[Bug tree-optimization/102853] New: [12 Regression] ICE in compute_distributive_range, at tree-data-ref.c:593 since r12-4398-g9b2ad21ab3ebc21a3408108327fa1a7cbedaf217

[Bug tree-optimization/102853] New: [12 Regression] ICE in compute_distributive_range, at tree-data-ref.c:593 since r12-4398-g9b2ad21ab3ebc21a3408108327fa1a7cbedaf217

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102853

            Bug ID: 102853
           Summary: [12 Regression] ICE in compute_distributive_range, at
                    tree-data-ref.c:593 since
                    r12-4398-g9b2ad21ab3ebc21a3408108327fa1a7cbedaf217
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: rguenth at gcc dot gnu.org
  Target Milestone: ---
              Host: x86_64-linux-gnu
            Target: ppc64-linux-gnu

The following ICEs:

$ ./xgcc -B. /home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/vect/pr33846.c
-O1 -ftree-vectorize -mmodulo -ftrapv
during GIMPLE pass: pcom
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/vect/pr33846.c: In function
‘_mix_some_samples’:
/home/marxin/Programming/gcc/gcc/testsuite/gcc.dg/vect/pr33846.c:12:6: internal
compiler error: in compute_distributive_range, at tree-data-ref.c:593
   12 | void _mix_some_samples (intptr_t buf, int *mix_buffer, int mix_size)
      |      ^~~~~~~~~~~~~~~~~
0x22f4a05 compute_distributive_range
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:593
0x22f551c split_constant_offset_1
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:794
0x22f5a26 split_constant_offset_1
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:895
0x22f61b0 split_constant_offset
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:1043
0x22f538f split_constant_offset_1
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:779
0x22f5a26 split_constant_offset_1
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:895
0x22f61b0 split_constant_offset
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:1043
0x22f6376 split_constant_offset(tree_node*, tree_node**, tree_node**)
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:1070
0x22f73b0 dr_analyze_indices
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:1381
0x22f7c1d create_data_ref(edge_def*, loop*, tree_node*, gimple*, bool, bool)
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:1500
0x2304459 find_data_references_in_stmt(loop*, gimple*, vec<data_reference*,
va_heap, vl_ptr>*)
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:5934
0x2304677 find_data_references_in_bb(loop*, basic_block_def*,
vec<data_reference*, va_heap, vl_ptr>*)
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:5986
0x2304749 find_data_references_in_loop(loop*, vec<data_reference*, va_heap,
vl_ptr>*)
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:6019
0x2304d89 compute_data_dependences_for_loop(loop*, bool, vec<loop*, va_heap,
vl_ptr>*, vec<data_reference*, va_heap, vl_ptr>*,
vec<data_dependence_relation*, va_heap, vl_ptr>*)
        /home/marxin/Programming/gcc/gcc/tree-data-ref.c:6194
0x146a2dd pcom_worker::tree_predictive_commoning_loop(bool)
        /home/marxin/Programming/gcc/gcc/tree-predcom.c:3320
0x146a87c tree_predictive_commoning(bool)
        /home/marxin/Programming/gcc/gcc/tree-predcom.c:3428
0x146a938 run_tree_predictive_commoning
        /home/marxin/Programming/gcc/gcc/tree-predcom.c:3460
0x146a9df execute
        /home/marxin/Programming/gcc/gcc/tree-predcom.c:3505
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug tree-optimization/102853] [12 Regression] ICE in compute_distributive_range, at tree-data-ref.c:593 since r12-4398-g9b2ad21ab3ebc21a3408108327fa1a7cbedaf217

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102853

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |NEW
      Known to fail|                            |12.0
     Ever confirmed|0                           |1
   Target Milestone|---                         |12.0
   Last reconfirmed|                            |2021-10-20
      Known to work|                            |11.2.0

[Bug tree-optimization/102853] [12 Regression] ICE in compute_distributive_range, at tree-data-ref.c:593 since r12-4398-g9b2ad21ab3ebc21a3408108327fa1a7cbedaf217

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102853

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
             Target|ppc64-linux-gnu             |ppc64-linux-gnu,
                   |                            |powerpc64le-linux-gnu
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
                 CC|                            |rsandifo at gcc dot gnu.org

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Also on LE, even without -mmodulo.  Richard inserted the assert with the last
refactoring of split_constant_offset.

