[Bug middle-end/102518] New: [11/12 regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2

[Bug middle-end/102518] New: [11/12 regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2

[jlegg at feralinteractive dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102518

            Bug ID: 102518
           Summary: [11/12 regression] ICE during GIMPLE pass: einline in
                    gimplify_modify_expr at -O2
           Product: gcc
           Version: 11.2.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: middle-end
          Assignee: unassigned at gcc dot gnu.org
          Reporter: jlegg at feralinteractive dot com
  Target Milestone: ---

Compiling this c++ code with g++ -O2 -c:
struct A {
  bool operator<(A b) { return b.x; }
  int x;
} * a;
int f(int *const c) {
  const A & b = reinterpret_cast<A const &>(c);
  while (a)
    if (*a < b)
      return 0;
}
int i;
void g() { f(&i); }

causes an ICE with g++ 11.2.0:
v.ii:10:1: warning: control reaches end of non-void function [-Wreturn-type]
   10 | }
      | ^
during GIMPLE pass: einline
v.ii: In function 'void g()':
v.ii:6:45: internal compiler error: in gimplify_modify_expr, at gimplify.c:5988
    6 |   const A & b = reinterpret_cast<A const &>(c);
      |                                             ^
0x6772ed gimplify_modify_expr
        ../../gcc-11.2.0/gcc/gimplify.c:5988
0xac86de gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        ../../gcc-11.2.0/gcc/gimplify.c:14094
0xacd4c2 gimplify_stmt(tree_node**, gimple**)
        ../../gcc-11.2.0/gcc/gimplify.c:6877
0xacd4c2 gimplify_and_add(tree_node*, gimple**)
        ../../gcc-11.2.0/gcc/gimplify.c:489
0xacd4c2 internal_get_tmp_var
        ../../gcc-11.2.0/gcc/gimplify.c:642
0xacd751 get_initialized_tmp_var(tree_node*, gimple**, gimple**, bool)
        ../../gcc-11.2.0/gcc/gimplify.c:674
0xacd751 prepare_gimple_addressable
        ../../gcc-11.2.0/gcc/gimplify.c:4334
0xacd7f1 gimplify_addr_expr
        ../../gcc-11.2.0/gcc/gimplify.c:6230
0xac924f gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        ../../gcc-11.2.0/gcc/gimplify.c:14141
0xac9fe8 gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        ../../gcc-11.2.0/gcc/gimplify.c:14253
0xacb35f gimplify_compound_lval
        ../../gcc-11.2.0/gcc/gimplify.c:3074
0xac81b1 gimplify_expr(tree_node**, gimple**, gimple**, bool (*)(tree_node*),
int)
        ../../gcc-11.2.0/gcc/gimplify.c:14046
0xad86b3 gimple_regimplify_operands(gimple*, gimple_stmt_iterator*)
        ../../gcc-11.2.0/gcc/gimplify-me.c:235
0xd907d2 copy_bb
        ../../gcc-11.2.0/gcc/tree-inline.c:2061
0xd91a64 copy_cfg_body
        ../../gcc-11.2.0/gcc/tree-inline.c:3048
0xd91a64 copy_body
        ../../gcc-11.2.0/gcc/tree-inline.c:3303
0xd94ccf expand_call_inline
        ../../gcc-11.2.0/gcc/tree-inline.c:5119
0xd96279 gimple_expand_calls_inline
        ../../gcc-11.2.0/gcc/tree-inline.c:5309
0xd96279 optimize_inline_calls(tree_node*)
        ../../gcc-11.2.0/gcc/tree-inline.c:5482
0x167957e early_inliner(function*)
        ../../gcc-11.2.0/gcc/ipa-inline.c:3007

The test case was heavily reduced, primarily without human interaction. I
wouldn't be surprised if an incorrect use of a type punned pointer was part of
the original code around the problem area however.

The ICE reproduces with "-O1 -finline-small-functions" instead of "-O2", but
not with plain "-O1".
I was able to reproduce it with compiler explorer using gcc with git hash
51018dd1395c72b3681ae5f84eceb94320472922, and 11.1, but not with 10.3 or
earlier.

[Bug middle-end/102518] [11/12 regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102518

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
           Keywords|                            |needs-bisection
   Target Milestone|---                         |11.3
   Last reconfirmed|                            |2021-09-28

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Confirmed, here is reduced C testcase:
struct A {
  int *x;
};
int i;
int f(int *const c) {
  struct A * b = (struct A *)(&c);
  return b->x != 0;
}
void g() { f(&i); }

--------------- CUT --------------
If I change &c into just c, GCC does not crash.

