c: `__builtin_unreachable()` as an operand of a larger expression still emits rows after UNREACHABLE (`sink((__builtin_unreachable(), x));`) — invalid IR by default, rejected under -fno-frontend-ssa

[davidgmbb]

Summary

#1682 and #1743 (closing #1503 and #1736) keep the block open after a noreturn call until the value's consumer, or the whole expression statement, has emitted its rows. __builtin_unreachable() does not go through that path. It always ends the block at once, so the rest of the enclosing expression is emitted behind the UNREACHABLE.

The C below is valid, and Clang 18.1.3 and GCC 13.3.0 accept it with -fsyntax-only -Wall:

void sink(int);
int arg(int x)    { sink((__builtin_unreachable(), x)); return x; }
int init(int x)   { int y = (__builtin_unreachable(), x + 1); return y; }
int assign(int x) { x = (__builtin_unreachable(), 0); return x; }
int ret(int x)    { return (__builtin_unreachable(), x); }
int stmt(int x)   { if (x) __builtin_unreachable(); return x; }   /* control: statement level */

Observed on main 126cc437e5935f2c829780597c0a8f67e203a22d

Function	default	-fverify-codegen	-fno-frontend-ssa (no verify)
arg	compiles, no diagnostic	canonical input, error 3, … instruction 3, opcode 18	local-promotion output, error 3, … opcode 18
init	compiles, no diagnostic	canonical input, error 3, … opcode 14	local-promotion output, error 3, … opcode 14
assign	compiles, no diagnostic	canonical input, error 3, … opcode 14	local-promotion output, error 3, … opcode 14
ret	unsupported C function-body statement or expression near 'x'	same	same
stmt	compiles	passes	compiles

• Error 3 is INSTRUCTION_AFTER_TERMINATOR.
• As with c: a noreturn call inside an expression statement (sink((die(), x));, (void)exit(1);) still emits rows after UNREACHABLE on main — invalid IR by default, rejected under -fno-frontend-ssa #1736, the default path does not detect the invalid IR. Certified input skips the input check, and a failing FAST guard only disables FAST (c(C23): T f(); is treated as unprototyped in type compatibility, so a conflicting prototype is accepted and canonical IR is invalid #1306).
• ade6ac4, from before c: keep a noreturn call's block open when a return/initializer consumes its value (#1503) #1682, gives the same results for all five. So this is older than those fixes; they just do not cover the builtin.

Cause

The __builtin_unreachable branch of the prepared-call loop (c_gen.c:20646–20660 at 126cc43) appends UNREACHABLE and stores terminated = true unconditionally:

IrInstruction unreachable = c_ir_instruction_initialize(IR_OPCODE_UNREACHABLE, builder->void_type);
c_ir_append_instruction(builder, unreachable, unreachable_source);
builder->function->blocks[builder->current_block.value].terminated = true;

The noreturn-call path goes through c_ir_end_control_flow_after_call, which asks c_ir_lowering_branch_resumes_after_call whether a consumer resumes after the value, and defers the close to the end of an expression statement (#1743). The builtin branch skips both. Routing it through c_ir_end_control_flow_after_call(builder, true, unreachable_source) would probably fix the first three rows. That is untested; the #1325 branch noted on #1503 made that same change.

Known fix, with measurements

#1453 merged with this main (local merge commit 81172a59) handles the cases like this:

• arg, init, assign: they compile and pass -fverify-codegen under both -ffrontend-ssa and -fno-frontend-ssa. ir: make block-row validity (ownership, termination, result binding) a construction-time invariant #1453's c_ir_reopen_unreachable_marker retracts the edge-less marker when the next row arrives.
• stmt: it passes.
• ret: it passes under -fno-frontend-ssa. Under -ffrontend-ssa it is still rejected with the same "unsupported … near 'x'". That rejection is separate and not addressed by ir: make block-row validity (ownership, termination, result binding) a construction-time invariant #1453.

Done when

• arg, init and assign pass -fverify-codegen in both frontend forms, and -fno-frontend-ssa accepts them.
• ret compiles, like return (die(), x); does since c: keep a noreturn call's block open when a return/initializer consumes its value (#1503) #1682.
• A statement-level __builtin_unreachable(); still ends its block in UNREACHABLE.
• The rows are registered next to c: keep a noreturn call's block open when a return/initializer consumes its value (#1503) #1682's c_test_noreturn_call_value_operands and c: an expression statement containing a noreturn call ends its block after its own rows (#1736) #1743's tests.

Environment

• Release ide built from 126cc437 and from ade6ac4, with Clang 18.1.3 on x86-64 Linux. This uses the hosted-Clang bootstrap exception, because the container has no TCC (dev-env: agent cloud containers have no TCC, so ./build.sh exits 127 and sessions fall back to a Clang-built driver the guides call non-trusted #1383).
• Reference compilers: Clang 18.1.3 and GCC 13.3.0.

Related

• c: return die_value(); (returning a noreturn call's value) is rejected as "unsupported", while -fsyntax-only accepts it #1503 / c: keep a noreturn call's block open when a return/initializer consumes its value (#1503) #1682 and c: a noreturn call inside an expression statement (sink((die(), x));, (void)exit(1);) still emits rows after UNREACHABLE on main — invalid IR by default, rejected under -fno-frontend-ssa #1736 / c: an expression statement containing a noreturn call ends its block after its own rows (#1736) #1743: the same fault for noreturn calls.
• ir: make block-row validity (ownership, termination, result binding) a construction-time invariant #1453: construction-time block termination, which covers arg, init and assign.
• Canonical IR: make the block-row family (chain ownership, termination, result binding) construction-time invariants #1448: the design issue.