[Bug tree-optimization/103253] New: [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma)

[Bug tree-optimization/103253] New: [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

            Bug ID: 103253
           Summary: [12 Regression] ICE: Segmentation fault (in
                    convert_mult_to_fma)
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---
            Target: x86_64-unknown-linux-gnu

gcc-12.0.0-alpha20111114 snapshot (g:3057f1ab737582a9fb37a3fb967ed8bf3659f2f4)
ICEs when compiling the following testcase, reduced from
libgomp/testsuite/libgomp.c/examples-4/simd-8.c, w/ -march=knl -O2 -fexceptions
-fopenmp -fno-delete-dead-exceptions -fno-trapping-math:

double
do_work (double do_work_pri)
{
  int i;

#pragma omp simd
  for (i = 0; i < 17; ++i)
    do_work_pri = (!i ? 0.5 : i) * 2.0;

  return do_work_pri;
}

% x86_64-unknown-linux-gnu-gcc-12.0.0 -march=knl -O2 -fexceptions -fopenmp
-fno-delete-dead-exceptions -fno-trapping-math -c gdl8z9xi.c
during GIMPLE pass: widening_mul
gdl8z9xi.c: In function 'do_work':
gdl8z9xi.c:2:1: internal compiler error: Segmentation fault
    2 | do_work (double do_work_pri)
      | ^~~~~~~
0xeac96f crash_signal
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/toplev.c:322
0x104eecf contains_struct_check(tree_node*, tree_node_structure_enum, char
const*, int, char const*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree.h:3554
0x104eecf convert_mult_to_fma
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-ssa-math-opts.c:3227
0x105056c after_dom_children
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-ssa-math-opts.c:4673
0x1b9ed62 dom_walker::walk(basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/domwalk.c:352
0x10436e2 execute
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-ssa-math-opts.c:4718

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern)

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

Arseny Solokha <asolokha at gmx dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12 Regression] ICE:        |[12 Regression] ICE:
                   |Segmentation fault (in      |Segmentation fault (in
                   |convert_mult_to_fma)        |convert_mult_to_fma or in
                   |                            |vect_recog_mask_conversion_
                   |                            |pattern)

--- Comment #1 from Arseny Solokha <asolokha at gmx dot com> ---
And compiling the following testcase, reduced from the same original file, w/
-march=knm -O2 -fassociative-math -fopenmp -fno-delete-dead-exceptions
-fno-signed-zeros -fno-trapping-math, yields this instead:

double
do_work (double *A, double do_work_pri)
{
  int i;

#pragma omp simd
  for (i = 0; i < 30; ++i)
    do_work_pri = !i ? 0.5 : i * 0.5 + A[i];

  return do_work_pri;
}

% x86_64-unknown-linux-gnu-g++-12.0.0 -march=knm -O2 -fassociative-math
-fopenmp -fno-delete-dead-exceptions -fno-signed-zeros -fno-trapping-math -c
qozmqkqm.c
during GIMPLE pass: slp
qozmqkqm.c: In function 'double do_work(double*, double)':
qozmqkqm.c:2:1: internal compiler error: Segmentation fault
    2 | do_work (double *A, double do_work_pri)
      | ^~~~~~~
0x1182a5f crash_signal
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/toplev.c:322
0x2011579 contains_struct_check(tree_node*, tree_node_structure_enum, char
const*, int, char const*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree.h:3554
0x2011579 vect_recog_mask_conversion_pattern
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-vect-patterns.c:4509
0x20125ca vect_pattern_recog_1
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-vect-patterns.c:5689
0x2019d1d vect_pattern_recog(vec_info*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-vect-patterns.c:5846
0x142cb0a vect_slp_analyze_bb_1
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-vect-slp.c:5737
0x142cb0a vect_slp_region
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-vect-slp.c:5846
0x142ec2b vect_slp_bbs
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-vect-slp.c:6038
0x142f09b vect_slp_function(function*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-vect-slp.c:6126
0x1435ad1 execute
       
/var/tmp/portage/sys-devel/gcc-12.0.0_alpha20211114/work/gcc-12-20211114/gcc/tree-vectorizer.c:1459

(Note g++ instead of gcc here.)

