[Bug ipa/103171] New: [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[Bug ipa/103171] New: [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

            Bug ID: 103171
           Summary: [12 Regression] ICE Segmentation fault since
                    r12-2523-g13586172d0b70c9d
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: marxin at gcc dot gnu.org
                CC: jamborm at gcc dot gnu.org, marxin at gcc dot gnu.org
  Target Milestone: ---

Created attachment 51756
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51756&action=edit
test-case

The following (reduced from Löve game engine:

$ g++ *.ii -O2 -flto=auto -flto-partition=1to1 -w
during GIMPLE pass: fre
1.ii: In function ‘w_isDown’:
1.ii:18:5: internal compiler error: Segmentation fault
   18 | int w_isDown(int *) {
      |     ^
0xdd2f6a crash_signal
        /home/marxin/Programming/gcc/gcc/toplev.c:322
0x7ffff789979f ???
       
/usr/src/debug/glibc-2.34-2.1.x86_64/signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x1b3f8a8 symtab_node::ultimate_alias_target(availability*, symtab_node*)
        /home/marxin/Programming/gcc/gcc/cgraph.h:3204
0x1b3f8a8 ipa_reference_var_uid(tree_node*)
        /home/marxin/Programming/gcc/gcc/ipa-reference.c:152
0xee588e call_may_clobber_ref_p_1(gcall*, ao_ref*, bool)
        /home/marxin/Programming/gcc/gcc/tree-ssa-alias.c:3088
0xee588e call_may_clobber_ref_p_1(gcall*, ao_ref*, bool)
        /home/marxin/Programming/gcc/gcc/tree-ssa-alias.c:2968
0xee6170 walk_non_aliased_vuses(ao_ref*, tree_node*, bool, void* (*)(ao_ref*,
tree_node*, void*), void* (*)(ao_ref*, tree_node*, void*, translate_flags*),
tree_node* (*)(tree_node*), unsigned int&, void*)
        /home/marxin/Programming/gcc/gcc/tree-ssa-alias.c:3720
0xfba1e7 vn_reference_lookup(tree_node*, tree_node*, vn_lookup_kind,
vn_reference_s**, bool, tree_node**, tree_node*)
        /home/marxin/Programming/gcc/gcc/tree-ssa-sccvn.c:3700
0xfbe6ce visit_reference_op_load
        /home/marxin/Programming/gcc/gcc/tree-ssa-sccvn.c:5166
0xfbe6ce visit_stmt
        /home/marxin/Programming/gcc/gcc/tree-ssa-sccvn.c:5615
0xfbee96 process_bb
        /home/marxin/Programming/gcc/gcc/tree-ssa-sccvn.c:7344
0xfc10ce do_rpo_vn
        /home/marxin/Programming/gcc/gcc/tree-ssa-sccvn.c:7828
0xfc1f1b execute
        /home/marxin/Programming/gcc/gcc/tree-ssa-sccvn.c:8096
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
make: *** [/tmp/ccO8uvv9.mk:11: /tmp/cc4akvXo.ltrans3.ltrans.o] Error 1
lto-wrapper: fatal error: make returned 2 exit status
compilation terminated.
/usr/bin/ld: fatal error: lto-wrapper failed
collect2: error: ld returned 1 exit status

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-11-10
   Target Milestone|---                         |12.0

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|normal                      |critical

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org

--- Comment #1 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
this looks like variable is optimized out because ipa-cp removes reference to
it and later it is used in code.  Perhaps another instance of missed transform
form ipa-cp?

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
I have one more single file test-case (though one needs s390x cross compiler):

$ s390x-linux-gnu-gcc
/home/marxin/Programming/gcc/gcc/testsuite/gfortran.dg/class_result_7.f90
-fno-ipa-modref --param=max-inline-insns-size=569371514
--param=max-early-inliner-iterations=0 -O2
--param=uninlined-function-insns=1000000 -c
during GIMPLE pass: fre
/home/marxin/Programming/gcc/gcc/testsuite/gfortran.dg/class_result_7.f90:30:7:

   30 |    use a_type_m
      |       ^
internal compiler error: Segmentation fault
0xbfc22f crash_signal
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/toplev.c:322
0x7ffff789979f ???
       
