[Bug tree-optimization/102385] New: ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning"

[Bug tree-optimization/102385] New: ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning"

[suochenyao at 163 dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

            Bug ID: 102385
           Summary: ICE: in single_pred_edge, at basic-block.h:350 under
                    "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce
                    -fno-tree-dominator-opts -fno-tree-dse
                    -fno-tree-loop-ivcanon -fpredictive-commoning"
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: suochenyao at 163 dot com
  Target Milestone: ---

*******************************************************************************
OS and Platform:
CentOS Linux release 7.8.2003 (Core), x86_64 GNU/Linux
*******************************************************************************
Program:
short a, b;
int c[9];
void(d)() {}
void e() {
  a = 0;
  for (; a <= 4; a++) {
    short *f = &b;
    c[a] || (*f = 0);
    d(c[a + 2]);
  }
}
int main() {return 0;}
*******************************************************************************
gcc version:
$ gcc -v
Using built-in specs.
COLLECT_GCC=/data/bin/gcc-dev/bin/gcc
COLLECT_LTO_WRAPPER=/data/bin/gcc-dev/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure --prefix=/data/bin/gcc-dev --disable-multilib
--enable-languages=c,c++
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20210916 (experimental) (GCC)

git version: 745781d24cd7562202687cfbe05597ee673d4537
*******************************************************************************
Command Lines:
$ gcc -Wall -Wextra -O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce
-fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon
-fpredictive-commoning a.c
during GIMPLE pass: pcom
a.c: In function ‘e’:
a.c:4:6: internal compiler error: in single_pred_edge, at basic-block.h:350
    4 | void e() {
      |      ^
0x773ee4 single_pred_edge
        ../../gcc/basic-block.h:350
0x77461d single_pred_edge
        ../../gcc/sbitmap.h:105
0x77461d tree_transform_and_unroll_loop(loop*, unsigned int, edge_def*,
tree_niter_desc*, void (*)(loop*, void*), void*)
        ../../gcc/tree-ssa-loop-manip.c:1295
0xf525c8 pcom_worker::tree_predictive_commoning_loop(bool)
        ../../gcc/tree-predcom.c:3401
0xf52aa4 tree_predictive_commoning(bool)
        ../../gcc/tree-predcom.c:3428
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/102385] [12 Regression] ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning"

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
                 CC|                            |rguenth at gcc dot gnu.org,
                   |                            |rsandifo at gcc dot gnu.org
            Summary|ICE: in single_pred_edge,   |[12 Regression] ICE: in
                   |at basic-block.h:350 under  |single_pred_edge, at
                   |"-O2 -fno-toplevel-reorder  |basic-block.h:350 under
                   |-fno-tree-ch -fno-tree-dce  |"-O2 -fno-toplevel-reorder
                   |-fno-tree-dominator-opts    |-fno-tree-ch -fno-tree-dce
                   |-fno-tree-dse               |-fno-tree-dominator-opts
                   |-fno-tree-loop-ivcanon      |-fno-tree-dse
                   |-fpredictive-commoning"     |-fno-tree-loop-ivcanon
                   |                            |-fpredictive-commoning"
           Keywords|                            |ice-on-valid-code,
                   |                            |needs-bisection, wrong-code
   Last reconfirmed|                            |2021-09-17
   Target Milestone|---                         |12.0

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Huh, the code is odd:

  basic_block exit_bb = single_pred (loop->latch);
  new_exit = find_edge (exit_bb, rest);
  new_exit->probability = profile_probability::always ()
                                .apply_scale (1, new_est_niter + 1);

but here we have a diamond after the block that exits the loop and thus
neither a single predecessor of the latch nor would that be something
resembling an exit block.  It looks like the code might have wanted
to use single_pred (rest) here plus eventually splitting the exit
edge in case it didn't have a single predecessor.

Richard, you refactored this, so likely caused this.

[Bug tree-optimization/102385] [12 Regression] ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning" since r12-2429-g62acc72a957b5614

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12 Regression] ICE: in     |[12 Regression] ICE: in
                   |single_pred_edge, at        |single_pred_edge, at
                   |basic-block.h:350 under     |basic-block.h:350 under
                   |"-O2 -fno-toplevel-reorder  |"-O2 -fno-toplevel-reorder
                   |-fno-tree-ch -fno-tree-dce  |-fno-tree-ch -fno-tree-dce
                   |-fno-tree-dominator-opts    |-fno-tree-dominator-opts
                   |-fno-tree-dse               |-fno-tree-dse
                   |-fno-tree-loop-ivcanon      |-fno-tree-loop-ivcanon
                   |-fpredictive-commoning"     |-fpredictive-commoning"
                   |                            |since
                   |                            |r12-2429-g62acc72a957b5614
      Known to fail|                            |12.0
      Known to work|                            |11.2.0
                 CC|                            |marxin at gcc dot gnu.org

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-2429-g62acc72a957b5614.

[Bug tree-optimization/102385] [12 Regression] ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning" since r12-2429-g62acc72a957b5614

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |DUPLICATE

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Dup of bug 102387.

