[Bug tree-optimization/100349] New: [11/12 Regression] ICE Segmentation fault during GIMPLE pass: evrp (under -O2 to -Os)

[Bug tree-optimization/100349] New: [11/12 Regression] ICE Segmentation fault during GIMPLE pass: evrp (under -O2 to -Os)

[haoxintu at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100349

            Bug ID: 100349
           Summary: [11/12 Regression] ICE Segmentation fault during
                    GIMPLE pass: evrp (under -O2 to -Os)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: haoxintu at gmail dot com
  Target Milestone: ---

Hi, all.

$cat small.c
#include <stdint.h>
uint8_t a;
b(int8_t c) {
  int d;
e:
  uint32_t f;
  for (;;)
    for (c = 10; c; c++)
      if (0 > (a = c) ?: d) {
        f = a;
        goto e;
      }
}

$gcc -w -O2 small.c
during GIMPLE pass: evrp
small.c: In function ‘b’:
small.c:13:1: internal compiler error: Segmentation fault
   13 | }
      | ^
0xb9ec1f crash_signal
        ../../gcc/toplev.c:327
0xe5a92b bounds_of_var_in_loop(tree_node**, tree_node**, range_query*, loop*,
gimple*, tree_node*)
        ../../gcc/vr-values.c:1658
0x146fa91 gimple_ranger::range_of_ssa_name_with_loop_info(irange&, tree_node*,
loop*, gphi*)
        ../../gcc/gimple-range.cc:1220
0x146fd83 gimple_ranger::range_of_phi(irange&, gphi*)
        ../../gcc/gimple-range.cc:568
0x147017d gimple_ranger::calc_stmt(irange&, gimple*, tree_node*)
        ../../gcc/gimple-range.cc:376
0x14704a1 gimple_ranger::range_of_stmt(irange&, gimple*, tree_node*)
        ../../gcc/gimple-range.cc:1068
0x146c040 gimple_ranger::range_of_expr(irange&, tree_node*, gimple*)
        ../../gcc/gimple-range.cc:960
0xe1a0e1 range_query::value_of_expr(tree_node*, gimple*)
        ../../gcc/value-query.cc:86
0x147a6f1 hybrid_folder::value_of_expr(tree_node*, gimple*)
        ../../gcc/gimple-ssa-evrp.c:235
0xcf836d substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
        ../../gcc/tree-ssa-propagate.c:1072
0x14482d7 dom_walker::walk(basic_block_def*)
        ../../gcc/domwalk.c:309
0xcf7a35 substitute_and_fold_engine::substitute_and_fold(basic_block_def*)
        ../../gcc/tree-ssa-propagate.c:1283
0x147a366 execute_early_vrp
        ../../gcc/gimple-ssa-evrp.c:349
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/home/tuhaoxin/compilers/gcc/build-20210425/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure
--prefix=/home/tuhaoxin/compilers/gcc/build-20210425/ --enable-bootstrap
--enable-checking=release --enable-languages=c,c++ --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20210425 (experimental) (GCC) 

This issue may start from one of the commits in GCC-11, and it's performed well
in released GCC-10.3.0 downwards versions.

Another weird behavior is that this code is accepted under -O1 in GCC-11 and
GCC-12 while rejected in other released GCC versions. I guess there might be a
problem here?

Reproduced in Godbolt: https://godbolt.org/z/E7K9Ghjcc

Thanks
Haoxin

[Bug tree-optimization/100349] [11/12 Regression] ICE Segmentation fault during GIMPLE pass: evrp (under -O2 to -Os)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100349

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com
           Priority|P3                          |P2
   Target Milestone|---                         |11.2
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-04-30

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.  I'll split out the accepts-invalid issue.

[Bug tree-optimization/100349] [11/12 Regression] ICE Segmentation fault during GIMPLE pass: evrp (under -O2 to -Os)

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100349

--- Comment #2 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
evolution_part_in_loop_num() is returning NULL when evrp asks about the PHI
result here:

(gdb) p debug(stmt)
c.1_4 = PHI <c.1_1(4)>

Is this expected?

If it is, we could easily return false if step is null and everything should
just work.