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-11-16
   Target Milestone|---                         |12.0
             Status|UNCONFIRMED                 |NEW
            Summary|[12 Regression] ICE:        |[12 Regression] ICE:
                   |Segmentation fault (in      |Segmentation fault (in
                   |convert_mult_to_fma or in   |convert_mult_to_fma or in
                   |vect_recog_mask_conversion_ |vect_recog_mask_conversion_
                   |pattern)                    |pattern) since
                   |                            |r12-5129-g8ed62c929c7c4462
     Ever confirmed|0                           |1
                 CC|                            |marxin at gcc dot gnu.org,
                   |                            |tnfchris at gcc dot gnu.org

--- Comment #2 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-5129-g8ed62c929c7c4462.

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

--- Comment #3 from Arseny Solokha <asolokha at gmx dot com> ---
(In reply to Martin Liška from comment #2)
> Started with r12-5129-g8ed62c929c7c4462.

On godbolt it ICEs even w/ 20211029 snapshot.

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

Tamar Christina <tnfchris at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |tnfchris at gcc dot gnu.org

--- Comment #4 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Strange... I'll take a look.

It looks like the vectorizer has generated correct code even after this change

  _54 = .COND_MUL (mask_patt_20.12_45, vect__1.9_38, { 2.0e+0, 2.0e+0, 2.0e+0,
2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0 }, { 1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0,
1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0 });
  vect_patt_21.13_48 = _54;
  _55 = .COND_MUL (mask_patt_20.12_46, vect__1.9_39, { 2.0e+0, 2.0e+0, 2.0e+0,
2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0 }, { 1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0,
1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0 });
  vect_patt_21.13_49 = _55;
  iftmp.0_3 = i_10 != 0 ? iftmp.0_8 : 1.0e+0;
  # RANGE [1, 17] NONZERO 31
  i_9 = i_10 + 1;
  ivtmp_2 = ivtmp_4 - 1;
  ivtmp_53 = ivtmp_52 + 1;
  if (ivtmp_53 < 1)

but DCE6 mangles this to invalid gimple:

  .COND_MUL (mask_patt_20.12_45, vect__1.9_38, { 2.0e+0, 2.0e+0, 2.0e+0,
2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0 }, { 1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0,
1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0 });
  .COND_MUL (mask_patt_20.12_46, vect__1.9_39, { 2.0e+0, 2.0e+0, 2.0e+0,
2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0 }, { 1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0,
1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0 });
  ivtmp_53 = ivtmp_52 + 1;
  if (ivtmp_53 < 1)


it removes the dead statements but removes the SSA var _55 without removing
it's definition.

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

--- Comment #5 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Looks like the RPO pass is causing match.pd to simply

  vect_iftmp.10_41 = vect__1.9_38 * vect_cst__40;
  vect_iftmp.10_42 = vect__1.9_39 * vect_cst__40;
  iftmp.0_8 = _1 * 2.0e+0;
  mask_patt_19.11_44 = vect_vec_iv_.8_36 != vect_cst__43;
  mask_patt_20.12_45 = [vec_unpack_lo_expr] mask_patt_19.11_44;
  mask_patt_20.12_46 = [vec_unpack_hi_expr] mask_patt_19.11_44;
  vect_patt_21.13_48 = VEC_COND_EXPR <mask_patt_20.12_45, vect_iftmp.10_41,
vect_cst__47>;
  vect_patt_21.13_49 = VEC_COND_EXPR <mask_patt_20.12_46, vect_iftmp.10_42,
vect_cst__47>;

into
  _54 = .COND_MUL (mask_patt_20.12_45, vect__1.9_38, { 2.0e+0, 2.0e+0, 2.0e+0,
2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0 }, { 1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0,
1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0 });
  vect_patt_21.13_48 = _54;
  _55 = .COND_MUL (mask_patt_20.12_46, vect__1.9_39, { 2.0e+0, 2.0e+0, 2.0e+0,
2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0, 2.0e+0 }, { 1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0,
1.0e+0, 1.0e+0, 1.0e+0, 1.0e+0 });
  vect_patt_21.13_49 = _55;
  iftmp.0_3 = i_10 != 0 ? iftmp.0_8 : 1.0e+0;

which is perfectly valid and much simpler, so need to see why DCE6 mangles
this.

