[Bug tree-optimization/103690] New: [12 Regression] ICE: in build2, at tree.c:4985 with -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94

[Bug tree-optimization/103690] New: [12 Regression] ICE: in build2, at tree.c:4985 with -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94

[zsojka at seznam dot cz]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

            Bug ID: 103690
           Summary: [12 Regression] ICE: in build2, at tree.c:4985 with
                    -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre
                    --param=max-jump-thread-duplication-stmts=94
           Product: gcc
           Version: 12.0
            Status: UNCONFIRMED
          Keywords: ice-on-valid-code
          Severity: normal
          Priority: P3
         Component: tree-optimization
          Assignee: unassigned at gcc dot gnu.org
          Reporter: zsojka at seznam dot cz
  Target Milestone: ---
              Host: x86_64-pc-linux-gnu

Created attachment 51989
  --> https://gcc.gnu.org/bugzilla/attachment.cgi?id=51989&action=edit
auto-reduced testcase

Compiler output:
$ x86_64-pc-linux-gnu-gcc -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre
--param=max-jump-thread-duplication-stmts=94 -g testcase.C
testcase.C: In member function '__alloc_traits vector<
<template-parameter-1-1>, <template-parameter-1-2> >::back()':
testcase.C:55:3: warning: no return statement in function returning non-void
[-Wreturn-type]
   55 |   }
      |   ^
during GIMPLE pass: pre
testcase.C: In member function 'void
EngineOverrideManager::ResetToDefaultMapping()':
testcase.C:88:6: internal compiler error: in build2, at tree.c:4985
   88 | void EngineOverrideManager::ResetToDefaultMapping() {
      |      ^~~~~~~~~~~~~~~~~~~~~
0x8cdf20 build2(tree_code, tree_node*, tree_node*, tree_node*)
        /repo/gcc-trunk/gcc/tree.c:4985
0x1125079 gimple_assign_rhs_to_tree(gimple*)
        /repo/gcc-trunk/gcc/cfgexpand.c:116
0x187316d insert_debug_temp_for_var_def(gimple_stmt_iterator*, tree_node*)
        /repo/gcc-trunk/gcc/tree-ssa.c:408
0x187339d insert_debug_temps_for_defs(gimple_stmt_iterator*)
        /repo/gcc-trunk/gcc/tree-ssa.c:514
0x12f2fe0 gsi_remove(gimple_stmt_iterator*, bool)
        /repo/gcc-trunk/gcc/gimple-iterator.c:567
0x176980f simple_dce_from_worklist(bitmap_head*)
        /repo/gcc-trunk/gcc/tree-ssa-dce.c:2029
0x17f3ffb execute
        /repo/gcc-trunk/gcc/tree-ssa-pre.c:4438
Please submit a full bug report,
with preprocessed source if appropriate.
Please include the complete backtrace with any bug report.
See <https://gcc.gnu.org/bugs/> for instructions.

$ x86_64-pc-linux-gnu-gcc -v
Using built-in specs.
COLLECT_GCC=/repo/gcc-trunk/binary-latest-amd64/bin/x86_64-pc-linux-gnu-gcc
COLLECT_LTO_WRAPPER=/repo/gcc-trunk/binary-trunk-r12-5936-20211213173013-g16c848090f2-checking-yes-rtl-df-extra-amd64/bin/../libexec/gcc/x86_64-pc-linux-gnu/12.0.0/lto-wrapper
Target: x86_64-pc-linux-gnu
Configured with: /repo/gcc-trunk//configure --enable-languages=c,c++
--enable-valgrind-annotations --disable-nls --enable-checking=yes,rtl,df,extra
--with-cloog --with-ppl --with-isl --build=x86_64-pc-linux-gnu
--host=x86_64-pc-linux-gnu --target=x86_64-pc-linux-gnu
--with-ld=/usr/bin/x86_64-pc-linux-gnu-ld
--with-as=/usr/bin/x86_64-pc-linux-gnu-as --disable-libstdcxx-pch
--prefix=/repo/gcc-trunk//binary-trunk-r12-5936-20211213173013-g16c848090f2-checking-yes-rtl-df-extra-amd64
Thread model: posix
Supported LTO compression algorithms: zlib zstd
gcc version 12.0.0 20211213 (experimental) (GCC)

[Bug tree-optimization/103690] [12 Regression] ICE: in build2, at tree.c:4985 with -g -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

--- Comment #1 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
Note the -g is important here.

