[Bug ipa/103513] New: [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above

[Bug ipa/103513] New: [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above

[haoxintu at gmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

            Bug ID: 103513
           Summary: [12 Regression] ICE in
                    evaluate_conditions_for_known_args, at
                    ipa-fnsummary.c:516 with -O2 and above
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: ipa
          Assignee: unassigned at gcc dot gnu.org
          Reporter: haoxintu at gmail dot com
                CC: marxin at gcc dot gnu.org
  Target Milestone: ---

Hi all.

It seems to be a recent regression issue.

$cat small.c
#include <stdint.h>
uint16_t(a)();
uint16_t(b)(int f, int g) { return f * g; }
uint64_t c();
void d() { c(a()); }
uint64_t c(int e) {
  for (;;)
    if (b(20, -1L == e))
      for (;;)
        ;
   return 0;
}


$gcc -c -O2 small.c
during IPA pass: inline
small.c:12:1: internal compiler error: in evaluate_conditions_for_known_args,
at ipa-fnsummary.c:516
   12 | }
      | ^
0x6c881e evaluate_conditions_for_known_args
        ../../gcc/ipa-fnsummary.c:516
0xa6133f do_estimate_edge_size(cgraph_edge*)
        ../../gcc/ipa-inline-analysis.c:330
0xa6247a estimate_edge_size
        ../../gcc/ipa-inline.h:79
0xa6247a estimate_edge_growth
        ../../gcc/ipa-inline.h:100
0xa6247a do_estimate_growth_1
        ../../gcc/ipa-inline-analysis.c:429
0xa625fd cgraph_node::call_for_symbol_and_aliases(bool (*)(cgraph_node*,
void*), void*, bool)
        ../../gcc/cgraph.h:3411
0xa625fd estimate_growth(cgraph_node*)
        ../../gcc/ipa-inline-analysis.c:467
0x18d8d6c inline_small_functions
        ../../gcc/ipa-inline.c:1980
0x18d8d6c ipa_inline
        ../../gcc/ipa-inline.c:2743
0x18d8d6c execute
        ../../gcc/ipa-inline.c:3142
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/home/haoxin/haoxin-data/compilers/gcc/build/libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: ../configure
--prefix=/home/haoxin/haoxin-data/compilers/gcc/build --enable-bootstrap
--enable-checking=release --enable-languages=c,c++ --enable-multilib
Thread model: posix
Supported LTO compression algorithms: zlib
gcc version 12.0.0 20211130 (experimental) (GCC)


Can also quickly check here: https://godbolt.org/z/W18G8jn7E

Thanks,
Haoxin

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Last reconfirmed|                            |2021-12-01
             Status|UNCONFIRMED                 |NEW
     Ever confirmed|0                           |1

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
  _1 = e_4(D) == -1;
  _5 = _1 ? 20 : 0;

It is not expecting the COND_EXPR here ....

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
                 CC|                            |jamborm at gcc dot gnu.org

--- Comment #2 from Richard Biener <rguenth at gcc dot gnu.org> ---
Yeah, more defensive would have been

  else
    res.set_varying ();

unreachable is always a bit on the hard side...

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

--- Comment #3 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note we disable the creation of the cond_expr here normally until
!canonicalize_math_p () is true

But evrp does:
Folding statement: _10 = _9 * 20;
Matching expression match.pd:2075, gimple-match.c:819
Matching expression match.pd:2078, gimple-match.c:892
Matching expression match.pd:2085, gimple-match.c:952
Applying pattern match.pd:5297, gimple-match.c:53296
Matching expression match.pd:1718, gimple-match.c:280
Matching expression match.pd:2075, gimple-match.c:819
Matching expression match.pd:2078, gimple-match.c:892
Matching expression match.pd:2085, gimple-match.c:952
gimple_simplified to _10 = _1 == 0 ? 0 : 20;

We should definitely be more defensive in evaluate_conditions_for_known_args
for the cond_expr but also I think evrp should disable this transformation
until later if we produce a cond_expr ...

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above since r12-5531-g1b0acc4b800b589a

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |hubicka at gcc dot gnu.org
            Summary|[12 Regression] ICE in      |[12 Regression] ICE in
                   |evaluate_conditions_for_kno |evaluate_conditions_for_kno
                   |wn_args, at                 |wn_args, at
                   |ipa-fnsummary.c:516 with    |ipa-fnsummary.c:516 with
                   |-O2 and above               |-O2 and above since
                   |                            |r12-5531-g1b0acc4b800b589a

--- Comment #4 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-5531-g1b0acc4b800b589a.

