[Bug tree-optimization/103467] New: [12 Regression] ICE in range_def_chain::register_dependency

[Bug tree-optimization/103467] New: [12 Regression] ICE in range_def_chain::register_dependency

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103467

            Bug ID: 103467
           Summary: [12 Regression] ICE in
                    range_def_chain::register_dependency
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: asolokha at gmx dot com
  Target Milestone: ---

gcc-12.0.0-alpha20211128 snapshot (g:2899d49e3701a4df18a336a680a7095cc99a2229)
ICEs when compiling the following testcase w/ -O2 -fsplit-loops
-funswitch-loops:

int rf, ub, lq;
__int128 w9, d5;

__attribute__ ((simd)) void
a5 (void)
{
  int vr;

  vr = (w9 % lq) <= 0;
  vr -= ub || w9;
  if (vr)
    {
      rf |= d5;
      if (rf != 0)
        __builtin_unreachable ();
    }
  else
    d5 = w9;

  if (w9 && rf)
    lq = 0;
}

% MALLOC_PERTURB_=3 MALLOC_CHECK_=3 gcc-12.0.0 -O2 -fsplit-loops
-funswitch-loops -c com3gnr2.c
during GIMPLE pass: vrp
com3gnr2.c: In function 'a5.simdclone.0':
com3gnr2.c:5:1: internal compiler error: Segmentation fault
    5 | a5 (void)
      | ^~
0xeaad8f crash_signal
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/toplev.c:322
0x97d207 bitmap_ior_into(bitmap_head*, bitmap_head const*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/bitmap.c:2080
0x1c110e0 range_def_chain::register_dependency(tree_node*, tree_node*,
basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-gori.cc:283
0x1c10b0c range_def_chain::get_def_chain(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-gori.cc:377
0x1c10e74 range_def_chain::in_chain_p(tree_node*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-gori.cc:198
0x1c11b15 gori_compute::compute_operand_range(irange&, gimple*, irange const&,
tree_node*, fur_source&)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-gori.cc:721
0x1c13351 gori_compute::outgoing_edge_range_p(irange&, edge_def*, tree_node*,
range_query&)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-gori.cc:1254
0x1c06bf6 ranger_cache::range_on_edge(irange&, edge_def*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-cache.cc:1093
0x1c077a5 ranger_cache::range_on_edge(irange&, edge_def*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-fold.h:98
0x1c077a5 ranger_cache::propagate_cache(tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-cache.cc:1180
0x1c080dd ranger_cache::fill_block_cache(tree_node*, basic_block_def*,
basic_block_def*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-cache.cc:1392
0x1c08582 ranger_cache::block_range(irange&, basic_block_def*, tree_node*,
bool)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-cache.cc:1136
0x1c024e4 gimple_ranger::range_on_entry(irange&, basic_block_def*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range.cc:151
0x1c02870 gimple_ranger::range_on_exit(irange&, basic_block_def*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range.cc:187
0x1c03afe gimple_ranger::range_on_edge(irange&, edge_def*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range.cc:229
0x1c0ba4c fold_using_range::range_of_phi(irange&, gphi*, fur_source&)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-fold.cc:796
0x1c0f448 fold_using_range::fold_stmt(irange&, gimple*, fur_source&,
tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range-fold.cc:554
0x1c03082 gimple_ranger::fold_range_internal(irange&, gimple*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range.cc:250
0x1c03082 gimple_ranger::range_of_stmt(irange&, gimple*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range.cc:311
0x1c024cc gimple_ranger::range_on_entry(irange&, basic_block_def*, tree_node*)
       
/var/tmp/portage/sys-devel/gcc-12.0.0_p20211128/work/gcc-12-20211128/gcc/gimple-range.cc:148

