[Bug tree-optimization/103489] New: ICE with -O3 in operator[], at vec.h:889

[Bug tree-optimization/103489] New: ICE with -O3 in operator[], at vec.h:889

[vsevolod.livinskij at frtk dot ru]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

            Bug ID: 103489
           Summary: ICE with -O3 in operator[], at vec.h:889
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: vsevolod.livinskij at frtk dot ru
  Target Milestone: ---

The same reproducer also triggers ICE for Sapphire Rapids with a different
stack trace.

Link to the Compiler Explorer: https://godbolt.org/z/nxqPhnnoe

Reproducer:
bool a[80];
short b, f;
void g(short h[][8][16]) {
  for (bool c = 0; c < b;)
    for (bool d = 0; d < (bool)f; d = 1)
      for (short e = 0; e < 16; e++)
        a[e] = h[b][1][e];
}

Error:
>$ g++ -O3 -c func.cpp
during GIMPLE pass: slp
func.cpp: In function 'void g(short int (*)[8][16])':
func.cpp:3:6: internal compiler error: in operator[], at vec.h:889
    3 | void g(short h[][8][16]) {
      |      ^
0x8b7e0a vec<edge_def*, va_gc, vl_embed>::operator[](unsigned int)
        /testing/gcc/gcc_src_master/gcc/vec.h:889
0x8b896f vec<gphi*, va_heap, vl_embed>::operator[](unsigned int)
        /testing/gcc/gcc_src_master/gcc/tree-vect-loop.c:7877
0x8b896f vec<gphi*, va_heap, vl_ptr>::operator[](unsigned int)
        /testing/gcc/gcc_src_master/gcc/vec.h:1495
0x8b896f vectorizable_phi(vec_info*, _stmt_vec_info*, gimple**, _slp_tree*,
vec<stmt_info_for_cost, va_heap, vl_ptr>*)
        /testing/gcc/gcc_src_master/gcc/tree-vect-loop.c:7869
0x2093485 vect_transform_stmt(vec_info*, _stmt_vec_info*,
gimple_stmt_iterator*, _slp_tree*, _slp_instance*)
        /testing/gcc/gcc_src_master/gcc/tree-vect-stmts.c:11174
0x1485797 vect_schedule_slp_node
        /testing/gcc/gcc_src_master/gcc/tree-vect-slp.c:7252
0x1496756 vect_schedule_scc
        /testing/gcc/gcc_src_master/gcc/tree-vect-slp.c:7450
0x14964e9 vect_schedule_scc
        /testing/gcc/gcc_src_master/gcc/tree-vect-slp.c:7431
0x14964e9 vect_schedule_scc
        /testing/gcc/gcc_src_master/gcc/tree-vect-slp.c:7431
0x1496daf vect_schedule_slp(vec_info*, vec<_slp_instance*, va_heap, vl_ptr>
const&)
        /testing/gcc/gcc_src_master/gcc/tree-vect-slp.c:7567
0x1498573 vect_slp_region
        /testing/gcc/gcc_src_master/gcc/tree-vect-slp.c:5926
0x1499503 vect_slp_bbs
        /testing/gcc/gcc_src_master/gcc/tree-vect-slp.c:6038
0x14998fc vect_slp_function(function*)
        /testing/gcc/gcc_src_master/gcc/tree-vect-slp.c:6126
0x14a02f2 execute
        /testing/gcc/gcc_src_master/gcc/tree-vectorizer.c:1503

Sapphire Rapids Error:
>$ g++ -O3 -c func.cpp -march=sapphirerapids
func.cpp: In function 'void g(short int (*)[8][16])':
func.cpp:3:6: error: incompatible types in 'PHI' argument 1
    3 | void g(short h[][8][16]) {
      |      ^
vector(16) unsigned char

vector(16) <signed-boolean:1>

vect_a_I_lsm.30_92 = PHI <_97(2), mask__28.29_93(4)>
during GIMPLE pass: slp
func.cpp:3:6: internal compiler error: verify_gimple failed
0x123e31a verify_gimple_in_cfg(function*, bool)
        /testing/gcc/gcc_src_master/gcc/tree-cfg.c:5578
0x110638f execute_function_todo
        /testing/gcc/gcc_src_master/gcc/passes.c:2084
0x110693b execute_todo
        /testing/gcc/gcc_src_master/gcc/passes.c:2138

gcc version 12.0.0 20211129 (ca5667e867252db3c8642ee90f55427149cd92b6) (GCC)

[Bug tree-optimization/103489] [12 Regression] ICE with -O3 in operator[], at vec.h:889

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|UNCONFIRMED                 |ASSIGNED
           Priority|P3                          |P1
     Ever confirmed|0                           |1
   Target Milestone|---                         |12.0
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org
   Last reconfirmed|                            |2021-11-30
           Keywords|                            |needs-bisection

--- Comment #1 from Richard Biener <rguenth at gcc dot gnu.org> ---
Confirmed.  I'll have a look.

[Bug tree-optimization/103489] [12 Regression] ICE with -O3 in operator[], at vec.h:889

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           See Also|                            |https://gcc.gnu.org/bugzill
                   |                            |a/show_bug.cgi?id=101636

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
So we BB vectorize sth we should use bool patterns to fixup.  We get

t.c:8:1: note:   using normal nonmask vectors for a_I_lsm.24_70 = PHI
<_54(D)(2), _208(4)>
t.c:8:1: note:   using boolean precision 16 for _208 = _207 != 0;

but fail to add compensation on the PHI arg def because that's not supported
right now.  See also PR101636 for another bool pattern issue (but probably
unrelated).