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above since r12-5531-g1b0acc4b800b589a

[dcb314 at hotmail dot com]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

David Binderman <dcb314 at hotmail dot com> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |dcb314 at hotmail dot com

--- Comment #5 from David Binderman <dcb314 at hotmail dot com> ---
Another test case:

$ more bug778.c
int us_1, func_8_i_8;
void func_8(int s_4) 
{
  func_8_i_8 = 7;
  for (;;)
    if (func_8_i_8 * (func_8_i_8 != s_4))
      for (;;)
        ;
}
void func_7_s_4() 
{ 
        func_8(us_1 && func_7_s_4); 
}
$

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above since r12-5531-g1b0acc4b800b589a

[zhendong.su at inf dot ethz.ch]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

Zhendong Su <zhendong.su at inf dot ethz.ch> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |zhendong.su at inf dot ethz.ch

--- Comment #6 from Zhendong Su <zhendong.su at inf dot ethz.ch> ---
Another test that fails at -Os and above:

[576] % gcctk -O1 -c small.c
[577] % 
[577] % gcctk -Os -c small.c
during IPA pass: inline
small.c:8:1: internal compiler error: in evaluate_conditions_for_known_args, at
ipa-fnsummary.c:516
    8 | }
      | ^
0xbd4256 evaluate_conditions_for_known_args
        ../../gcc-trunk/gcc/ipa-fnsummary.c:516
0xbd952e evaluate_properties_for_edge(cgraph_edge*, bool, unsigned int*,
unsigned int*, ipa_auto_call_arg_values*, bool)
        ../../gcc-trunk/gcc/ipa-fnsummary.c:726
0xbf0323 do_estimate_edge_time(cgraph_edge*, sreal*)
        ../../gcc-trunk/gcc/ipa-inline-analysis.c:197
0xbf1d34 do_estimate_edge_size(cgraph_edge*)
        ../../gcc-trunk/gcc/ipa-inline-analysis.c:319
0x1c0bc14 estimate_edge_size
        ../../gcc-trunk/gcc/ipa-inline.h:79
0x1c0bc14 estimate_edge_growth
        ../../gcc-trunk/gcc/ipa-inline.h:100
0x1c0eb89 want_inline_small_function_p
        ../../gcc-trunk/gcc/ipa-inline.c:912
0x1c1425c inline_small_functions
        ../../gcc-trunk/gcc/ipa-inline.c:2050
0x1c1425c ipa_inline
        ../../gcc-trunk/gcc/ipa-inline.c:2756
0x1c1425c execute
        ../../gcc-trunk/gcc/ipa-inline.c:3155
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.
[578] % 
[578] % cat small.c
int a;
void b(int c) {
  int d = 3;
  d ^= c < 2;
  if (d < 3 && a)
    while (1)
      b(!a);
}

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above since r12-5531-g1b0acc4b800b589a

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

--- Comment #7 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
OK, i suppose we do not really have interface to fold ternary expression? It
could still do useful work merging the value ranges of both arms...

I am testing the following:
gcc/ChangeLog:

2021-12-12  Jan Hubicka  <hubicka@ucw.cz>

        * ipa-fnsummary.c (evaluate_conditions_for_known_args): Do not ICE
        on ternary expression.

gcc/testsuite/ChangeLog:

2021-12-12  Jan Hubicka  <hubicka@ucw.cz>

        * gcc.c-torture/compile/pr103513.c: New test.

diff --git a/gcc/ipa-fnsummary.c b/gcc/ipa-fnsummary.c
index 6c1cdf17e47..cb3c198ec0c 100644
--- a/gcc/ipa-fnsummary.c
+++ b/gcc/ipa-fnsummary.c
@@ -513,7 +513,7 @@ evaluate_conditions_for_known_args (struct cgraph_node
*node,
                                              op->index ? &vr : &op0);
                    }
                  else
-                   gcc_unreachable ();
+                   res.set_varying (op->type);
                  type = op->type;
                  vr = res;
                }
diff --git a/gcc/testsuite/gcc.c-torture/compile/pr103513.c
b/gcc/testsuite/gcc.c-torture/compile/pr103513.c
new file mode 100644
index 00000000000..ca876a9816c
--- /dev/null
+++ b/gcc/testsuite/gcc.c-torture/compile/pr103513.c
@@ -0,0 +1,8 @@
+int a;
+void b(int c) {
+  int d = 3;
+  d ^= c < 2;
+  if (d < 3 && a)
+    while (1)
+      b(!a);
+}

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above since r12-5531-g1b0acc4b800b589a

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

--- Comment #8 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Jan Hubicka <hubicka@gcc.gnu.org>:

https://gcc.gnu.org/g:3b61f06b2e1e7e72fcb6c0cf3590cb25eb92c4f2

commit r12-5921-g3b61f06b2e1e7e72fcb6c0cf3590cb25eb92c4f2
Author: Jan Hubicka <jh@suse.cz>
Date:   Mon Dec 13 09:38:53 2021 +0100

    Do not ICE on ternary expressions when calculating value ranges

    gcc/ChangeLog:

    2021-12-12  Jan Hubicka  <hubicka@ucw.cz>

            PR ipa/103513
            * ipa-fnsummary.c (evaluate_conditions_for_known_args): Do not ICE
            on ternary expression.

    gcc/testsuite/ChangeLog:

    2021-12-12  Jan Hubicka  <hubicka@ucw.cz>

            PR ipa/103513
            * gcc.c-torture/compile/pr103513.c: New test.

[Bug ipa/103513] [12 Regression] ICE in evaluate_conditions_for_known_args, at ipa-fnsummary.c:516 with -O2 and above since r12-5531-g1b0acc4b800b589a

[hubicka at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103513

Jan Hubicka <hubicka at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|NEW                         |RESOLVED
         Resolution|---                         |FIXED

--- Comment #9 from Jan Hubicka <hubicka at gcc dot gnu.org> ---
Fixed.