[Bug tree-optimization/101242] New: Segfault in SLP vectorizor after 2ad71efb5de

[Bug tree-optimization/101242] New: Segfault in SLP vectorizor after 2ad71efb5de

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

            Bug ID: 101242
           Summary: Segfault in SLP vectorizor after 2ad71efb5de
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jamborm at gcc dot gnu.org
                CC: rguenth at gcc dot gnu.org
  Target Milestone: ---
              Host: x86_64-linux
            Target: x86_64-linux

Since commit 2ad71efb5de (fix BB reduc permute elide with life stmts), the
following testcase (reduced from 433.milc) ICEs for me when compiled at -Ofast
(on x86_64-linux with generic march):

typedef struct {
  double real;
  double imag;
} complex;
typedef struct {
  complex e[3][3];
} su3_matrix;
su3_matrix check_su3_c;
double check_su3_ar, check_su3_ari, check_su3_max;
int arireturn();
int check_su3() {
  check_su3_ar = check_su3_c.e[0][0].real * check_su3_c.e[1][0].real +
                 check_su3_c.e[0][0].imag * check_su3_c.e[1][0].imag +
                 check_su3_c.e[0][1].real * check_su3_c.e[1][1].real +
                 check_su3_c.e[0][1].imag * check_su3_c.e[1][1].imag +
                 check_su3_c.e[0][2].real * check_su3_c.e[1][2].real +
                 check_su3_c.e[0][2].imag * check_su3_c.e[1][2].imag;
  check_su3_max = check_su3_c.e[0][0].real * check_su3_c.e[2][0].real +
                  check_su3_c.e[0][0].imag * check_su3_c.e[2][0].imag +
                  check_su3_c.e[0][1].real * check_su3_c.e[2][1].real +
                  check_su3_c.e[0][1].imag * check_su3_c.e[2][1].imag +
                  check_su3_c.e[0][2].real * check_su3_c.e[2][2].real +
                  check_su3_c.e[0][2].imag * check_su3_c.e[2][2].imag;
  check_su3_ari = check_su3_ar;
  if (check_su3_ari)
    check_su3_max = check_su3_c.e[1][0].real * check_su3_c.e[2][0].real +
                    check_su3_c.e[1][0].imag * check_su3_c.e[2][0].imag +
                    check_su3_c.e[1][1].real * check_su3_c.e[2][1].real +
                    check_su3_c.e[1][1].imag * check_su3_c.e[2][1].imag +
                    check_su3_c.e[1][2].real * check_su3_c.e[2][2].real +
                    check_su3_c.e[1][2].imag * check_su3_c.e[2][2].imag;
  if (check_su3_max)
    arireturn();
  return 0;
}

[Bug tree-optimization/101242] Segfault in SLP vectorizor after 2ad71efb5de

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

--- Comment #1 from Martin Jambor <jamborm at gcc dot gnu.org> ---
For the reference, this is the backtrace:

mjambor@virgil:/tmp/bbb$ ~/gcc/trunk/inst/bin/gcc -S -Ofast test.i 
during GIMPLE pass: slp
test.i: In function ‘check_su3’:
test.i:11:5: internal compiler error: Segmentation fault
   11 | int check_su3() {
      |     ^~~~~~~~~
0x12ad5a0 crash_signal
        /home/mjambor/gcc/trunk/src/gcc/toplev.c:327
0x162643d vec<_stmt_vec_info*, va_heap, vl_embed>::iterate(unsigned int,
_stmt_vec_info**) const
        /home/mjambor/gcc/trunk/src/gcc/vec.h:932
0x1625168 vec<_stmt_vec_info*, va_heap, vl_ptr>::iterate(unsigned int,
_stmt_vec_info**) const
        /home/mjambor/gcc/trunk/src/gcc/vec.h:1698
0x166d14d vect_optimize_slp(vec_info*)
        /home/mjambor/gcc/trunk/src/gcc/tree-vect-slp.c:3992
0x1672d1e vect_slp_analyze_bb_1
        /home/mjambor/gcc/trunk/src/gcc/tree-vect-slp.c:5621
0x1673111 vect_slp_region
        /home/mjambor/gcc/trunk/src/gcc/tree-vect-slp.c:5708
0x1673bba vect_slp_bbs
        /home/mjambor/gcc/trunk/src/gcc/tree-vect-slp.c:5858
0x1674063 vect_slp_function(function*)
        /home/mjambor/gcc/trunk/src/gcc/tree-vect-slp.c:5944
0x168f92b execute
        /home/mjambor/gcc/trunk/src/gcc/tree-vectorizer.c:1445
Please submit a full bug report...