So in this case the store is outside of a vectorized cycle (store motion is
applied) and thus defined by a loop closed PHI node.  check_bool_pattern
doesn't handle this and thus we get to see we have a normal nonmask vector
for the LC PHI:

t.c:8:1: note:   using normal nonmask vectors for a_I_lsm.24_20 = PHI
<a_I_lsm.24_70(5)>

but since we do not have patterns for PHIs the first nonmask use cannot
get compensation code.

The precision determining code in this case is broken since it does not handle
cycles properly, we first visit the loop PHI having an external def and not
yet visited backedge argument.

I'm going to produce a fix for the ICE and think about fixing bool pattern
detection for GCC 13.

[Bug tree-optimization/103489] [11/12 Regression] ICE with -O3 in operator[], at vec.h:889

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[12 Regression] ICE with    |[11/12 Regression] ICE with
                   |-O3 in operator[], at       |-O3 in operator[], at
                   |vec.h:889                   |vec.h:889
   Target Milestone|12.0                        |11.3

--- Comment #3 from Richard Biener <rguenth at gcc dot gnu.org> ---
The issue should be latent on the GCC 11 branch as well.

[Bug tree-optimization/103489] [11/12 Regression] ICE with -O3 in operator[], at vec.h:889

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
         Depends on|                            |103495

--- Comment #4 from Richard Biener <rguenth at gcc dot gnu.org> ---
I've filed PR103495 for the bool pattern recog issue and will keep this bug for
the ICE.


Referenced Bugs:

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103495
[Bug 103495] vectorizer bool pattern recog does not handle cycles correctly

[Bug tree-optimization/103489] [11/12 Regression] ICE with -O3 in operator[], at vec.h:889

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

--- Comment #5 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:0194d92c35ca8b3aa850b805d9becb4491cf6bec

commit r12-5626-g0194d92c35ca8b3aa850b805d9becb4491cf6bec
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Nov 30 14:08:19 2021 +0100

    tree-optimization/103489 - fix ICE when bool pattern recog fails

    bool pattern recog currently does not handle cycles correctly
    and when it fails we can ICE later vectorizing PHIs with
    mismatched bool and non-bool vector types.  The following avoids
    blindly trusting bool pattern recog here and verifies things
    more thoroughly in vectorizable_phi.  A bool pattern recog fix
    is for GCC 13.

    2021-11-30  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/103489
            * tree-vect-loop.c (vectorizable_phi): Verify argument
            vector type compatibility to mitigate bool pattern recog
            bug.

            * gcc.dg/torture/pr103489.c: New testcase.

[Bug tree-optimization/103489] [11 Regression] ICE with -O3 in operator[], at vec.h:889

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
            Summary|[11/12 Regression] ICE with |[11 Regression] ICE with
                   |-O3 in operator[], at       |-O3 in operator[], at
                   |vec.h:889                   |vec.h:889

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed on trunk sofar, will backport as I think the issue is latent on the
branch.

[Bug tree-optimization/103489] [11 Regression] ICE with -O3 in operator[], at vec.h:889 since r12-5394-g0fc859f5efcb4624

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Keywords|needs-bisection             |
                 CC|                            |marxin at gcc dot gnu.org
            Summary|[11 Regression] ICE with    |[11 Regression] ICE with
                   |-O3 in operator[], at       |-O3 in operator[], at
                   |vec.h:889                   |vec.h:889 since
                   |                            |r12-5394-g0fc859f5efcb4624

--- Comment #7 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-5394-g0fc859f5efcb4624.

[Bug tree-optimization/103489] [11 Regression] ICE with -O3 in operator[], at vec.h:889 since r12-5394-g0fc859f5efcb4624

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Huh, interestingly on the branch LIM eliminates all stores to a[] because the
outer loop doesn't terminate (if it is entered).  Not sure what "regressed"
that optimization on trunk.

[Bug tree-optimization/103489] [11 Regression] ICE with -O3 in operator[], at vec.h:889 since r12-5394-g0fc859f5efcb4624

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

--- Comment #9 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The releases/gcc-11 branch has been updated by Richard Biener
<rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:2c7d8ca8317981c2eb21eb1e85e0f55d3f71aff1

commit r11-9523-g2c7d8ca8317981c2eb21eb1e85e0f55d3f71aff1
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Nov 30 14:08:19 2021 +0100

    tree-optimization/103489 - fix ICE when bool pattern recog fails

    bool pattern recog currently does not handle cycles correctly
    and when it fails we can ICE later vectorizing PHIs with
    mismatched bool and non-bool vector types.  The following avoids
    blindly trusting bool pattern recog here and verifies things
    more thoroughly in vectorizable_phi.  A bool pattern recog fix
    is for GCC 13.

    2021-11-30  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/103489
            * tree-vect-loop.c (vectorizable_phi): Verify argument
            vector type compatibility to mitigate bool pattern recog
            bug.

            * gcc.dg/torture/pr103489.c: New testcase.

    (cherry picked from commit 0194d92c35ca8b3aa850b805d9becb4491cf6bec)

[Bug tree-optimization/103489] [11 Regression] ICE with -O3 in operator[], at vec.h:889 since r12-5394-g0fc859f5efcb4624

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103489

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #10 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.