[Bug tree-optimization/100349] [11/12 Regression] ICE Segmentation fault during GIMPLE pass: evrp (under -O2 to -Os)

[tlwang at uwaterloo dot ca]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100349

Theodore Wang <tlwang at uwaterloo dot ca> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |tlwang at uwaterloo dot ca

--- Comment #3 from Theodore Wang <tlwang at uwaterloo dot ca> ---
A possible duplicate:

$ /home/cnsun/usr/bin/gcc-trunk -v
Using built-in specs.
COLLECT_GCC=/home/cnsun/usr/bin/gcc-trunk
COLLECT_LTO_WRAPPER=/scratch/software/gcc-trunk/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/configure
--enable-languages=c,c++,lto --enable-checking-yes --enable-multiarch
--prefix=/scratch/software/gcc-trunk --disable-bootstrap
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20210511 (experimental) [master revision
:61d4686bb:71d38ec80008afdbb9a059253407d80598b765c0] (GCC)

$ cat program3.c
int a;
void c() {
  char b;
d:
  for (;;) {
    b = -16;
    for (; b; b = ({
                unsigned char e = b;
                e + 1;
              }))
      for (;;) {
        if (a)
          break;
        unsigned f = b;
        goto d;
      }
  }
}

$ /home/cnsun/usr/bin/gcc-trunk -O2 -c program3.c
during GIMPLE pass: evrp
program3.c: In function ‘c’:
program3.c:18:1: internal compiler error: Segmentation fault
   18 | }
      | ^
0xef6d63 crash_signal
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/toplev.c:327
0x12630f3 bounds_of_var_in_loop(tree_node**, tree_node**, range_query*, loop*,
gimple*, tree_node*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/vr-values.c:1658
0x191d98d gimple_ranger::range_of_ssa_name_with_loop_info(irange&, tree_node*,
loop*, gphi*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/gimple-range.cc:1229
0x191dd2b gimple_ranger::range_of_phi(irange&, gphi*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/gimple-range.cc:568
0x191e15d gimple_ranger::calc_stmt(irange&, gimple*, tree_node*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/gimple-range.cc:376
0x191e514 gimple_ranger::range_of_stmt(irange&, gimple*, tree_node*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/gimple-range.cc:1077
0x19192a2 gimple_ranger::range_of_expr(irange&, tree_node*, gimple*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/gimple-range.cc:960
0x120f8b4 range_query::value_of_expr(tree_node*, gimple*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/value-query.cc:86
0x192b125 hybrid_folder::value_of_expr(tree_node*, gimple*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/gimple-ssa-evrp.c:235
0x10ab78d substitute_and_fold_dom_walker::before_dom_children(basic_block_def*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/tree-ssa-propagate.c:776
0x18ed787 dom_walker::walk(basic_block_def*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/domwalk.c:309
0x10aad29 substitute_and_fold_engine::substitute_and_fold(basic_block_def*)
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/tree-ssa-propagate.c:987
0x192ad8e execute_early_vrp
        /tmp/tmp.BriefQJ2R3-gcc-builder/gcc/gcc/gimple-ssa-evrp.c:349
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/100349] [11/12 Regression] ICE Segmentation fault during GIMPLE pass: evrp (under -O2 to -Os)

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100349

--- Comment #4 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Yes, it's a duplicate.  There's a patch awaiting review here:

https://gcc.gnu.org/pipermail/gcc-patches/2021-May/570301.html

[Bug tree-optimization/100349] [11/12 Regression] ICE Segmentation fault during GIMPLE pass: evrp (under -O2 to -Os)

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100349

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Aldy Hernandez <aldyh@gcc.gnu.org>:

https://gcc.gnu.org/g:ce81282261c6c77883b17d0ebfbbe337bed76457

commit r12-842-gce81282261c6c77883b17d0ebfbbe337bed76457
Author: Aldy Hernandez <aldyh@redhat.com>
Date:   Thu May 13 16:09:58 2021 -0400

    Bail in bounds_of_var_in_loop if scev returns NULL.

    Both initial_condition_in_loop_num and evolution_part_in_loop_num
    can return NULL.  This patch exits if either one is NULL.  Presumably
    this didn't happen before, because adjust_range_with_scev was called
    far less frequently than in ranger, which can call it for every PHI.

    gcc/ChangeLog:

            PR tree-optimization/100349
            * vr-values.c (bounds_of_var_in_loop): Bail if scev returns
              NULL.

    gcc/testsuite/ChangeLog:

            * gcc.dg/pr100349.c: New test.

[Bug tree-optimization/100349] [11 Regression] ICE Segmentation fault during GIMPLE pass: evrp (under -O2 to -Os)

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100349

Andrew Macleod <amacleod at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Andrew Macleod <amacleod at redhat dot com> ---
fixed