[Bug tree-optimization/103690] [12 Regression] ICE: in build2, at tree.c:4985 with -g -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
   Target Milestone|---                         |12.0

[Bug tree-optimization/103690] [12 Regression] ICE: in build2, at tree.c:4985 with -g -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94

[pinskia at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

Andrew Pinski <pinskia at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
     Ever confirmed|0                           |1
             Status|UNCONFIRMED                 |NEW
   Last reconfirmed|                            |2021-12-13

--- Comment #2 from Andrew Pinski <pinskia at gcc dot gnu.org> ---
(gdb) p debug_gimple_stmt(stmt)
_67 = _14 + _66;


Before pre had:
  intD.9 * __trans_tmp_1D.2946;
....
  # RANGE [1, 9223372036854775807] NONZERO 9223372036854775804
  _66 = (long unsigned intD.16) _17;
  # PT = nonlocal escaped
  # ALIGN = 4, MISALIGN = 0
  _67 = __trans_tmp_1_14 + _66;

But after:
  # RANGE [1, 9223372036854775807] NONZERO 9223372036854775804
  _66 = (long unsigned intD.16) _17;
  # PT = nonlocal escaped
  # ALIGN = 4, MISALIGN = 0
  _67 = _14 + _66;

We already removed the definition of _14 too:
Removing dead stmt __trans_tmp_1_14 = _24 + 4;

So it is the order of the removal which is causing issues.

[Bug tree-optimization/103690] [12 Regression] ICE: in build2, at tree.c:4985 with -g -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94 since r12-2591-g2e96b5f14e402569

[marxin at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

Martin Liška <marxin at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |aldyh at gcc dot gnu.org,
                   |                            |amacleod at redhat dot com,
                   |                            |marxin at gcc dot gnu.org
            Summary|[12 Regression] ICE: in     |[12 Regression] ICE: in
                   |build2, at tree.c:4985 with |build2, at tree.c:4985 with
                   |-g -O2 -fno-tree-dce        |-g -O2 -fno-tree-dce
                   |-fno-tree-dse -fno-tree-fre |-fno-tree-dse -fno-tree-fre
                   |--param=max-jump-thread-dup |--param=max-jump-thread-dup
                   |lication-stmts=94           |lication-stmts=94 since
                   |                            |r12-2591-g2e96b5f14e402569

--- Comment #3 from Martin Liška <marxin at gcc dot gnu.org> ---
Started with r12-2591-g2e96b5f14e402569.

[Bug tree-optimization/103690] [12 Regression] ICE: in build2, at tree.c:4985 with -g -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94 since r12-2591-g2e96b5f14e402569

[acoplan at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

Alex Coplan <acoplan at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
                 CC|                            |acoplan at gcc dot gnu.org

--- Comment #4 from Alex Coplan <acoplan at gcc dot gnu.org> ---
Here's a slightly cleaned up testcase which fails with the same options FWIW:

typedef int *int_ptr;
struct __normal_iterator {
  int *_M_current;
  __normal_iterator(const int_ptr &__i) : _M_current(__i) {}
  void foo() { __normal_iterator(_M_current - 1); }
};
void deallocate(int *);
struct vector {
  int *_M_start;
  int *_M_finish;
  __normal_iterator end() { return _M_finish; }
  int back() {
    __normal_iterator t = _M_finish;
    t.foo();
  }
  void foo();
};
int *p1, *p2;
int last, result;
void vector::foo() {
  for (int i; i;)
    while (i) {
      __normal_iterator t1 = end();
      int *p3, *__old_start = _M_start, *__new_finish;
      long __count = &last - __old_start;
      if (__count > 0)
        __builtin_memmove(&result, __old_start, __count);
      p1 = &result + __count;
      p2 = p1 + 1;
      __count = _M_finish - t1._M_current;
      if (__count)
        __builtin_memmove(p2, t1._M_current, __count);
      p3 = p2 + __count;
      __new_finish = p3;
      if (__old_start)
        deallocate(__old_start);
      _M_finish = __new_finish;
      back();
    }
}

also confirmed on aarch64-linux-gnu.