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |rguenth at gcc dot gnu.org,
                   |                            |rsandifo at gcc dot gnu.org
           Priority|P3                          |P1

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
.COND_MUL might raise an exception and DCE removes unused LHS of calls.  Looks
like FMA analysis doesn't like internal fns w/o a LHS?  That is, DCE keeps
the .COMD_MUL just for the side-effects (maybe there's sth wrong with the
IFN given -fno-trapping-math is used).

Likely the issue is latent.

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

--- Comment #7 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
> .COND_MUL might raise an exception and DCE removes unused LHS of calls.  Looks like FMA analysis doesn't like internal fns w/o a LHS?

That makes sense, it looks like it needs the LHS to find the uses to see if
it's an ADD.  So likely `convert_mult_to_fma` should return false if there's no
LHS as there are no uses then and it can't be an FMA.

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

--- Comment #8 from rguenther at suse dot de <rguenther at suse dot de> ---
On Tue, 16 Nov 2021, tnfchris at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253
> 
> --- Comment #7 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
> > .COND_MUL might raise an exception and DCE removes unused LHS of calls.  Looks like FMA analysis doesn't like internal fns w/o a LHS?
> 
> That makes sense, it looks like it needs the LHS to find the uses to see if
> it's an ADD.  So likely `convert_mult_to_fma` should return false if there's no
> LHS as there are no uses then and it can't be an FMA.

Yes.  As said, it's odd that .COND_MUL prevails, so maybe sth is wrong
with its attribute spec.  Ah, I think it's the "old" issue of
internal-fn.def not being sensitive to -fno-trapping-math.  Generally
ECF_NOTHROW would be wrong here but with -fno-trapping-math it would
be OK.

We might want to eventually special-case some of the internal fns
in internal_fn_flags?  Or have a special ECF_FP_TRAP which
we'd rewrite in internal_fn_flags based on flag_trapping_math
(but we'd need a caller context to be able to lookup the correct
flag_trapping_math here).  Alternatively whoever adds those
patterns should mark the GIMPLE call as gimple_call_nothrow
(that might be genmatch generated code in this case).

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

--- Comment #9 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
> We might want to eventually special-case some of the internal fns
> in internal_fn_flags?  Or have a special ECF_FP_TRAP which
> we'd rewrite in internal_fn_flags based on flag_trapping_math
> (but we'd need a caller context to be able to lookup the correct
> flag_trapping_math here).  Alternatively whoever adds those
> patterns should mark the GIMPLE call as gimple_call_nothrow
> (that might be genmatch generated code in this case).

That last part seems easiest to do in this case, what's the best way
to tell genmatch to do so for some internal-fns.  does genmatch have
access to the ECF attributes or is it just doing symbolic rewriting?

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[rguenther at suse dot de]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

--- Comment #10 from rguenther at suse dot de <rguenther at suse dot de> ---
On Tue, 16 Nov 2021, tnfchris at gcc dot gnu.org wrote:

> https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253
> 
> --- Comment #9 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
> > We might want to eventually special-case some of the internal fns
> > in internal_fn_flags?  Or have a special ECF_FP_TRAP which
> > we'd rewrite in internal_fn_flags based on flag_trapping_math
> > (but we'd need a caller context to be able to lookup the correct
> > flag_trapping_math here).  Alternatively whoever adds those
> > patterns should mark the GIMPLE call as gimple_call_nothrow
> > (that might be genmatch generated code in this case).
> 
> That last part seems easiest to do in this case, what's the best way
> to tell genmatch to do so for some internal-fns.  does genmatch have
> access to the ECF attributes or is it just doing symbolic rewriting?