==1360540== ERROR SUMMARY: 8 errors from 2 contexts (suppressed: 0 from 0)
==1360540==
==1360540== 4 errors in context 1 of 2:
==1360540== Invalid read of size 8
==1360540==    at 0x1C110F8: set_import (gimple-range-gori.cc:213)
==1360540==    by 0x1C110F8: range_def_chain::register_dependency(tree_node*,
tree_node*, basic_block_def*) (gimple-range-gori.cc:285)
==1360540==    by 0x1C10B0C: range_def_chain::get_def_chain(tree_node*)
(gimple-range-gori.cc:377)
==1360540==    by 0x1C10E74: range_def_chain::in_chain_p(tree_node*,
tree_node*) (gimple-range-gori.cc:198)
==1360540==    by 0x1C11B15: gori_compute::compute_operand_range(irange&,
gimple*, irange const&, tree_node*, fur_source&) (gimple-range-gori.cc:721)
==1360540==    by 0x1C13351: gori_compute::outgoing_edge_range_p(irange&,
edge_def*, tree_node*, range_query&) (gimple-range-gori.cc:1254)
==1360540==    by 0x1C06BF6: ranger_cache::range_on_edge(irange&, edge_def*,
tree_node*) [clone .part.0] (gimple-range-cache.cc:1093)
==1360540==    by 0x1C077A5: range_on_edge (gimple-range-fold.h:98)
==1360540==    by 0x1C077A5: ranger_cache::propagate_cache(tree_node*)
(gimple-range-cache.cc:1180)
==1360540==    by 0x1C080DD: ranger_cache::fill_block_cache(tree_node*,
basic_block_def*, basic_block_def*) (gimple-range-cache.cc:1392)
==1360540==    by 0x1C08582: ranger_cache::block_range(irange&,
basic_block_def*, tree_node*, bool) (gimple-range-cache.cc:1136)
==1360540==    by 0x1C024E4: gimple_ranger::range_on_entry(irange&,
basic_block_def*, tree_node*) (gimple-range.cc:151)
==1360540==    by 0x1C02870: gimple_ranger::range_on_exit(irange&,
basic_block_def*, tree_node*) (gimple-range.cc:187)
==1360540==    by 0x1C03AFE: gimple_ranger::range_on_edge(irange&, edge_def*,
tree_node*) (gimple-range.cc:229)
==1360540==  Address 0x61881c0 is 288 bytes inside a block of size 5,704 free'd
==1360540==    at 0x484338F: realloc (in
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1360540==    by 0x1EAA5FC: xrealloc (xmalloc.c:181)
==1360540==    by 0x1C13B1B: reserve<range_def_chain::rdc> (vec.h:290)
==1360540==    by 0x1C13B1B: reserve (vec.h:1858)
==1360540==    by 0x1C13B1B: safe_grow (vec.h:2006)
==1360540==    by 0x1C13B1B: vec<range_def_chain::rdc, va_heap,
vl_ptr>::safe_grow_cleared(unsigned int, bool) (vec.h:2025)
==1360540==    by 0x1C1089C: has_def_chain (gimple-range-gori.cc:318)
==1360540==    by 0x1C1089C: range_def_chain::get_def_chain(tree_node*)
(gimple-range-gori.cc:336)
==1360540==    by 0x1C110CF: range_def_chain::register_dependency(tree_node*,
tree_node*, basic_block_def*) (gimple-range-gori.cc:280)
==1360540==    by 0x1C10B0C: range_def_chain::get_def_chain(tree_node*)
(gimple-range-gori.cc:377)
==1360540==    by 0x1C10E74: range_def_chain::in_chain_p(tree_node*,
tree_node*) (gimple-range-gori.cc:198)
==1360540==    by 0x1C11B15: gori_compute::compute_operand_range(irange&,
gimple*, irange const&, tree_node*, fur_source&) (gimple-range-gori.cc:721)
==1360540==    by 0x1C13351: gori_compute::outgoing_edge_range_p(irange&,
edge_def*, tree_node*, range_query&) (gimple-range-gori.cc:1254)
==1360540==    by 0x1C06BF6: ranger_cache::range_on_edge(irange&, edge_def*,