[Bug middle-end/102518] [11/12 regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102518

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P2

[Bug middle-end/102518] [11/12 regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2 since r11-165-geb72dc663e9070b2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102518

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |rguenth at gcc dot gnu.org
            Summary|[11/12 regression] ICE      |[11/12 regression] ICE
                   |during GIMPLE pass: einline |during GIMPLE pass: einline
                   |in gimplify_modify_expr at  |in gimplify_modify_expr at
                   |-O2                         |-O2 since
                   |                            |r11-165-geb72dc663e9070b2

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r11-165-geb72dc663e9070b2.

[Bug middle-end/102518] [11/12 regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2 since r11-165-geb72dc663e9070b2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102518

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
I will have a look.  We're getting

# VUSE <.MEM>
_2 = MEM[(struct A *)&&i].x;

when mapping &i into

  <bb 2> [local count: 1073741824]:
  _1 = MEM[(struct A *)&c].x;
  _2 = _1 != 0B;
  _4 = (int) _2;
  return _4;

here what's the difference is that 'c' is no longer TREE_ADDRESSABLE because
we can now mark it with DECL_NOT_GIMPLE_REG.

That means the "obvious" fix would be to amend the !TREE_ADDRESSABLE check in

  if (TREE_READONLY (p)
      && !TREE_ADDRESSABLE (p)
      && value
      && !TREE_SIDE_EFFECTS (value)
      && !def)

with a !DECL_NOT_GIMPLE_REG check.

[Bug middle-end/102518] [11/12 regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2 since r11-165-geb72dc663e9070b2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102518

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:3a7f20ed26416b56df6f3c8240f3c65a5715b17d

commit r12-4031-g3a7f20ed26416b56df6f3c8240f3c65a5715b17d
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Sep 30 15:05:53 2021 +0200

    middle-end/102518 - avoid invalid GIMPLE during inlining

    When inlining we have to avoid mapping a non-lvalue parameter
    value into a context that prevents the parameter to be a register.
    Formerly the register were TREE_ADDRESSABLE but now it can be
    just DECL_NOT_GIMPLE_REG_P.

    2021-09-30  Richard Biener  <rguenther@suse.de>

            PR middle-end/102518
            * tree-inline.c (setup_one_parameter): Avoid substituting
            an invariant into contexts where a GIMPLE register is not valid.

            * gcc.dg/torture/pr102518.c: New testcase.

[Bug middle-end/102518] [11 Regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2 since r11-165-geb72dc663e9070b2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102518

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to work|                            |12.0
            Summary|[11/12 regression] ICE      |[11 Regression] ICE during
                   |during GIMPLE pass: einline |GIMPLE pass: einline in
                   |in gimplify_modify_expr at  |gimplify_modify_expr at -O2
                   |-O2 since                   |since
                   |r11-165-geb72dc663e9070b2   |r11-165-geb72dc663e9070b2

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar.

[Bug middle-end/102518] [11 Regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2 since r11-165-geb72dc663e9070b2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102518

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ae3227710c71ca693ee43c825f5d0d0fbd3c3773

commit r11-9228-gae3227710c71ca693ee43c825f5d0d0fbd3c3773
Author: Richard Biener <rguenther@suse.de>
Date:   Thu Sep 30 15:05:53 2021 +0200

    middle-end/102518 - avoid invalid GIMPLE during inlining

    When inlining we have to avoid mapping a non-lvalue parameter
    value into a context that prevents the parameter to be a register.
    Formerly the register were TREE_ADDRESSABLE but now it can be
    just DECL_NOT_GIMPLE_REG_P.

    2021-09-30  Richard Biener  <rguenther@suse.de>

            PR middle-end/102518
            * tree-inline.c (setup_one_parameter): Avoid substituting
            an invariant into contexts where a GIMPLE register is not valid.

            * gcc.dg/torture/pr102518.c: New testcase.

[Bug middle-end/102518] [11 Regression] ICE during GIMPLE pass: einline in gimplify_modify_expr at -O2 since r11-165-geb72dc663e9070b2

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102518

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
      Known to fail|                            |11.2.0
      Known to work|                            |11.2.1
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.