[Bug tree-optimization/100512] New: [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os)

[Bug tree-optimization/100512] New: [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os)

[haoxintu at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

            Bug ID: 100512
           Summary: [12 Regression] ICE during GIMPLE pass: cddce in
                    mark_operand_necessary, at tree-ssa-dce.c:173  (under
                    -O2 to -Os)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: haoxintu at gmail dot com
  Target Milestone: ---

Hi all.

$cat small.c
#include <stdint.h>
int a;
void b() {
  int16_t *c;
  uint16_t d = 2;
  if (0 == d) {
    uint64_t e;
    uint64_t *f = &e;
    for (;;) {
      if (e += 0 >= 0)
        for (;;)
          ;
    g:
      for (; a;) {
        int16_t i = &d;
        *c = i && *f;
      }
    }
  }
  goto g;
}


$gcc -w -O2 
during GIMPLE pass: cddce
small.c: In function ‘b’:
small.c:21:1: internal compiler error: in mark_operand_necessary, at
tree-ssa-dce.c:173
   21 | }
      | ^
0x65b30e mark_operand_necessary
        ../../gcc/tree-ssa-dce.c:173
0xc86d76 propagate_necessity
        ../../gcc/tree-ssa-dce.c:852
0xc86d76 perform_tree_ssa_dce
        ../../gcc/tree-ssa-dce.c:1673
0xc887d5 tree_ssa_cd_dce
        ../../gcc/tree-ssa-dce.c:1717
0xc887d5 execute
        ../../gcc/tree-ssa-dce.c:1789
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
tuhaoxin@oscar-2020:~/dut-research/covsmith-test/20210502$ cat small.c
#include <stdint.h>
int a;
void b() {
  int16_t *c;
  uint16_t d = 2;
  if (0 == d) {
    uint64_t e;
    uint64_t *f = &e;
    for (;;) {
      if (e += 0 >= 0)
        for (;;)
          ;
    g:
      for (; a;) {
        int16_t i = &d;
        *c = i && *f;
      }
    }
  }
  goto g;
}

$gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/home/tuhaoxin/compilers/gcc/build/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure --prefix=/home/tuhaoxin/compilers/gcc/build/
--enable-bootstrap --enable-checking=release --enable-languages=c,c++
-disable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20210510 (experimental) (GCC) 

This crash only exists in the current trunk version of GCC, and the released
versions perform well. I also tested it on an earlier GCC trunk built on
20210425, it does not crash as well. So I think it's a regression issue in
GCC-12.


Thanks,
Haoxin

[Bug tree-optimization/100512] [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os)

[haoxintu at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

--- Comment #1 from Haoxin Tu <haoxintu at gmail dot com> ---

(In reply to Haoxin Tu from comment #0)

> $gcc -w -O2 

Sorry, it's an incomplete command here. It should be "gcc -w -O2 small.c".

[Bug tree-optimization/100512] [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os)

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-05-11
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com
   Target Milestone|---                         |12.0
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
checking reveals

during GIMPLE pass: evrp
t.c:21:1: internal compiler error: tree check: expected class 'type', have
'exceptional' (error_mark) in useless_type_conversion_p, at gimple-expr.c:88
   21 | }
      | ^
0x17569f1 tree_class_check_failed(tree_node const*, tree_code_class, char
const*, int, char const*)
        /home/rguenther/src/gcc3/gcc/tree.c:8724
0xa2a9cb tree_class_check(tree_node*, tree_code_class, char const*, int, char
const*)
        /home/rguenther/src/gcc3/gcc/tree.h:3479
0xec8f6c useless_type_conversion_p(tree_node*, tree_node*)
        /home/rguenther/src/gcc3/gcc/gimple-expr.c:88
0x138e103 verify_gimple_comparison
        /home/rguenther/src/gcc3/gcc/tree-cfg.c:3515
0x13946ef verify_gimple_cond
        /home/rguenther/src/gcc3/gcc/tree-cfg.c:4945

that's in

if (_26 != 0)

where we have a released SSA name.

[Bug tree-optimization/100512] [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os) since r12-623-g1416a1434c43de0b

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12 Regression] ICE during  |[12 Regression] ICE during
                   |GIMPLE pass: cddce in       |GIMPLE pass: cddce in
                   |mark_operand_necessary, at  |mark_operand_necessary, at
                   |tree-ssa-dce.c:173  (under  |tree-ssa-dce.c:173  (under
                   |-O2 to -Os)                 |-O2 to -Os) since
                   |                            |r12-623-g1416a1434c43de0b
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-623-g1416a1434c43de0b.

[Bug tree-optimization/100512] [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os) since r12-623-g1416a1434c43de0b

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

--- Comment #4 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
After the mentioned commit, e_27(D) is considered undefined, and since
_3 is [0,0], e_26 folds to [0,0] and the PHI is marked for removal:

# e_26 = PHI <e_27(D)(2), _3(13)>

However, when propagating to the uses of e_26 (replace_uses_in) here:

  if (e_26 != 0)

...value_of_expr() returns NULL, because get_non_stale_global_range()
considers the value of e_26 stale:

  if (m_globals.get_global_range (r, name))
    {
      if (m_temporal->current_p (name))
        return true;
    }

The dependencies for e_26 are e_27 and _3, per the PHI, but _3 has a
later time stamp.