It has access to the IL.  But then the patterns producing the
COND_MUL would need to direct genmatch to mark something nothrow
since it's not obvious to genmatch.  flag_trapping_math or
-fno-exceptions is reflected into the IL for calls so we shouldn't
really use flag_trapping_math to unconditionally make all
internal-fn calls nothrow (but that would be the simplest thing
to do of course).

So with say a transform (plus .COND_ADD .COND_ADD) to
(.COND_ADD (plus ...)) the resulting .COND_ADD should inherit
the trappingness from the existing .COND_ADD (and the plus
which does not have the flag reflected to the IL ...).
Which means we'd need to "capture" those details and annotate
result pieces.

But as said -ftrapping-math is a bit difficult because
for generic operands we just have the flag while for internal
functions it's modeled as 'throw'.  The FP exception state
is also not very well modeled.

So I think this is something for stage 1 to sort out and for
now we should simply fix the ICEs.

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

--- Comment #11 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Tamar Christina <tnfchris@gcc.gnu.org>:

https://gcc.gnu.org/g:1a0bce98dcf84dd0a7b3ac67b51ac68758cc7ad0

commit r12-5369-g1a0bce98dcf84dd0a7b3ac67b51ac68758cc7ad0
Author: Tamar Christina <tamar.christina@arm.com>
Date:   Thu Nov 18 11:22:11 2021 +0000

    middle-end: Fix FMA detection when inspecting gimple which have no LHS.

    convert_mult_to_fma assumes that all gimple_assigns have a LHS set.  This
    assumption is however not true when an IFN is kept around just for the
    side-effects.  In those situations you have just the IFN and lhs will be
null.

    Since there's no LHS, there also can't be any ADD and such it can't be an
FMA
    so it's correct to just return early if no LHS.

    gcc/ChangeLog:

            PR tree-optimization/103253
            * tree-ssa-math-opts.c (convert_mult_to_fma): Check for LHS.

    gcc/testsuite/ChangeLog:

            PR tree-optimization/103253
            * gcc.dg/vect/pr103253.c: New test.

[Bug tree-optimization/103253] [12 Regression] ICE: Segmentation fault (in convert_mult_to_fma or in vect_recog_mask_conversion_pattern) since r12-5129-g8ed62c929c7c4462

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

--- Comment #12 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
Fixed the ice on trunk, the issue with the IFN still need to be addressed.
Unsure whether to reclassify this ticket or make a new one.

[Bug tree-optimization/103253] Unused COND_MUL isn't removed by DCE even with -fno-trapping-math

[tnfchris at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

Tamar Christina <tnfchris at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P1                          |P3
            Summary|[12 Regression] ICE:        |Unused COND_MUL isn't
                   |Segmentation fault (in      |removed by DCE even with
                   |convert_mult_to_fma or in   |-fno-trapping-math
                   |vect_recog_mask_conversion_ |
                   |pattern) since              |
                   |r12-5129-g8ed62c929c7c4462  |
           Keywords|ice-on-valid-code           |missed-optimization

--- Comment #13 from Tamar Christina <tnfchris at gcc dot gnu.org> ---
ICE is fixed, underlying problem needs some checking but no longer a P1 or a
regression. Just a missed optimization.

[Bug tree-optimization/103253] Unused COND_MUL isn't removed by DCE even with -fno-trapping-math

[jakub at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

Jakub Jelinek <jakub at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.0                        |12.2

--- Comment #14 from Jakub Jelinek <jakub at gcc dot gnu.org> ---
GCC 12.1 is being released, retargeting bugs to GCC 12.2.

[Bug tree-optimization/103253] Unused COND_MUL isn't removed by DCE even with -fno-trapping-math

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103253

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|12.3                        |12.4

--- Comment #16 from Richard Biener <rguenth at gcc dot gnu.org> ---
GCC 12.3 is being released, retargeting bugs to GCC 12.4.