tree_node*) [clone .part.0] (gimple-range-cache.cc:1093)
==1360540==    by 0x1C077A5: range_on_edge (gimple-range-fold.h:98)
==1360540==    by 0x1C077A5: ranger_cache::propagate_cache(tree_node*)
(gimple-range-cache.cc:1180)
==1360540==    by 0x1C080DD: ranger_cache::fill_block_cache(tree_node*,
basic_block_def*, basic_block_def*) (gimple-range-cache.cc:1392)
==1360540==  Block was alloc'd at
==1360540==    at 0x483E0A9: malloc (in
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1360540==    by 0x1EAA60F: xrealloc (xmalloc.c:179)
==1360540==    by 0x1C13B1B: reserve<range_def_chain::rdc> (vec.h:290)
==1360540==    by 0x1C13B1B: reserve (vec.h:1858)
==1360540==    by 0x1C13B1B: safe_grow (vec.h:2006)
==1360540==    by 0x1C13B1B: vec<range_def_chain::rdc, va_heap,
vl_ptr>::safe_grow_cleared(unsigned int, bool) (vec.h:2025)
==1360540==    by 0x1C12BA3: range_def_chain (gimple-range-gori.cc:176)
==1360540==    by 0x1C12BA3: gori_map::gori_map() (gimple-range-gori.cc:451)
==1360540==    by 0x1C12C41: gori_compute::gori_compute(int)
(gimple-range-gori.cc:646)
==1360540==    by 0x1C08637: ranger_cache::ranger_cache(int)
(gimple-range-cache.cc:871)
==1360540==    by 0x1C022E8: gimple_ranger::gimple_ranger()
(gimple-range.cc:41)
==1360540==    by 0x1C0359C: enable_ranger(function*) (gimple-range.cc:577)
==1360540==    by 0x11660FF: execute_ranger_vrp(function*, bool)
(tree-vrp.c:4337)
==1360540==    by 0xDBBE8A: execute_one_pass(opt_pass*) (passes.c:2637)
==1360540==    by 0xDBC74F: execute_pass_list_1(opt_pass*) (passes.c:2737)
==1360540==    by 0xDBC761: execute_pass_list_1(opt_pass*) (passes.c:2738)
==1360540==
==1360540==
==1360540== 4 errors in context 2 of 2:
==1360540== Invalid read of size 8
==1360540==    at 0x1C110D8: range_def_chain::register_dependency(tree_node*,
tree_node*, basic_block_def*) (gimple-range-gori.cc:283)
==1360540==    by 0x1C10B0C: range_def_chain::get_def_chain(tree_node*)
(gimple-range-gori.cc:377)
==1360540==    by 0x1C10E74: range_def_chain::in_chain_p(tree_node*,
tree_node*) (gimple-range-gori.cc:198)
==1360540==    by 0x1C11B15: gori_compute::compute_operand_range(irange&,
gimple*, irange const&, tree_node*, fur_source&) (gimple-range-gori.cc:721)
==1360540==    by 0x1C13351: gori_compute::outgoing_edge_range_p(irange&,
edge_def*, tree_node*, range_query&) (gimple-range-gori.cc:1254)
==1360540==    by 0x1C06BF6: ranger_cache::range_on_edge(irange&, edge_def*,
tree_node*) [clone .part.0] (gimple-range-cache.cc:1093)
==1360540==    by 0x1C077A5: range_on_edge (gimple-range-fold.h:98)
==1360540==    by 0x1C077A5: ranger_cache::propagate_cache(tree_node*)
(gimple-range-cache.cc:1180)
==1360540==    by 0x1C080DD: ranger_cache::fill_block_cache(tree_node*,
basic_block_def*, basic_block_def*) (gimple-range-cache.cc:1392)
==1360540==    by 0x1C08582: ranger_cache::block_range(irange&,
basic_block_def*, tree_node*, bool) (gimple-range-cache.cc:1136)
==1360540==    by 0x1C024E4: gimple_ranger::range_on_entry(irange&,
basic_block_def*, tree_node*) (gimple-range.cc:151)
==1360540==    by 0x1C02870: gimple_ranger::range_on_exit(irange&,
basic_block_def*, tree_node*) (gimple-range.cc:187)