The full IL follows.  Notice the interdependence between e_26 and _3.

void b ()
{
  int16_t i;
  uint64_t * f;
  uint64_t e;
  uint16_t d;
  int16_t * c;
  long unsigned int _3;
  long int d.3_5;
  short int _7;
  int a.5_8;
  int iftmp.4_11;

  <bb 2> :
  d = 2;
  // predicted unlikely by goto predictor.
  goto <bb 9>; [INV]

  <bb 3> :
  # e_25 = PHI <e_26(10)>
  _3 = e_25 + 1;
  if (_3 != 0)
    goto <bb 4>; [INV]
  else
    goto <bb 9>; [INV]

  <bb 4> :
  goto <bb 4>; [INV]

  <bb 5> :
  d.3_5 = (long int) &d;
  i_19 = (int16_t) d.3_5;
  if (i_19 != 0)
    goto <bb 6>; [INV]
  else
    goto <bb 7>; [INV]

  <bb 6> :
  if (e_26 != 0)
    goto <bb 8>; [INV]
  else
    goto <bb 7>; [INV]

  <bb 7> :

  <bb 8> :
  # iftmp.4_11 = PHI <1(6), 0(7)>
  _7 = (short int) iftmp.4_11;
  *c_22(D) = _7;
  goto <bb 10>; [INV]

  <bb 9> :
  # e_26 = PHI <e_27(D)(2), _3(3)>
g:

  <bb 10> :
  a.5_8 = a;
  if (a.5_8 != 0)
    goto <bb 5>; [INV]
  else
    goto <bb 3>; [INV]

}

[Bug tree-optimization/100512] [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os) since r12-623-g1416a1434c43de0b

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

--- Comment #5 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
*** Bug 100578 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/100512] [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os) since r12-623-g1416a1434c43de0b

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zhendong.su at inf dot ethz.ch

--- Comment #6 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
*** Bug 100636 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/100512] [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os) since r12-623-g1416a1434c43de0b

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

--- Comment #7 from Andrew Macleod <amacleod at redhat dot com> ---


# e_25 = PHI <e_26(10)>
 _3 = e_25 + 1;
 if (_3 != 0)
   goto <bb 4>; [INV]
 else
   goto <bb 9>; [INV]

<...>

<bb 9> :
 # e_26 = PHI <e_27(D)(2), _3(3)>

in order to take the edge 3->9, _3 must be [0,0].   _27 is used before defined,
so we now use UNDEFINED for that.  This allows the PHI to be folded to [0,0]

This in turn feeds the PHI for e_25, and means e_25 must be [0,0]

_3 is now confidently calculated as [0,0] + 1, making it [1,1]

BUT. we just concluded that _3 must be [0,0] in order to feed the PHI, so
ranger now decides that means _3 and e_26 are actually UNDEFINED.. which is
true. This entire hunk of code is about to be removed, so we don't really need
to do anything to it.

However, the early VRP pass has concluded that since e_26 and _3 are constants,
we can propagate the constant value.   It does not consider UNDEFINED to be a
constant value, so the propagation code was trapping because it had eliminated
the definition of e_26, expecting it to be replaced with [0,0], not  UNDEFINED.

Probably the best way to fix this entire class of propagation errors is to do
what we do with non-zero pointers.  Once we get to a globally constant range
where further refinements can only end up in an UNDEFINED state, stop further
evaluating the range.  This typically happens in places which are about to be
removed by CFG cleanup anyway.


Patch is in testing

[Bug tree-optimization/100512] [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os) since r12-623-g1416a1434c43de0b

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Andrew Macleod <amacleod@gcc.gnu.org>:

https://gcc.gnu.org/g:3f476de7fd274f619a0b04c2e2f7077ee8ab17a5

commit r12-852-g3f476de7fd274f619a0b04c2e2f7077ee8ab17a5
Author: Andrew MacLeod <amacleod@redhat.com>
Date:   Mon May 17 15:53:39 2021 -0400

    Once a range becomes constant, make it invariant.

    Once a range is forced to a constant globally, simply make it invariant.
    Unify this with the code which makes non-zero pointer ranges invariant.

            gcc/
            PR tree-optimization/100512
            * gimple-range-cache.cc (ranger_cache::set_global_range): Mark
const
            and non-zero pointer ranges as invariant.
            * gimple-range.cc (gimple_ranger::range_of_stmt): Remove pointer
            processing from here.

            gcc/testsuite/
            PR tree-optimization/100512
            * gcc.dg/pr100512.c: New.

[Bug tree-optimization/100512] [12 Regression] ICE during GIMPLE pass: cddce in mark_operand_necessary, at tree-ssa-dce.c:173 (under -O2 to -Os) since r12-623-g1416a1434c43de0b

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=100512

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Martin Liška <marxin at gcc dot gnu.org> ---
I guess it's fixed now.