product: gcc
           Version: 17.0
            Status: UNCONFIRMED
          Keywords: wrong-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: kyuwoncho18 at gmail dot com
  Target Milestone: ---
            Target: x86_64-pc-linux-gnu

#include <stdlib.h>
struct T { int v; struct T *restrict next; };

__attribute__((noipa)) void f(struct T *restrict p) {
  p->next->v = 7;
}

int main(void) {
  struct T *q = malloc(sizeof *q);
  q->next = malloc(sizeof *q);
  q->next->v = 2;
  f(q);
  if (q->next->v != 7)
    __builtin_abort();
}

godbolt: https://godbolt.org/z/Mr8jvTYMG

With -O0 or -O1 the program exits normally, but with -O2, -O3 or -Os f is
compiled to a bare ret (the store p->next->v = 7 is gone) and the program
aborts. -fno-tree-pta avoids it. Nothing else accesses *p or *p->next while f
runs, and main reads q->next->v only after f returns, so neither restrict
qualifier is violated.

Disclaimer: This test case was generated by a fuzzer, and the report was
written with LLM assistance.

Reply via email to