[Bug tree-optimization/103219] New: [12 Regression] ICE Segmentation fault at -O3 (during GIMPLE pass: unrolljam)

[Bug tree-optimization/103219] New: [12 Regression] ICE Segmentation fault at -O3 (during GIMPLE pass: unrolljam)

[haoxintu at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103219

            Bug ID: 103219
           Summary: [12 Regression] ICE Segmentation fault at -O3 (during
                    GIMPLE pass: unrolljam)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: haoxintu at gmail dot com
  Target Milestone: ---

Hi all.

I am not sure whether there is a dup but it appears to be a recent regression
issue.

$cat small.c
int a, b, c, e;
int d[10];
int main() {
  if (c)
    if (f()) {
      g();
      if (e) {
        a = 0;
        for (; a != 6; a = a + 2) {
          b = 0;
          for (; b <= 3; b++)
            d[b] &= 1;
        }
      }
    }
  return 0;
}

$gcc -w -O3
during GIMPLE pass: unrolljam
small.c: In function ‘main’:
small.c:3:5: internal compiler error: Segmentation fault
    3 | int main() {
      |     ^~~~
0xc290af crash_signal
        ../../gcc/toplev.c:322
0x17bfea7 tree_loop_unroll_and_jam
        ../../gcc/gimple-loop-jam.c:596
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.


$gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/media/haoxin/SeagateData/haoxin-data/dut-research/compilers/gcc/build/bin/../libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with:../configure
--prefix=/home/haoxin/haoxin-data/dut-research/compilers/gcc/build/
--enable-bootstrap --enable-checking=release --enable-languages=c,c++
--enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20211112 (experimental) (GCC) 

Can also check here: https://godbolt.org/z/r7TKr8MxW


Thanks,
Haoxin

[Bug tree-optimization/103219] [12 Regression] ICE Segmentation fault at -O3 (during GIMPLE pass: unrolljam)

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103219

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0

[Bug tree-optimization/103219] [12 Regression] ICE Segmentation fault at -O3 (during GIMPLE pass: unrolljam) since r12-4526-gd8edfadfc7a9795b

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103219

Aldy Hernandez <aldyh at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-11-14
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW

--- Comment #1 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
Looks like a latent bug elsewhere as we're not threading anything.  For that
matter, test fails even with -fno-thread-jumps.

$ ./cc1 a.c -O3 -fno-thread-jumps -quiet -w
during GIMPLE pass: unrolljam
a.c: In function ‘main’:
a.c:3:5: internal compiler error: Segmentation fault
    3 | int main() {
      |     ^~~~
0x133a4fb crash_signal


Seems like tree_loop_unroll_and_jam is dereferencing a null return from
single_dom_exit():

          auto_bitmap exit_bbs;
          bitmap_set_bit (exit_bbs, single_dom_exit (outer)->dest->index);
          todo |= do_rpo_vn (cfun, loop_preheader_edge (outer), exit_bbs);

(gdb) p debug(outer)
loop_1 (header = 9, latch = 26, niter = )
$6 = void
(gdb) p single_dom_exit (outer)
$7 = <edge 0x0>

[Bug tree-optimization/103219] [12 Regression] ICE Segmentation fault at -O3 (during GIMPLE pass: unrolljam) since r12-4526-gd8edfadfc7a9795b

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103219

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(In reply to Aldy Hernandez from comment #1)
> Looks like a latent bug elsewhere as we're not threading anything.  For that
> matter, test fails even with -fno-thread-jumps.

Right, it is a dup of one of the other bugs listed in see also.  The code in
unrolljam is suspect as mentioned in one of them (I can't remember which one).

[Bug tree-optimization/103219] [12 Regression] ICE Segmentation fault at -O3 (during GIMPLE pass: unrolljam) since r12-4526-gd8edfadfc7a9795b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103219

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |matz at gcc dot gnu.org
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
I think for the case in question the code should simply use single_exit (). 
But as was said the issue is latent.

[Bug tree-optimization/103219] [12 Regression] ICE Segmentation fault at -O3 (during GIMPLE pass: unrolljam) since r12-4526-gd8edfadfc7a9795b

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103219

--- Comment #4 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:d1ca8aeaf34a717dffd8f4a1f0333d25c7d1c904

commit r12-5264-gd1ca8aeaf34a717dffd8f4a1f0333d25c7d1c904
Author: Richard Biener <rguenther@suse.de>
Date:   Mon Nov 15 11:07:55 2021 +0100

    tree-optimization/103219 - avoid ICE in unroll-and-jam

    For no particularly good reason unroll-and-jam uses single_dom_exit
    to determine the exit for the region it wants to run VN on.  That
    happens to ICE because of the dominance restriction.  Use single_exit
    instead.

    2021-11-15  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/103219
            * gimple-loop-jam.c (tree_loop_unroll_and_jam): Use single_exit
            to determine the exit for the VN region.

            * gcc.dg/torture/pr103219.c: New testcase.

[Bug tree-optimization/103219] [9/10/11/12 Regression] ICE Segmentation fault at -O3 (during GIMPLE pass: unrolljam) since r12-4526-gd8edfadfc7a9795b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103219

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.0                        |9.5
      Known to work|                            |12.0
           Priority|P3                          |P2
            Summary|[12 Regression] ICE         |[9/10/11/12 Regression] ICE
                   |Segmentation fault at -O3   |Segmentation fault at -O3
                   |(during GIMPLE pass:        |(during GIMPLE pass:
                   |unrolljam) since            |unrolljam) since
                   |r12-4526-gd8edfadfc7a9795b  |r12-4526-gd8edfadfc7a9795b

--- Comment #5 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar, latent issue elsewhere.

[Bug tree-optimization/103219] [12 Regression] ICE Segmentation fault at -O3 (during GIMPLE pass: unrolljam) since r12-4526-gd8edfadfc7a9795b

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103219

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Resolution|---                         |FIXED
             Status|ASSIGNED                    |RESOLVED
   Target Milestone|9.5                         |12.0
            Summary|[9/10/11 Regression] ICE    |[12 Regression] ICE
                   |Segmentation fault at -O3   |Segmentation fault at -O3
                   |(during GIMPLE pass:        |(during GIMPLE pass:
                   |unrolljam) since            |unrolljam) since
                   |r12-4526-gd8edfadfc7a9795b  |r12-4526-gd8edfadfc7a9795b

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Actually the use was new in GCC 12.