/usr/src/debug/glibc-2.34-2.1.x86_64/signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x139f40b symtab_node::ultimate_alias_target(availability*, symtab_node*)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/cgraph.h:3211
0x139f40b ipa_reference_var_uid(tree_node*)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/ipa-reference.c:152
0xcd3521 call_may_clobber_ref_p_1(gcall*, ao_ref*, bool)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/tree-ssa-alias.c:3078
0xcd4b1c walk_non_aliased_vuses(ao_ref*, tree_node*, bool, void* (*)(ao_ref*,
tree_node*, void*), void* (*)(ao_ref*, tree_node*, void*, translate_flags*),
tree_node* (*)(tree_node*), unsigned int&, void*)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/tree-ssa-alias.c:3779
0xd895fe vn_reference_lookup(tree_node*, tree_node*, vn_lookup_kind,
vn_reference_s**, bool, tree_node**, tree_node*)
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/tree-ssa-sccvn.c:3703
0xd90051 visit_reference_op_load
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/tree-ssa-sccvn.c:5169
0xd90051 visit_stmt
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/tree-ssa-sccvn.c:5618
0xd905b6 process_bb
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/tree-ssa-sccvn.c:7347
0xd9236e do_rpo_vn
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/tree-ssa-sccvn.c:7831
0xd92c40 execute
       
/home/marxin/BIG/buildbot/buildworker/marxinbox-gcc-trunk-s390x/build/gcc/tree-ssa-sccvn.c:8099
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Severity|critical                    |normal

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
@Martin: Can you please take a look?

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |jamborm at gcc dot gnu.org

--- Comment #4 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I'm about to test a patch.

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

--- Comment #5 from Martin Jambor <jamborm at gcc dot gnu.org> ---
I have proposed a patch on the mailing list:
https://gcc.gnu.org/pipermail/gcc-patches/2022-January/589429.html

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

--- Comment #6 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Martin Jambor <jamborm@gcc.gnu.org>:

https://gcc.gnu.org/g:f6d65e803623c7ba6c8eb92ce5975fc1b90cd91e

commit r12-7936-gf6d65e803623c7ba6c8eb92ce5975fc1b90cd91e
Author: Martin Jambor <mjambor@suse.cz>
Date:   Thu Mar 31 16:50:24 2022 +0200

    ipa: Create LOAD references when necessary during inlining (PR 103171)

    in r12-2523-g13586172d0b70c ipa-prop tracking of jump functions during
    inlining got the ability to remove ADDR references when inlining
    discovered that they were not necessary or turn them into LOAD
    references when we know that what was a function call argument passed
    by reference will end up as a load (one or more).

    Unfortunately, the code only creates the LOAD references when
    replacing removed ADDR references and PR 103171 showed that with some
    ordering of inlining, we need to add the LOAD reference before we know
    we can remove the ADDR one - or the reference will be lost, leading to
    link errors or even ICEs.

    Specifically in testcase gcc.dg/lto/pr103171_1.c added in this patch,
    if foo() is inlined to entry(), we need to create the LOAD reference
    so that when later bar() is inlined into foo() and we discover that
    the paameter is unused, we can remove the ADDR reference and still
    keep the varaible around for the load.

    Martin

    gcc/ChangeLog:

    2022-01-28  Martin Jambor  <mjambor@suse.cz>

            PR ipa/103171
            * ipa-prop.cc (propagate_controlled_uses): Add a LOAD reference
            always when an ADDR_EXPR constant is known to reach a load because
            of inlining, not just when removing an ADDR reference.

    gcc/testsuite/ChangeLog:

    2022-01-28  Martin Jambor  <mjambor@suse.cz>

            PR ipa/103171
            * gcc.dg/ipa/remref-6.c: Adjust dump scan string.
            * gcc.dg/ipa/remref-7.c: New test.
            * gcc.dg/lto/pr103171_0.c: New test.
            * gcc.dg/lto/pr103171_1.c: Likewise.

[Bug ipa/103171] [12 Regression] ICE Segmentation fault since r12-2523-g13586172d0b70c9d

[jamborm at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103171

Martin Jambor <jamborm at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED

--- Comment #7 from Martin Jambor <jamborm at gcc dot gnu.org> ---
Fixed.