==1360540==    by 0x1C03AFE: gimple_ranger::range_on_edge(irange&, edge_def*,
tree_node*) (gimple-range.cc:229)
==1360540==  Address 0x61881b8 is 280 bytes inside a block of size 5,704 free'd
==1360540==    at 0x484338F: realloc (in
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1360540==    by 0x1EAA5FC: xrealloc (xmalloc.c:181)
==1360540==    by 0x1C13B1B: reserve<range_def_chain::rdc> (vec.h:290)
==1360540==    by 0x1C13B1B: reserve (vec.h:1858)
==1360540==    by 0x1C13B1B: safe_grow (vec.h:2006)
==1360540==    by 0x1C13B1B: vec<range_def_chain::rdc, va_heap,
vl_ptr>::safe_grow_cleared(unsigned int, bool) (vec.h:2025)
==1360540==    by 0x1C1089C: has_def_chain (gimple-range-gori.cc:318)
==1360540==    by 0x1C1089C: range_def_chain::get_def_chain(tree_node*)
(gimple-range-gori.cc:336)
==1360540==    by 0x1C110CF: range_def_chain::register_dependency(tree_node*,
tree_node*, basic_block_def*) (gimple-range-gori.cc:280)
==1360540==    by 0x1C10B0C: range_def_chain::get_def_chain(tree_node*)
(gimple-range-gori.cc:377)
==1360540==    by 0x1C10E74: range_def_chain::in_chain_p(tree_node*,
tree_node*) (gimple-range-gori.cc:198)
==1360540==    by 0x1C11B15: gori_compute::compute_operand_range(irange&,
gimple*, irange const&, tree_node*, fur_source&) (gimple-range-gori.cc:721)
==1360540==    by 0x1C13351: gori_compute::outgoing_edge_range_p(irange&,
edge_def*, tree_node*, range_query&) (gimple-range-gori.cc:1254)
==1360540==    by 0x1C06BF6: ranger_cache::range_on_edge(irange&, edge_def*,
tree_node*) [clone .part.0] (gimple-range-cache.cc:1093)
==1360540==    by 0x1C077A5: range_on_edge (gimple-range-fold.h:98)
==1360540==    by 0x1C077A5: ranger_cache::propagate_cache(tree_node*)
(gimple-range-cache.cc:1180)
==1360540==    by 0x1C080DD: ranger_cache::fill_block_cache(tree_node*,
basic_block_def*, basic_block_def*) (gimple-range-cache.cc:1392)
==1360540==  Block was alloc'd at
==1360540==    at 0x483E0A9: malloc (in
/usr/libexec/valgrind/vgpreload_memcheck-amd64-linux.so)
==1360540==    by 0x1EAA60F: xrealloc (xmalloc.c:179)
==1360540==    by 0x1C13B1B: reserve<range_def_chain::rdc> (vec.h:290)
==1360540==    by 0x1C13B1B: reserve (vec.h:1858)
==1360540==    by 0x1C13B1B: safe_grow (vec.h:2006)
==1360540==    by 0x1C13B1B: vec<range_def_chain::rdc, va_heap,
vl_ptr>::safe_grow_cleared(unsigned int, bool) (vec.h:2025)
==1360540==    by 0x1C12BA3: range_def_chain (gimple-range-gori.cc:176)
==1360540==    by 0x1C12BA3: gori_map::gori_map() (gimple-range-gori.cc:451)
==1360540==    by 0x1C12C41: gori_compute::gori_compute(int)
(gimple-range-gori.cc:646)
==1360540==    by 0x1C08637: ranger_cache::ranger_cache(int)
(gimple-range-cache.cc:871)
==1360540==    by 0x1C022E8: gimple_ranger::gimple_ranger()
(gimple-range.cc:41)
==1360540==    by 0x1C0359C: enable_ranger(function*) (gimple-range.cc:577)
==1360540==    by 0x11660FF: execute_ranger_vrp(function*, bool)
(tree-vrp.c:4337)
==1360540==    by 0xDBBE8A: execute_one_pass(opt_pass*) (passes.c:2637)
==1360540==    by 0xDBC74F: execute_pass_list_1(opt_pass*) (passes.c:2737)
==1360540==    by 0xDBC761: execute_pass_list_1(opt_pass*) (passes.c:2738)
==1360540==