*** This bug has been marked as a duplicate of bug 102387 ***

[Bug tree-optimization/102385] [12 Regression] ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning" since r12-2429-g62acc72a957b5614

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|RESOLVED                    |NEW
         Resolution|DUPLICATE                   |---

[Bug tree-optimization/102385] [12 Regression] ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning" since r12-2429-g62acc72a957b5614

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

--- Comment #4 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 102387 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/102385] [12 Regression] ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning" since r12-2429-g62acc72a957b5614

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

--- Comment #5 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
*** Bug 101580 has been marked as a duplicate of this bug. ***

[Bug tree-optimization/102385] [12 Regression] ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning" since r12-2429-g62acc72a957b5614

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rsandifo at gcc dot gnu.org

--- Comment #6 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Mine.

[Bug tree-optimization/102385] [12 Regression] ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning" since r12-2429-g62acc72a957b5614

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Sandiford <rsandifo@gcc.gnu.org>:

https://gcc.gnu.org/g:0ee3dc6052361290c92bba492cc0a9e556b31055

commit r12-4250-g0ee3dc6052361290c92bba492cc0a9e556b31055
Author: Richard Sandiford <richard.sandiford@arm.com>
Date:   Mon Oct 4 23:55:43 2021 +0100

    loop: Fix profile updates after unrolling [PR102385]

    In g:62acc72a957b5614 I'd stopped the unroller from using
    an epilogue loop in cases where the iteration count was
    known to be a multiple of the unroll factor.  The epilogue
    and non-epilogue cases still shared this (preexisting) code
    to update the edge frequencies:

      basic_block exit_bb = single_pred (loop->latch);
      new_exit = find_edge (exit_bb, rest);
      new_exit->probability = profile_probability::always ()
                                   .apply_scale (1, new_est_niter + 1);
      [etc]

    But of course (in hindsight) that only makes sense for the
    epilogue case, where we've already moved the main loop's exit edge
    to be a sibling of the latch edge.  For the non-epilogue case,
    the exit edge stays (and needs to stay) in its original position.

    I don't really understand what the code is trying to do for
    the epilogue case.  It has:

          /* Ensure that the frequencies in the loop match the new estimated
             number of iterations, and change the probability of the new
             exit edge.  */

          profile_count freq_h = loop->header->count;
          profile_count freq_e = (loop_preheader_edge (loop))->count ();
          if (freq_h.nonzero_p ())
            {
              ...
              scale_loop_frequencies (loop, freq_e.probability_in (freq_h));
            }

    Here, freq_e.probability_in (freq_h) is freq_e / freq_h, so for the
    header block, this has the effect of:

      new header count = freq_h * (freq_e / freq_h)

    i.e. we say that the header executes exactly as often as the
    preheader edge, which would only make sense if the loop never
    iterates.  Also, after setting the probability of the nonexit edge
    (correctly) to new_est_niter / (new_est_niter + 1), the code does:

        scale_bbs_frequencies (&loop->latch, 1, prob);

    for this new probability.  I think that only makes sense if the
    nonexit edge was previously unconditional (100%).  But the code
    carefully preserved the probability of the original exit edge
    when creating the new one.

    All I'm trying to do here though is fix the mess I created
    and get the probabilities right for the non-epilogue case.
    Things are simpler there since we don't have to worry about
    loop versioning.  Hopefully the comments explain the approach.

    The function's current interface implies that it can cope with
    multiple exit edges and that the function only needs the iteration
    count relative to one of those edges in order to work correctly.
    In practice that's not the case: it assumes there is exactly one
    exit edge and all current callers also ensure that the exit test
    dominates the latch.  I think the function is easier to follow
    if we remove the implied generality.

    gcc/
            PR tree-optimization/102385
            * predict.h (change_edge_frequency): Declare.
            * predict.c (change_edge_frequency): New function.
            * tree-ssa-loop-manip.h (tree_transform_and_unroll_loop): Remove
            edge argument.
            (tree_unroll_loop): Likewise.
            * gimple-loop-jam.c (tree_loop_unroll_and_jam): Update accordingly.
            * tree-predcom.c (pcom_worker::tree_predictive_commoning_loop):
            Likewise.
            * tree-ssa-loop-prefetch.c (loop_prefetch_arrays): Likewise.
            * tree-ssa-loop-manip.c (tree_unroll_loop): Likewise.
            (tree_transform_and_unroll_loop): Likewise.  Use single_dom_exit
            to retrieve the exit edges.  Make all the old profile update code
            conditional on !single_loop_p -- the case it was written for --
            and use a different approach for the single-loop case.

    gcc/testsuite/
            * gcc.dg/pr102385.c: New test.

[Bug tree-optimization/102385] [12 Regression] ICE: in single_pred_edge, at basic-block.h:350 under "-O2 -fno-toplevel-reorder -fno-tree-ch -fno-tree-dce -fno-tree-dominator-opts -fno-tree-dse -fno-tree-loop-ivcanon -fpredictive-commoning" since r12-2429-g62acc72a957b5614

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102385

rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Fixed.