[Bug tree-optimization/103690] [12 Regression] ICE: in build2, at tree.c:4985 with -g -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94 since r12-2591-g2e96b5f14e402569

[aldyh at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

--- Comment #5 from Aldy Hernandez <aldyh at gcc dot gnu.org> ---
(In reply to Andrew Pinski from comment #2)
> (gdb) p debug_gimple_stmt(stmt)
> _67 = _14 + _66;
> 
> 
> Before pre had:
>   intD.9 * __trans_tmp_1D.2946;
> ....
>   # RANGE [1, 9223372036854775807] NONZERO 9223372036854775804
>   _66 = (long unsigned intD.16) _17;
>   # PT = nonlocal escaped
>   # ALIGN = 4, MISALIGN = 0
>   _67 = __trans_tmp_1_14 + _66;
> 
> But after:
>   # RANGE [1, 9223372036854775807] NONZERO 9223372036854775804
>   _66 = (long unsigned intD.16) _17;
>   # PT = nonlocal escaped
>   # ALIGN = 4, MISALIGN = 0
>   _67 = _14 + _66;
> 
> We already removed the definition of _14 too:
> Removing dead stmt __trans_tmp_1_14 = _24 + 4;
> 
> So it is the order of the removal which is causing issues.

Why is PRE removing the DEF of _14 when there are still uses?

  <bb 5> [local count: 69834]:
  __count.1_62 = (long unsigned int) _11;
  __builtin_memmove (_14, _9, __count.1_62);
  _66 = (long unsigned int) _17;
  _67 = _14 + _66;
...

[Bug tree-optimization/103690] [12 Regression] ICE: in build2, at tree.c:4985 with -g -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94 since r12-2591-g2e96b5f14e402569

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
           Priority|P3                          |P1
             Status|NEW                         |ASSIGNED
           Assignee|unassigned at gcc dot gnu.org      |rguenth at gcc dot gnu.org

--- Comment #6 from Richard Biener <rguenth at gcc dot gnu.org> ---
Value numbering stmt = __trans_tmp_1_14 = _24 + 4;
Setting value number of __trans_tmp_1_14 to __trans_tmp_1_22 (changed)

what we do is avoiding useless work during elimination, not visiting if (0)
guarded code - those regions will have not up-to-date SSA form.

Block 14: BB5 found not executable

the issue is that PRE does

  /* Because we don't follow exactly the standard PRE algorithm, and decide not
     to insert PHI nodes sometimes, and because value numbering of casts isn't
     perfect, we sometimes end up inserting dead code.   This simple DCE-like
     pass removes any insertions we made that weren't actually used.  */
  simple_dce_from_worklist (inserted_exprs);

which eventually runs into those uses for expressions we inserted into those
unreachable blocks.

The issue is long latent I think.

[Bug tree-optimization/103690] [12 Regression] ICE: in build2, at tree.c:4985 with -g -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94 since r12-2591-g2e96b5f14e402569

[cvs-commit at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

--- Comment #7 from CVS Commits <cvs-commit at gcc dot gnu.org> ---
The master branch has been updated by Richard Biener <rguenth@gcc.gnu.org>:

https://gcc.gnu.org/g:ebc853deb7cc0487de9ef6e891a007ba853d1933

commit r12-6208-gebc853deb7cc0487de9ef6e891a007ba853d1933
Author: Richard Biener <rguenther@suse.de>
Date:   Tue Jan 4 11:59:35 2022 +0100

    tree-optimization/103690 - not up-to-date SSA and PRE DCE

    This avoids running simple_dce_from_worklist on partially not up-to-date
    SSA form (in unreachable code regions) by scheduling CFG cleanup
    manually as is done anyway when tail-merging runs.

    2022-01-04  Richard Biener  <rguenther@suse.de>

            PR tree-optimization/103690
            * tree-pass.h (tail_merge_optimize): Adjust.
            * tree-ssa-tail-merge.c (tail_merge_optimize): Pass in whether
            to re-split critical edges, move CFG cleanup ...
            * tree-ssa-pre.c (pass_pre::execute): ... here, before
            simple_dce_from_worklist and delay freeing inserted_exprs from
            ...
            (fini_pre): .. here.

[Bug tree-optimization/103690] [12 Regression] ICE: in build2, at tree.c:4985 with -g -O2 -fno-tree-dce -fno-tree-dse -fno-tree-fre --param=max-jump-thread-duplication-stmts=94 since r12-2591-g2e96b5f14e402569

[rguenth at gcc dot gnu.org]

https://gcc.gnu.org/bugzilla/show_bug.cgi?id=103690

Richard Biener <rguenth at gcc dot gnu.org> changed:

           What    |Removed                     |Added
----------------------------------------------------------------------------
             Status|ASSIGNED                    |RESOLVED
         Resolution|---                         |FIXED

--- Comment #8 from Richard Biener <rguenth at gcc dot gnu.org> ---
Fixed.