[Bug tree-optimization/103467] [12 Regression] ICE in range_def_chain::register_dependency since r12-4871-g502ffb1f389011b2

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103467

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |amacleod at redhat dot com,
                   |                            |marxin at gcc dot gnu.org
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1
   Last reconfirmed|                            |2021-11-29
   Target Milestone|---                         |12.0
           Priority|P3                          |P1
            Summary|[12 Regression] ICE in      |[12 Regression] ICE in
                   |range_def_chain::register_d |range_def_chain::register_d
                   |ependency                   |ependency since
                   |                            |r12-4871-g502ffb1f389011b2

--- Comment #1 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-4871-g502ffb1f389011b2.

[Bug tree-optimization/103467] [12 Regression] ICE in range_def_chain::register_dependency since r12-4871-g502ffb1f389011b2

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103467

--- Comment #2 from Andrew Macleod <amacleod at redhat dot com> ---
Hm.. I can't seem to reproduce, I built alpha cross with latest trunk, but it
seems to compile, as does x86_64.  
What with the  MALLOC_PERTURB_=3 MALLOC_CHECK_=3 ?

[Bug tree-optimization/103467] [12 Regression] ICE in range_def_chain::register_dependency since r12-4871-g502ffb1f389011b2

[asolokha at gmx dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103467

--- Comment #3 from Arseny Solokha <asolokha at gmx dot com> ---
Sorry for the probably misleading description. This PR is indeed filed against
x86_64, "alpha" there means "pre-release gcc version". MALLOC_PERTURB_ and
MALLOC_CHECK_ handling is implemented by glibc and is glibc-specific. Valgrind
should be able to demonstrate the problem at least on x86_64, but likely
universally.

gcc really ICEs only under glibc checking. It compiles the testcase w/o any
checking or when run under valgrind, but in latter case valgrind highlights
invalid reads in its summary report.

[Bug tree-optimization/103467] [12 Regression] ICE in range_def_chain::register_dependency since r12-4871-g502ffb1f389011b2

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103467

--- Comment #4 from Andrew Macleod <amacleod at redhat dot com> ---
OK, got it.  patch coming...

[Bug tree-optimization/103467] [12 Regression] ICE in range_def_chain::register_dependency since r12-4871-g502ffb1f389011b2

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103467

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Andrew Macleod <amacleod@gcc.gnu.org>:

https://gcc.gnu.org/g:ab202b659dbdfd3a1f45ffe7a5052f35b5e8fa6d

commit r12-5587-gab202b659dbdfd3a1f45ffe7a5052f35b5e8fa6d
Author: Andrew MacLeod <amacleod@redhat.com>
Date:   Mon Nov 29 19:53:50 2021 -0500

    Don't reuse reference after potential resize.

    When a new def chain is requested, any existing reference may no longer
    be valid, so just use the object directly.

            PR tree-optimization/103467
            * gimple-range-gori.cc (range_def_chain::register_dependency):
Don't
            use an object reference after a potential resize.

[Bug tree-optimization/103467] [12 Regression] ICE in range_def_chain::register_dependency since r12-4871-g502ffb1f389011b2

[amacleod at redhat dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103467

Andrew Macleod <amacleod at redhat dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #6 from Andrew Macleod <amacleod at redhat dot com> ---
Nice catch by the way.. This was not obvious. 
Fixed.