[Bug tree-optimization/101242] Segfault in SLP vectorizor after g:2ad71efb5de

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
            Summary|Segfault in SLP vectorizor  |Segfault in SLP vectorizor
                   |after 2ad71efb5de           |after g:2ad71efb5de
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-06-28
                 CC|                            |marxin at gcc dot gnu.org
   Target Milestone|---                         |12.0

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Confirmed.

[Bug tree-optimization/101242] Segfault in SLP vectorizor after g:2ad71efb5de

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

--- Comment #3 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Profiled LTO bootstrap also fails with a segfault with the same backtrace.

[Bug tree-optimization/101242] Segfault in SLP vectorizor after g:2ad71efb5de

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

David Binderman <dcb314 at hotmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dcb314 at hotmail dot com

--- Comment #4 from David Binderman <dcb314 at hotmail dot com> ---
Created attachment 51078
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51078&action=edit
gzipped C++ source code

I also see this with -O3 with the attached C++ code.

[Bug tree-optimization/101242] Segfault in SLP vectorizor after g:2ad71efb5de

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Mine.

[Bug tree-optimization/101242] Segfault in SLP vectorizor after g:2ad71efb5de

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

--- Comment #6 from David Binderman <dcb314 at hotmail dot com> ---
(In reply to David Binderman from comment #4)
> Created attachment 51078 [details]
> gzipped C++ source code
> 
> I also see this with -O3 with the attached C++ code.

Poor example - too big to reduce easily. Here is some reduced
C code from a different example:

--- /home/dcb/cvise/test/bug733b.c ---
typedef struct {
  int height, width
} ufraw_image_data;
typedef struct {
  ufraw_image_data thumb
} ufraw_data;
ufraw_data ufraw_convert_embedded_uf;
int ufraw_convert_embedded_uf_1;
void ufraw_convert_embedded(void) {
  unsigned srcHeight = ufraw_convert_embedded_uf.thumb.height,
           srcWidth = ufraw_convert_embedded_uf.thumb.width;
  int scaleDenom = 1;
  srcSize();
  if (ufraw_convert_embedded_uf_1)
    scaleDenom = srcSize;
  unsigned dstWidth = srcWidth / scaleDenom;
  unsigned dstHeight = srcHeight / scaleDenom;
  if (dstWidth != srcWidth || dstHeight != srcHeight) {
    unsigned width = dstHeight;
    dstHeight = dstWidth;
    dstWidth = width;
  }
  ufraw_convert_embedded_uf.thumb.height = dstHeight;
  ufraw_convert_embedded_uf.thumb.width = dstWidth;
}

[Bug tree-optimization/101242] Segfault in SLP vectorizor after g:2ad71efb5de

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:c01760bc548ba79bc9ac15168b27fe7aabcb19ae

commit r12-1866-gc01760bc548ba79bc9ac15168b27fe7aabcb19ae
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jun 29 09:33:24 2021 +0200

    tree-optimization/101242 - fix reverse graph entry detection

    This avoids detecting random unrelated nodes as possible entries
    to not backwards reachable regions of the SLP graph.  Instead
    explicitely add the problematic nodes.

    This temporary XFAILs gcc.dg/vect/pr67790.c until I get the
    permute propagation adjusted to when it needs more than one
    optimistic iteration.

    2021-06-29  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/101242
            * tree-vect-slp.c (vect_slp_build_vertices): Force-add
            PHIs with not represented initial values as leafs.

            * gcc.dg/vect/bb-slp-pr101242.c: New testcase.
            * gcc.dg/vect/pr67790.c: XFAIL scan for zero VEC_PERM_EXPR.

[Bug tree-optimization/101242] Segfault in SLP vectorizor after g:2ad71efb5de

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.

[Bug tree-optimization/101242] Segfault in SLP vectorizor after g:2ad71efb5de

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101242

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |suochenyao at 163 dot com

--- Comment #9 from Richard Biener <rguenth at gcc dot gnu.org> ---
*** Bug 101249 has been marked as a duplicate of this bug. ***