We are splitting the initial value of the IV tmp.9_69 here which is

niters_vector_mult_vf.8_68 = bnd.7_67 << 3;
_70 = (long int) niters_vector_mult_vf.8_68;
_71 = _70 * 2;
tmp.9_69 = buf_12(D) + _71;

and the operation we're asserting on is _70 * 2.

Note the IV is

(short int *) buf_53

with

# buf_53 = PHI <..., tmp9_69>

so the trigger for the ICE is the added

1373          STRIP_NOPS (access_fn);

in dr_analyze_indices.  That was necessary to avoid regressions when IVs
are demoted to uintptr_t by if-conversion.

split_constant_offset makes sure to not look through conversions to
trapping types - maybe that check should also be on the individual operations
in case we start analyzing with an expression in trapping types (as done
here)?  Immediate mitigation would of course be to restrict the STRIP_NOPS
to not expose an IV that evolves in a trapping type.

For example the following would fix it:

diff --git a/gcc/tree-data-ref.c b/gcc/tree-data-ref.c
index 57bac06242f..2cae2528e41 100644
--- a/gcc/tree-data-ref.c
+++ b/gcc/tree-data-ref.c
@@ -775,6 +775,9 @@ split_constant_offset_1 (tree type, tree op0, enum
tree_code code, tree op1,

     case PLUS_EXPR:
     case MINUS_EXPR:
+      if (TYPE_OVERFLOW_TRAPS (type))
+       return false;
+
       split_constant_offset (op0, &var0, &off0, &op0_range, cache, limit);
       split_constant_offset (op1, &var1, &off1, &op1_range, cache, limit);
       *off = size_binop (code, off0, off1);
@@ -785,7 +788,7 @@ split_constant_offset_1 (tree type, tree op0, enum
tree_code code, tree op1,
       return true;

     case MULT_EXPR:
-      if (TREE_CODE (op1) != INTEGER_CST)
+      if (TREE_CODE (op1) != INTEGER_CST || TYPE_OVERFLOW_TRAPS (type))
        return false;

       split_constant_offset (op0, &var0, &off0, &op0_range, cache, limit);

of course (after more work already done), compute_distributive_range could
return false itself.

Richard?

[Bug tree-optimization/102853] [12 Regression] ICE in compute_distributive_range, at tree-data-ref.c:593 since r12-4398-g9b2ad21ab3ebc21a3408108327fa1a7cbedaf217

[rsandifo at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102853

--- Comment #2 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
Maybe it's much of a muchness, but would it work instead to bail
out for wrapping types at the top of split_constant_offset_1
and remove the check for trapping from the CASE_CONVERT code?
It seems that in practice split_constant_offset_1 can't handle
any trapping types.

[Bug tree-optimization/102853] [12 Regression] ICE in compute_distributive_range, at tree-data-ref.c:593 since r12-4398-g9b2ad21ab3ebc21a3408108327fa1a7cbedaf217

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102853

--- Comment #3 from rguenther at suse dot de <rguenther at suse dot de> ---
On Wed, 20 Oct 2021, rsandifo at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102853
> 
> --- Comment #2 from rsandifo at gcc dot gnu.org <rsandifo at gcc dot gnu.org> ---
> Maybe it's much of a muchness, but would it work instead to bail
> out for wrapping types at the top of split_constant_offset_1
> and remove the check for trapping from the CASE_CONVERT code?
> It seems that in practice split_constant_offset_1 can't handle
> any trapping types.

Yeah, that makes sense.

[Bug tree-optimization/102853] [12 Regression] ICE in compute_distributive_range, at tree-data-ref.c:593 since r12-4398-g9b2ad21ab3ebc21a3408108327fa1a7cbedaf217

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102853

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ac5e46563817f4f1bd786be1d21b85d18e61bc0c

commit r12-4558-gac5e46563817f4f1bd786be1d21b85d18e61bc0c
Author: Richard Biener <rguenther@suse.de>
Date:   Wed Oct 20 12:54:59 2021 +0200

    tree-optimization/102853 - avoid trapping types in split_constant_offset

    This avoids running into the assert in compute_distributive_range when
    starting the analysis with operations in a trapping type.

    2021-10-20  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/102853
            * tree-data-ref.c (split_constant_offset_1): Bail out
            immediately if the expression traps on overflow.

[Bug tree-optimization/102853] [12 Regression] ICE in compute_distributive_range, at tree-data-ref.c:593 since r12-4398-g9b2ad21ab3ebc21a3408108327fa1a7cbedaf217

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=102853

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.